Risks of running Honeypot [specific setup]

As long as your router has its access rules to not allow any connections from your honeypot to the rest of your network then that should work out fine. Only allow connections from the management network or IP addresses to the linux VM host and honeypot, that way if either is hacked it won't be able to attack your network directly.

Make sure there's no information on the linux VM host or the honeypot that can be used to attack your network. Don't use the same usernames or passwords, and don't store any information on them at all.

Also, hopefully you've given us fake IP address ranges, otherwise you're enumerated the IP Address ranges you use on your network in which case I'd change them.


GdD makes some good points about routing and access rules, so I won't regurgitate those. I will, however, remind you that you're inviting nare-do-wells into a segment of your network and the only separation between church and state with your setup is one router, which I assume is a generic consumer grade device. It's very likely that this perimeter device will come under attack at some point and if it goes down there doesn't appear to be any network defense. At the very ABSOLUTE MINIMUM I would recommend a separate firewall between your personal network and the router. If you can put a switch and there and isolate the traffic, even better.

Tags:

Honeypot