536 lines
5.4 KiB
Markdown
536 lines
5.4 KiB
Markdown
# Chapter 1 - Proxmox Infrastructure
|
|
|
|
> This chapter covers the installation and configuration of the Proxmox virtualization environment that serves as the foundation for the entire cyber range.
|
|
|
|
---
|
|
|
|
# Objectives
|
|
|
|
After completing this chapter you should have:
|
|
|
|
* A working Proxmox VE server
|
|
* Virtual networking configured
|
|
* Storage configured
|
|
* VM templates prepared
|
|
* Snapshot strategy planned
|
|
* A scalable architecture capable of supporting an enterprise penetration testing lab
|
|
|
|
---
|
|
|
|
# Hardware
|
|
|
|
My lab consists of a single Proxmox server.
|
|
|
|
Minimum recommendations:
|
|
|
|
| Component | Recommendation |
|
|
| --------- | -------------------------------------: |
|
|
| CPU | 8+ Threads with virtualization support |
|
|
| RAM | 32 GB minimum |
|
|
| Storage | 500 GB SSD |
|
|
| Network | One Gigabit Ethernet adapter |
|
|
|
|
One physical network adapter is sufficient because all internal networks will exist as virtual bridges.
|
|
|
|
---
|
|
|
|
# Virtualization Extensions
|
|
|
|
Verify virtualization is enabled in BIOS.
|
|
|
|
AMD
|
|
|
|
```bash
|
|
egrep "(svm)" /proc/cpuinfo
|
|
```
|
|
|
|
Intel
|
|
|
|
```bash
|
|
egrep "(vmx)" /proc/cpuinfo
|
|
```
|
|
|
|
---
|
|
|
|
# Install Proxmox
|
|
|
|
1. Download the latest ISO.
|
|
2. Create a bootable USB drive.
|
|
3. Install Proxmox.
|
|
4. Configure:
|
|
|
|
* Hostname
|
|
* Management IP
|
|
* DNS
|
|
* Gateway
|
|
5. Log into the web interface.
|
|
|
|
Example:
|
|
|
|
```
|
|
https://192.168.1.100:8006
|
|
```
|
|
|
|
---
|
|
|
|
# Storage Layout
|
|
|
|
Recommended layout:
|
|
|
|
```
|
|
Local
|
|
ISO Images
|
|
|
|
Local-LVM
|
|
Virtual Machine Disks
|
|
|
|
Templates
|
|
VM Templates
|
|
|
|
Backups
|
|
vzdump Backups
|
|
```
|
|
|
|
As the lab grows, consider moving VM disks to dedicated SSD storage.
|
|
|
|
---
|
|
|
|
# Virtual Networking
|
|
|
|
The cyber range is isolated using Linux bridges.
|
|
|
|
```
|
|
Internet
|
|
|
|
|
Home Router
|
|
|
|
|
eno1
|
|
|
|
|
vmbr0
|
|
```
|
|
|
|
vmbr0 is connected to the physical NIC.
|
|
|
|
Additional bridges are completely virtual.
|
|
|
|
```
|
|
vmbr1
|
|
Attack Network
|
|
|
|
vmbr2
|
|
Corporate LAN
|
|
|
|
vmbr3
|
|
DMZ
|
|
```
|
|
|
|
No physical interfaces are attached to these bridges.
|
|
|
|
This creates isolated virtual switches inside Proxmox.
|
|
|
|
---
|
|
|
|
# Creating Linux Bridges
|
|
|
|
Navigate to:
|
|
|
|
```
|
|
Node
|
|
└── System
|
|
└── Network
|
|
```
|
|
|
|
Create:
|
|
|
|
## vmbr1
|
|
|
|
Type
|
|
|
|
```
|
|
Linux Bridge
|
|
```
|
|
|
|
Bridge Ports
|
|
|
|
```
|
|
(blank)
|
|
```
|
|
|
|
IPv4
|
|
|
|
```
|
|
None
|
|
```
|
|
|
|
IPv6
|
|
|
|
```
|
|
None
|
|
```
|
|
|
|
Repeat for:
|
|
|
|
```
|
|
vmbr2
|
|
|
|
vmbr3
|
|
```
|
|
|
|
Apply configuration.
|
|
|
|
---
|
|
|
|
# Bridge Purposes
|
|
|
|
## vmbr0
|
|
|
|
Management network.
|
|
|
|
Contains:
|
|
|
|
* Proxmox
|
|
* pfSense WAN
|
|
|
|
---
|
|
|
|
## vmbr1
|
|
|
|
Attack network.
|
|
|
|
Contains:
|
|
|
|
* Kali Linux
|
|
|
|
Subnet
|
|
|
|
```
|
|
10.10.10.0/24
|
|
```
|
|
|
|
---
|
|
|
|
## vmbr2
|
|
|
|
Corporate network.
|
|
|
|
Contains:
|
|
|
|
* Domain Controller
|
|
* Windows Clients
|
|
* File Server
|
|
* SQL Server
|
|
* Linux Target
|
|
|
|
Subnet
|
|
|
|
```
|
|
10.10.20.0/24
|
|
```
|
|
|
|
---
|
|
|
|
## vmbr3
|
|
|
|
DMZ
|
|
|
|
Contains:
|
|
|
|
* Vulnerable Web Server
|
|
|
|
Subnet
|
|
|
|
```
|
|
10.10.30.0/24
|
|
```
|
|
|
|
---
|
|
|
|
# VM Naming Convention
|
|
|
|
Maintain consistent naming.
|
|
|
|
Examples:
|
|
|
|
```
|
|
DC01
|
|
```
|
|
|
|
```
|
|
WIN10-01
|
|
```
|
|
|
|
```
|
|
WIN10-02
|
|
```
|
|
|
|
```
|
|
WEB01
|
|
```
|
|
|
|
```
|
|
FILE01
|
|
```
|
|
|
|
```
|
|
SQL01
|
|
```
|
|
|
|
```
|
|
BOF-WIN7
|
|
```
|
|
|
|
```
|
|
PIVOT01
|
|
```
|
|
|
|
```
|
|
KALI
|
|
```
|
|
|
|
---
|
|
|
|
# VM Hardware Standards
|
|
|
|
## Kali
|
|
|
|
CPU
|
|
|
|
```
|
|
2
|
|
```
|
|
|
|
Memory
|
|
|
|
```
|
|
4096 MB
|
|
```
|
|
|
|
Disk
|
|
|
|
```
|
|
80 GB
|
|
```
|
|
|
|
Bridge
|
|
|
|
```
|
|
vmbr1
|
|
```
|
|
|
|
---
|
|
|
|
## Windows Workstations
|
|
|
|
CPU
|
|
|
|
```
|
|
2
|
|
```
|
|
|
|
Memory
|
|
|
|
```
|
|
4096 MB
|
|
```
|
|
|
|
Disk
|
|
|
|
```
|
|
80 GB
|
|
```
|
|
|
|
---
|
|
|
|
## Windows Server
|
|
|
|
CPU
|
|
|
|
```
|
|
2-4
|
|
```
|
|
|
|
Memory
|
|
|
|
```
|
|
4096-8192 MB
|
|
```
|
|
|
|
Disk
|
|
|
|
```
|
|
100 GB
|
|
```
|
|
|
|
---
|
|
|
|
# VirtIO Drivers
|
|
|
|
For Windows virtual machines:
|
|
|
|
* Attach the VirtIO ISO.
|
|
* Install storage drivers during Windows setup.
|
|
* Install the VirtIO guest tools after installation.
|
|
|
|
Benefits:
|
|
|
|
* Better disk performance
|
|
* Better network performance
|
|
* Improved stability
|
|
|
|
---
|
|
|
|
# VM Templates
|
|
|
|
Create reusable templates.
|
|
|
|
Recommended templates:
|
|
|
|
```
|
|
Ubuntu Server
|
|
```
|
|
|
|
```
|
|
Windows Server 2022
|
|
```
|
|
|
|
```
|
|
Windows 10
|
|
```
|
|
|
|
```
|
|
Kali Linux
|
|
```
|
|
|
|
Convert each into a Proxmox template after completing:
|
|
|
|
* Updates
|
|
* Guest Agent
|
|
* VirtIO drivers
|
|
* Basic configuration
|
|
|
|
Future machines can be cloned in seconds.
|
|
|
|
---
|
|
|
|
# Snapshots
|
|
|
|
Snapshots are one of the biggest advantages of using Proxmox.
|
|
|
|
Recommended snapshot workflow:
|
|
|
|
```
|
|
Fresh Install
|
|
```
|
|
|
|
↓
|
|
|
|
```
|
|
Patched
|
|
```
|
|
|
|
↓
|
|
|
|
```
|
|
Configured
|
|
```
|
|
|
|
↓
|
|
|
|
```
|
|
Vulnerable
|
|
```
|
|
|
|
↓
|
|
|
|
```
|
|
Ready for Attack
|
|
```
|
|
|
|
If a machine becomes unstable after exploitation:
|
|
|
|
```
|
|
Rollback
|
|
```
|
|
|
|
and continue practicing.
|
|
|
|
---
|
|
|
|
# Backups
|
|
|
|
Snapshots are not backups.
|
|
|
|
Use Proxmox Backup jobs to protect:
|
|
|
|
* Domain Controller
|
|
* pfSense
|
|
* Wiki.js
|
|
* Gitea
|
|
|
|
Recommended schedule:
|
|
|
|
```
|
|
Nightly
|
|
```
|
|
|
|
Keep multiple restore points.
|
|
|
|
---
|
|
|
|
# Best Practices
|
|
|
|
✔ Use VirtIO devices whenever possible.
|
|
|
|
✔ Allocate only the RAM required.
|
|
|
|
✔ Enable the QEMU Guest Agent.
|
|
|
|
✔ Use static IP addresses for infrastructure.
|
|
|
|
✔ Name every VM consistently.
|
|
|
|
✔ Snapshot every vulnerable machine.
|
|
|
|
✔ Keep ISO images organized.
|
|
|
|
✔ Document every configuration change in Wiki.js.
|
|
|
|
---
|
|
|
|
# Validation Checklist
|
|
|
|
Before moving to the next chapter:
|
|
|
|
* [ ] Proxmox installed
|
|
* [ ] vmbr0 configured
|
|
* [ ] vmbr1 created
|
|
* [ ] vmbr2 created
|
|
* [ ] vmbr3 created
|
|
* [ ] ISO library populated
|
|
* [ ] VM templates created
|
|
* [ ] Snapshot strategy documented
|
|
* [ ] Backup strategy configured
|
|
|
|
---
|
|
|
|
# Next Chapter
|
|
|
|
The next chapter covers pfSense.
|
|
|
|
Topics include:
|
|
|
|
* Creating multiple virtual NICs
|
|
* Assigning interfaces
|
|
* WAN configuration
|
|
* LAN configuration
|
|
* DMZ configuration
|
|
* Firewall rules
|
|
* DHCP
|
|
* NAT
|
|
* DNS
|
|
* Static mappings
|
|
* Routing between virtual networks
|
|
* Internet access for the cyber range
|
|
* Isolating the lab from the home network
|
|
|