Friday, December 21, 2018

Virtualization server setup

This post is about how I have my virtualization server setup at home. I built it earlier this year. 

Use cases for me are: running VM's, malware analysis, pentesting practice, processing data/logs, doing CTF stuff, running containers, virtualized networking, and so on...

CPU: AMD Ryzen 5 1600, it's 6 cores and 12 threads. It's cheap and good enough. 
Motherboard: B350M Mortar
RAM: 4x8GB, total 32GB. It's good enough for running multiple VM's and containers. I had 16GB before and it worked fine.
Networking: Motherboard has an onboard 1GB Ethernet. For a connection to a NAS, I added a 10GB MELLANOX NIC and a pair of those should cost around 30 bucks on ebay. Finally, I added 4x1GB ethernet NIC, which I think is sold by Syba on Amazon.
Case: Thermaltake Versa H17
Storage: 2x2TB HDD, 1x240GB SSD

Virtualization setup: I'm using Proxmox VE for virtualization. It supports VM's and Containers. On top of that, I'm using Docker as well. ServeTheHome has an article on how to set it up: https://www.servethehome.com/creating-the-ultimate-virtualization-and-container-setup-with-management-guis/

The 2x2TB drives are installed in RAID 1 mode. Proxmox VE is installed on top of them. SSD contains ISO images for Linux, Windows, and etc. It also holds Container images. All of the VM content is saved to the HDD's. Additionally, all the data can be backed up via the 10GB link to the NAS. 

Proxmox VE allows you to create templates based on VM's too. In my case, I have templates for Windows and Ubuntu server, which tools such as git, python, and etc. preinstalled. 

With networking, Proxmox VE allows you to use OpenVSwitch, right from the WebUI. It lets you create virtualized networks just for VM's or use one of the hardware ports. This comes in very handy when doing malware analysis. For example, you can set up pfsense as a VM and add a virtualized network. You can also put the VM you're doing malware analysis on the virtualized network. Pfsense can be configured to route all the traffic through VPN. When malware traffic leaves the network, it ends up going through VPN. 

Here's what the virtualization machine looks like on the inside:

Here's the back:

Links:
Proxmox VE: https://www.proxmox.com/en/proxmox-ve
ServeTheHome - a really useful website: https://www.servethehome.com/
Pfsense: https://www.pfsense.org/
Opnsense (similar to pfsense): https://opnsense.org/
Homelab subreddit, useful for looking at other setups and asking questions: https://www.reddit.com/r/homelab