DMZ + honeypot for bot pattern capture #58

New issue

Open

opened 2026-05-30 09:46:27 -07:00 by pyr0ball · 0 comments

pyr0ball commented

2026-05-30 09:46:27 -07:00

Owner

Goal

Set up a DMZ VLAN and honeypot to capture inbound bot/scanner patterns for Turnstone log analysis.

Context

Router (Untangle/Arista at 10.1.10.13) now has IoT (VLAN 20) and Cameras (VLAN 30) VLANs active. Next step is to add a DMZ VLAN with a honeypot container that logs connection attempts — feeding those patterns back into Turnstone glean rules.

Tasks

Add DMZ VLAN (VLAN 40, 10.10.40.0/24) on the Untangle router
Deploy honeypot container (e.g. cowrie or opencanary) on Navi in the DMZ
Add port-forward rules to expose honeypot ports to WAN (22, 23, 80, 443, 3389)
Add Turnstone log source for honeypot container
Add glean patterns for honeypot hit events
Consider firewall rules to prevent DMZ from reaching main LAN

Notes

Untangle filter rules are default-allow for internal traffic — explicit block rules needed for DMZ→LAN
Use unifi-cli.sh for UniFi side if a DMZ WiFi SSID is needed
Untangle UI automatable via Playwright session (credentials in memory)

## Goal Set up a DMZ VLAN and honeypot to capture inbound bot/scanner patterns for Turnstone log analysis. ## Context Router (Untangle/Arista at 10.1.10.13) now has IoT (VLAN 20) and Cameras (VLAN 30) VLANs active. Next step is to add a DMZ VLAN with a honeypot container that logs connection attempts — feeding those patterns back into Turnstone glean rules. ## Tasks - [ ] Add DMZ VLAN (VLAN 40, 10.10.40.0/24) on the Untangle router - [ ] Deploy honeypot container (e.g. cowrie or opencanary) on Navi in the DMZ - [ ] Add port-forward rules to expose honeypot ports to WAN (22, 23, 80, 443, 3389) - [ ] Add Turnstone log source for honeypot container - [ ] Add glean patterns for honeypot hit events - [ ] Consider firewall rules to prevent DMZ from reaching main LAN ## Notes - Untangle filter rules are default-allow for internal traffic — explicit block rules needed for DMZ→LAN - Use `unifi-cli.sh` for UniFi side if a DMZ WiFi SSID is needed - Untangle UI automatable via Playwright session (credentials in memory)