Virtual Appliance

PrivateLAN is delivered as a ready-to-run virtual machine (VM appliance). The downloads page provides images for XCP-ng, Microsoft Hyper-V and VMware ESXi. This page describes the appliance's system requirements and disk layout, and the settings needed to import the image into each hypervisor.

System requirements

The appliance is built to run light and predictable:

Disk layout

The appliance consists of 3 virtual disks:

Offline updates: if the appliance has no internet access for the built-in update mechanism (see Software Updates), disk 1 can be replaced with disk 1 from a newer VM image, while disks 2 and 3 remain attached to the existing VM. This preserves your database, certificates and logs across the update. The step-by-step procedure is described under Offline Updates.

When importing or managing the VM, do not remove or detach any of the 3 disks, even if one appears empty.

Network adapters

The appliance has 2 virtual network adapters:

Connect eth0 to your internal network/portgroup and eth1 to a network with internet access.

Isolation between eth0 (LAN) and eth1 (WAN)

eth0 and eth1 are separated on multiple, independent levels, so that an internet connection on eth1 never grants access to your internal network, and traffic from eth0 cannot reach the internet via eth1 either:

• Firewall (nftables): the forward chain has policy drop and contains no rules at all, for both IPv4 and IPv6 — traffic is never forwarded between eth0 and eth1.
• No NAT: there is no NAT/masquerade configuration. Even if forwarding were enabled, there is no mechanism to translate LAN traffic out via eth1.
• Kernel hardening: net.ipv4.ip_forward, net.ipv4.conf..forwarding and net.ipv6.conf..forwarding are explicitly set to 0 (/etc/sysctl.d/99-privatelan-no-forwarding.conf), so routing between the interfaces is not possible at the operating-system level either.
• Restricted inbound traffic on eth1: from the internet, only ICMP is accepted (echo-request is rate-limited to 10 packets/second against scanning and floods), plus replies to traffic the appliance itself initiated (established/related). New inbound connections are always rejected.
• IPv6 on eth1: input, forward and output are all fully closed (policy drop, no rules), preventing any unintended IPv6 leak via mechanisms such as SLAAC.

This combination lets you connect eth1 to an internet connection for software updates and telemetry without any further precautions.

Downloading the VM image

Go to Downloads and select the tab for your hypervisor:

• Microsoft Hyper-V — Generation 2 VM, delivered as VHDX files with XML configuration
• XCP-ng / Citrix Hypervisor — XVA file
• VMware ESXi / vSphere — OVA file

Importing into XCP-ng

1. Open Xen Orchestra or XenCenter
2. Choose Import (Xen Orchestra: VMs → New VM → Import; XenCenter: File → Import)
3. Select the downloaded .xva file
4. Assign a storage repository for all 3 disks
5. Connect eth0 to your internal LAN network and eth1 to a network with internet access
6. Power on the VM

Importing into Microsoft Hyper-V

1. Open Hyper-V Manager
2. Choose Action → Import Virtual Machine
3. Select the folder containing the downloaded VHDX files and XML configuration
4. Choose Copy the virtual machine so the original files are preserved
5. Connect eth0 to the virtual switch for your internal LAN and eth1 to a virtual switch with internet access
6. For this Generation 2 VM, check the Security settings: Secure Boot is disabled by default — leave it that way
7. Power on the VM

Importing into VMware ESXi / vSphere

1. Open the vSphere Client (or ESXi Host Client)
2. Choose Deploy OVF Template
3. Select the downloaded .ova file
4. Choose the desired datastore and provisioning type (thin or thick)
5. Connect eth0 to the portgroup for your internal LAN and eth1 to a portgroup with internet access
6. Verify that all 3 disks are included ("Include all disks")
7. Power on the VM

Alternatively, use ovftool to deploy the OVA file from the command line.

First boot

Once the VM has been imported and powered on, connect to the appliance following the Quick Start guide.