How to make VM1 connect to fakedns server on VM2?

I am trying to create a mini malware analysis environment between a few MacOS VMs to analyse the network activity of MacOS malwares.

Some context about the VMs:

  • Both VM are MacOS Catalina 10.15
  • Both are in a private network (Both VMs can ping each other)

I have installed Python3 on VM2 and installed fakedns to simulate as a DNS server.

I have also changed the DNS server of VM1 to point towards VM2 by using the following steps:

  1. System Preferences
  2. Network
  3. Under Ethernet, click "Advanced"
  4. Select "DNS" tab and click "+" and entered the IP address of VM2.
  5. Clicked "Ok" and "Apply" to apply changes.

At this time, I also started the FakeDNS by entering sudo python3 fakedns.py <IP address of VM2>

However, when I did nslookup something.com on VM1, (based on my Wireshark capture), it went out via loopback port and not the ethernet port. [Refer to picture below, this Wireshark capture was taken from VM1] Wireshark capture of loopback port

EDIT: The two screenshots below are the IP address of VM1 and DNS tab of VM1, with IP address of VM2 set as the DNS enter image description here enter image description here

This screenshot is the IP address of VM2 and I did not configure anything on VM2 enter image description here

When I entered nslookup anything.com <IP address of VM2>, I managed to get the response. However, if I am to enter nslookup anything.com, it goes via the default connection. Is there a way to change the default DNS path??

EDIT #2: This is the screenshot of the network adapter of VM1 (I'm using VMWare Fusion to run the VMs) Both VMs have the same interface as the screenshot below. enter image description here

Also, I've checked my netstat table in VM1 and realised that there's no default route. So I added route add default 172.16.6.1 and below is the Internet routing table enter image description here

I've tried nslookup anything.com after setting the default route, and flushing my DNS cache, but it still doesn't work.

Answers 1

  • Managed to solve it with the help of @jksoegaard.

    Must set manually IP for both VM1 and VM2, with the default gateway (router) of both configurations pointing to the same IP address (I indicated 172.16.6.1 for mine). With these configurations, VM1 managed to get a nslookup response from VM2


Related Questions