Building Your First Internet-Facing Honeypot

What is a Honeypot?

A honeypot is a deliberately vulnerable system deployed to attract, detect, and study attackers. Unlike a real server, a honeypot has no production value — everything that touches it is either a scanner, a bot, or a human probing for weaknesses.

For beginners, start with low-interaction honeypots. They are safe, well-documented, and capture the same attacker behavior (credentials, commands, malware downloads) without the risk of a real compromise.

The Architecture: Why a VPS Front Door

The single most important design decision is never expose your home IP. If you port-forward honeypot ports on your home router, every scanner on the internet learns your residential address. Instead, use a disposable cloud server as the public face.

What You Need

You do not need a static home IP, port forwarding on your router, or a domain name. The Pi dials out to the VPS; the VPS never needs to reach in.

Setting Up the VPS

Choose a Provider

Any cheap VPS provider works. Popular choices:

Basic VPS Setup

# 1. Create a VPS (Ubuntu 22.04 or 24.04 LTS, smallest tier)
# 2. SSH in as root
ssh root@YOUR_VPS_IP

# 3. Update and harden SSH
apt update && apt upgrade -y
# Change SSH to a non-standard port (e.g., 4422)
sed -i 's/#Port 22/Port 4422/' /etc/ssh/sshd_config
systemctl restart sshd

# 4. Create a non-root user
adduser honeypi-admin
usermod -aG sudo honeypi-admin

# 5. Disable root SSH login
sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
systemctl restart sshd

The Secure Tunnel (WireGuard)

WireGuard creates an encrypted tunnel between the VPS and your Pi. The Pi dials out to the VPS, so no home router configuration is needed. The VPS never needs to know your home IP.

Figure 2. The Pi dials out to the VPS (arrow shows tunnel direction). The VPS forwards attacker traffic through the tunnel.

On the VPS

apt install wireguard
wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey

# /etc/wireguard/wg0.conf on the VPS
[Interface]
Address = 10.42.0.1/24
ListenPort = 51820
PrivateKey = 

[Peer]
# Pi's public key
PublicKey = 
AllowedIPs = 10.42.0.99/32

On the Pi

sudo apt install wireguard
wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey

# /etc/wireguard/wg0.conf on the Pi
[Interface]
PrivateKey = 
Address = 10.42.0.99/24

[Peer]
PublicKey = 
Endpoint = :51820
AllowedIPs = 10.42.0.0/24
PersistentKeepalive = 25

Port Forwarding (DNAT)

The VPS forwards attacker traffic from its public IP through the tunnel to the Pi's honeypot containers. This is done with iptables DNAT rules.

Figure 4. Attacker traffic path: internet → VPS public IP (DNAT) → WireGuard tunnel → Pi → Docker honeypot containers. The Pi firewall seals container egress.

# On the VPS: forward port 22 (SSH) and 23 (Telnet) to the Pi
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 22 -j DNAT --to-destination 10.42.0.99:22
iptables -t nat -L PREROUTING -n --line-numbers   # verify

Repeat for each honeypot port you want to expose. Common choices for IoT research:

Firewall and Isolation

This is the most critical safety layer. Without it, a compromised honeypot container could pivot to your home network or reveal your real IP.

On the Pi: Seal Container Egress

The Pi's firewall must block all outbound traffic from Docker containers except the WireGuard tunnel. This prevents a compromised honeypot from phoning home (which would leak your home IP).

# Block all container egress (sealed mode)
iptables -A FORWARD -j DROP

# Allow established connections back in
iptables -I FORWARD 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Block containers from reaching the home LAN
iptables -A FORWARD -d 192.168.0.0/16 -j DROP
iptables -A FORWARD -d 10.0.0.0/8 -j DROP
iptables -A FORWARD -d 172.16.0.0/12 -j DROP

Network-Level VLAN Isolation

Firewall rules are important, but they are a software control that can be bypassed if the host itself is compromised. The strongest protection is network-level separation — putting the honeypot Pi on a subnet that physically cannot reach your trusted devices.

Figure 3. VLAN isolation puts the honeypot on a separate broadcast domain with no route to trusted devices.

How to Implement VLAN Isolation

Monitoring What You Capture

At minimum, you want to know:

• Who is connecting (source IP, country, ASN)
• What credentials they try
• What commands they run after a successful login
• What files they try to download

Log Storage Options

What to Look For in Your First Week

• Top source IPs — who is scanning you most?
• Top credentials — root/admin, admin/12345, etc.
• Commands after login — uname, cat /etc/passwd, wget
• Downloaded files — malware samples (save the SHA-256, do not execute them)
• Port distribution — Telnet (23) usually dominates for IoT honeypots

Legal and Ethical Considerations

• Do not actively attack back. Honeypots are passive observers.
• Do not use captured credentials against real systems.
• Do not share malware samples outside controlled research channels.
• Do report abusive IPs to AbuseIPDB or your hosting provider.
• Do anonymize data before publishing (redact your VPS IP, home network details).

Common Beginner Mistakes

Pre-Launch Checklist

Sources & Further Reading

• Cowrie documentation — the most widely deployed SSH/Telnet honeypot
• Dionaea documentation — SMB/HTTP/malware capture
• WireGuard quick start — tunnel setup
• T-Pot — all-in-one honeypot platform (heavier, but good for comparison)
• AbuseIPDB — report and check abusive IPs