Instructor: Network segmentation. 2 2
In this lesson, we're going to go through 3 3
and do a little bit of configuration 4 4
of how you would do network segmentation 5 5
and security within your network. 6 6
Now, to do this, I'm going to be using 7 7
an open source unified threat management appliance 8 8
known as pfSense. 9 9
You can download this yourself 10 10
and install it in your own network at pfsense.org. 11 11
Now, this lab is going to be focused on the installation 12 12
and configuration issues that you might come across 13 13
when you're doing this in the real world. 14 14
To get started, I'm going to go into my lab environment, 15 15
and I'm going to enter into the web application interface 16 16
for this particular unified threat management system. 17 17
I'm going to log in with my username and password, 18 18
which in my case is admin, and the password of "Password." 19 19
Now, once I'm in here, I want to go forward 20 20
and look at the firewall ACLs. 21 21
This firewall that we have has two different interfaces. 22 22
It has an external one and an internal one. 23 23
This might act like a router. 24 24
On the external side, I have the internet. 25 25
On the internal side, I have my local area network. 26 26
This firewall is going to be screening 27 27
any traffic coming in from the external network 28 28
before it gets into my local network segment. 29 29
This means that any traffic 30 30
that matches my access control list can get through, 31 31
and anything that's denied by my access control list 32 32
will be rejected. 33 33
So let's take a look at what rules we already have here. 34 34
First, we're going to click on "Firewall," and then "Rules." 35 35
From here, we can see on the WAN tab 36 36
that there are several different types 37 37
of traffic that's permitted. 38 38
We have things like ICMP, which is ping traffic. 39 39
We have DNS, which does domain name resolution. 40 40
We have HTTP and HTTPS, 41 41
which is going to allow web browsing. 42 42
And we have SMTP, which is going to allow outbound email. 43 43
Now notice all of these things 44 44
are things that you would normally expect to see, 45 45
and they all have forwarding rules. 46 46
That means that traffic from these ports 47 47
is going to be directed to a host inside the LAN. 48 48
Now, all of these, except for ICMP that is. 49 49
ICMP just has an allow rule, not a forwarding rule. 50 50
Now, why are these forwarding rules in place? 51 51
Well, because I'm setting up a DMZ. 52 52
And so I'm going to have people from outside the network 53 53
being able to go into my network using that forwarding, 54 54
and then get to my DNS server or my HTTP server, 55 55
or my HTTPS server, or my SMTP server. 56 56
So now let's click on the LAN tab, 57 57
which is the internal network. 58 58
This is where I'm hosting those servers. 59 59
Now notice here there is no egress filtering, 60 60
which means there's nothing blocking 61 61
anything from going out. 62 62
Any type of traffic from a host on the LAN 63 63
can go to any other endpoint, 64 64
unless there's going to be a deny rule put in place 65 65
by a higher level ACL. 66 66
Now, if I click on the Firewall and click on NAT, 67 67
you can see the host 68 68
that I'm going to be sending this traffic to. 69 69
Remember, I had that NAT forwarding going on. 70 70
So here you see DNS is going to go to the server 71 71
located at 10.1.0.1. 72 72
If you look at the web, HTTP and HTTPS, 73 73
this is going to my Apache web server at 10.1.0.10, 74 74
and my SMTP is going to go to my email server at 10.1.0.2. 75 75
So is there any issues with this? 76 76
Well, there is an issue here. 77 77
Putting all these things in the same segment is pretty risky 78 78
because a web server, for instance, is going to be exposed 79 79
to a large number of vulnerabilities and exploits 80 80
because they can have things like cross-site scripting. 81 81
They can have things like remote code execution 82 82
and all sorts of other exploits. 83 83
So if somebody was able to compromise that one server, 84 84
they can then pivot over to the SMTP server, 85 85
or over to the DNS server and take advantage of those too. 86 86
So we probably want to add some segmentation, 87 87
and that's what we're going to focus on 88 88
here through the rest of this lab. 89 89
Now, to configure this firewall so that my web server 90 90
is put into an isolated demilitarized zone, 91 91
I need to be able to separate it from the other hosts, 92 92
and I'm going to do this 93 93
by creating a third interface on the firewall. 94 94
Now, to do this within pfSense, 95 95
I'm going to go to "Interfaces" and then "Assignments." 96 96
From here, I'm going to click the "Add" button, 97 97
next to the unused interface. 98 98
Now from the menu bar, 99 99
I can select interfaces and then OPT1 for option one. 100 100
I'm going to check the enable interface box, 101 101
and I'm going to go in and select "Static IPv4" 102 102
for my IPv4 configuration type. 103 103
When I go down there, I'm going to put in the IPv4 address 104 104
of 10.1.254.254, 105 105
and I'm going to select 24 from the list box. 106 106
Now I'm going to save my changes and apply those changes. 107 107
This is going to enable that interface 108 108
on the firewall using that IP address. 109 109
Next I'm going to go to firewall and then click "Nat." 110 110
And here I'm going to click the edit button, 111 111
that pen icon, on the HTTP forwarding rule. 112 112
I want to redirect that IP value to 10.1.254.10, 113 113
and change my description of HTTP forwarding 114 114
to the DMZ and then save it. 115 115
Next, I'm going to edit the HTTPS forwarding rule. 116 116
Again, I'm going to type in 10.1.254.10, 117 117
and I'm going to change the description to HTTPS forwarding 118 118
to the DMZ and click "Save," and then apply changes. 119 119
So at this point, 120 120
you can now see we have a couple of rules here. 121 121
You can see we have the SMTP rule going to 10.1.0.2. 122 122
It's using forwarding. 123 123
Then we have HTTPS and HTTP both going to 10.1.254.10, 124 124
using that forwarding rule to the DMZ. 125 125
And finally, we have DNS still going 126 126
to the DNS server located at 10.1.0.1. 127 127
Next, I need to set up my logging. 128 128
So anything that's going through this firewall gets logged. 129 129
So what am I going to log? 130 130
Well, let's go up here 131 131
and click on "Status," "System Logs," and "Settings." 132 132
Then scroll down, 133 133
and click the check button next to 134 134
"Log packets matched from the default block rules" 135 135
in the rule set. 136 136
This means anything that's blocked is going to get logged. 137 137
All right, so everything's looking good now, 138 138
but we still have one more step. 139 139
We haven't configured the web server to move itself 140 140
into the DMZ, because we changed the IP address, 141 141
so now we have to give that web server that new IP address 142 142
of 10.1.254.10. 143 143
To do this, I'm going to log into my web server. 144 144
I'm going to click on the network icon, 145 145
and then select the wired connected, and the wired settings. 146 146
From here, I'm going to turn the wired connection off, 147 147
click the cog icon to be able to go into settings, 148 148
and then set IPv4 tab to set static manual IP address. 149 149
And I'm going to give the address of 10.1.254.10/24, 150 150
with a default gateway of 10.1.254.254. 151 151
Once I've done that, I can click that slider button 152 152
to turn the wired connection back on 153 153
and close the connection window. 154 154
All right, at this point, we should have our DMZ configured 155 155
with the web server sitting in the DMZ, the DNS server 156 156
and the SMTP server sitting on the internal network, 157 157
and the external network, being the internet, 158 158
out on that external interface. 159 159
Let's go ahead and test our segmentation. 160 160
First, I'm going to verify 161 161
that we can browse the server as normal if we're doing this 162 162
from our PC, which is inside of that local area network. 163 163
Well, to do this, I'm going to go to 164 164
www.515support.com/dvwa, and www.515support.com/multitilde. 165 165
Notice both of these browse with no issues at all. 166 166
Next, I'm going to see if this server is vulnerable 167 167
to a reverse shell attack vector. 168 168
To do this, I'm going to go into Metasploit, 169 169
like I've used in other lessons, 170 170
and I'm going to use the exploit multi handler. 171 171
And then I'm going to type in "Exploit." 172 172
From here, I'm going to run the "Curl" command 173 173
and see if I can establish a reverse shell. 174 174
So if I type in "curl --user" 175 175
and then the user I'm going to use, 176 176
in this case sam:password, 177 177
and the site I'm trying to do this to, 178 178
http://www.515support.com/webdev/get.php. 179 179
Now, this is not going to work this time. 180 180
This means there's no interpreter shells being open, 181 181
because our ACL should have been configured 182 182
to only allow incoming connections on each interface. 183 183
So it's going to block OPT1 when the web server 184 184
is trying to initiate a new connection to it. 185 185
However, it can reply to web sessions 186 186
that external hosts have started. 187 187
So when I tried to access it to the web browser, 188 188
I made a request and then it responded. 189 189
But in this case, with the curl command, 190 190
I'm trying to have the server send that out initially 191 191
without a request coming, and that is why we're showing 192 192
that this reverse shell is not going to work. 193 193
All right, 194 194
let's go back and take a look at our firewall logs now. 195 195
If I go back into my firewall, 196 196
I can click on "Status," "System Logs," and then "Firewall." 197 197
Note here you can see the log view has been configured 198 198
with the most recent events at the top. 199 199
Observe the rule at the top for regular HTTP browsing. 200 200
This came from 192.168.2.192, 201 201
and it went to the web server at 10.1.254.10 over port 80. 202 202
Now, observe the default blocking rule that we saw here. 203 203
10.1.254.10 is not allowed to establish a connection 204 204
to 192.168.2.192 over port 8080. 205 205
This is what we try to do when I use that curl command. 206 206
Essentially, I was trying to go from the web server 207 207
over to the client PC in the internal network, 208 208
and because of this DMZ rule, it's going to block that. 209 209
Now, if I click on that cross, 210 210
I can see additional details about this hidden default rule. 211 211
So as you can see here, 212 212
we have successfully isolated our web server 213 213
from other hosts on the internal network, 214 214
while still allowing it to have access 215 215
from those hosts to the web server when they need it 216 216
but preventing the web server 217 217
from getting back to those hosts. 218 218
So you can see how we can add segmentation here to make sure 219 219
that the devices in the internal network are protected 220 220
from the external network and from that untrusted DMZ. 221 221
Now, we've talked about jump boxes as well, 222 222
and you could configure a jump box on the DMZ 223 223
as the single point of entry. 224 224
Essentially, you would get SSH access into that jump box 225 225
in the DMZ, and then from that jump box in the DMZ 226 226
you could access all of the other hosts 227 227
inside the DMZ because it's in that environment already. 228 228
This would be a good way to set things up, 229 229
especially if you configure a forward proxy connection 230 230
to those different application servers. 231 231
All right, so I hope you've enjoyed this lesson 232 232
as we got a little hands-on using unified threat management 233 233
and firewalls, 234 234
and going through some configurations for segmentation.