1 00:00:00,120 --> 00:00:01,290 Okay, in this demonstration, 2 00:00:01,290 --> 00:00:02,123 we're going to walk through 3 00:00:02,123 --> 00:00:04,920 how to configure the firewall daemon. 4 00:00:04,920 --> 00:00:07,080 Now the firewall's default state 5 00:00:07,080 --> 00:00:10,110 is to deny any network access. 6 00:00:10,110 --> 00:00:11,970 So that means anything that we're going to allow, 7 00:00:11,970 --> 00:00:14,310 we have to explicitly allow. 8 00:00:14,310 --> 00:00:15,300 In most networks, 9 00:00:15,300 --> 00:00:17,430 especially enterprise level networks, 10 00:00:17,430 --> 00:00:19,650 we're going to create something called a screen subnet 11 00:00:19,650 --> 00:00:23,700 where you allow things that are very susceptible to attack, 12 00:00:23,700 --> 00:00:25,350 and that's what area you're going to put in. 13 00:00:25,350 --> 00:00:28,830 So a web facing server, DNS servers, things of the nature, 14 00:00:28,830 --> 00:00:32,640 where you need external users or services 15 00:00:32,640 --> 00:00:34,530 to use that system or network, 16 00:00:34,530 --> 00:00:37,140 you're going to put in a separate area 17 00:00:37,140 --> 00:00:39,690 to where your internal network is blocked 18 00:00:39,690 --> 00:00:41,910 by another set of controls, 19 00:00:41,910 --> 00:00:44,160 in which usually is the firewall. 20 00:00:44,160 --> 00:00:47,927 So we're going to go through and figure how to allow HTTP, 21 00:00:47,927 --> 00:00:52,927 HTTPS, and also a custom port that we will sometimes use. 22 00:00:53,160 --> 00:00:54,439 So, first thing we need to do, 23 00:00:54,439 --> 00:00:56,310 we're going to check the status of the firewall. 24 00:00:56,310 --> 00:00:58,810 So we're going to use our handy-dandy system control. 25 00:01:04,950 --> 00:01:07,440 Okay, now we see it's up and running for us, 26 00:01:07,440 --> 00:01:08,273 so that's good. 27 00:01:10,290 --> 00:01:11,700 Next we're going to use nmap, 28 00:01:11,700 --> 00:01:13,830 which is a network mapping tool. 29 00:01:13,830 --> 00:01:15,990 It's used a lot with penetration testing, 30 00:01:15,990 --> 00:01:17,940 and some attackers use it as well, 31 00:01:17,940 --> 00:01:20,160 but we're just going to see if we can get the status 32 00:01:20,160 --> 00:01:23,250 and version of whatever's running on port 80, 33 00:01:23,250 --> 00:01:25,983 which should be HTTP on our partner's network. 34 00:01:27,510 --> 00:01:28,890 Can do SUDO. 35 00:01:28,890 --> 00:01:33,503 Now the location of this is in the local bin, nmap, 36 00:01:37,530 --> 00:01:40,713 get the service version information, 37 00:01:42,600 --> 00:01:44,613 do server zero two. 38 00:01:45,726 --> 00:01:47,753 As far as the other port, it's going to be 80. 39 00:01:50,910 --> 00:01:54,630 Okay, now we see that the state is showed as filtered. 40 00:01:54,630 --> 00:01:57,360 There's typically going to be three states in this mode: 41 00:01:57,360 --> 00:01:59,730 open, filtered, and closed. 42 00:01:59,730 --> 00:02:02,250 Now open means that the service is up and running, 43 00:02:02,250 --> 00:02:04,980 and they're listening for connections. 44 00:02:04,980 --> 00:02:07,860 Filtered means it's being blocked actively 45 00:02:07,860 --> 00:02:10,710 by either a firewall or some other network protocol 46 00:02:10,710 --> 00:02:11,970 that's restricting access 47 00:02:11,970 --> 00:02:14,490 to that particular port or service. 48 00:02:14,490 --> 00:02:17,010 And closed means that that connection 49 00:02:17,010 --> 00:02:20,643 is not actively listening for that service or port. 50 00:02:21,510 --> 00:02:24,210 Next we're going to get information about the zones. 51 00:02:24,210 --> 00:02:25,653 So let's do a new firewall. 52 00:02:27,510 --> 00:02:28,343 Command. 53 00:02:29,640 --> 00:02:31,830 We want to get the zones, 54 00:02:31,830 --> 00:02:33,080 let's get a list of them. 55 00:02:36,990 --> 00:02:39,570 Okay, so we have the block DMZ drop, 56 00:02:39,570 --> 00:02:44,570 external home, internal public, and trusted and work zones. 57 00:02:44,820 --> 00:02:47,040 Now, if this was a physical device, 58 00:02:47,040 --> 00:02:50,940 these would literally be different ports on the firewall. 59 00:02:50,940 --> 00:02:54,300 So they would be separated physically. 60 00:02:54,300 --> 00:02:56,190 Everything has to go through the firewall, 61 00:02:56,190 --> 00:02:59,340 and it will decide if it's able to go to the next port. 62 00:02:59,340 --> 00:03:01,080 Now this one is a logical one, 63 00:03:01,080 --> 00:03:03,300 which works in a similar way. 64 00:03:03,300 --> 00:03:05,523 Now next we're going to focus on the DMZ. 65 00:03:06,612 --> 00:03:07,830 Okay, so what we're going to do. 66 00:03:07,830 --> 00:03:11,043 Firewall command, zone. 67 00:03:22,350 --> 00:03:24,960 Okay, now we see what we have currently allowed 68 00:03:24,960 --> 00:03:26,610 on this particular firewall. 69 00:03:26,610 --> 00:03:29,010 So we're currently allowing HTTP, 70 00:03:29,010 --> 00:03:34,010 HTTPS, SSH, port 7743 TCP. 71 00:03:34,200 --> 00:03:36,450 And if you look at this target, the default, 72 00:03:36,450 --> 00:03:40,920 what that means is anything that's not listed as a service 73 00:03:40,920 --> 00:03:42,990 or a port that's allowed will be blocked 74 00:03:42,990 --> 00:03:45,120 'cause that's the default setting of this. 75 00:03:45,120 --> 00:03:46,170 Now, usually for troubleshooting, 76 00:03:46,170 --> 00:03:49,050 you might be able to change the default to accept, 77 00:03:49,050 --> 00:03:50,700 which means that everything that comes through 78 00:03:50,700 --> 00:03:51,960 will get accepted. 79 00:03:51,960 --> 00:03:54,330 And you only want to do that to kind of troubleshoot 80 00:03:54,330 --> 00:03:55,650 and see if your firewall's the issue 81 00:03:55,650 --> 00:03:57,540 for connectivity problems. 82 00:03:57,540 --> 00:04:00,450 Now, we also notice what interface that it's supplied to, 83 00:04:00,450 --> 00:04:02,070 'cause I have multiple on this one. 84 00:04:02,070 --> 00:04:05,700 So for my enps03, 85 00:04:05,700 --> 00:04:08,823 that interface is going to be designated as our DMZ area. 86 00:04:10,110 --> 00:04:11,100 Okay, next what we're going to do 87 00:04:11,100 --> 00:04:12,580 is want to get the active zones 88 00:04:13,650 --> 00:04:16,293 that are currently being used. 89 00:04:19,200 --> 00:04:20,367 All right, so we see that the DMZ 90 00:04:20,367 --> 00:04:22,260 and the public interfaces, 91 00:04:22,260 --> 00:04:25,380 these are the ones that are currently being engaged with. 92 00:04:25,380 --> 00:04:29,850 Now, if I wanted to add the enp0s3 to the DMZ interface, 93 00:04:29,850 --> 00:04:30,720 I can do that. 94 00:04:30,720 --> 00:04:34,713 And we're going to simply use sudo firewall, 95 00:04:42,090 --> 00:04:43,833 specify the zone equal to DMZ. 96 00:04:47,040 --> 00:04:48,093 Change the interface. 97 00:04:58,073 --> 00:05:02,460 Do permanent because all these changes are runtime changes, 98 00:05:02,460 --> 00:05:05,040 meaning that they will not persist if a reboot. 99 00:05:05,040 --> 00:05:07,500 So the permanent allows it to be stored, 100 00:05:07,500 --> 00:05:08,640 and whenever we reboot the system, 101 00:05:08,640 --> 00:05:10,090 these settings will be saved. 102 00:05:12,870 --> 00:05:15,723 Okay, we see that was success. 103 00:05:17,460 --> 00:05:19,980 So if we can go to get active zones again, 104 00:05:19,980 --> 00:05:24,980 we'll see that enp0s8 is now part of the DMZ zone. 105 00:05:25,560 --> 00:05:26,430 So next thing we're going to do, 106 00:05:26,430 --> 00:05:27,930 we're going to add different services 107 00:05:27,930 --> 00:05:30,570 and a custom port to the zone. 108 00:05:30,570 --> 00:05:32,460 Now, as you saw earlier that they were already there, 109 00:05:32,460 --> 00:05:34,800 so I'm going through and remove those and then add 'em, 110 00:05:34,800 --> 00:05:37,710 so you can see how to remove and ad services as well. 111 00:05:37,710 --> 00:05:40,800 So we're going to use this firewall command right here, 112 00:05:40,800 --> 00:05:42,090 just to remove the services. 113 00:05:42,090 --> 00:05:43,200 We're going to focus on the additions, 114 00:05:43,200 --> 00:05:44,033 but I'm going to go through 115 00:05:44,033 --> 00:05:45,360 and remove these services really quick, 116 00:05:45,360 --> 00:05:46,560 so we can see 'em at it. 117 00:05:48,292 --> 00:05:49,125 Okay. 118 00:06:12,439 --> 00:06:13,830 All right, now let's take a view 119 00:06:13,830 --> 00:06:16,380 at current services that's running. 120 00:06:16,380 --> 00:06:20,070 Okay, so we see we don't have any services that are allowed 121 00:06:20,070 --> 00:06:22,023 or any ports except for SSH. 122 00:06:23,100 --> 00:06:26,190 Okay, let's go ahead and make some changes. 123 00:06:26,190 --> 00:06:28,983 I'm going to do SUDO firewall command, 124 00:06:33,210 --> 00:06:34,383 specify the zone. 125 00:06:38,910 --> 00:06:40,533 I'm going to add a service. 126 00:06:43,050 --> 00:06:45,180 It's going to be HTTP, 127 00:06:45,180 --> 00:06:46,830 and we want this to be permanent, 128 00:06:47,790 --> 00:06:50,910 meaning that we want it to persist during a reload. 129 00:06:50,910 --> 00:06:52,210 Okay, that was successful. 130 00:06:53,670 --> 00:06:55,503 Now we're going to do HTTPS. 131 00:06:56,430 --> 00:06:57,900 Okay. 132 00:06:57,900 --> 00:07:00,100 And then we're going to do the custom port 133 00:07:01,290 --> 00:07:02,540 that I specified earlier, 134 00:07:04,890 --> 00:07:06,060 and we're just going to have to make sure 135 00:07:06,060 --> 00:07:07,260 we have the port number, 136 00:07:10,620 --> 00:07:14,479 and then the protocol that we're going to use, TCP or UDP. 137 00:07:14,479 --> 00:07:15,364 Okay. 138 00:07:15,364 --> 00:07:16,860 Now if we look here, 139 00:07:16,860 --> 00:07:20,310 we'll see that it's not going to show initially. 140 00:07:20,310 --> 00:07:23,210 So what we have to do is we're going to reload this firewall. 141 00:07:29,340 --> 00:07:31,203 Okay, now we should see it. 142 00:07:33,270 --> 00:07:36,960 Okay, so now we have our services that are allowed HTTP, 143 00:07:36,960 --> 00:07:41,130 HTTPS, and also the custom port that we're using, 144 00:07:41,130 --> 00:07:44,010 7743 on a TCP. 145 00:07:44,010 --> 00:07:46,680 Next I want to make changes to my partner's firewall. 146 00:07:46,680 --> 00:07:48,390 So we see earlier that it show filter, 147 00:07:48,390 --> 00:07:49,590 but next is just show open. 148 00:07:49,590 --> 00:07:51,480 So I'll be right back. 149 00:07:51,480 --> 00:07:52,860 Okay, I'm back. 150 00:07:52,860 --> 00:07:55,830 Now let's try to do our nmap scan again, 151 00:07:55,830 --> 00:07:56,970 and we're going to look for the service 152 00:07:56,970 --> 00:07:58,140 and it should be running now. 153 00:07:58,140 --> 00:07:59,523 It should be showing open. 154 00:08:05,010 --> 00:08:08,667 Okay, now we see that the state is now open for HTTP, 155 00:08:08,667 --> 00:08:10,470 and we actually got some version information 156 00:08:10,470 --> 00:08:11,583 about it as well. 157 00:08:12,720 --> 00:08:14,010 So again, when we're using a lot 158 00:08:14,010 --> 00:08:16,680 of network information gathering tools like nmap, 159 00:08:16,680 --> 00:08:18,600 it'll give us all this information. 160 00:08:18,600 --> 00:08:20,130 And that's also something to be aware of 161 00:08:20,130 --> 00:08:21,810 when you're trying to secure your system, 162 00:08:21,810 --> 00:08:23,550 because you know what type of information 163 00:08:23,550 --> 00:08:26,820 is vulnerable to these type of information grabs 164 00:08:26,820 --> 00:08:28,443 with specific ports being open. 165 00:08:29,310 --> 00:08:30,240 Okay, we're going to try it one more time. 166 00:08:30,240 --> 00:08:31,560 We're going to use port 21, 167 00:08:31,560 --> 00:08:33,720 which is for file transfer protocol 168 00:08:33,720 --> 00:08:35,760 and it should be blocked. 169 00:08:35,760 --> 00:08:37,530 Okay, we see that it's filtered, 170 00:08:37,530 --> 00:08:39,390 meaning that it's blocked. 171 00:08:39,390 --> 00:08:40,890 So remember also a filter doesn't mean 172 00:08:40,890 --> 00:08:43,530 that the system isn't necessarily listening for it. 173 00:08:43,530 --> 00:08:45,390 You don't know if it's open or closed, 174 00:08:45,390 --> 00:08:47,190 but we do know that something is blocking it. 175 00:08:47,190 --> 00:08:48,330 And since we have the firewall set up 176 00:08:48,330 --> 00:08:49,980 on our partner's network, 177 00:08:49,980 --> 00:08:52,350 we know that's going to default to block anything 178 00:08:52,350 --> 00:08:55,077 that's not explicitly established to go through, 179 00:08:55,077 --> 00:08:57,963 and TCP port 21 was not. 180 00:08:58,920 --> 00:09:00,090 Okay, just one more time. 181 00:09:00,090 --> 00:09:01,707 We're going to do SSH, 182 00:09:01,707 --> 00:09:06,707 and we're going to use our server zero one SSH. 183 00:09:11,486 --> 00:09:14,087 I'm going to connect to server zero two, 184 00:09:17,460 --> 00:09:19,680 just to make sure that's able to go through, okay? 185 00:09:19,680 --> 00:09:21,870 So we're still able to go through to server zero two, 186 00:09:21,870 --> 00:09:23,163 'cause we do allow SSH. 187 00:09:24,300 --> 00:09:28,410 So again, the firewall by default blocks everything, 188 00:09:28,410 --> 00:09:31,143 and it only allows what we explicitly tell it to. 189 00:09:31,980 --> 00:09:33,240 Thank you for sticking with this lesson, 190 00:09:33,240 --> 00:09:35,290 and I'll see you in the next walkthrough.