Assessment Prep
Assessment Description: For the assessment, you will be given a 3 zone network to configure that consists of:
edge01: A vyOS Firewall with three interfaces (WAN, DMZ, LAN). You will need to add an interface using vCenter. (this replaces fw01)
- IP: 10.0.17.15
- GATEWAY: 10.0.17.2
- SUBNET: 255.255.255.0
- DNS: 10.0.17.2
$Password = Read-Host -AsSecureString
New-LocalUser "david" -Password $Password -FullName "david"
Add-LocalGroupMember -Group "Administrators" -Member "david"
Rename-Computer -NewName "traveler-david" -Restart
# Install OpenSSH , does not install if "ssh" folder exists
if (!(Test-Path "C:\ProgramData\ssh\ssh_host_rsa_key")) {
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
}
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic
# Generate Keys
ssh-keygen.exe -f .\ssh-keys
sftp david@10.0.17.15:ssh-keys.pub
scp ssh-keys.pub david@172.16.50.4:travel.pub
ssh david@172.16.50.4
sudo -i
cat /home/david/travel.pub >> /home/jump-david/.ssh/authorized_keys
END
VMWare Config: adap1: WAN adap2: DMZ adap3: LAN
set system host-name 'edge01-david'
set system name-server '10.0.17.2'
set system login user vyos authentication plaintext-password [PASS HERE]
wget -O edgeconf "https://raw.githubusercontent.com/dthomsen116/SEC-350/main/edgefirewall"
configure
load edgeconf
commit
save
default-action drop
enable-default-log
rule 1:
action accept
state establised enable
rule 10:
action accept
desc: "wazuh comms w wazuhServ"
destination address 172.16.200.10
destination port 1514-1515
protocol tcp
default-action drop
enable-default-log
rule 1:
action accept
state establised enable
default-action drop
enable-default-log
rule 1:
action accept
state establised enable
rule 10:
action accept
desc: "HTTP from LAN 2 NGINX"
destination address 172.16.50.3
destination port 80
protocol tcp
rule 20:
action accept
desc: "ssh from mgmt01 2 DMZ"
destination address 172.16.50.0/29
destination port 22
protocol tcp
source address 172.16.150.10
default-action drop
enable-default-log
rule 1:
action accept
state establised enable
default-action drop
enable-default-log
rule 1:
action accept
state establised enable
rule 10:
action accept
desc: "HTTP from WAN 2 DMZ"
destination address 172.16.50.3
destination port 80
protocol tcp
rule 20:
action accept
desc: "SSH from WAN 2 DMZ"
destination address 172.16.50.4
destination port 22
protocol tcp
default-action drop
enable-default-log
rule 1:
action accept
state establised enable
address 10.0.17.115/24
desc: WAN
address 172.16.50.2/29
desc: DMZ
address 172.16.150.2/24
desc: LAN
rule 10:
desc: HTTP-2-NGINX
destination port 80
inbound interface eth0
protocol tcp
translation address 172.16.50.3
translation port 80
rule 20:
desc: WAN-2-JUMP
destination port 22
inbound interface eth0
protocol tcp
translation address 172.16.50.4
translation port 22
rule 10:
desc: NAT from DMZ-2-WAN
outbound interface eth0
source address 172.16.50.3
translation address masquerade
rule 20:
desc: NAT from LAN-2-WAN
outbound interface eth0
source address 172.16.150.0/24
translation address masquerade
rule 30:
desc: NAT from MGMT-2-WAN
outbound interface eth0
source address 172.16.200.0/28
translation address masquerade
rip:
interface eth2
network 172.16.50.0/29
static:
route 0.0.0.0/0
next hop 10.0.17.2
dns:
forwarding allow-from 172.16.50.0/29
forwarding allow-from 172.16.150.0/24
forwarding listen-address 172.16.50.2
forwarding listen-address 172.16.150.2
forwarding system
ssh:
listen address 172.16.150.2
zone WAN:
from DMZ firewall name DMZ-2-WAN
from LAN firewall name LAN-2-WAN
interface eth0
zone DMZ:
from LAN firewall name LAN-2-DMZ
from WAN firewall name WAN-2-DMZ
interface eth1
zone LAN
from DMZ firewall name DMZ-2-LAN
from WAN firewall name WAN-2-LAN
interface eth2
- IP: 172.16.50.3
- GATEWAY: 172.16.50.2
- SUBNET: 255.255.255.0
- DNS: 172.16.50.2
Example of a Netplan setup if necessary.
sudo adduser david
sudo usermod -aG sudo david
sudo hostnamectl set-hostname nginx-david
sudo apt install nginx -y
cd /var/www/html
vim index.html
davids custom page
:wq
sudo systemctl enable nginx
sudo systemctl start nginx
sudo systemctl status nginx
sudo apt install isc-dhcp-server -y
#backup
cp /etc/dhcp/dhcpd.conf /etc/dhcp/dhcpd.conf.backup
vim /etc/dhcp/dhcpd.conf
subnet 172.16.150.0 netmask 255.255.255.0 {
option routers 172.16.150.2;
option subnet-mask 255.255.255.0;
option domain-name-servers 172.16.150.2;
range 172.16.150.100 172.16.150.150;
default-lease-time 3600;
max-lease-time 14400;
}
systemctl enable dhcpd
systemctl start dhcpd
show configuration commands \| grep -v "syslog global\\|ntp\\|login\\|console\\|config\\|hw-id\\|loopback\\|conntrack"
All Linux systems should have a named sudo or administrator user.
-
useradd [user] -
passwd [user] -
usermod -aG sudo/wheel [user]