Basic network and firewall connectivity and initial testing

Basic network and firewall connectivity and initial testing

Question

Title: Basic Network and Firewall Connectivity & Initial Testing

This exercise involves building a virtual small business network to support Beta Corp’s international operations. To support. The network consists of 1) management clients, 2) enterprise clients, 3) pfSense firewalls, and 4) servers. For simplicity, the “server” required for this exercise is simply an Ubuntu desktop VM. If you can run this on an Ubuntu desktop computer, you should be able to run it on a Linux-based server as well.

In this exercise, you will configure a pfSense router/firewall to allow management clients to access the server’s management services over the network. “Regular” corporate customers have different privileges. Both access a single remote server, but in different ways. In this exercise, you will create firewall rules for your pfSense router/firewall as part of your asset protection strategy.

Beta Corporation is a small software development consulting company. Regular corporate users are on one subnet and IT department traffic is on another subnet. Both are routed through a FreeBSD router/firewall (pfSense) to a multifunctional server. This small business provides all the necessary services on a single server, so security is very important. It’s your job to properly configure your firewall so that your company’s resources are properly protected and critical services function.

Credentials:

• The default credentials for the pfSense web interface are admin:pfsense (I recommend leaving them set this way for this exercise)
• I strongly recommend that you set all other credentials to user:P@ssw0rd so that we won’t run into problems with forgotten passwords as part of this lab

This lab requires 3 Ubuntu Linux virtual machines and 1 pfSense virtual machine. Note that you will need

Internet access while you download software onto the Ubuntu machines. I recommend:

1. Downloading all required software into a single Ubuntu VM (see next page)
2. Creating a Snapshot
3. Make 2 full copies of the original Ubuntu VM for the 2nd &3rd Ubuntu VMs
4. Then… configure your NICs for the internal subnets used in the lab

Admin Client

Configure the Admin Client’s Network Settings:

• Manually set the Admin Client’s IP address, netmask, and default gateway in the “interfaces” file using the following command:

sudo nano /etc/network/interfaces 

• Your file should look like this:

auto lo

iface lo inet loopback

auto enp0s3

iface enp0s3 inet static

address 7.7.7.7/28

post-up ip route add default via 7.7.7.1

• Provide your completed Admin client interfaces file as Screenshot 1. 
• Restart the system! (to restart the networking processes) – don’t use the command to restart the networking service, it is unreliable 
• Use the ip a command to verify that your network settings are correct ip a

(you should see the network interface with the IP & netmask you set above)

• Note that we are setting a default gateway that is not yet configured on the corresponding router (we will do this later). Also be careful with the use of post-up switches. If this switch is not used, the command to set the default gateway may be executed before the network interface is operational. This is one of the wonders of multicore parallelism. Post-up switches ensure that the interface is “up” before configuring the default gateway. This is useful for various networking processes.

Use the following command to view the routing table: ip route 

• Provide your Admin client routing table (output from command above) as Screenshot 2. 
• Modify the Admin Client’s “hosts”file

sudo nano /etc/hosts

Append the following line to this file and save it 5.5.5.5 web-server

• Provide your updated hosts file as Screenshot 3. 

Corporate Client

Configure the Corporate Client’s Network Settings:

• Manually set the Corporate Client’s IP address, netmask, and default gateway in the “interfaces” file using the following command:

sudo nano /etc/network/interfaces 

• Your file should look like this:

auto lo

iface lo inet loopback

auto enp0s3

iface enp0s3 inet static

address 8.8.8.8/28

post-up ip route add default via 8.8.8.1

• Restart the system! (to restart the networking processes) – don’t use the command to restart the networking service, it is unreliable 
• Use the ip a command to verify that your network settings are correct

ip a (you should see the network interface with the IP & netmask you set above)