Category:I802 Firewalls and VPN IPSec (2017) - Revision history

Lvosandi: /* Hardware */

2017-12-11T15:11:06Z

Hardware

2017-12-07T14:42:04Z

Lectures

← Older revision		Revision as of 17:42, 7 December 2017
Line 111:		Line 111:
	* 21. sept - iptables, ebtables, packet forwarding, DNAT, SNAT, routing tables, empheral ports, listening ports, slides [https://docs.google.com/presentation/d/1XMISOg88BJ0Dy8o3r8ZL9cxFT0oZZKDqPZ2EaWJRqFQ/edit?usp=sharing here]		* 21. sept - iptables, ebtables, packet forwarding, DNAT, SNAT, routing tables, empheral ports, listening ports, slides [https://docs.google.com/presentation/d/1XMISOg88BJ0Dy8o3r8ZL9cxFT0oZZKDqPZ2EaWJRqFQ/edit?usp=sharing here]
	* 28. sept - X.509 certificates, certificate authority, TLS, symmetric, asymmetric, keyexchange, Let's Encrypt, relevant slides [https://docs.google.com/presentation/d/1kqTyhhUu5CfwODmOTIC7odhlYfeEeJALTd4RX7XhPLE/edit?usp=sharing here]		* 28. sept - X.509 certificates, certificate authority, TLS, symmetric, asymmetric, keyexchange, Let's Encrypt, relevant slides [https://docs.google.com/presentation/d/1kqTyhhUu5CfwODmOTIC7odhlYfeEeJALTd4RX7XhPLE/edit?usp=sharing here]
			* 30. nov - [https://docs.google.com/presentation/d/1aXtreUS2YD9vlsngVUSr_ZaXdrQv37zCRtc51TSGjPI/edit?usp=sharing AD auth]

	Order to be determined:		Order to be determined:
Line 117:		Line 118:
	* IPSec		* IPSec
	* TBD, there are a lot of topics to discuss		* TBD, there are a lot of topics to discuss


	==Firewall rules==		==Firewall rules==

2017-10-26T14:24:40Z

Firewall rules

← Older revision		Revision as of 17:24, 26 October 2017
Line 120:		Line 120:

	==Firewall rules==		==Firewall rules==

			You can load these rules by running iptables-restore command, pasting the rules to the terminal and pressing Ctrl-D.

			To make rules persistent on your box install netfilter-persistent package, the rules will be stored at /etc/iptables/rules.v4

	<syntaxhighlight lang="iptables">		<syntaxhighlight lang="iptables">

2017-10-19T14:33:40Z

Firewall rules

← Older revision		Revision as of 17:33, 19 October 2017
Line 140:		Line 140:
	:OUTPUT ACCEPT [0:0]		:OUTPUT ACCEPT [0:0]
	:POSTROUTING ACCEPT [0:0]		:POSTROUTING ACCEPT [0:0]
	-A POSTROUTING -o eth1 -m comment --comment "Hide VPN addresses from LAN" -j MASQUERADE		-A POSTROUTING -o eth1 -m comment --comment "Hide VPN addresses from LAN" -j MASQUERADE
	COMMIT		COMMIT

Line 154:		Line 154:
	-A INPUT -p tcp -m tcp --dport 5666 -m comment --comment "Allow Nika\'s Monitoring" -j ACCEPT		-A INPUT -p tcp -m tcp --dport 5666 -m comment --comment "Allow Nika\'s Monitoring" -j ACCEPT
	-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "Allow returning packets" -j ACCEPT		-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "Allow returning packets" -j ACCEPT
	-A FORWARD -i tun0 -eth1 -m comment --comment "Allow from VPN to LAN" -j ACCEPT		-A FORWARD -i tun0 -o eth1 -m comment --comment "Allow from VPN to LAN" -j ACCEPT
	COMMIT		COMMIT
	</syntaxhighlight>		</syntaxhighlight>

2017-10-19T14:30:42Z

Firewall rules

← Older revision		Revision as of 17:30, 19 October 2017
Line 140:		Line 140:
	:OUTPUT ACCEPT [0:0]		:OUTPUT ACCEPT [0:0]
	:POSTROUTING ACCEPT [0:0]		:POSTROUTING ACCEPT [0:0]
			-A POSTROUTING -o eth1 -m comment --comment "Hide VPN addresses from LAN" -j MASQUERADE
	COMMIT		COMMIT

Line 152:		Line 153:
	-A INPUT -p tcp -m tcp --dport 22 -m comment --comment "Allow SSH" -j ACCEPT		-A INPUT -p tcp -m tcp --dport 22 -m comment --comment "Allow SSH" -j ACCEPT
	-A INPUT -p tcp -m tcp --dport 5666 -m comment --comment "Allow Nika\'s Monitoring" -j ACCEPT		-A INPUT -p tcp -m tcp --dport 5666 -m comment --comment "Allow Nika\'s Monitoring" -j ACCEPT
			-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "Allow returning packets" -j ACCEPT
	-A FORWARD -i tun0 -eth1 -m comment --comment "Allow from VPN to LAN" -j ACCEPT		-A FORWARD -i tun0 -eth1 -m comment --comment "Allow from VPN to LAN" -j ACCEPT
	COMMIT		COMMIT
	</syntaxhighlight>		</syntaxhighlight>

2017-10-19T14:29:09Z

Firewall rules

2017-10-19T14:25:23Z

← Older revision		Revision as of 17:25, 19 October 2017
Line 117:		Line 117:
	* IPSec		* IPSec
	* TBD, there are a lot of topics to discuss		* TBD, there are a lot of topics to discuss


			==Firewall rules==

			<syntaxhighlight lang="iptables">
			*raw
			:PREROUTING ACCEPT [0:0]
			:OUTPUT ACCEPT [0:0]
			COMMIT

			*mangle
			:PREROUTING ACCEPT [0:0]
			:INPUT ACCEPT [1227947:503510401]
			:FORWARD ACCEPT [0:0]
			:OUTPUT ACCEPT [570735:77510916]
			:POSTROUTING ACCEPT [570741:77511294]
			COMMIT

			*nat
			:PREROUTING ACCEPT [0:0]
			:INPUT ACCEPT [0:0]
			:OUTPUT ACCEPT [0:0]
			:POSTROUTING ACCEPT [0:0]
			COMMIT

			*filter
			:INPUT DROP [0:0]
			:FORWARD DROP [0:0]
			:OUTPUT ACCEPT [0:0]
			-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "Allow returning packets" -j ACCEPT
			-A INPUT -i eth1 -m comment --comment "Allow traffic from LAN" -j ACCEPT
			-A INPUT -s 127.0.0.0/8 -i lo -m comment --comment "Allow loopback" -j ACCEPT
			-A INPUT -p icmp -m icmp --icmp-type 8 -m comment --comment "Allow ping" -j ACCEPT
			-A INPUT -p tcp -m tcp --dport 22 -m comment --comment "Allow SSH" -j ACCEPT
			-A INPUT -p tcp -m tcp --dport 5666 -m comment --comment "Allow Nika\'s Monitoring" -j ACCEPT
			-A FORWARD -i tun0 -eth1 -m comment --comment "Allow from VPN to LAN" -j ACCEPT
			COMMIT
			</syntaxhighlight>

2017-10-12T12:28:52Z

General information

← Older revision		Revision as of 15:28, 12 October 2017
Line 8:		Line 8:

	To register to this course send your SSH public key to Lauri and state which service you want to configure.		To register to this course send your SSH public key to Lauri and state which service you want to configure.

			Grading bot is at http://193.40.244.178/static/bot.html

	==Scenario==		==Scenario==

2017-09-28T13:03:31Z

Services

← Older revision		Revision as of 16:03, 28 September 2017
Line 75:		Line 75:
	* ns1.momcorp.eu - Primary Bind9 installation, later also add DNSSEC. Erik J		* ns1.momcorp.eu - Primary Bind9 installation, later also add DNSSEC. Erik J
	* ns2.momcorp.eu - Secondary Bind9 installation in another physical host. ???		* ns2.momcorp.eu - Secondary Bind9 installation in another physical host. ???
	* git.momcorp.eu - Gogs installation. ~~???~~		* git.momcorp.eu - Gogs installation. Farhan
	* mon.momcorp.eu - Nagios monitoring. Nika		* mon.momcorp.eu - Nagios monitoring. Nika
	* mail.momcorp.eu - Mailserver with Postfix (postfw, greylisting, dkim, spf, setup secondary mx), later with AD integration if exchange won't be used. Andris		* mail.momcorp.eu - Mailserver with Postfix (postfw, greylisting, dkim, spf, setup secondary mx), later with AD integration if exchange won't be used. Andris

2017-09-27T08:49:05Z

Hardware

← Older revision		Revision as of 11:49, 27 September 2017
Line 37:		Line 37:
	* Frank's box DELL 16GB, 2x 256GB SSD, 6 NIC (hosts 180-185)		* Frank's box DELL 16GB, 2x 256GB SSD, 6 NIC (hosts 180-185)
	* Another Sun box with 24G of RAM, dying harddisks		* Another Sun box with 24G of RAM, dying harddisks
			* Reserved addresses 186-188

	NB! Replace BIOS batteries; replace thermal paste		NB! Replace BIOS batteries; replace thermal paste