TetraWiki - User contributions [en]

Pfsense Carp

2015-07-29T13:49:49Z

Manojsemwal:

[[category:Tetra Clients]]
[[category:GSPC]]

'''CARP-SETUP-GIPL'''

[[File:Gipl_cluster.jpg]]

(Before CARP Setup Layer 2 Switching Loop needs to be eliminated by making changes in the system files , configuration changes is located at bottom of this Doc

As we have already configured pfsense firewall, now we need to make another pfsense with exact same configurations, which will serve as backup server, in case of primary pfsense goes down or failure.

In order to build backup pfsense, we are going to first download whole Configuration Backup from primary pfsense

Reference :- https://doc.pfsense.org/index.php/Configuration_Backup_and_Restore

Diagnostics > Backup/Restore, and clicking Download Configuration.

Now keep this file in safe place in your local system.

Now we are going to create backup server, just install the pfsense on backup server (already described in previous document)

After Installation Connect one machine directly to LAN port of backup server and assign IP 192.168.1.2/24 (so that we can use GUI to restore backup)

Because by default pfsense will assign LAN IP as 192.168.1.1/24 to its LAN interface

Now from your Local Machine which is connected directly to pfsense LAN interface open this link:-
https://192.168.1.1

It will load configuration panel of pfsense just skip it by clicking at the TOP of pfsense Picture on left side.

Now restoring a configuration is just as easy,

Diagnostics > Backup/Restore

Click Browse, locate the backup configuration file, and then click Restore Configuration.

Configuration files can be restored to a completely different piece of hardware without issue. If the new target hardware has different NICs

than the system where the backup was taken, a prompt will appear to re-assign the NICs after restoring the configuration

Now Wait For around 5 hours, this process will install all the packages with configurations.

Once the task is completed Change the IP’s as described in the Diagram, for wan, bridge and lan.

Now we have Two Machines Ready running Pfsense with same configurations (make sure you change the WAN, bridge, LAN IP’s on Backup Server)
We are now going to Setup CARP:-

Reference:- https://doc.pfsense.org/index.php/Configuring_pfSense_Hardware_Redundancy_%28CARP%29

One real IP address is required for every CARP cluster node. To have 2 cluster nodes, 2 IP addresses are needed for the real interfaces and then an additional IP for each CARP type virtual IP address

On the primary cluster node, add a virtual IP addresses of the CARP type in Firewall > Virtual IPs. The virtual IP addresses must fall within the same subnet of an IP address defined on a real interface

[[File:virtual_ip.jpg]]

A unique VHID must be used for each shared virtual IP address on a given interface (It is assigned automatically)
Setup a Dedicated Sync Interface

Set up each cluster Sync interface; give it an IP address in the same subnet. on the primary cluster node enter 10.0.0.1 and on the secondary cluster node enter 10.0.0.2 for the IP address. Use a /24 subnet.

Add Firewall Rules for Synchronization

Before configuring synchronization, add firewall rules to the Sync interface that will pass traffic between the nodes.
• Navigate to Firewall > Rules on the Sync interface tab

• Add a rule to pass traffic from the Sync Net to any destination.

Enable State Synchronization (pfsync)

State synchronization should be enabled on all cluster nodes.

• Navigate to System > High Avail. Sync

• Check Synchronize States

• Choose the correct Synchronize Interface for state synchronization

• If using two cluster nodes, enter the sync interface IP address for the opposing node in pfsync Synchronize Peer IP.

the primary cluster node would have 10.0.0.2 set. The secondary node would have 10.0.0.1 set.

Click Save

[[File:Sync_settings.jpg]]

Enable Configuration Synchronization (XMLRPC Sync)

Before proceeding, set the same admin user password and webConfigurator protocol (e.g. HTTPS) on each cluster node.

The configuration synchronization settings should only be enabled on the primary cluster node.

• Navigate to System > High Avail. Sync

• Enter the IP address of the secondary in Synchronize Config to IP 10.0.0.2

• Enter admin for the Remote System Username (other usernames will not work)

• Enter the Remote System Password (the password should be the same on all nodes)

• Check boxes for the desired configuration areas to sync

• Click Save
The chosen areas will synchronize to the secondary node once the settings have been saved.

Now reboot both the machines 1 by 1

Verify CARP Status

On both nodes, check Status > CARP (failover). If either system shows a button labeled Enable CARP, click it.
On that page, verify that the VIPs show the proper status. On the primary node, each VIP should show MASTER. On the secondary node, each VIP should show BACKUP.

Layer 2 Switching Loop Workaround:-
The editor is available here:
Diagnostics>Edit File. The Load/Save path is “/conf/config.xml”.

Look for these lines :-
# CARP notify hooks. This will call carpup/carpdown with the
# interface (carp0, carp1) as the first parameter.
notify 100 {
match "system" "CARP";
match "type" "MASTER";
action "/usr/local/sbin/pfSctl -c 'interface carpmaster $subsystem'";
};
notify 100 {
match "system" "CARP";
match "type" "BACKUP";
action "/usr/local/sbin/pfSctl -c 'interface carpbackup $subsystem'";
};

Modify As:-
notify 100 {
match "system" "CARP";
match "type" "MASTER";
action "'''ifconfig bridge0 up &&''' /usr/local/sbin/pfSctl -c 'interface carpmaster $subsystem'";
};

notify 100 {
match "system" "CARP";
match "type" "BACKUP";
action "'''ifconfig bridge0 down &&''' /usr/local/sbin/pfSctl -c 'interface carpbackup $subsystem'";
};

Save this file and reboot both servers 1 by 1. Make these changes before CARPSETUP.

Pfsense Carp

2015-07-29T13:48:05Z

Manojsemwal:

[[category:Tetra Clients]]
[[category:GSPC]]

'''CARP-SETUP-GIPL'''

[[File:Gipl_cluster.jpg]]

(Before CARP Setup Layer 2 Switching Loop needs to be eliminated by making changes in the system files , configuration changes is located at bottom of this Doc

As we have already configured pfsense firewall, now we need to make another pfsense with exact same configurations, which will serve as backup server, in case of primary pfsense goes down or failure.

In order to build backup pfsense, we are going to first download whole Configuration Backup from primary pfsense

Reference :- https://doc.pfsense.org/index.php/Configuration_Backup_and_Restore

Diagnostics > Backup/Restore, and clicking Download Configuration.

Now keep this file in safe place in your local system.

Now we are going to create backup server, just install the pfsense on backup server (already described in previous document)

After Installation Connect one machine directly to LAN port of backup server and assign IP 192.168.1.2/24 (so that we can use GUI to restore backup)

Because by default pfsense will assign LAN IP as 192.168.1.1/24 to its LAN interface

Now from your Local Machine which is connected directly to pfsense LAN interface open this link:-
https://192.168.1.1

It will load configuration panel of pfsense just skip it by clicking at the TOP of pfsense Picture on left side.

Now restoring a configuration is just as easy,

Diagnostics > Backup/Restore

Click Browse, locate the backup configuration file, and then click Restore Configuration.

Configuration files can be restored to a completely different piece of hardware without issue. If the new target hardware has different NICs

than the system where the backup was taken, a prompt will appear to re-assign the NICs after restoring the configuration

Now Wait For around 5 hours, this process will install all the packages with configurations.

Once the task is completed Change the IP’s as described in the Diagram, for wan, bridge and lan.

Now we have Two Machines Ready running Pfsense with same configurations (make sure you change the WAN, bridge, LAN IP’s on Backup Server)
We are now going to Setup CARP:-

Reference:- https://doc.pfsense.org/index.php/Configuring_pfSense_Hardware_Redundancy_%28CARP%29

One real IP address is required for every CARP cluster node. To have 2 cluster nodes, 2 IP addresses are needed for the real interfaces and then an additional IP for each CARP type virtual IP address

On the primary cluster node, add a virtual IP addresses of the CARP type in Firewall > Virtual IPs. The virtual IP addresses must fall within the same subnet of an IP address defined on a real interface

[[File:virtual_ip.jpg]]

A unique VHID must be used for each shared virtual IP address on a given interface (It is assigned automatically)
Setup a Dedicated Sync Interface

Set up each cluster Sync interface; give it an IP address in the same subnet. on the primary cluster node enter 10.0.0.1 and on the secondary cluster node enter 10.0.0.2 for the IP address. Use a /24 subnet.

Add Firewall Rules for Synchronization

Before configuring synchronization, add firewall rules to the Sync interface that will pass traffic between the nodes.
• Navigate to Firewall > Rules on the Sync interface tab

• Add a rule to pass traffic from the Sync Net to any destination.

Enable State Synchronization (pfsync)

State synchronization should be enabled on all cluster nodes.

• Navigate to System > High Avail. Sync

• Check Synchronize States

• Choose the correct Synchronize Interface for state synchronization

• If using two cluster nodes, enter the sync interface IP address for the opposing node in pfsync Synchronize Peer IP.

the primary cluster node would have 10.0.0.2 set. The secondary node would have 10.0.0.1 set.

Click Save

[[File:Sync_settings.jpg]]

Enable Configuration Synchronization (XMLRPC Sync)

Before proceeding, set the same admin user password and webConfigurator protocol (e.g. HTTPS) on each cluster node.

The configuration synchronization settings should only be enabled on the primary cluster node.

• Navigate to System > High Avail. Sync

• Enter the IP address of the secondary in Synchronize Config to IP 10.0.0.2

• Enter admin for the Remote System Username (other usernames will not work)

• Enter the Remote System Password (the password should be the same on all nodes)

• Check boxes for the desired configuration areas to sync

• Click Save
The chosen areas will synchronize to the secondary node once the settings have been saved.

Now reboot both the machines 1 by 1

Verify CARP Status

On both nodes, check Status > CARP (failover). If either system shows a button labeled Enable CARP, click it.
On that page, verify that the VIPs show the proper status. On the primary node, each VIP should show MASTER. On the secondary node, each VIP should show BACKUP.

Layer 2 Switching Loop Workaround:-
The editor is available here:
Diagnostics>Edit File. The Load/Save path is “/conf/config.xml”.

Look for these lines :-
# CARP notify hooks. This will call carpup/carpdown with the
# interface (carp0, carp1) as the first parameter.
notify 100 {
match "system" "CARP";
match "type" "MASTER";
action "/usr/local/sbin/pfSctl -c 'interface carpmaster $subsystem'";
};
notify 100 {
match "system" "CARP";
match "type" "BACKUP";
action "/usr/local/sbin/pfSctl -c 'interface carpbackup $subsystem'";
};

Modify As:-
notify 100 {
match "system" "CARP";
match "type" "MASTER";
action "ifconfig bridge0 up && /usr/local/sbin/pfSctl -c 'interface carpmaster $subsystem'";
};

notify 100 {
match "system" "CARP";
match "type" "BACKUP";
action "ifconfig bridge0 down && /usr/local/sbin/pfSctl -c 'interface carpbackup $subsystem'";
};

Save this file and reboot both servers 1 by 1. Make these changes before CARPSETUP.

Pfsense Carp

2015-07-29T13:45:17Z

Manojsemwal: Created page with "category:Tetra Clients category:GSPC '''CARP-SETUP-GIPL''' File:Gipl_cluster.jpg (Before CARP Setup Layer ..."

[[category:Tetra Clients]]
[[category:GSPC]]

'''CARP-SETUP-GIPL'''

[[File:Gipl_cluster.jpg]]

(Before CARP Setup Layer 2 Switching Loop needs to be eliminated by making changes in the system files , configuration changes is located at bottom of this Doc .)
As we have already configured pfsense firewall, now we need to make another pfsense with exact same configurations, which will serve as backup server, in case of primary pfsense goes down or failure.
In order to build backup pfsense, we are going to first download whole Configuration Backup from primary pfsense
Reference :- https://doc.pfsense.org/index.php/Configuration_Backup_and_Restore

Diagnostics > Backup/Restore, and clicking Download Configuration.
Now keep this file in safe place in your local system.
Now we are going to create backup server, just install the pfsense on backup server (already described in previous document)
After Installation Connect one machine directly to LAN port of backup server and assign IP 192.168.1.2/24 (so that we can use GUI to restore backup)
Because by default pfsense will assign LAN IP as 192.168.1.1/24 to its LAN interface

Now from your Local Machine which is connected directly to pfsense LAN interface open this link:-
https://192.168.1.1
It will load configuration panel of pfsense just skip it by clicking at the TOP of pfsense Picture on left side.
Now restoring a configuration is just as easy,
Diagnostics > Backup/Restore
Click Browse, locate the backup configuration file, and then click Restore Configuration.
Configuration files can be restored to a completely different piece of hardware without issue. If the new target hardware has different NICs than the system where the backup was taken, a prompt will appear to re-assign the NICs after restoring the configuration
Now Wait For around 5 hours, this process will install all the packages with configurations.
Once the task is completed Change the IP’s as described in the Diagram, for wan, bridge and lan.

Now we have Two Machines Ready running Pfsense with same configurations (make sure you change the WAN, bridge, LAN IP’s on Backup Server)
We are now going to Setup CARP:-
Reference:- https://doc.pfsense.org/index.php/Configuring_pfSense_Hardware_Redundancy_%28CARP%29
One real IP address is required for every CARP cluster node. To have 2 cluster nodes, 2 IP addresses are needed for the real interfaces and then an additional IP for each CARP type virtual IP address
On the primary cluster node, add a virtual IP addresses of the CARP type in Firewall > Virtual IPs. The virtual IP addresses must fall within the same subnet of an IP address defined on a real interface

[[File:virtual_ip.jpg]]

A unique VHID must be used for each shared virtual IP address on a given interface (It is assigned automatically)
Setup a Dedicated Sync Interface
Set up each cluster Sync interface; give it an IP address in the same subnet. Example: on the primary cluster node enter 10.0.0.1 and on the secondary cluster node enter 10.0.0.2 for the IP address. Use a /24 subnet.

Add Firewall Rules for Synchronization
Before configuring synchronization, add firewall rules to the Sync interface that will pass traffic between the nodes.
• Navigate to Firewall > Rules on the Sync interface tab
• Add a rule to pass traffic from the Sync Net to any destination.
Enable State Synchronization (pfsync)
State synchronization should be enabled on all cluster nodes.
• Navigate to System > High Avail. Sync
• Check Synchronize States
• Choose the correct Synchronize Interface for state synchronization
• If using two cluster nodes, enter the sync interface IP address for the opposing node in pfsync Synchronize Peer IP.
Using the above example, the primary cluster node would have 10.0.0.2 set. The secondary node would have 10.0.0.1 set. Click Save

[[File:Sync_settings.jpg]]

Enable Configuration Synchronization (XMLRPC Sync)
Before proceeding, set the same admin user password and webConfigurator protocol (e.g. HTTPS) on each cluster node.
The configuration synchronization settings should only be enabled on the primary cluster node.
• Navigate to System > High Avail. Sync
• Enter the IP address of the secondary in Synchronize Config to IP 10.0.0.2
• Enter admin for the Remote System Username (other usernames will not work)
• Enter the Remote System Password (the password should be the same on all nodes)
• Check boxes for the desired configuration areas to sync
• Click Save
The chosen areas will synchronize to the secondary node once the settings have been saved.
Now reboot both the machines 1 by 1
Verify CARP Status
On both nodes, check Status > CARP (failover). If either system shows a button labeled Enable CARP, click it.
On that page, verify that the VIPs show the proper status. On the primary node, each VIP should show MASTER. On the secondary node, each VIP should show BACKUP.

Layer 2 Switching Loop Workaround:-
The editor is available here:
Diagnostics>Edit File. The Load/Save path is “/conf/config.xml”.

Look for these lines :-
# CARP notify hooks. This will call carpup/carpdown with the
# interface (carp0, carp1) as the first parameter.
notify 100 {
match "system" "CARP";
match "type" "MASTER";
action "/usr/local/sbin/pfSctl -c 'interface carpmaster $subsystem'";
};
notify 100 {
match "system" "CARP";
match "type" "BACKUP";
action "/usr/local/sbin/pfSctl -c 'interface carpbackup $subsystem'";
};

Modify As:-
notify 100 {
match "system" "CARP";
match "type" "MASTER";
action "ifconfig bridge0 up && /usr/local/sbin/pfSctl -c 'interface carpmaster $subsystem'";
};

notify 100 {
match "system" "CARP";
match "type" "BACKUP";
action "ifconfig bridge0 down && /usr/local/sbin/pfSctl -c 'interface carpbackup $subsystem'";
};

Save this file and reboot both servers 1 by 1. Make these changes before CARPSETUP.

File:Sync settings.jpg

2015-07-29T13:02:32Z

Manojsemwal:

File:Virtual ip.jpg

2015-07-29T13:02:11Z

Manojsemwal:

File:Gipl cluster.jpg

2015-07-29T13:01:20Z

Manojsemwal:

Pahwa Bryair Zimbra

2015-07-29T12:49:35Z

Manojsemwal:

[[category:Pahwa Group]]
'''Pahwa New Architecture'''

[[File:Pahwa 01.jpg]]

Installation :-

On IMSS server :-
//Install Postfix
Yum install postfix

// Install Trend IMSS
Download IMSS_v7.1_Linux_1224_r2.tar.gz for
Untar the file and run the installation script :-
./ isinst.sh
Press y when ask for installation and confirm .
It will ask for database server to install locally , press y and proceed .

Postfix Configuration.
cd /etc/postfix

#vim main.cf

//insert following entry

mydomain = pahwa.com
myhostname = imss.pahwa.com
mydestination = $myhostname, localhost.$mydomain, $mydomain
default_process_limit=200
imss_timeout=10m
imss_connect_timeout=1s
content_filter = imss:localhost:10025
imss_destination_recipient_limit=200
imss_destination_concurrency_limit=200

smtpd_client_restrictions =
permit_mynetworks,
reject_rbl_client bl.spamcop.net,
reject_rbl_client b.barracudacentral.org,
reject_rbl_client cbl.abuseat.org,
reject_rbl_client dnsbl.sorbs.net,
permit

disable_vrfy_command = yes
smtpd_recipient_restrictions =
check_recipient_access hash:/etc/postfix/recipient_domains, permit_mynetworks, permit_sasl_authenticated,
reject_unverified_recipient,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_unauth_destination,
reject_unauth_pipelining,
reject

smtpd_sender_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
check_sender_access hash:/etc/postfix/sender_access
reject_unknown_sender_domain

mynetworks = 127.0.0.1, 192.168.0.5, 192.168.0.254, 192.168.0.2

//For recipent restriction

#vim recipient_domains
//Make Entry :-

pahwa.com OK

//Now Postmap command to make db

#postmap recipient_domains

//For Sender restriction
#vim /etc/postfix/sender_access

pahwa.com REJECT

postmaster@imss.pahwa.com REJECT

#postmap sender_access

//Also Edit master.cf

#vim master.cf

//IMSS: content filter smtp transport imss for IMSS
imss unix - - n - - smtp
-o disable_dns_lookups=yes
-o smtp_connect_timeout=$imss_connect_timeout
-o smtp_data_done_timeout=$imss_timeout
//IMSS: content filter loop back smtpd
localhost:10026 inet n - n - 200 smtpd
-o content_filter=
-o smtpd_timeout=$imss_timeout
-o local_recipient_maps=
-o myhostname=postfix.imss71
-o smtpd_client_restrictions=
-o smtpd_enforce_tls=no

//IMSS Configuration Via Graphical Panel :-
All the configurations are done by IT team of Pahwa like filters and rules for AV/AS .
we have defined :-

IMSS configuration -> SMTP Routing -> Domain-based delivery

Domain IP Port
pahwa.com 192.168.0.2 25

Fetch mail is also configured on this server, to download mails from mx2 in case of failure of mx1
http://192.168.1.15/wiki/index.php/Fetchmail
Configuration of fetch mail was downloaded from old server

DRBD and HEARTBEAT configuration:-

Step :1 Download EPEL and ELRepo (epel is for heartbeat and elrepo is for DRBD)
# rpm -Uvh http://elrepo.org/elrepo-release-6-4.el6.elrepo.noarch.rpm
vi /etc/yum.repos.d/elrepo.repo
enabled=0
# yum --enablerepo=elrepo install drbd83-utils kmod-drbd83
rpm -Uvh http://download.fedora.redhat.com/pub/epel/6/x86_64/epel-release-6-5.noarch.rpm
# vi /etc/yum.repos.d/epel.repo
enabled=0
# yum --enablerepo=epel install heartbeat

Same configyration in Node1 and Node2

vim /etc/hosts
192.168.0.5 node1.pahwa.com node1
192.168.0.2 mail21c.pahwa.com mail21c
node2.pahwa.com need to be added later

#mv /etc/drbd.d/global_common.conf /etc/drbd.d/global_common.sample
and create a new file:

# vi /etc/drbd.d/global_common.conf
global { usage-count no; }
common {
syncer { rate 100M; }
}

Create a new resource file that I called “main”, on both servers they have to be equal:
# vi /etc/drbd.d/main.res
resource main {
protocol C;
startup { wfc-timeout 0; degr-wfc-timeout 120; }
disk { on-io-error detach; }
on node1.pahwa.com {
device /dev/drbd0;
disk /dev/vg_pahwa/LogVol01;
meta-disk internal;
address 10.0.0.1:7788;
on node2.pahwa.com {
device /dev/drbd0;
disk /dev/vg_pahwa/LogVol01;
meta-disk internal;
address 10.0.0.2:7788;

Now we have to create the metadata on both servers:
#dd if=/dev/zero of= /dev/vg_home1 bs=1M count=50
drbdadm create-md main (run on node1)
drbdadm create-md main (run on node2)
node 2 is not configured yet and need to be configured.

[root@node1 drbd.d]# service drbd start
Starting DRBD resources: [ d(main) s(main) n(main) ].

We will tell DRBD that server1 is the Primary server:
On node1:
# drbdsetup /dev/drbd0 primary -o

On node1:
# mkfs.ext4 /dev/drbd0
Now DRBD is configured , now you ready to mount your /dev/drbd0 to /opt
On Node1
# mount –t ext4 /dev/drbd0 /opt

We will install heartbeat from the EPEL repository:
# rpm -Uvh http://download.fedora.redhat.com/pub/epel/6/x86_64/epel-release-6-5.noarch.rpm
# vi /etc/yum.repos.d/epel.repo
enabled=0
# yum --enablerepo=epel install heartbeat

Create the following file on both servers with the exact same content:
# vi /etc/ha.d/ha.cf
keepalive 2
deadtime 30
bcast eth0
node node1.pahwa.com node2.pahwa.com

The next setp is to create the resource file for heartbeat on both servers with exact same content again:
# vi /etc/ha.d/haresources
node1.pahwa.com IPaddr::192.168.0.2/24/eth0 drbddisk::main Filesystem::/dev/drbd0::/opt::ext4 zimbra

# first word is the hostname of the primary server then the IP 192.168.0.2 is the one I choose to be the virtual IP to be moved to the slave in case of a failure.
The last thing is to create the authentication file on both servers again with the same content:
# vi /etc/ha.d/authkeys
auth 3

3 md5 asd1234f

This password file should only be readable by the root user:
# chmod 600 /etc/ha.d/authkeys

Need To Configure Same settings on node2.pahwa.com which will be provided later by Client.
Currently IP Alias is Added Directly on eth0 for node1.pahwa.com

Zimbra Installation On node1.pahwa.com:-

Download zcs-8.6.0_GA_1153.RHEL6_64.20141215151155.tgz and untar the compressed file .

#cd zcs-8.6.0_GA_1153.RHEL6_64.20141215151155

now inside this directory run install.sh

./install.sh --platform-override

now follow the onscreen instructions and install zimbra .

Do not install zimbra-proxy and zimbra-memcahce , Just press [N] while setup prompts for install .

After Successful Installation we need to create users which was provided by IT team of pahwa with passwords .

//script location /root/Desktop/scripts

zmprov < /PATH_of_script

Now we want all external mails to go via IMSS server so we have Defined External Relay IP under Global Config via
Admin Panel as 192.168.0.10:25

Pahwa Bryair Zimbra

2015-07-29T12:47:42Z

Manojsemwal: Created page with " '''Pahwa New Architecture''' File:Pahwa 01.jpg Installation :- On IMSS server :- //Install Postfix Yum install..."

'''Pahwa New Architecture'''

[[File:Pahwa 01.jpg]]

Installation :-

On IMSS server :-
//Install Postfix
Yum install postfix

// Install Trend IMSS
Download IMSS_v7.1_Linux_1224_r2.tar.gz for
Untar the file and run the installation script :-
./ isinst.sh
Press y when ask for installation and confirm .
It will ask for database server to install locally , press y and proceed .

Postfix Configuration.
cd /etc/postfix

#vim main.cf

//insert following entry

mydomain = pahwa.com
myhostname = imss.pahwa.com
mydestination = $myhostname, localhost.$mydomain, $mydomain
default_process_limit=200
imss_timeout=10m
imss_connect_timeout=1s
content_filter = imss:localhost:10025
imss_destination_recipient_limit=200
imss_destination_concurrency_limit=200

smtpd_client_restrictions =
permit_mynetworks,
reject_rbl_client bl.spamcop.net,
reject_rbl_client b.barracudacentral.org,
reject_rbl_client cbl.abuseat.org,
reject_rbl_client dnsbl.sorbs.net,
permit

disable_vrfy_command = yes
smtpd_recipient_restrictions =
check_recipient_access hash:/etc/postfix/recipient_domains, permit_mynetworks, permit_sasl_authenticated,
reject_unverified_recipient,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_unauth_destination,
reject_unauth_pipelining,
reject

smtpd_sender_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
check_sender_access hash:/etc/postfix/sender_access
reject_unknown_sender_domain

mynetworks = 127.0.0.1, 192.168.0.5, 192.168.0.254, 192.168.0.2

//For recipent restriction

#vim recipient_domains
//Make Entry :-
pahwa.com OK

//Now Postmap command to make db

#postmap recipient_domains

//For Sender restriction
#vim /etc/postfix/sender_access

pahwa.com REJECT
postmaster@imss.pahwa.com REJECT

#postmap sender_access

//Also Edit master.cf

#vim master.cf

//IMSS: content filter smtp transport imss for IMSS
imss unix - - n - - smtp
-o disable_dns_lookups=yes
-o smtp_connect_timeout=$imss_connect_timeout
-o smtp_data_done_timeout=$imss_timeout
//IMSS: content filter loop back smtpd
localhost:10026 inet n - n - 200 smtpd
-o content_filter=
-o smtpd_timeout=$imss_timeout
-o local_recipient_maps=
-o myhostname=postfix.imss71
-o smtpd_client_restrictions=
-o smtpd_enforce_tls=no

//IMSS Configuration Via Graphical Panel :-
All the configurations are done by IT team of Pahwa like filters and rules for AV/AS .
we have defined :-

IMSS configuration -> SMTP Routing -> Domain-based delivery

Domain IP Port
pahwa.com 192.168.0.2 25

Fetch mail is also configured on this server, to download mails from mx2 in case of failure of mx1
http://192.168.1.15/wiki/index.php/Fetchmail
Configuration of fetch mail was downloaded from old server

DRBD and HEARTBEAT configuration:-

Step :1 Download EPEL and ELRepo (epel is for heartbeat and elrepo is for DRBD)
# rpm -Uvh http://elrepo.org/elrepo-release-6-4.el6.elrepo.noarch.rpm
vi /etc/yum.repos.d/elrepo.repo
enabled=0
# yum --enablerepo=elrepo install drbd83-utils kmod-drbd83
rpm -Uvh http://download.fedora.redhat.com/pub/epel/6/x86_64/epel-release-6-5.noarch.rpm
# vi /etc/yum.repos.d/epel.repo
enabled=0
# yum --enablerepo=epel install heartbeat

Same configyration in Node1 and Node2

vim /etc/hosts
192.168.0.5 node1.pahwa.com node1
192.168.0.2 mail21c.pahwa.com mail21c
node2.pahwa.com need to be added later

#mv /etc/drbd.d/global_common.conf /etc/drbd.d/global_common.sample
and create a new file:

# vi /etc/drbd.d/global_common.conf
global { usage-count no; }
common {
syncer { rate 100M; }
}

Create a new resource file that I called “main”, on both servers they have to be equal:
# vi /etc/drbd.d/main.res
resource main {
protocol C;
startup { wfc-timeout 0; degr-wfc-timeout 120; }
disk { on-io-error detach; }
on node1.pahwa.com {
device /dev/drbd0;
disk /dev/vg_pahwa/LogVol01;
meta-disk internal;
address 10.0.0.1:7788;
on node2.pahwa.com {
device /dev/drbd0;
disk /dev/vg_pahwa/LogVol01;
meta-disk internal;
address 10.0.0.2:7788;

Now we have to create the metadata on both servers:
#dd if=/dev/zero of= /dev/vg_home1 bs=1M count=50
drbdadm create-md main (run on node1)
drbdadm create-md main (run on node2)
node 2 is not configured yet and need to be configured.

[root@node1 drbd.d]# service drbd start
Starting DRBD resources: [ d(main) s(main) n(main) ].

We will tell DRBD that server1 is the Primary server:
On node1:
# drbdsetup /dev/drbd0 primary -o

On node1:
# mkfs.ext4 /dev/drbd0
Now DRBD is configured , now you ready to mount your /dev/drbd0 to /opt
On Node1
# mount –t ext4 /dev/drbd0 /opt

We will install heartbeat from the EPEL repository:
# rpm -Uvh http://download.fedora.redhat.com/pub/epel/6/x86_64/epel-release-6-5.noarch.rpm
# vi /etc/yum.repos.d/epel.repo
enabled=0
# yum --enablerepo=epel install heartbeat

Create the following file on both servers with the exact same content:
# vi /etc/ha.d/ha.cf
keepalive 2
deadtime 30
bcast eth0
node node1.pahwa.com node2.pahwa.com

The next setp is to create the resource file for heartbeat on both servers with exact same content again:
# vi /etc/ha.d/haresources
node1.pahwa.com IPaddr::192.168.0.2/24/eth0 drbddisk::main Filesystem::/dev/drbd0::/opt::ext4 zimbra

# first word is the hostname of the primary server then the IP 192.168.0.2 is the one I choose to be the virtual IP to be moved to the slave in case of a failure.
The last thing is to create the authentication file on both servers again with the same content:
# vi /etc/ha.d/authkeys
auth 3

3 md5 asd1234f

This password file should only be readable by the root user:
# chmod 600 /etc/ha.d/authkeys

Need To Configure Same settings on node2.pahwa.com which will be provided later by Client.
Currently IP Alias is Added Directly on eth0 for node1.pahwa.com

Zimbra Installation On node1.pahwa.com:-

Download zcs-8.6.0_GA_1153.RHEL6_64.20141215151155.tgz and untar the compressed file .

#cd zcs-8.6.0_GA_1153.RHEL6_64.20141215151155

now inside this directory run install.sh

./install.sh --platform-override

now follow the onscreen instructions and install zimbra .

Do not install zimbra-proxy and zimbra-memcahce , Just press [N] while setup prompts for install .

After Successful Installation we need to create users which was provided by IT team of pahwa with passwords .

//script location /root/Desktop/scripts

zmprov < /PATH_of_script

Now we want all external mails to go via IMSS server so we have Defined External Relay IP under Global Config via
Admin Panel as 192.168.0.10:25

2015-04-16T10:44:56Z

Manojsemwal:

<center>'''PF Sense Firewall Implementation at GIPL , GandhiNagar '''</center>

== Table of Contents ==
[#__RefHeading__2322_1445225205 NETWORK DIAGRAM2]

[#__RefHeading__2324_1445225205 Performing a Full Install (LiveCD)3]

[#__RefHeading__2326_1445225205 GUI Configuration Setup8]

[#__RefHeading__2328_1445225205 Configuration Of Bridge Interface13]

[#__RefHeading__2330_1445225205 Assign Virtual IP’s To LAN interface:-15]

[#__RefHeading__2332_1445225205 Configuration of SNORT17]

[#__RefHeading__2334_1445225205 Add Snort to an interface20]

[#__RefHeading__2336_1445225205 Select which types of rules will protect the network22]

[#__RefHeading__2338_1445225205 IP Alias and Port Alias24]

[#__RefHeading__2340_1445225205 Firewall Rules :-27]

[#__RefHeading__2342_1445225205 Configuration Of Squid and Squidguard:-31]

[#__RefHeading__2344_1445225205 Configuration of SARG:-39]

[#__RefHeading__2346_1445225205 Configuration Of Bandwidthd:-42]

[#__RefHeading__2348_1445225205 Configuration Of ntopng:-44]

[#__RefHeading__2350_1445225205 Configuring OpenVPN46]

[#__RefHeading__2352_1445225205 Certificate Authority47]

[#__RefHeading__2354_1445225205 Server Certificate48]

[#__RefHeading__2356_1445225205 Firewall Rules54]

[#__RefHeading__2358_1445225205 End of the Wizard54]

[#__RefHeading__2360_1445225205 Adding a User with a Certificate54]

[#__RefHeading__2362_1445225205 Installing the OpenVPN Client Export Package57]

[#__RefHeading__2364_1445225205 Exporting a Configuration57]

[#__RefHeading__2366_1445225205 Firewall Logs60]

[#__RefHeading__2368_1445225205 Setup Log File Location61]

[#__RefHeading__2370_1445225205 Enable Module and UDP Protocol61]

[#__RefHeading__2372_1445225205 Restart Rsyslog61]= NETWORK DIAGRAM =
[[Image:Gpil-000.jpg]]

'''Installation'''

'''pfSense''' is an open source firewall/router computer software distribution based on FreeBSD. It is installed on a computer to make a dedicated firewall/router for a network and is noted for its reliability[1] and offering features often only found in expensive commercial firewalls

'''Download pfSense'''

Visit https://www.pfsense.org/download/mirror.php?section=downloads

'''''Step 1 :- '''''

== Performing a Full Install (LiveCD) ==
Power on the target system and connect the install media: Place the CD into the drive or plug the Memstick into a USB port. If the BIOS is set to boot from CD/USB, pfSense will start.

[[Image:Gpil-001.jpeg]]

As the operating system boots and pfSense starts, a prompt is presented with some choices and a countdown timer. At this prompt, press ''i'' to invoke the installer now.

When the installer detects multiple disks in the system the first screen available provides the option '''Setup GEOM Mirror'''. Choose that option, pick the primary disk, the disk to use for the mirror copy, and then proceed with the installation as normal.

The Quick/Easy install choice will target the GEOM mirror automatically

[[Image:Gpil-002.jpeg]]

At the '''Select Task''' prompt, choose ''Quick/Easy Install''. [[Image:]]

[[Image:Gpil-003.jpeg]]

The install will proceed, wiping the target disk and installing pfSense. Copying files may take some time to finish.

After the files have been copied to the target disk, a choice is presented to select the console type. ''Standard'' defaults to the VGA console. ''Embedded'' defaults to serial console

[[Image:Gpil-004.jpeg]]

Now the system must reboot so that pfSense may start from the target disk. Select ''Reboot'' and then press '''Enter (remove CD from Drive)'''

[[Image:Gpil-005.jpeg]]

After the system reboots, pfSense will be running from the target disk. The next step is to Assign Interfaces on the Console below.

[[Image:Gpil-006.jpeg]]

After installation and assignment, a shell menu is presented on the console with a number of options. pfSense now is ready to be accessed via the network, LAN interface IP 192.168.1.1 is assigned by default.

Open a web browser and navigate to https://192.168.1.1/, using the default username admin and password pfsense to login.

The first visit to the WebGUI will be redirected to the setup wizard.

== GUI Configuration Setup ==
Once The Setup is launched, Fill the details are follows:-

[[Image:Gpil-007.jpeg]]

We have defined FQDN as gipl.firewall

DNS servers:- 8.8.8.8 and 4.4.2.2 Global DNS

Click NEXT

[[Image:Gpil-008.jpg]]

Select The Time-Zone as Asia/Kolkata .

And Click NEXT

[[Image:Gpil-009.jpg]]

Here we have Set WAN as Static Interface

With IP address :- 203.77.200.91/25

Gateway :- 203.77.200.1

Click Next.

[[Image:Gpil-010.jpg]]

Here we have Configured LAN interface with IP address 192.168.45.101/24

Click Next.

( note:-As per the client Network Topology , Lan interface have multiple Subnets configured , so we will be configuring Virtual IP’s from GUI )

After Setting Admin Password, Page will be redirected to Pfsense-Dashboard.

[[Image:Gpil-011.jpg]]

We Have Changed Default Port from 443 to 8080 Via :-

'''System > Advanced'''
[[Image:Gpil-012.jpg]]

Change TCP Port from Default 443 to 8080 .
[[Image:Gpil-013.jpg]]
Save .

Now pfsense Can be accessed via [https://IP:8080 https://IP:8080]

IP Address of Firewall is 203.77.200.91 on WAN interface.

Go to :- interface > assign , and edit Opt1 as DMZ , do not assign IP address to This interface , because we will be creating bridge interface .

== Configuration Of Bridge Interface ==
Now we have to configure '''Interface Bridges''' in order to Setup Pfsense in

Transparent mode.

Reference:- https://doc.pfsense.org/index.php/Interface_Bridges

Navigate To :- Interfaces > (assign)

on the Bridges tab Click “ +” symbol to add a new bridge .

Ctrl-Click to select the Member interfaces from the list of available interfaces and type a Description , we have selected WAN + DMZ as bridge0 and create new Interface BRIDGEINTERFACE using bridge0 .

[[Image:Gpil-014.jpg]]

By default, traffic is filtered on the member interfaces and not on the bridge interface itself. This behavior may be changed by toggling the values of '''net.link.bridge.pfil_member''' and net.link.bridge.pfil'''_bridge '''under System''' > Advanced '''on the '''System Tunables''' tab. With them set at ''0'' and ''1'', respectively, then filtering would be performed on the bridge only.

[[Image:Gpil-015.jpg]]

'''Now Pfsense is Configured In Bridge Mode with '''

'''WAN interface: - 203.77.200.91/25 gateway :- 203.77.200.1'''

'''LAN interface:- 192.168.45.101/24'''

'''DMZ: - no ip '''

'''BRIDGEINTERFACE:- 203.77.200.92/25'''

[[Image:Gpil-016.jpg]]

== Assign Virtual IP’s To LAN interface:- ==
[[Image:Gpil-018.jpg]]
Now as LAN environment have multiple Subnet configured, we will be assigning Virtual IP address to LAN interface.

[[Image:Gpil-017.jpg]]

Clients on LAN Environment have their Gateway Set from These Virtual IP’s.

203.77.196.230 is added for outside access of Local Servers 203.77.192.49/28.

(203.77.196.230) is configured in 203.77.192.2 switch which will receive any packet for 203.77.192.49/28 from Outside and send it to 203.77.196.230.

== Configuration of SNORT ==
'''Reference''' :- '''https://doc.pfsense.org/index.php/Setup_Snort_Package'''

Go to the '''Available Packages''' tab under the '''System''' menu and install the snort package.

 When the installation completes, click on '''Snort''' under the '''Services''' menu.  This will open the Snort main setup page.

Click the '''Global Settings''' tab and perform the following At the top of the page you have three choices for Rule Sets to activate.

Put Check mark on :-Install '''Snort Community''' rules , Install '''Emerging Threats''' rules , Install '''Snort VRT''' rules. And save.

The '''Updates''' tab is used to check the status of downloaded rules packages and to download new updates. The table shows the available rule packages and their current status [[Image:Gpil-019.jpg]]

Click Update Button to Update the rules.
[[Image:Gpil-020.jpeg]]

== Add Snort to an interface ==
Click the Snort Interfaces tab and then the "+" icon to add a new Snort interface.

 On the '''WAN Settings''' tab, click the ''Enable'' checkbox.In the drop-down, choose the interface.  The WAN interface is the default and is a good first choice.In the ''Description'' textbox, enter a name (WAN again, is fine here).Click the checkbox to "''Send alerts to the main System logs''".leave the other settings at their defaults

[[Image:Gpil-021.jpg]]

After saving, the browser will be returned to the Snort Interfaces tab. Note the warning icons in the image below showing no rules have been selected for the new Snort interface. Those rules will be configured next. Click the "e" icon to edit the new Snort interface again

[[Image:Gpil-024.jpeg]]

== Select which types of rules will protect the network ==
Click the '''Categories''' tab for the new interface

Check [https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=GPLv2_community.rules Snort GPLv2 Community Rules (VRT certified)] Box .

And Manual Rules :-

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-botcc.rules emerging-botcc.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_blacklist.rules snort_blacklist.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_exploit-kit.so.rules snort_exploit-kit.so.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_ddos.rules snort_ddos.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_dos.rules snort_dos.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_exploit-kit.rules snort_exploit-kit.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-malware.rules emerging-malware.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-mobile_malware.rules emerging-mobile_malware.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-tor.rules emerging-tor.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-trojan.rules emerging-trojan.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_malware-backdoor.rules snort_malware-backdoor.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_virus.rules snort_virus.rules]

[[Image:Gpil-023.jpg]]

Click SAVE when finished to save the selection and build the rules

After that restart the service

[[Image:Gpil-024.jpg]]

'''Managing Pass lists:-'''

'''Pass Lists are lists of IP addresses that Snort should never block. These may be created and managed on the Pass Lists tab. When an IP address is listed on a Pass List, Snort will never insert a block on that address even when malicious traffic is detected.'''

'''To create a new Pass List, click "+". To edit an existing Pass List, click the "e". To delete a Pass List, click "x". Note that a Pass List may not be deleted if it is currently assigned to one or more Snort interfaces.'''

We have added GIPL IP’s in Pass list . i.e''' 203.77.192.0/20'''

[[Image:Gpil-025.jpg]]

== IP Alias and Port Alias ==
IP aliases allow you to create a group of IP addresses that you can assign by group name instead of specifying each IP address individually. This can be great for specifying a group of servers that need ssh access and then in the firewall rules you can create a rule that allows ssh traffic for the ssh servers group.

Along the top menu hover over Firewall and click on Aliases.

[[Image:Gpil-026.jpg]]

The next tab is for setting up Port Aliases.  Similar to the IP Aliases you can setup groups but on this tab you are creating groups of ports instead of IP addresses.

[[Image:Gpil-027.jpg]]

IP Aliases Created.

[[Image:Gpil-028.jpeg]]

PORT ALIAS CREATED

[[Image:Gpil-029.jpg]]

== Firewall Rules :- ==
Reference:- [https://doc.pfsense.org/index.php/Firewall_Rule_Basics https://doc.pfsense.org/index.php/Firewall_Rule_Basics]

Firewall rules control what traffic is allowed to enter an interface on the firewall. Once traffic is passed on the interface it enters an entry in the state table is created. A state table entry allows through subsequent packets that are part of that connection.

Firewall rules are managed at Firewall > Rules. Multiple rules may be selected for some actions by clicking on their row or checking the box at the start of their row. Rules may be deleted or reordered in bulk in this way. See Managing Lists of Items on pfSense for more information on the meaning of the icons when manipulating rules.

* '''any''' - ''0.0.0.0'' to ''255.255.255.255'', or all IPv6 addresses
* '''Single host or alias''' - Select this and enter one IP address (''1.2.3.4'', ''aa:bb:cc:dd::1'') or type the name of an Alias that has already been configured ('''Firewall > Aliases''')
* '''Network''' - Select this and enter a network and mask (''10.99.0.0/16'', ''aa:bb:cc:dd::0/64'')
* '''LAN net''' - The subnet configured on the LAN interface under '''Interfaces > LAN'''. On pfSense 2.2+, this also includes static route networks on that interface.
* '''LAN address''' - The IP address configured on the LAN interface under '''Interfaces > LAN'''
* '''zzz Net''' / '''zzz address''' - Works the same as LAN above but for other interfaces (WAN, OPT1, OPT2, etc.)
* '''PPTP clients''' - Automatically locate and use the addresses of PPTP clients
* '''L2TP clients''' - Automatically locate and use the addresses of L2TP clients
* '''This Firewall (self)''' - Any IP address assigned to any interface on this firewall (pfSense 2.2+)

Firewall rules are generally processed starting with Floating Rules, then Interface Group rules, then Interface tab rules

Rules Created on bridge interface, for DMZ access

[[Image:Gpil-030.jpg]]

[[Image:Gpil-031.jpg]]

'''LAN interface Rules Created:-'''

[[Image:Gpil-032.jpg]]

== Configuration Of Squid and Squidguard:- ==
'''Reference - '''[https://doc.pfsense.org/index.php/SquidGuard_package https://doc.pfsense.org/index.php/SquidGuard_package]

Login to your pfsense's Web Administrator, and click on "Server -> Packages", scroll down the list and find squid and click on "+" button to install, wait for the process to finish then return to the packages section and look for squidguard and install that package as well.

[[Image:Gpil-033.jpg]]

Now go to "Services" menu and look for Proxy Server & Proxy Filter

[[Image:Gpil-034.jpg]]

(We are setting up the proxy server as a transparent proxy)

Click on Services -> Proxy Server.

On the General Tab, you want to set the following settings, the Proxy Interface Option should be set to "LAN", to set up transparent proxy server, tick the "Transparent Proxy" check box.

[[Image:Gpil-035.jpg]]

Tick the "Enabled Logging" Checkbox, set the log store to the default location " /var/squid/logs " rotate your logs every 30 days, set your proxy port to port number 3128 We have By-passed Proxy for 203.77.192.49/28, These are the Local Servers.

Next click on the "Cache Mgmt." tab, by default the Hard Disk Cache Size is set to 100mb, we have allocated 100GB , Memory Cache Size 3072 .

[[Image:Gpil-036.jpg]]

Click on Save.

Click on the Access Control Tab next, in the allowed subnets field type in your required subnets. As we have multiple Subnets, so we are going to define all.

[[Image:Gpil-037.jpg]]

'''203.77.201.129/29'''

'''10.1.224.1/24'''

'''203.77.192.49/28'''

'''203.77.206.57/29'''

'''203.77.206.17/29'''

'''203.77.201.137/29'''

'''10.33.50.1/27'''

Click On Save

Now that’s is the proxy server configured, next we are going to configure SquidGuard, click on the Services menu and select the Proxy Filter button, tick the following 3 check boxes "Enable", "Enable GUI Log" and "Enable Log" then click the Save button, once the page has reloaded click on apply and then confirm that the Squidguard service is running by making sure the SquidGuard status is set to STARTED.

[[Image:Gpil-038.jpg]]

Click on the Black list tab and add URL '''http://www.shallalist.de/Downloads/shallalist.tar.gz''' to the Update Address and click on Download. Wait for the process to complete.

[[Image:Gpil-039.jpg]]

[[Image:Gpil-040.jpg]]

'''Now we can set up common ACL’s'''

[[Image:Gpil-041.jpg]]

[[Image:Gpil-042.jpg]]

'''Click on Save and restart the Squid and SquidGuard from Services. '''

== Configuration of SARG:- ==
After Installing SARG package, we can configure SARG from Status > Sarg Reports

[[Image:Gpil-043.jpg]]

Select Proxy Servers as SQUID proxy . And leave Rest of Field set to Default

And Save.

'''Now Go to Next Tab Schedule'''

Click “+” Symbol to create new schedule

[[Image:Gpil-044.jpg]]

'''Reports can be viewed From “View Reports”'''

[[Image:Gpil-045.jpg]]

== Configuration Of Bandwidthd:- ==
After Installing Package '''bandwidthd''' , Configuration can be done via

Services > bandwidthd

[[Image:Gpil-046.jpg]]

[[Image:Gpil-047.jpg]]

Enable Bandwidthd by checking the BOX.

Now Select the Interface: - LAN.

Enter The Subnets from LAN interface.

Click Save and Restart bandwidthd service from Services.

Now Bandwidthd can be accessed:-

[https://203.77.200.91:8080/bandwidthd/index.html https://203.77.200.91:8080/bandwidthd/index.html]

== Configuration Of ntopng:- ==
After installing ntopng package, it appears under Diagnostics > ntopng. It will even track where connections were made by local PCs, and how much bandwidth was used on individual connections.

[[Image:Gpil-048.jpg]]

First we have to configure ntopng settings. Via Diagnostics > ntopng settings.

[[Image:Gpil-049.jpg]]

<nowiki># Setup Admin Password </nowiki>

<nowiki># Select the Interfaces on Which ntopng will be monitoring traffic.</nowiki>

We have selected LAN, DMZ and BRIDGEINTERFACE

To save the changes Click “Change”

Ntopng can be accessed via [http://203.77.200.91:3000/login.html http://203.77.200.91:3000/login.html]

With username admin and password assigned in previous step.

= Configuring OpenVPN =
A VPN (virtual private network) allows us to connect directly to our home private network over the internet

The certificate authority or CA will sign the certificates that we will be creating for the server and client side when we configure OpenVPN. You can access the certificate configuration by going over to System–>Cert Manager.

[[Image:Gpil-050.jpg]]

Under the CAs tab you might already have a CA created if you followed one of my previous articles as we needed to created one in order to sign an internal certificate to be used for securing the pfSense web interface.

=== Certificate Authority ===
Fill in the fields to '''create a new Certificate Authority'''

* '''Descriptive Name''' - Used as the Common Name (CN) for the CA. Do not spaces, punctuation or special characters (ex: ''VPN Server CA'')
* '''Key Length''' - Default is OK, the higher the better but will use more CPU.
* '''Lifetime''' - Default is OK, but can be lowered if it must be changed out more often.
* '''Country Code''', '''State/Province''', '''City''', '''Organization''' - Enter values for this location/company.
* '''E-mail''' - Used as a reference on the certificate, does not receive any mail from the system.

Click '''Add New CA'''

[[Image:Gpil-051.jpg]]

After you finished setting up the CA the next step is to create some certificates that the recently created CA will sign for us. Since these are self-signed certificates most browsers will give you a warning

=== Server Certificate ===
Fill in the fields to create a new '''Server Certificate'''. Similar Fields as CA entry, most of the fields carry over and do not need changed.

Click '''Create new Certificate'''

[[Image:Gpil-052.jpg]]

Now that we have all the components in place we can configure OpenVPN. Head over to VPN–>OpenVPN.

.

[[Image:Gpil-053.jpg]]

Select “Wizards” from the tab at the top which will guide us step by step to configure OpenVPN

[[Image:Gpil-054.jpg]]

[[Image:Gpil-055.jpeg]]

We will select the local user access database provided by pfSense

In the next step we will be selecting the CA that we created at the beginning of this article.

[[Image:Gpil-056.jpeg]]

Following is the Server Certificate that we will be using which is the Certificate that we recently created.

[[Image:Gpil-057.jpg]]

'''OpenVPN Server Configuration'''

* '''TLS Authentication''' -- Leave this checked, along with the box underneath to generate a new key. Using a TLS key is technically optional, but ''highly'' recommended
* '''Tunnel Network''' -- Should be a new, unique network that does not exist anywhere in the current network or routing table.

[[Image:Gpil-058.jpg]]

[[Image:Gpil-059.jpg]]

[[Image:Gpil-060.jpg]]

Click '''Next'''

=== Firewall Rules ===
The next screen offers the choice to add firewall rules automatically. For convenience, check both unless the rules will be managed manually.

Click '''Next'''

=== End of the Wizard ===
Click '''Finish''' to exit the wizard and the new settings will be saved and applied automatically.

== Adding a User with a Certificate ==
Navigate to '''System > User Manager'''

Click "+" To add a '''user'''

Fill in '''Username'''

Fill in '''Password / Confirm password'''

Check Click to create a '''user certificate.'''

Fill in the Descriptive Name as the username

[[Image:Gpil-061.jpg]]

[[Image:Gpil-062.jpeg]]

The OpenVPN Client Export Package allows exporting configurations formatted for a wide variety of platforms. It also allows exporting a pre-packaged Windows installer executable which includes the configuration bundled inside for a painly client installation.

=== Installing the OpenVPN Client Export Package ===
To Install the OpenVPN Client Export Package

* Navigate to '''System > Packages''', '''Available Packages''' tab
* Find '''OpenVPN Client Export Package''' in the list

=== Exporting a Configuration ===
* Navigate to '''VPN > OpenVPN''' on the '''Client Export''' tab
* Choose the VPN from the '''Remote Access Server''' drop-down list
* Find the user in the list at the bottom of the page and select the appropriate configuration type to export.

[[Image:Gpil-063.jpg]]

[[Image:Gpil-064.jpg]]

Multiple instance of VPN server can be created with different tunnel network

[[Image:Gpil-065.jpg]]

Firewall Rules are applied as per the requirement on tunnel network .

[[Image:Gpil-066.jpg]]

= Firewall Logs =
The Firewall logs at '''Status > System Logs''' on the '''Firewall''' tab show all events logged by the firewall.

Each entry is displayed with the action ( pass or block, reject is only logged as block), time, interface, source, destination, and protocol.

Configuration Of rsyslog Server for Logs Storage:-

Status: >System logs > Settings

[[Image:Gpil-067.jpeg]]

'''Configuration of rsyslog on Centos :-'''

===== Setup Log File Location =====
Now edit Rsyslog configuration file and configure the location’s to generate log files in system.

<nowiki># vim /etc/rsyslog.conf</nowiki>

and add following lines as the end of file.

$template TmplAuth, "/var/log/%HOSTNAME%/%PROGRAMNAME%.log"

authpriv.* ?TmplAuth

<nowiki>*.info,mail.none,authpriv.none,cron.none </nowiki>?TmplMsg

===== Enable Module and UDP Protocol =====
Also remove comment from following lines ( remove starting # ) in rsyslog configuration file to enable UDP.

$ModLoad imudp

$UDPServerRun 514

===== Restart Rsyslog =====
After making above changes in Rsyslog central server, restart service using following command.

<nowiki># service rsyslog restart</nowiki>

'''Logrotation:-'''

Create file''' :- '''/etc/logrotate.d/pfsense

'''And enter:-'''

'''/var/log/pfsense/filterlog.log'''

'''{'''

'''daily'''

'''missingok'''

'''rotate 60'''

'''compress'''

'''notifempty'''

'''create 640 root root'''

'''postrotate'''

'''/etc/init.d/rsyslog restart >/dev/null'''

'''endscript'''

'''}'''

'''Save and Quit.'''

'''RRD Graphs:-'''

These are located under '''Status > RRD Graphs'''. Several graphs are presented for each monitored item, with varying time intervals and averages.

These graphs measure things such as CPU usage, memory usage, state table usage, throughput (in bytes as well as packets), link quality, traffic shaping queue usage, and so on.

[[Image:Gpil-068.jpg]]

PF Sense Firewall Implementation at GIPL

2015-04-16T10:43:50Z

Manojsemwal:

<center>'''PF Sense Firewall Implementation at GIPL , GandhiNagar '''</center>

== Table of Contents ==
[#__RefHeading__2322_1445225205 NETWORK DIAGRAM2]

[#__RefHeading__2324_1445225205 Performing a Full Install (LiveCD)3]

[#__RefHeading__2326_1445225205 GUI Configuration Setup8]

[#__RefHeading__2328_1445225205 Configuration Of Bridge Interface13]

[#__RefHeading__2330_1445225205 Assign Virtual IP’s To LAN interface:-15]

[#__RefHeading__2332_1445225205 Configuration of SNORT17]

[#__RefHeading__2334_1445225205 Add Snort to an interface20]

[#__RefHeading__2336_1445225205 Select which types of rules will protect the network22]

[#__RefHeading__2338_1445225205 IP Alias and Port Alias24]

[#__RefHeading__2340_1445225205 Firewall Rules :-27]

[#__RefHeading__2342_1445225205 Configuration Of Squid and Squidguard:-31]

[#__RefHeading__2344_1445225205 Configuration of SARG:-39]

[#__RefHeading__2346_1445225205 Configuration Of Bandwidthd:-42]

[#__RefHeading__2348_1445225205 Configuration Of ntopng:-44]

[#__RefHeading__2350_1445225205 Configuring OpenVPN46]

[#__RefHeading__2352_1445225205 Certificate Authority47]

[#__RefHeading__2354_1445225205 Server Certificate48]

[#__RefHeading__2356_1445225205 Firewall Rules54]

[#__RefHeading__2358_1445225205 End of the Wizard54]

[#__RefHeading__2360_1445225205 Adding a User with a Certificate54]

[#__RefHeading__2362_1445225205 Installing the OpenVPN Client Export Package57]

[#__RefHeading__2364_1445225205 Exporting a Configuration57]

[#__RefHeading__2366_1445225205 Firewall Logs60]

[#__RefHeading__2368_1445225205 Setup Log File Location61]

[#__RefHeading__2370_1445225205 Enable Module and UDP Protocol61]

[#__RefHeading__2372_1445225205 Restart Rsyslog61]= NETWORK DIAGRAM =
[[Image:Gpil-000.jpg]]

'''Installation'''

'''pfSense''' is an open source firewall/router computer software distribution based on FreeBSD. It is installed on a computer to make a dedicated firewall/router for a network and is noted for its reliability[1] and offering features often only found in expensive commercial firewalls

'''Download pfSense'''

Visit https://www.pfsense.org/download/mirror.php?section=downloads

'''''Step 1 :- '''''

== Performing a Full Install (LiveCD) ==
Power on the target system and connect the install media: Place the CD into the drive or plug the Memstick into a USB port. If the BIOS is set to boot from CD/USB, pfSense will start.

[[Image:Gpil-001.jpeg]]

As the operating system boots and pfSense starts, a prompt is presented with some choices and a countdown timer. At this prompt, press ''i'' to invoke the installer now.

When the installer detects multiple disks in the system the first screen available provides the option '''Setup GEOM Mirror'''. Choose that option, pick the primary disk, the disk to use for the mirror copy, and then proceed with the installation as normal.

The Quick/Easy install choice will target the GEOM mirror automatically

[[Image:Gpil-002.jpeg]]

At the '''Select Task''' prompt, choose ''Quick/Easy Install''. [[Image:]]

[[Image:Gpil-003.jpeg]]

The install will proceed, wiping the target disk and installing pfSense. Copying files may take some time to finish.

After the files have been copied to the target disk, a choice is presented to select the console type. ''Standard'' defaults to the VGA console. ''Embedded'' defaults to serial console

[[Image:Gpil-004.jpeg]]

Now the system must reboot so that pfSense may start from the target disk. Select ''Reboot'' and then press '''Enter (remove CD from Drive)'''

[[Image:Gpil-005.jpeg]]

After the system reboots, pfSense will be running from the target disk. The next step is to Assign Interfaces on the Console below.

[[Image:Gpil-006.jpeg]]

After installation and assignment, a shell menu is presented on the console with a number of options. pfSense now is ready to be accessed via the network, LAN interface IP 192.168.1.1 is assigned by default.

Open a web browser and navigate to https://192.168.1.1/, using the default username admin and password pfsense to login.

The first visit to the WebGUI will be redirected to the setup wizard.

== GUI Configuration Setup ==
Once The Setup is launched, Fill the details are follows:-

[[Image:Gpil-007.jpeg]]

We have defined FQDN as gipl.firewall

DNS servers:- 8.8.8.8 and 4.4.2.2 Global DNS

Click NEXT

[[Image:Gpil-008.jpg]]

Select The Time-Zone as Asia/Kolkata .

And Click NEXT

[[Image:Gpil-009.jpg]]

Here we have Set WAN as Static Interface

With IP address :- 203.77.200.91/25

Gateway :- 203.77.200.1

Click Next.

[[Image:Gpil-010.jpg]]

Here we have Configured LAN interface with IP address 192.168.45.101/24

Click Next.

( note:-As per the client Network Topology , Lan interface have multiple Subnets configured , so we will be configuring Virtual IP’s from GUI )

After Setting Admin Password, Page will be redirected to Pfsense-Dashboard.

[[Image:Gpil-011.jpg]]

We Have Changed Default Port from 443 to 8080 Via :-

'''System > Advanced'''
[[Image:Gpil-012.jpg]]

Change TCP Port from Default 443 to 8080 .
[[Image:Gpil-013.jpg]]
Save .

Now pfsense Can be accessed via [https://IP:8080 https://IP:8080]

IP Address of Firewall is 203.77.200.91 on WAN interface.

Go to :- interface > assign , and edit Opt1 as DMZ , do not assign IP address to This interface , because we will be creating bridge interface .

== Configuration Of Bridge Interface ==
Now we have to configure '''Interface Bridges''' in order to Setup Pfsense in

Transparent mode.

Reference:- https://doc.pfsense.org/index.php/Interface_Bridges

Navigate To :- Interfaces > (assign)

on the Bridges tab Click “ +” symbol to add a new bridge .

Ctrl-Click to select the Member interfaces from the list of available interfaces and type a Description , we have selected WAN + DMZ as bridge0 and create new Interface BRIDGEINTERFACE using bridge0 .

[[Image:Gpil-014.jpg]]

By default, traffic is filtered on the member interfaces and not on the bridge interface itself. This behavior may be changed by toggling the values of '''net.link.bridge.pfil_member''' and net.link.bridge.pfil'''_bridge '''under System''' > Advanced '''on the '''System Tunables''' tab. With them set at ''0'' and ''1'', respectively, then filtering would be performed on the bridge only.

[[Image:Gpil-015.jpg]]

'''Now Pfsense is Configured In Bridge Mode with '''

'''WAN interface: - 203.77.200.91/25 gateway :- 203.77.200.1'''

'''LAN interface:- 192.168.45.101/24'''

'''DMZ: - no ip '''

'''BRIDGEINTERFACE:- 203.77.200.92/25'''

[[Image:Gpil-016.jpg]]

== Assign Virtual IP’s To LAN interface:- ==
[[Image:Gpil-018.jpg]]
Now as LAN environment have multiple Subnet configured, we will be assigning Virtual IP address to LAN interface.

[[Image:Gpil-017.jpg]]

Clients on LAN Environment have their Gateway Set from These Virtual IP’s.

203.77.196.230 is added for outside access of Local Servers 203.77.192.49/28.

(203.77.196.230) is configured in 203.77.192.2 switch which will receive any packet for 203.77.192.49/28 from Outside and send it to 203.77.196.230.

== Configuration of SNORT ==
'''Reference''' :- '''https://doc.pfsense.org/index.php/Setup_Snort_Package'''

Go to the '''Available Packages''' tab under the '''System''' menu and install the snort package.

 When the installation completes, click on '''Snort''' under the '''Services''' menu.  This will open the Snort main setup page.

Click the '''Global Settings''' tab and perform the following At the top of the page you have three choices for Rule Sets to activate.

Put Check mark on :-Install '''Snort Community''' rules , Install '''Emerging Threats''' rules , Install '''Snort VRT''' rules. And save.

The '''Updates''' tab is used to check the status of downloaded rules packages and to download new updates. The table shows the available rule packages and their current status [[Image:Gpil-019.jpg]]

Click Update Button to Update the rules.
[[Image:Gpil-020.jpeg]]

== Add Snort to an interface ==
Click the Snort Interfaces tab and then the "+" icon to add a new Snort interface.

 On the '''WAN Settings''' tab, click the ''Enable'' checkbox.In the drop-down, choose the interface.  The WAN interface is the default and is a good first choice.In the ''Description'' textbox, enter a name (WAN again, is fine here).Click the checkbox to "''Send alerts to the main System logs''".leave the other settings at their defaults

[[Image:Gpil-021.jpg]]

After saving, the browser will be returned to the Snort Interfaces tab. Note the warning icons in the image below showing no rules have been selected for the new Snort interface. Those rules will be configured next. Click the "e" icon to edit the new Snort interface again

[[Image:Gpil-024.jpeg]]

== Select which types of rules will protect the network ==
Click the '''Categories''' tab for the new interface

Check [https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=GPLv2_community.rules Snort GPLv2 Community Rules (VRT certified)] Box .

And Manual Rules :-

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-botcc.rules emerging-botcc.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_blacklist.rules snort_blacklist.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_exploit-kit.so.rules snort_exploit-kit.so.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_ddos.rules snort_ddos.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_dos.rules snort_dos.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_exploit-kit.rules snort_exploit-kit.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-malware.rules emerging-malware.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-mobile_malware.rules emerging-mobile_malware.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-tor.rules emerging-tor.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-trojan.rules emerging-trojan.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_malware-backdoor.rules snort_malware-backdoor.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_virus.rules snort_virus.rules]

[[Image:Gpil-023.jpg]]

Click SAVE when finished to save the selection and build the rules

After that restart the service

[[Image:Gpil-024.jpg]]

'''Managing Pass lists:-'''

'''Pass Lists are lists of IP addresses that Snort should never block. These may be created and managed on the Pass Lists tab. When an IP address is listed on a Pass List, Snort will never insert a block on that address even when malicious traffic is detected.'''

'''To create a new Pass List, click "+". To edit an existing Pass List, click the "e". To delete a Pass List, click "x". Note that a Pass List may not be deleted if it is currently assigned to one or more Snort interfaces.'''

We have added GIPL IP’s in Pass list . i.e''' 203.77.192.0/20'''

[[Image:Gpil-025.jpg]]

== IP Alias and Port Alias ==
IP aliases allow you to create a group of IP addresses that you can assign by group name instead of specifying each IP address individually. This can be great for specifying a group of servers that need ssh access and then in the firewall rules you can create a rule that allows ssh traffic for the ssh servers group.

Along the top menu hover over Firewall and click on Aliases.

[[Image:Gpil-026.jpg]]

The next tab is for setting up Port Aliases.  Similar to the IP Aliases you can setup groups but on this tab you are creating groups of ports instead of IP addresses.

[[Image:Gpil-027.jpg]]

IP Aliases Created.

[[Image:Gpil-028.jpg]]

PORT ALIAS CREATED

[[Image:Gpil-029.jpg]]

== Firewall Rules :- ==
Reference:- [https://doc.pfsense.org/index.php/Firewall_Rule_Basics https://doc.pfsense.org/index.php/Firewall_Rule_Basics]

Firewall rules control what traffic is allowed to enter an interface on the firewall. Once traffic is passed on the interface it enters an entry in the state table is created. A state table entry allows through subsequent packets that are part of that connection.

Firewall rules are managed at Firewall > Rules. Multiple rules may be selected for some actions by clicking on their row or checking the box at the start of their row. Rules may be deleted or reordered in bulk in this way. See Managing Lists of Items on pfSense for more information on the meaning of the icons when manipulating rules.

* '''any''' - ''0.0.0.0'' to ''255.255.255.255'', or all IPv6 addresses
* '''Single host or alias''' - Select this and enter one IP address (''1.2.3.4'', ''aa:bb:cc:dd::1'') or type the name of an Alias that has already been configured ('''Firewall > Aliases''')
* '''Network''' - Select this and enter a network and mask (''10.99.0.0/16'', ''aa:bb:cc:dd::0/64'')
* '''LAN net''' - The subnet configured on the LAN interface under '''Interfaces > LAN'''. On pfSense 2.2+, this also includes static route networks on that interface.
* '''LAN address''' - The IP address configured on the LAN interface under '''Interfaces > LAN'''
* '''zzz Net''' / '''zzz address''' - Works the same as LAN above but for other interfaces (WAN, OPT1, OPT2, etc.)
* '''PPTP clients''' - Automatically locate and use the addresses of PPTP clients
* '''L2TP clients''' - Automatically locate and use the addresses of L2TP clients
* '''This Firewall (self)''' - Any IP address assigned to any interface on this firewall (pfSense 2.2+)

Firewall rules are generally processed starting with Floating Rules, then Interface Group rules, then Interface tab rules

Rules Created on bridge interface, for DMZ access

[[Image:Gpil-030.jpg]]

[[Image:Gpil-031.jpg]]

'''LAN interface Rules Created:-'''

[[Image:Gpil-032.jpg]]

== Configuration Of Squid and Squidguard:- ==
'''Reference - '''[https://doc.pfsense.org/index.php/SquidGuard_package https://doc.pfsense.org/index.php/SquidGuard_package]

Login to your pfsense's Web Administrator, and click on "Server -> Packages", scroll down the list and find squid and click on "+" button to install, wait for the process to finish then return to the packages section and look for squidguard and install that package as well.

[[Image:Gpil-033.jpg]]

Now go to "Services" menu and look for Proxy Server & Proxy Filter

[[Image:Gpil-034.jpg]]

(We are setting up the proxy server as a transparent proxy)

Click on Services -> Proxy Server.

On the General Tab, you want to set the following settings, the Proxy Interface Option should be set to "LAN", to set up transparent proxy server, tick the "Transparent Proxy" check box.

[[Image:Gpil-035.jpg]]

Tick the "Enabled Logging" Checkbox, set the log store to the default location " /var/squid/logs " rotate your logs every 30 days, set your proxy port to port number 3128 We have By-passed Proxy for 203.77.192.49/28, These are the Local Servers.

Next click on the "Cache Mgmt." tab, by default the Hard Disk Cache Size is set to 100mb, we have allocated 100GB , Memory Cache Size 3072 .

[[Image:Gpil-036.jpg]]

Click on Save.

Click on the Access Control Tab next, in the allowed subnets field type in your required subnets. As we have multiple Subnets, so we are going to define all.

[[Image:Gpil-037.jpg]]

'''203.77.201.129/29'''

'''10.1.224.1/24'''

'''203.77.192.49/28'''

'''203.77.206.57/29'''

'''203.77.206.17/29'''

'''203.77.201.137/29'''

'''10.33.50.1/27'''

Click On Save

Now that’s is the proxy server configured, next we are going to configure SquidGuard, click on the Services menu and select the Proxy Filter button, tick the following 3 check boxes "Enable", "Enable GUI Log" and "Enable Log" then click the Save button, once the page has reloaded click on apply and then confirm that the Squidguard service is running by making sure the SquidGuard status is set to STARTED.

[[Image:Gpil-038.jpg]]

Click on the Black list tab and add URL '''http://www.shallalist.de/Downloads/shallalist.tar.gz''' to the Update Address and click on Download. Wait for the process to complete.

[[Image:Gpil-039.jpg]]

[[Image:Gpil-040.jpg]]

'''Now we can set up common ACL’s'''

[[Image:Gpil-041.jpg]]

[[Image:Gpil-042.jpg]]

'''Click on Save and restart the Squid and SquidGuard from Services. '''

== Configuration of SARG:- ==
After Installing SARG package, we can configure SARG from Status > Sarg Reports

[[Image:Gpil-043.jpg]]

Select Proxy Servers as SQUID proxy . And leave Rest of Field set to Default

And Save.

'''Now Go to Next Tab Schedule'''

Click “+” Symbol to create new schedule

[[Image:Gpil-044.jpg]]

'''Reports can be viewed From “View Reports”'''

[[Image:Gpil-045.jpg]]

== Configuration Of Bandwidthd:- ==
After Installing Package '''bandwidthd''' , Configuration can be done via

Services > bandwidthd

[[Image:Gpil-046.jpg]]

[[Image:Gpil-047.jpg]]

Enable Bandwidthd by checking the BOX.

Now Select the Interface: - LAN.

Enter The Subnets from LAN interface.

Click Save and Restart bandwidthd service from Services.

Now Bandwidthd can be accessed:-

[https://203.77.200.91:8080/bandwidthd/index.html https://203.77.200.91:8080/bandwidthd/index.html]

== Configuration Of ntopng:- ==
After installing ntopng package, it appears under Diagnostics > ntopng. It will even track where connections were made by local PCs, and how much bandwidth was used on individual connections.

[[Image:Gpil-048.jpg]]

First we have to configure ntopng settings. Via Diagnostics > ntopng settings.

[[Image:Gpil-049.jpg]]

<nowiki># Setup Admin Password </nowiki>

<nowiki># Select the Interfaces on Which ntopng will be monitoring traffic.</nowiki>

We have selected LAN, DMZ and BRIDGEINTERFACE

To save the changes Click “Change”

Ntopng can be accessed via [http://203.77.200.91:3000/login.html http://203.77.200.91:3000/login.html]

With username admin and password assigned in previous step.

= Configuring OpenVPN =
A VPN (virtual private network) allows us to connect directly to our home private network over the internet

The certificate authority or CA will sign the certificates that we will be creating for the server and client side when we configure OpenVPN. You can access the certificate configuration by going over to System–>Cert Manager.

[[Image:Gpil-050.jpg]]

Under the CAs tab you might already have a CA created if you followed one of my previous articles as we needed to created one in order to sign an internal certificate to be used for securing the pfSense web interface.

=== Certificate Authority ===
Fill in the fields to '''create a new Certificate Authority'''

* '''Descriptive Name''' - Used as the Common Name (CN) for the CA. Do not spaces, punctuation or special characters (ex: ''VPN Server CA'')
* '''Key Length''' - Default is OK, the higher the better but will use more CPU.
* '''Lifetime''' - Default is OK, but can be lowered if it must be changed out more often.
* '''Country Code''', '''State/Province''', '''City''', '''Organization''' - Enter values for this location/company.
* '''E-mail''' - Used as a reference on the certificate, does not receive any mail from the system.

Click '''Add New CA'''

[[Image:Gpil-051.jpg]]

After you finished setting up the CA the next step is to create some certificates that the recently created CA will sign for us. Since these are self-signed certificates most browsers will give you a warning

=== Server Certificate ===
Fill in the fields to create a new '''Server Certificate'''. Similar Fields as CA entry, most of the fields carry over and do not need changed.

Click '''Create new Certificate'''

[[Image:Gpil-052.jpg]]

Now that we have all the components in place we can configure OpenVPN. Head over to VPN–>OpenVPN.

.

[[Image:Gpil-053.jpg]]

Select “Wizards” from the tab at the top which will guide us step by step to configure OpenVPN

[[Image:Gpil-054.jpg]]

[[Image:Gpil-055.jpeg]]

We will select the local user access database provided by pfSense

In the next step we will be selecting the CA that we created at the beginning of this article.

[[Image:Gpil-056.jpeg]]

Following is the Server Certificate that we will be using which is the Certificate that we recently created.

[[Image:Gpil-057.jpg]]

'''OpenVPN Server Configuration'''

* '''TLS Authentication''' -- Leave this checked, along with the box underneath to generate a new key. Using a TLS key is technically optional, but ''highly'' recommended
* '''Tunnel Network''' -- Should be a new, unique network that does not exist anywhere in the current network or routing table.

[[Image:Gpil-058.jpg]]

[[Image:Gpil-059.jpg]]

[[Image:Gpil-060.jpg]]

Click '''Next'''

=== Firewall Rules ===
The next screen offers the choice to add firewall rules automatically. For convenience, check both unless the rules will be managed manually.

Click '''Next'''

=== End of the Wizard ===
Click '''Finish''' to exit the wizard and the new settings will be saved and applied automatically.

== Adding a User with a Certificate ==
Navigate to '''System > User Manager'''

Click "+" To add a '''user'''

Fill in '''Username'''

Fill in '''Password / Confirm password'''

Check Click to create a '''user certificate.'''

Fill in the Descriptive Name as the username

[[Image:Gpil-061.jpg]]

[[Image:Gpil-062.jpeg]]

The OpenVPN Client Export Package allows exporting configurations formatted for a wide variety of platforms. It also allows exporting a pre-packaged Windows installer executable which includes the configuration bundled inside for a painly client installation.

=== Installing the OpenVPN Client Export Package ===
To Install the OpenVPN Client Export Package

* Navigate to '''System > Packages''', '''Available Packages''' tab
* Find '''OpenVPN Client Export Package''' in the list

=== Exporting a Configuration ===
* Navigate to '''VPN > OpenVPN''' on the '''Client Export''' tab
* Choose the VPN from the '''Remote Access Server''' drop-down list
* Find the user in the list at the bottom of the page and select the appropriate configuration type to export.

[[Image:Gpil-063.jpg]]

[[Image:Gpil-064.jpg]]

Multiple instance of VPN server can be created with different tunnel network

[[Image:Gpil-065.jpg]]

Firewall Rules are applied as per the requirement on tunnel network .

[[Image:Gpil-066.jpg]]

= Firewall Logs =
The Firewall logs at '''Status > System Logs''' on the '''Firewall''' tab show all events logged by the firewall.

Each entry is displayed with the action ( pass or block, reject is only logged as block), time, interface, source, destination, and protocol.

Configuration Of rsyslog Server for Logs Storage:-

Status: >System logs > Settings

[[Image:Gpil-067.jpeg]]

'''Configuration of rsyslog on Centos :-'''

===== Setup Log File Location =====
Now edit Rsyslog configuration file and configure the location’s to generate log files in system.

<nowiki># vim /etc/rsyslog.conf</nowiki>

and add following lines as the end of file.

$template TmplAuth, "/var/log/%HOSTNAME%/%PROGRAMNAME%.log"

authpriv.* ?TmplAuth

<nowiki>*.info,mail.none,authpriv.none,cron.none </nowiki>?TmplMsg

===== Enable Module and UDP Protocol =====
Also remove comment from following lines ( remove starting # ) in rsyslog configuration file to enable UDP.

$ModLoad imudp

$UDPServerRun 514

===== Restart Rsyslog =====
After making above changes in Rsyslog central server, restart service using following command.

<nowiki># service rsyslog restart</nowiki>

'''Logrotation:-'''

Create file''' :- '''/etc/logrotate.d/pfsense

'''And enter:-'''

'''/var/log/pfsense/filterlog.log'''

'''{'''

'''daily'''

'''missingok'''

'''rotate 60'''

'''compress'''

'''notifempty'''

'''create 640 root root'''

'''postrotate'''

'''/etc/init.d/rsyslog restart >/dev/null'''

'''endscript'''

'''}'''

'''Save and Quit.'''

'''RRD Graphs:-'''

These are located under '''Status > RRD Graphs'''. Several graphs are presented for each monitored item, with varying time intervals and averages.

These graphs measure things such as CPU usage, memory usage, state table usage, throughput (in bytes as well as packets), link quality, traffic shaping queue usage, and so on.

[[Image:Gpil-068.jpg]]

File:Gpil-028.jpeg

2015-04-16T10:42:21Z

Manojsemwal: uploaded a new version of "File:Gpil-028.jpeg"

File:Gpil-024.jpg

2015-04-16T10:40:13Z

Manojsemwal: uploaded a new version of "File:Gpil-024.jpg"

PF Sense Firewall Implementation at GIPL

2015-04-16T10:38:44Z

Manojsemwal:

<center>'''PF Sense Firewall Implementation at GIPL , GandhiNagar '''</center>

== Table of Contents ==
[#__RefHeading__2322_1445225205 NETWORK DIAGRAM2]

[#__RefHeading__2324_1445225205 Performing a Full Install (LiveCD)3]

[#__RefHeading__2326_1445225205 GUI Configuration Setup8]

[#__RefHeading__2328_1445225205 Configuration Of Bridge Interface13]

[#__RefHeading__2330_1445225205 Assign Virtual IP’s To LAN interface:-15]

[#__RefHeading__2332_1445225205 Configuration of SNORT17]

[#__RefHeading__2334_1445225205 Add Snort to an interface20]

[#__RefHeading__2336_1445225205 Select which types of rules will protect the network22]

[#__RefHeading__2338_1445225205 IP Alias and Port Alias24]

[#__RefHeading__2340_1445225205 Firewall Rules :-27]

[#__RefHeading__2342_1445225205 Configuration Of Squid and Squidguard:-31]

[#__RefHeading__2344_1445225205 Configuration of SARG:-39]

[#__RefHeading__2346_1445225205 Configuration Of Bandwidthd:-42]

[#__RefHeading__2348_1445225205 Configuration Of ntopng:-44]

[#__RefHeading__2350_1445225205 Configuring OpenVPN46]

[#__RefHeading__2352_1445225205 Certificate Authority47]

[#__RefHeading__2354_1445225205 Server Certificate48]

[#__RefHeading__2356_1445225205 Firewall Rules54]

[#__RefHeading__2358_1445225205 End of the Wizard54]

[#__RefHeading__2360_1445225205 Adding a User with a Certificate54]

[#__RefHeading__2362_1445225205 Installing the OpenVPN Client Export Package57]

[#__RefHeading__2364_1445225205 Exporting a Configuration57]

[#__RefHeading__2366_1445225205 Firewall Logs60]

[#__RefHeading__2368_1445225205 Setup Log File Location61]

[#__RefHeading__2370_1445225205 Enable Module and UDP Protocol61]

[#__RefHeading__2372_1445225205 Restart Rsyslog61]= NETWORK DIAGRAM =
[[Image:Gpil-000.jpg]]

'''Installation'''

'''pfSense''' is an open source firewall/router computer software distribution based on FreeBSD. It is installed on a computer to make a dedicated firewall/router for a network and is noted for its reliability[1] and offering features often only found in expensive commercial firewalls

'''Download pfSense'''

Visit https://www.pfsense.org/download/mirror.php?section=downloads

'''''Step 1 :- '''''

== Performing a Full Install (LiveCD) ==
Power on the target system and connect the install media: Place the CD into the drive or plug the Memstick into a USB port. If the BIOS is set to boot from CD/USB, pfSense will start.

[[Image:Gpil-001.jpeg]]

As the operating system boots and pfSense starts, a prompt is presented with some choices and a countdown timer. At this prompt, press ''i'' to invoke the installer now.

When the installer detects multiple disks in the system the first screen available provides the option '''Setup GEOM Mirror'''. Choose that option, pick the primary disk, the disk to use for the mirror copy, and then proceed with the installation as normal.

The Quick/Easy install choice will target the GEOM mirror automatically

[[Image:Gpil-002.jpeg]]

At the '''Select Task''' prompt, choose ''Quick/Easy Install''. [[Image:]]

[[Image:Gpil-003.jpeg]]

The install will proceed, wiping the target disk and installing pfSense. Copying files may take some time to finish.

After the files have been copied to the target disk, a choice is presented to select the console type. ''Standard'' defaults to the VGA console. ''Embedded'' defaults to serial console

[[Image:Gpil-004.jpeg]]

Now the system must reboot so that pfSense may start from the target disk. Select ''Reboot'' and then press '''Enter (remove CD from Drive)'''

[[Image:Gpil-005.jpeg]]

After the system reboots, pfSense will be running from the target disk. The next step is to Assign Interfaces on the Console below.

[[Image:Gpil-006.jpeg]]

After installation and assignment, a shell menu is presented on the console with a number of options. pfSense now is ready to be accessed via the network, LAN interface IP 192.168.1.1 is assigned by default.

Open a web browser and navigate to https://192.168.1.1/, using the default username admin and password pfsense to login.

The first visit to the WebGUI will be redirected to the setup wizard.

== GUI Configuration Setup ==
Once The Setup is launched, Fill the details are follows:-

[[Image:Gpil-007.jpeg]]

We have defined FQDN as gipl.firewall

DNS servers:- 8.8.8.8 and 4.4.2.2 Global DNS

Click NEXT

[[Image:Gpil-008.jpg]]

Select The Time-Zone as Asia/Kolkata .

And Click NEXT

[[Image:Gpil-009.jpg]]

Here we have Set WAN as Static Interface

With IP address :- 203.77.200.91/25

Gateway :- 203.77.200.1

Click Next.

[[Image:Gpil-010.jpg]]

Here we have Configured LAN interface with IP address 192.168.45.101/24

Click Next.

( note:-As per the client Network Topology , Lan interface have multiple Subnets configured , so we will be configuring Virtual IP’s from GUI )

After Setting Admin Password, Page will be redirected to Pfsense-Dashboard.

[[Image:Gpil-011.jpg]]

We Have Changed Default Port from 443 to 8080 Via :-

'''System > Advanced'''
[[Image:Gpil-012.jpg]]

Change TCP Port from Default 443 to 8080 .
[[Image:Gpil-013.jpg]]
Save .

Now pfsense Can be accessed via [https://IP:8080 https://IP:8080]

IP Address of Firewall is 203.77.200.91 on WAN interface.

Go to :- interface > assign , and edit Opt1 as DMZ , do not assign IP address to This interface , because we will be creating bridge interface .

== Configuration Of Bridge Interface ==
Now we have to configure '''Interface Bridges''' in order to Setup Pfsense in

Transparent mode.

Reference:- https://doc.pfsense.org/index.php/Interface_Bridges

Navigate To :- Interfaces > (assign)

on the Bridges tab Click “ +” symbol to add a new bridge .

Ctrl-Click to select the Member interfaces from the list of available interfaces and type a Description , we have selected WAN + DMZ as bridge0 and create new Interface BRIDGEINTERFACE using bridge0 .

[[Image:Gpil-014.jpg]]

By default, traffic is filtered on the member interfaces and not on the bridge interface itself. This behavior may be changed by toggling the values of '''net.link.bridge.pfil_member''' and net.link.bridge.pfil'''_bridge '''under System''' > Advanced '''on the '''System Tunables''' tab. With them set at ''0'' and ''1'', respectively, then filtering would be performed on the bridge only.

[[Image:Gpil-015.jpg]]

'''Now Pfsense is Configured In Bridge Mode with '''

'''WAN interface: - 203.77.200.91/25 gateway :- 203.77.200.1'''

'''LAN interface:- 192.168.45.101/24'''

'''DMZ: - no ip '''

'''BRIDGEINTERFACE:- 203.77.200.92/25'''

[[Image:Gpil-016.jpg]]

== Assign Virtual IP’s To LAN interface:- ==
[[Image:Gpil-018.jpg]]
Now as LAN environment have multiple Subnet configured, we will be assigning Virtual IP address to LAN interface.

[[Image:Gpil-017.jpg]]

Clients on LAN Environment have their Gateway Set from These Virtual IP’s.

203.77.196.230 is added for outside access of Local Servers 203.77.192.49/28.

(203.77.196.230) is configured in 203.77.192.2 switch which will receive any packet for 203.77.192.49/28 from Outside and send it to 203.77.196.230.

== Configuration of SNORT ==
'''Reference''' :- '''https://doc.pfsense.org/index.php/Setup_Snort_Package'''

Go to the '''Available Packages''' tab under the '''System''' menu and install the snort package.

 When the installation completes, click on '''Snort''' under the '''Services''' menu.  This will open the Snort main setup page.

Click the '''Global Settings''' tab and perform the following At the top of the page you have three choices for Rule Sets to activate.

Put Check mark on :-Install '''Snort Community''' rules , Install '''Emerging Threats''' rules , Install '''Snort VRT''' rules. And save.

The '''Updates''' tab is used to check the status of downloaded rules packages and to download new updates. The table shows the available rule packages and their current status [[Image:Gpil-019.jpg]]

Click Update Button to Update the rules.

== Add Snort to an interface ==
Click the Snort Interfaces tab and then the "+" icon to add a new Snort interface.

[[Image:Gpil-020.jpeg]]

 On the '''WAN Settings''' tab, click the ''Enable'' checkbox.In the drop-down, choose the interface.  The WAN interface is the default and is a good first choice.In the ''Description'' textbox, enter a name (WAN again, is fine here).Click the checkbox to "''Send alerts to the main System logs''".leave the other settings at their defaults

[[Image:Gpil-021.jpg]]

After saving, the browser will be returned to the Snort Interfaces tab. Note the warning icons in the image below showing no rules have been selected for the new Snort interface. Those rules will be configured next. Click the "e" icon to edit the new Snort interface again

[[Image:Gpil-024.jpeg]]

== Select which types of rules will protect the network ==
Click the '''Categories''' tab for the new interface

Check [https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=GPLv2_community.rules Snort GPLv2 Community Rules (VRT certified)] Box .

And Manual Rules :-

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-botcc.rules emerging-botcc.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_blacklist.rules snort_blacklist.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_exploit-kit.so.rules snort_exploit-kit.so.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_ddos.rules snort_ddos.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_dos.rules snort_dos.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_exploit-kit.rules snort_exploit-kit.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-malware.rules emerging-malware.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-mobile_malware.rules emerging-mobile_malware.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-tor.rules emerging-tor.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-trojan.rules emerging-trojan.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_malware-backdoor.rules snort_malware-backdoor.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_virus.rules snort_virus.rules]

[[Image:Gpil-023.jpg]]

Click SAVE when finished to save the selection and build the rules

After that restart the service

[[Image:Gpil-024.jpg]]

'''Managing Pass lists:-'''

'''Pass Lists are lists of IP addresses that Snort should never block. These may be created and managed on the Pass Lists tab. When an IP address is listed on a Pass List, Snort will never insert a block on that address even when malicious traffic is detected.'''

'''To create a new Pass List, click "+". To edit an existing Pass List, click the "e". To delete a Pass List, click "x". Note that a Pass List may not be deleted if it is currently assigned to one or more Snort interfaces.'''

We have added GIPL IP’s in Pass list . i.e''' 203.77.192.0/20'''

[[Image:Gpil-025.jpg]]

== IP Alias and Port Alias ==
IP aliases allow you to create a group of IP addresses that you can assign by group name instead of specifying each IP address individually. This can be great for specifying a group of servers that need ssh access and then in the firewall rules you can create a rule that allows ssh traffic for the ssh servers group.

Along the top menu hover over Firewall and click on Aliases.

[[Image:Gpil-026.jpg]]

The next tab is for setting up Port Aliases.  Similar to the IP Aliases you can setup groups but on this tab you are creating groups of ports instead of IP addresses.

[[Image:Gpil-027.jpg]]

IP Aliases Created.

[[Image:Gpil-028.jpg]]

PORT ALIAS CREATED

[[Image:Gpil-029.jpg]]

== Firewall Rules :- ==
Reference:- [https://doc.pfsense.org/index.php/Firewall_Rule_Basics https://doc.pfsense.org/index.php/Firewall_Rule_Basics]

Firewall rules control what traffic is allowed to enter an interface on the firewall. Once traffic is passed on the interface it enters an entry in the state table is created. A state table entry allows through subsequent packets that are part of that connection.

Firewall rules are managed at Firewall > Rules. Multiple rules may be selected for some actions by clicking on their row or checking the box at the start of their row. Rules may be deleted or reordered in bulk in this way. See Managing Lists of Items on pfSense for more information on the meaning of the icons when manipulating rules.

* '''any''' - ''0.0.0.0'' to ''255.255.255.255'', or all IPv6 addresses
* '''Single host or alias''' - Select this and enter one IP address (''1.2.3.4'', ''aa:bb:cc:dd::1'') or type the name of an Alias that has already been configured ('''Firewall > Aliases''')
* '''Network''' - Select this and enter a network and mask (''10.99.0.0/16'', ''aa:bb:cc:dd::0/64'')
* '''LAN net''' - The subnet configured on the LAN interface under '''Interfaces > LAN'''. On pfSense 2.2+, this also includes static route networks on that interface.
* '''LAN address''' - The IP address configured on the LAN interface under '''Interfaces > LAN'''
* '''zzz Net''' / '''zzz address''' - Works the same as LAN above but for other interfaces (WAN, OPT1, OPT2, etc.)
* '''PPTP clients''' - Automatically locate and use the addresses of PPTP clients
* '''L2TP clients''' - Automatically locate and use the addresses of L2TP clients
* '''This Firewall (self)''' - Any IP address assigned to any interface on this firewall (pfSense 2.2+)

Firewall rules are generally processed starting with Floating Rules, then Interface Group rules, then Interface tab rules

Rules Created on bridge interface, for DMZ access

[[Image:Gpil-030.jpg]]

[[Image:Gpil-031.jpg]]

'''LAN interface Rules Created:-'''

[[Image:Gpil-032.jpg]]

== Configuration Of Squid and Squidguard:- ==
'''Reference - '''[https://doc.pfsense.org/index.php/SquidGuard_package https://doc.pfsense.org/index.php/SquidGuard_package]

Login to your pfsense's Web Administrator, and click on "Server -> Packages", scroll down the list and find squid and click on "+" button to install, wait for the process to finish then return to the packages section and look for squidguard and install that package as well.

[[Image:Gpil-033.jpg]]

Now go to "Services" menu and look for Proxy Server & Proxy Filter

[[Image:Gpil-034.jpg]]

(We are setting up the proxy server as a transparent proxy)

Click on Services -> Proxy Server.

On the General Tab, you want to set the following settings, the Proxy Interface Option should be set to "LAN", to set up transparent proxy server, tick the "Transparent Proxy" check box.

[[Image:Gpil-035.jpg]]

Tick the "Enabled Logging" Checkbox, set the log store to the default location " /var/squid/logs " rotate your logs every 30 days, set your proxy port to port number 3128 We have By-passed Proxy for 203.77.192.49/28, These are the Local Servers.

Next click on the "Cache Mgmt." tab, by default the Hard Disk Cache Size is set to 100mb, we have allocated 100GB , Memory Cache Size 3072 .

[[Image:Gpil-036.jpg]]

Click on Save.

Click on the Access Control Tab next, in the allowed subnets field type in your required subnets. As we have multiple Subnets, so we are going to define all.

[[Image:Gpil-037.jpg]]

'''203.77.201.129/29'''

'''10.1.224.1/24'''

'''203.77.192.49/28'''

'''203.77.206.57/29'''

'''203.77.206.17/29'''

'''203.77.201.137/29'''

'''10.33.50.1/27'''

Click On Save

Now that’s is the proxy server configured, next we are going to configure SquidGuard, click on the Services menu and select the Proxy Filter button, tick the following 3 check boxes "Enable", "Enable GUI Log" and "Enable Log" then click the Save button, once the page has reloaded click on apply and then confirm that the Squidguard service is running by making sure the SquidGuard status is set to STARTED.

[[Image:Gpil-038.jpg]]

Click on the Black list tab and add URL '''http://www.shallalist.de/Downloads/shallalist.tar.gz''' to the Update Address and click on Download. Wait for the process to complete.

[[Image:Gpil-039.jpg]]

[[Image:Gpil-040.jpg]]

'''Now we can set up common ACL’s'''

[[Image:Gpil-041.jpg]]

[[Image:Gpil-042.jpg]]

'''Click on Save and restart the Squid and SquidGuard from Services. '''

== Configuration of SARG:- ==
After Installing SARG package, we can configure SARG from Status > Sarg Reports

[[Image:Gpil-043.jpg]]

Select Proxy Servers as SQUID proxy . And leave Rest of Field set to Default

And Save.

'''Now Go to Next Tab Schedule'''

Click “+” Symbol to create new schedule

[[Image:Gpil-044.jpg]]

'''Reports can be viewed From “View Reports”'''

[[Image:Gpil-045.jpg]]

== Configuration Of Bandwidthd:- ==
After Installing Package '''bandwidthd''' , Configuration can be done via

Services > bandwidthd

[[Image:Gpil-046.jpg]]

[[Image:Gpil-047.jpg]]

Enable Bandwidthd by checking the BOX.

Now Select the Interface: - LAN.

Enter The Subnets from LAN interface.

Click Save and Restart bandwidthd service from Services.

Now Bandwidthd can be accessed:-

[https://203.77.200.91:8080/bandwidthd/index.html https://203.77.200.91:8080/bandwidthd/index.html]

== Configuration Of ntopng:- ==
After installing ntopng package, it appears under Diagnostics > ntopng. It will even track where connections were made by local PCs, and how much bandwidth was used on individual connections.

[[Image:Gpil-048.jpg]]

First we have to configure ntopng settings. Via Diagnostics > ntopng settings.

[[Image:Gpil-049.jpg]]

<nowiki># Setup Admin Password </nowiki>

<nowiki># Select the Interfaces on Which ntopng will be monitoring traffic.</nowiki>

We have selected LAN, DMZ and BRIDGEINTERFACE

To save the changes Click “Change”

Ntopng can be accessed via [http://203.77.200.91:3000/login.html http://203.77.200.91:3000/login.html]

With username admin and password assigned in previous step.

= Configuring OpenVPN =
A VPN (virtual private network) allows us to connect directly to our home private network over the internet

The certificate authority or CA will sign the certificates that we will be creating for the server and client side when we configure OpenVPN. You can access the certificate configuration by going over to System–>Cert Manager.

[[Image:Gpil-050.jpg]]

Under the CAs tab you might already have a CA created if you followed one of my previous articles as we needed to created one in order to sign an internal certificate to be used for securing the pfSense web interface.

=== Certificate Authority ===
Fill in the fields to '''create a new Certificate Authority'''

* '''Descriptive Name''' - Used as the Common Name (CN) for the CA. Do not spaces, punctuation or special characters (ex: ''VPN Server CA'')
* '''Key Length''' - Default is OK, the higher the better but will use more CPU.
* '''Lifetime''' - Default is OK, but can be lowered if it must be changed out more often.
* '''Country Code''', '''State/Province''', '''City''', '''Organization''' - Enter values for this location/company.
* '''E-mail''' - Used as a reference on the certificate, does not receive any mail from the system.

Click '''Add New CA'''

[[Image:Gpil-051.jpg]]

After you finished setting up the CA the next step is to create some certificates that the recently created CA will sign for us. Since these are self-signed certificates most browsers will give you a warning

=== Server Certificate ===
Fill in the fields to create a new '''Server Certificate'''. Similar Fields as CA entry, most of the fields carry over and do not need changed.

Click '''Create new Certificate'''

[[Image:Gpil-052.jpg]]

Now that we have all the components in place we can configure OpenVPN. Head over to VPN–>OpenVPN.

.

[[Image:Gpil-053.jpg]]

Select “Wizards” from the tab at the top which will guide us step by step to configure OpenVPN

[[Image:Gpil-054.jpg]]

[[Image:Gpil-055.jpeg]]

We will select the local user access database provided by pfSense

In the next step we will be selecting the CA that we created at the beginning of this article.

[[Image:Gpil-056.jpeg]]

Following is the Server Certificate that we will be using which is the Certificate that we recently created.

[[Image:Gpil-057.jpg]]

'''OpenVPN Server Configuration'''

* '''TLS Authentication''' -- Leave this checked, along with the box underneath to generate a new key. Using a TLS key is technically optional, but ''highly'' recommended
* '''Tunnel Network''' -- Should be a new, unique network that does not exist anywhere in the current network or routing table.

[[Image:Gpil-058.jpg]]

[[Image:Gpil-059.jpg]]

[[Image:Gpil-060.jpg]]

Click '''Next'''

=== Firewall Rules ===
The next screen offers the choice to add firewall rules automatically. For convenience, check both unless the rules will be managed manually.

Click '''Next'''

=== End of the Wizard ===
Click '''Finish''' to exit the wizard and the new settings will be saved and applied automatically.

== Adding a User with a Certificate ==
Navigate to '''System > User Manager'''

Click "+" To add a '''user'''

Fill in '''Username'''

Fill in '''Password / Confirm password'''

Check Click to create a '''user certificate.'''

Fill in the Descriptive Name as the username

[[Image:Gpil-061.jpg]]

[[Image:Gpil-062.jpeg]]

The OpenVPN Client Export Package allows exporting configurations formatted for a wide variety of platforms. It also allows exporting a pre-packaged Windows installer executable which includes the configuration bundled inside for a painly client installation.

=== Installing the OpenVPN Client Export Package ===
To Install the OpenVPN Client Export Package

* Navigate to '''System > Packages''', '''Available Packages''' tab
* Find '''OpenVPN Client Export Package''' in the list

=== Exporting a Configuration ===
* Navigate to '''VPN > OpenVPN''' on the '''Client Export''' tab
* Choose the VPN from the '''Remote Access Server''' drop-down list
* Find the user in the list at the bottom of the page and select the appropriate configuration type to export.

[[Image:Gpil-063.jpg]]

[[Image:Gpil-064.jpg]]

Multiple instance of VPN server can be created with different tunnel network

[[Image:Gpil-065.jpg]]

Firewall Rules are applied as per the requirement on tunnel network .

[[Image:Gpil-066.jpg]]

= Firewall Logs =
The Firewall logs at '''Status > System Logs''' on the '''Firewall''' tab show all events logged by the firewall.

Each entry is displayed with the action ( pass or block, reject is only logged as block), time, interface, source, destination, and protocol.

Configuration Of rsyslog Server for Logs Storage:-

Status: >System logs > Settings

[[Image:Gpil-067.jpeg]]

'''Configuration of rsyslog on Centos :-'''

===== Setup Log File Location =====
Now edit Rsyslog configuration file and configure the location’s to generate log files in system.

<nowiki># vim /etc/rsyslog.conf</nowiki>

and add following lines as the end of file.

$template TmplAuth, "/var/log/%HOSTNAME%/%PROGRAMNAME%.log"

authpriv.* ?TmplAuth

<nowiki>*.info,mail.none,authpriv.none,cron.none </nowiki>?TmplMsg

===== Enable Module and UDP Protocol =====
Also remove comment from following lines ( remove starting # ) in rsyslog configuration file to enable UDP.

$ModLoad imudp

$UDPServerRun 514

===== Restart Rsyslog =====
After making above changes in Rsyslog central server, restart service using following command.

<nowiki># service rsyslog restart</nowiki>

'''Logrotation:-'''

Create file''' :- '''/etc/logrotate.d/pfsense

'''And enter:-'''

'''/var/log/pfsense/filterlog.log'''

'''{'''

'''daily'''

'''missingok'''

'''rotate 60'''

'''compress'''

'''notifempty'''

'''create 640 root root'''

'''postrotate'''

'''/etc/init.d/rsyslog restart >/dev/null'''

'''endscript'''

'''}'''

'''Save and Quit.'''

'''RRD Graphs:-'''

These are located under '''Status > RRD Graphs'''. Several graphs are presented for each monitored item, with varying time intervals and averages.

These graphs measure things such as CPU usage, memory usage, state table usage, throughput (in bytes as well as packets), link quality, traffic shaping queue usage, and so on.

[[Image:Gpil-068.jpg]]

PF Sense Firewall Implementation at GIPL

2015-04-16T10:35:58Z

Manojsemwal:

<center>'''PF Sense Firewall Implementation at GIPL , GandhiNagar '''</center>

== Table of Contents ==
[#__RefHeading__2322_1445225205 NETWORK DIAGRAM2]

[#__RefHeading__2324_1445225205 Performing a Full Install (LiveCD)3]

[#__RefHeading__2326_1445225205 GUI Configuration Setup8]

[#__RefHeading__2328_1445225205 Configuration Of Bridge Interface13]

[#__RefHeading__2330_1445225205 Assign Virtual IP’s To LAN interface:-15]

[#__RefHeading__2332_1445225205 Configuration of SNORT17]

[#__RefHeading__2334_1445225205 Add Snort to an interface20]

[#__RefHeading__2336_1445225205 Select which types of rules will protect the network22]

[#__RefHeading__2338_1445225205 IP Alias and Port Alias24]

[#__RefHeading__2340_1445225205 Firewall Rules :-27]

[#__RefHeading__2342_1445225205 Configuration Of Squid and Squidguard:-31]

[#__RefHeading__2344_1445225205 Configuration of SARG:-39]

[#__RefHeading__2346_1445225205 Configuration Of Bandwidthd:-42]

[#__RefHeading__2348_1445225205 Configuration Of ntopng:-44]

[#__RefHeading__2350_1445225205 Configuring OpenVPN46]

[#__RefHeading__2352_1445225205 Certificate Authority47]

[#__RefHeading__2354_1445225205 Server Certificate48]

[#__RefHeading__2356_1445225205 Firewall Rules54]

[#__RefHeading__2358_1445225205 End of the Wizard54]

[#__RefHeading__2360_1445225205 Adding a User with a Certificate54]

[#__RefHeading__2362_1445225205 Installing the OpenVPN Client Export Package57]

[#__RefHeading__2364_1445225205 Exporting a Configuration57]

[#__RefHeading__2366_1445225205 Firewall Logs60]

[#__RefHeading__2368_1445225205 Setup Log File Location61]

[#__RefHeading__2370_1445225205 Enable Module and UDP Protocol61]

[#__RefHeading__2372_1445225205 Restart Rsyslog61]= NETWORK DIAGRAM =
[[Image:Gpil-000.jpg]]

'''Installation'''

'''pfSense''' is an open source firewall/router computer software distribution based on FreeBSD. It is installed on a computer to make a dedicated firewall/router for a network and is noted for its reliability[1] and offering features often only found in expensive commercial firewalls

'''Download pfSense'''

Visit https://www.pfsense.org/download/mirror.php?section=downloads

'''''Step 1 :- '''''

== Performing a Full Install (LiveCD) ==
Power on the target system and connect the install media: Place the CD into the drive or plug the Memstick into a USB port. If the BIOS is set to boot from CD/USB, pfSense will start.

[[Image:Gpil-001.jpeg]]

As the operating system boots and pfSense starts, a prompt is presented with some choices and a countdown timer. At this prompt, press ''i'' to invoke the installer now.

When the installer detects multiple disks in the system the first screen available provides the option '''Setup GEOM Mirror'''. Choose that option, pick the primary disk, the disk to use for the mirror copy, and then proceed with the installation as normal.

The Quick/Easy install choice will target the GEOM mirror automatically

[[Image:Gpil-002.jpeg]]

At the '''Select Task''' prompt, choose ''Quick/Easy Install''. [[Image:]]

[[Image:Gpil-003.jpeg]]

The install will proceed, wiping the target disk and installing pfSense. Copying files may take some time to finish.

After the files have been copied to the target disk, a choice is presented to select the console type. ''Standard'' defaults to the VGA console. ''Embedded'' defaults to serial console

[[Image:Gpil-004.jpeg]]

Now the system must reboot so that pfSense may start from the target disk. Select ''Reboot'' and then press '''Enter (remove CD from Drive)'''

[[Image:Gpil-005.jpeg]]

After the system reboots, pfSense will be running from the target disk. The next step is to Assign Interfaces on the Console below.

[[Image:Gpil-006.jpeg]]

After installation and assignment, a shell menu is presented on the console with a number of options. pfSense now is ready to be accessed via the network, LAN interface IP 192.168.1.1 is assigned by default.

Open a web browser and navigate to https://192.168.1.1/, using the default username admin and password pfsense to login.

The first visit to the WebGUI will be redirected to the setup wizard.

== GUI Configuration Setup ==
Once The Setup is launched, Fill the details are follows:-

[[Image:Gpil-007.jpeg]]

We have defined FQDN as gipl.firewall

DNS servers:- 8.8.8.8 and 4.4.2.2 Global DNS

Click NEXT

[[Image:Gpil-008.jpg]]

Select The Time-Zone as Asia/Kolkata .

And Click NEXT

[[Image:Gpil-009.jpg]]

Here we have Set WAN as Static Interface

With IP address :- 203.77.200.91/25

Gateway :- 203.77.200.1

Click Next.

[[Image:Gpil-010.jpg]]

Here we have Configured LAN interface with IP address 192.168.45.101/24

Click Next.

( note:-As per the client Network Topology , Lan interface have multiple Subnets configured , so we will be configuring Virtual IP’s from GUI )

After Setting Admin Password, Page will be redirected to Pfsense-Dashboard.

[[Image:Gpil-011.jpg]]

We Have Changed Default Port from 443 to 8080 Via :-

'''System > Advanced'''
[[Image:Gpil-012.jpg]]

Change TCP Port from Default 443 to 8080 .
[[Image:Gpil-013.jpg]]
Save .

Now pfsense Can be accessed via [https://IP:8080 https://IP:8080]

IP Address of Firewall is 203.77.200.91 on WAN interface.

Go to :- interface > assign , and edit Opt1 as DMZ , do not assign IP address to This interface , because we will be creating bridge interface .

== Configuration Of Bridge Interface ==
Now we have to configure '''Interface Bridges''' in order to Setup Pfsense in

Transparent mode.

Reference:- https://doc.pfsense.org/index.php/Interface_Bridges

Navigate To :- Interfaces > (assign)

on the Bridges tab Click “ +” symbol to add a new bridge .

Ctrl-Click to select the Member interfaces from the list of available interfaces and type a Description , we have selected WAN + DMZ as bridge0 and create new Interface BRIDGEINTERFACE using bridge0 .

[[Image:Gpil-014.jpg]]

By default, traffic is filtered on the member interfaces and not on the bridge interface itself. This behavior may be changed by toggling the values of '''net.link.bridge.pfil_member''' and net.link.bridge.pfil'''_bridge '''under System''' > Advanced '''on the '''System Tunables''' tab. With them set at ''0'' and ''1'', respectively, then filtering would be performed on the bridge only.

[[Image:Gpil-015.jpg]]

'''Now Pfsense is Configured In Bridge Mode with '''

'''WAN interface: - 203.77.200.91/25 gateway :- 203.77.200.1'''

'''LAN interface:- 192.168.45.101/24'''

'''DMZ: - no ip '''

'''BRIDGEINTERFACE:- 203.77.200.92/25'''

[[Image:Gpil-016.jpg]]

== Assign Virtual IP’s To LAN interface:- ==
[[Image:Gpil-018.jpg]]
Now as LAN environment have multiple Subnet configured, we will be assigning Virtual IP address to LAN interface.

[[Image:Gpil-017.jpg]]

Clients on LAN Environment have their Gateway Set from These Virtual IP’s.

203.77.196.230 is added for outside access of Local Servers 203.77.192.49/28.

(203.77.196.230) is configured in 203.77.192.2 switch which will receive any packet for 203.77.192.49/28 from Outside and send it to 203.77.196.230.

== Configuration of SNORT ==
'''Reference''' :- '''https://doc.pfsense.org/index.php/Setup_Snort_Package'''

Go to the '''Available Packages''' tab under the '''System''' menu and install the snort package.

 When the installation completes, click on '''Snort''' under the '''Services''' menu.  This will open the Snort main setup page.

Click the '''Global Settings''' tab and perform the following At the top of the page you have three choices for Rule Sets to activate.

Put Check mark on :-Install '''Snort Community''' rules , Install '''Emerging Threats''' rules , Install '''Snort VRT''' rules. And save.

The '''Updates''' tab is used to check the status of downloaded rules packages and to download new updates. The table shows the available rule packages and their current status [[Image:Gpil-019.jpg]]

Click Update Button to Update the rules.

== Add Snort to an interface ==
Click the Snort Interfaces tab and then the "+" icon to add a new Snort interface.

[[Image:Gpil-020.jpeg]]

 On the '''WAN Settings''' tab, click the ''Enable'' checkbox.In the drop-down, choose the interface.  The WAN interface is the default and is a good first choice.In the ''Description'' textbox, enter a name (WAN again, is fine here).Click the checkbox to "''Send alerts to the main System logs''".leave the other settings at their defaults

[[Image:Gpil-021.jpg]]

After saving, the browser will be returned to the Snort Interfaces tab. Note the warning icons in the image below showing no rules have been selected for the new Snort interface. Those rules will be configured next. Click the "e" icon to edit the new Snort interface again

[[Image:Gpil-022.jpeg]]

== Select which types of rules will protect the network ==
Click the '''Categories''' tab for the new interface

Check [https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=GPLv2_community.rules Snort GPLv2 Community Rules (VRT certified)] Box .

And Manual Rules :-

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-botcc.rules emerging-botcc.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_blacklist.rules snort_blacklist.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_exploit-kit.so.rules snort_exploit-kit.so.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_ddos.rules snort_ddos.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_dos.rules snort_dos.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_exploit-kit.rules snort_exploit-kit.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-malware.rules emerging-malware.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-mobile_malware.rules emerging-mobile_malware.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-tor.rules emerging-tor.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-trojan.rules emerging-trojan.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_malware-backdoor.rules snort_malware-backdoor.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_virus.rules snort_virus.rules]

[[Image:Gpil-023.jpg]]

Click SAVE when finished to save the selection and build the rules

After that restart the service

[[Image:Gpil-024.jpg]]

'''Managing Pass lists:-'''

'''Pass Lists are lists of IP addresses that Snort should never block. These may be created and managed on the Pass Lists tab. When an IP address is listed on a Pass List, Snort will never insert a block on that address even when malicious traffic is detected.'''

'''To create a new Pass List, click "+". To edit an existing Pass List, click the "e". To delete a Pass List, click "x". Note that a Pass List may not be deleted if it is currently assigned to one or more Snort interfaces.'''

We have added GIPL IP’s in Pass list . i.e''' 203.77.192.0/20'''

[[Image:Gpil-025.jpg]]

== IP Alias and Port Alias ==
IP aliases allow you to create a group of IP addresses that you can assign by group name instead of specifying each IP address individually. This can be great for specifying a group of servers that need ssh access and then in the firewall rules you can create a rule that allows ssh traffic for the ssh servers group.

Along the top menu hover over Firewall and click on Aliases.

[[Image:Gpil-026.jpg]]

The next tab is for setting up Port Aliases.  Similar to the IP Aliases you can setup groups but on this tab you are creating groups of ports instead of IP addresses.

[[Image:Gpil-027.jpg]]

IP Aliases Created.

[[Image:Gpil-028.jpg]]

PORT ALIAS CREATED

[[Image:Gpil-029.jpg]]

== Firewall Rules :- ==
Reference:- [https://doc.pfsense.org/index.php/Firewall_Rule_Basics https://doc.pfsense.org/index.php/Firewall_Rule_Basics]

Firewall rules control what traffic is allowed to enter an interface on the firewall. Once traffic is passed on the interface it enters an entry in the state table is created. A state table entry allows through subsequent packets that are part of that connection.

Firewall rules are managed at Firewall > Rules. Multiple rules may be selected for some actions by clicking on their row or checking the box at the start of their row. Rules may be deleted or reordered in bulk in this way. See Managing Lists of Items on pfSense for more information on the meaning of the icons when manipulating rules.

* '''any''' - ''0.0.0.0'' to ''255.255.255.255'', or all IPv6 addresses
* '''Single host or alias''' - Select this and enter one IP address (''1.2.3.4'', ''aa:bb:cc:dd::1'') or type the name of an Alias that has already been configured ('''Firewall > Aliases''')
* '''Network''' - Select this and enter a network and mask (''10.99.0.0/16'', ''aa:bb:cc:dd::0/64'')
* '''LAN net''' - The subnet configured on the LAN interface under '''Interfaces > LAN'''. On pfSense 2.2+, this also includes static route networks on that interface.
* '''LAN address''' - The IP address configured on the LAN interface under '''Interfaces > LAN'''
* '''zzz Net''' / '''zzz address''' - Works the same as LAN above but for other interfaces (WAN, OPT1, OPT2, etc.)
* '''PPTP clients''' - Automatically locate and use the addresses of PPTP clients
* '''L2TP clients''' - Automatically locate and use the addresses of L2TP clients
* '''This Firewall (self)''' - Any IP address assigned to any interface on this firewall (pfSense 2.2+)

Firewall rules are generally processed starting with Floating Rules, then Interface Group rules, then Interface tab rules

Rules Created on bridge interface, for DMZ access

[[Image:Gpil-030.jpg]]

[[Image:Gpil-031.jpg]]

'''LAN interface Rules Created:-'''

[[Image:Gpil-032.jpg]]

== Configuration Of Squid and Squidguard:- ==
'''Reference - '''[https://doc.pfsense.org/index.php/SquidGuard_package https://doc.pfsense.org/index.php/SquidGuard_package]

Login to your pfsense's Web Administrator, and click on "Server -> Packages", scroll down the list and find squid and click on "+" button to install, wait for the process to finish then return to the packages section and look for squidguard and install that package as well.

[[Image:Gpil-033.jpg]]

Now go to "Services" menu and look for Proxy Server & Proxy Filter

[[Image:Gpil-034.jpg]]

(We are setting up the proxy server as a transparent proxy)

Click on Services -> Proxy Server.

On the General Tab, you want to set the following settings, the Proxy Interface Option should be set to "LAN", to set up transparent proxy server, tick the "Transparent Proxy" check box.

[[Image:Gpil-035.jpg]]

Tick the "Enabled Logging" Checkbox, set the log store to the default location " /var/squid/logs " rotate your logs every 30 days, set your proxy port to port number 3128 We have By-passed Proxy for 203.77.192.49/28, These are the Local Servers.

Next click on the "Cache Mgmt." tab, by default the Hard Disk Cache Size is set to 100mb, we have allocated 100GB , Memory Cache Size 3072 .

[[Image:Gpil-036.jpg]]

Click on Save.

Click on the Access Control Tab next, in the allowed subnets field type in your required subnets. As we have multiple Subnets, so we are going to define all.

[[Image:Gpil-037.jpg]]

'''203.77.201.129/29'''

'''10.1.224.1/24'''

'''203.77.192.49/28'''

'''203.77.206.57/29'''

'''203.77.206.17/29'''

'''203.77.201.137/29'''

'''10.33.50.1/27'''

Click On Save

Now that’s is the proxy server configured, next we are going to configure SquidGuard, click on the Services menu and select the Proxy Filter button, tick the following 3 check boxes "Enable", "Enable GUI Log" and "Enable Log" then click the Save button, once the page has reloaded click on apply and then confirm that the Squidguard service is running by making sure the SquidGuard status is set to STARTED.

[[Image:Gpil-038.jpg]]

Click on the Black list tab and add URL '''http://www.shallalist.de/Downloads/shallalist.tar.gz''' to the Update Address and click on Download. Wait for the process to complete.

[[Image:Gpil-039.jpg]]

[[Image:Gpil-040.jpg]]

'''Now we can set up common ACL’s'''

[[Image:Gpil-041.jpg]]

[[Image:Gpil-042.jpg]]

'''Click on Save and restart the Squid and SquidGuard from Services. '''

== Configuration of SARG:- ==
After Installing SARG package, we can configure SARG from Status > Sarg Reports

[[Image:Gpil-043.jpg]]

Select Proxy Servers as SQUID proxy . And leave Rest of Field set to Default

And Save.

'''Now Go to Next Tab Schedule'''

Click “+” Symbol to create new schedule

[[Image:Gpil-044.jpg]]

'''Reports can be viewed From “View Reports”'''

[[Image:Gpil-045.jpg]]

== Configuration Of Bandwidthd:- ==
After Installing Package '''bandwidthd''' , Configuration can be done via

Services > bandwidthd

[[Image:Gpil-046.jpg]]

[[Image:Gpil-047.jpg]]

Enable Bandwidthd by checking the BOX.

Now Select the Interface: - LAN.

Enter The Subnets from LAN interface.

Click Save and Restart bandwidthd service from Services.

Now Bandwidthd can be accessed:-

[https://203.77.200.91:8080/bandwidthd/index.html https://203.77.200.91:8080/bandwidthd/index.html]

== Configuration Of ntopng:- ==
After installing ntopng package, it appears under Diagnostics > ntopng. It will even track where connections were made by local PCs, and how much bandwidth was used on individual connections.

[[Image:Gpil-048.jpg]]

First we have to configure ntopng settings. Via Diagnostics > ntopng settings.

[[Image:Gpil-049.jpg]]

<nowiki># Setup Admin Password </nowiki>

<nowiki># Select the Interfaces on Which ntopng will be monitoring traffic.</nowiki>

We have selected LAN, DMZ and BRIDGEINTERFACE

To save the changes Click “Change”

Ntopng can be accessed via [http://203.77.200.91:3000/login.html http://203.77.200.91:3000/login.html]

With username admin and password assigned in previous step.

= Configuring OpenVPN =
A VPN (virtual private network) allows us to connect directly to our home private network over the internet

The certificate authority or CA will sign the certificates that we will be creating for the server and client side when we configure OpenVPN. You can access the certificate configuration by going over to System–>Cert Manager.

[[Image:Gpil-050.jpg]]

Under the CAs tab you might already have a CA created if you followed one of my previous articles as we needed to created one in order to sign an internal certificate to be used for securing the pfSense web interface.

=== Certificate Authority ===
Fill in the fields to '''create a new Certificate Authority'''

* '''Descriptive Name''' - Used as the Common Name (CN) for the CA. Do not spaces, punctuation or special characters (ex: ''VPN Server CA'')
* '''Key Length''' - Default is OK, the higher the better but will use more CPU.
* '''Lifetime''' - Default is OK, but can be lowered if it must be changed out more often.
* '''Country Code''', '''State/Province''', '''City''', '''Organization''' - Enter values for this location/company.
* '''E-mail''' - Used as a reference on the certificate, does not receive any mail from the system.

Click '''Add New CA'''

[[Image:Gpil-051.jpg]]

After you finished setting up the CA the next step is to create some certificates that the recently created CA will sign for us. Since these are self-signed certificates most browsers will give you a warning

=== Server Certificate ===
Fill in the fields to create a new '''Server Certificate'''. Similar Fields as CA entry, most of the fields carry over and do not need changed.

Click '''Create new Certificate'''

[[Image:Gpil-052.jpg]]

Now that we have all the components in place we can configure OpenVPN. Head over to VPN–>OpenVPN.

.

[[Image:Gpil-053.jpg]]

Select “Wizards” from the tab at the top which will guide us step by step to configure OpenVPN

[[Image:Gpil-054.jpg]]

[[Image:Gpil-055.jpeg]]

We will select the local user access database provided by pfSense

In the next step we will be selecting the CA that we created at the beginning of this article.

[[Image:Gpil-056.jpeg]]

Following is the Server Certificate that we will be using which is the Certificate that we recently created.

[[Image:Gpil-057.jpg]]

'''OpenVPN Server Configuration'''

* '''TLS Authentication''' -- Leave this checked, along with the box underneath to generate a new key. Using a TLS key is technically optional, but ''highly'' recommended
* '''Tunnel Network''' -- Should be a new, unique network that does not exist anywhere in the current network or routing table.

[[Image:Gpil-058.jpg]]

[[Image:Gpil-059.jpg]]

[[Image:Gpil-060.jpg]]

Click '''Next'''

=== Firewall Rules ===
The next screen offers the choice to add firewall rules automatically. For convenience, check both unless the rules will be managed manually.

Click '''Next'''

=== End of the Wizard ===
Click '''Finish''' to exit the wizard and the new settings will be saved and applied automatically.

== Adding a User with a Certificate ==
Navigate to '''System > User Manager'''

Click "+" To add a '''user'''

Fill in '''Username'''

Fill in '''Password / Confirm password'''

Check Click to create a '''user certificate.'''

Fill in the Descriptive Name as the username

[[Image:Gpil-061.jpg]]

[[Image:Gpil-062.jpeg]]

The OpenVPN Client Export Package allows exporting configurations formatted for a wide variety of platforms. It also allows exporting a pre-packaged Windows installer executable which includes the configuration bundled inside for a painly client installation.

=== Installing the OpenVPN Client Export Package ===
To Install the OpenVPN Client Export Package

* Navigate to '''System > Packages''', '''Available Packages''' tab
* Find '''OpenVPN Client Export Package''' in the list

=== Exporting a Configuration ===
* Navigate to '''VPN > OpenVPN''' on the '''Client Export''' tab
* Choose the VPN from the '''Remote Access Server''' drop-down list
* Find the user in the list at the bottom of the page and select the appropriate configuration type to export.

[[Image:Gpil-063.jpg]]

[[Image:Gpil-064.jpg]]

Multiple instance of VPN server can be created with different tunnel network

[[Image:Gpil-065.jpg]]

Firewall Rules are applied as per the requirement on tunnel network .

[[Image:Gpil-066.jpg]]

= Firewall Logs =
The Firewall logs at '''Status > System Logs''' on the '''Firewall''' tab show all events logged by the firewall.

Each entry is displayed with the action ( pass or block, reject is only logged as block), time, interface, source, destination, and protocol.

Configuration Of rsyslog Server for Logs Storage:-

Status: >System logs > Settings

[[Image:Gpil-067.jpeg]]

'''Configuration of rsyslog on Centos :-'''

===== Setup Log File Location =====
Now edit Rsyslog configuration file and configure the location’s to generate log files in system.

<nowiki># vim /etc/rsyslog.conf</nowiki>

and add following lines as the end of file.

$template TmplAuth, "/var/log/%HOSTNAME%/%PROGRAMNAME%.log"

authpriv.* ?TmplAuth

<nowiki>*.info,mail.none,authpriv.none,cron.none </nowiki>?TmplMsg

===== Enable Module and UDP Protocol =====
Also remove comment from following lines ( remove starting # ) in rsyslog configuration file to enable UDP.

$ModLoad imudp

$UDPServerRun 514

===== Restart Rsyslog =====
After making above changes in Rsyslog central server, restart service using following command.

<nowiki># service rsyslog restart</nowiki>

'''Logrotation:-'''

Create file''' :- '''/etc/logrotate.d/pfsense

'''And enter:-'''

'''/var/log/pfsense/filterlog.log'''

'''{'''

'''daily'''

'''missingok'''

'''rotate 60'''

'''compress'''

'''notifempty'''

'''create 640 root root'''

'''postrotate'''

'''/etc/init.d/rsyslog restart >/dev/null'''

'''endscript'''

'''}'''

'''Save and Quit.'''

'''RRD Graphs:-'''

These are located under '''Status > RRD Graphs'''. Several graphs are presented for each monitored item, with varying time intervals and averages.

These graphs measure things such as CPU usage, memory usage, state table usage, throughput (in bytes as well as packets), link quality, traffic shaping queue usage, and so on.

[[Image:Gpil-068.jpg]]

PF Sense Firewall Implementation at GIPL

2015-04-16T10:21:11Z

2015-04-16T09:57:13Z

Manojsemwal:

File:Gpil-061.jpg

2015-04-16T09:56:55Z

Manojsemwal: