Editing PF Sense Firewall Implementation at GIPL

[[category:Tetra Clients]]
[[category:GSPC]]



<center><u>'''PF Sense Firewall Implementation at GIPL , GandhiNagar '''</u></center>



[[Image:Gpil-000.jpg]]




== Performing a Full Install (LiveCD) ==

'''Installation'''

'''pfSense''' is an open source firewall/router computer software distribution based on FreeBSD. It is installed on a computer to make a dedicated firewall/router for a network and is noted for its reliability[1] and offering features often only found in expensive commercial firewalls

'''Download pfSense'''

Visit https://www.pfsense.org/download/mirror.php?section=downloads


'''''Step 1 :- '''''

Power on the target system and connect the install media: Place the CD into the drive or plug the Memstick into a USB port. If the BIOS is set to boot from CD/USB, pfSense will start. 



[[Image:Gpil-001.jpeg]]


As the operating system boots and pfSense starts, a prompt is presented with some choices and a countdown timer. At this prompt, press ''i'' to invoke the installer now.

When the installer detects multiple disks in the system the first screen available provides the option '''Setup GEOM Mirror'''. Choose that option, pick the primary disk, the disk to use for the mirror copy, and then proceed with the installation as normal. 

The Quick/Easy install choice will target the GEOM mirror automatically

[[Image:Gpil-002.jpeg]]

At the '''Select Task''' prompt, choose ''Quick/Easy Install''. [[Image:Gpil-003.jpeg]]


[[Image:Gpil-004.jpeg]]

The install will proceed, wiping the target disk and installing pfSense. Copying files may take some time to finish. 

After the files have been copied to the target disk, a choice is presented to select the console type. ''Standard'' defaults to the VGA console. ''Embedded'' defaults to serial console

[[Image:Gpil-005.jpeg]]

Now the system must reboot so that pfSense may start from the target disk. Select ''Reboot'' and then press '''Enter (remove CD from Drive)'''


[[Image:Gpil-006.jpeg]]

After the system reboots, pfSense will be running from the target disk. The next step is to Assign Interfaces on the Console below.

[[Image:Gpil-007.jpeg]]

After installation and assignment, a shell menu is presented on the console with a number of options. pfSense now is ready to be accessed via the network, LAN interface IP 192.168.1.1 is assigned by default.

Open a web browser and navigate to https://192.168.1.1/, using the default username admin and password pfsense to login.

The first visit to the WebGUI will be redirected to the setup wizard.

== GUI Configuration Setup ==
Once The Setup is launched, Fill the details are follows:-


[[Image:Gpil-008.jpg]]

We have defined FQDN as gipl.firewall

DNS servers:- 8.8.8.8 and 4.4.2.2 Global DNS


Click NEXT

[[Image:Gpil-009.jpg]]


Select The Time-Zone as Asia/Kolkata .


And Click NEXT


[[Image:Gpil-010.jpg]]


Here we have Set WAN as Static Interface

With IP address :- 203.77.200.91/25

Gateway :- 203.77.200.1


Click Next.


[[Image:Gpil-011.jpg]]

Here we have Configured LAN interface with IP address 192.168.45.101/24

Click Next.

( note:-As per the client Network Topology , Lan interface have multiple Subnets configured , so we will be configuring Virtual IP’s from GUI )

After Setting Admin Password, Page will be redirected to Pfsense-Dashboard.





We Have Changed Default Port from 443 to 8080 Via :-
[[Image:Gpil-012.jpg]]

'''System > Advanced'''



[[Image:Gpil-013.jpg]]


Change TCP Port from Default 443 to 8080 .

Save .

Now pfsense Can be accessed via [https://IP:8080 https://IP:8080]

IP Address of Firewall is 203.77.200.91 on WAN interface.

Go to :- interface > assign , and edit Opt1 as DMZ , do not assign IP address to This interface , because we will be creating bridge interface .


== Configuration Of Bridge Interface ==
Now we have to configure '''Interface Bridges''' in order to Setup Pfsense in 

Transparent mode.

Reference:- <u>https://doc.pfsense.org/index.php/Interface_Bridges</u>

Navigate To :- Interfaces > (assign) 

on the Bridges tab Click “ +” symbol to add a new bridge .
[[Image:Gpil-014.jpg]] 

Ctrl-Click to select the Member interfaces from the list of available interfaces and type a Description , we have selected WAN + DMZ as bridge0 and create new Interface BRIDGEINTERFACE using bridge0 .

[[Image:Gpil-015.jpg]]


By default, traffic is filtered on the member interfaces and not on the bridge interface itself. This behavior may be changed by toggling the values of '''net.link.bridge.pfil_member''' and net.link.bridge.pfil'''_bridge '''under System''' > Advanced '''on the '''System Tunables''' tab. With them set at ''0'' and ''1'', respectively, then filtering would be performed on the bridge only.


[[Image:Gpil-016.jpg]]


'''Now Pfsense is Configured In Bridge Mode with '''

'''WAN interface: - 203.77.200.91/25 gateway :- 203.77.200.1'''

'''LAN interface:- 192.168.45.101/24'''

'''DMZ: - no ip '''

'''BRIDGEINTERFACE:- 203.77.200.92/25'''

[[Image:Gpil-017.jpg]]

== Assign Virtual IP’s To LAN interface:- ==
[[Image:Gpil-018.jpg]]
Now as LAN environment have multiple Subnet configured, we will be assigning Virtual IP address to LAN interface.

[[Image:Gpil-019.jpg]]

Clients on LAN Environment have their Gateway Set from These Virtual IP’s.

203.77.196.230 is added for outside access of Local Servers 203.77.192.49/28.

(203.77.196.230) is configured in 203.77.192.2 switch which will receive any packet for 203.77.192.49/28 from Outside and send it to 203.77.196.230.


== Configuration of SNORT  ==
<u>'''Reference'''</u> :- <u>'''https://doc.pfsense.org/index.php/Setup_Snort_Package'''</u>

Go to the '''Available Packages''' tab under the '''System''' menu and install the snort package.

&nbsp;When the installation completes, click on '''Snort''' under the '''Services''' menu. &nbsp;This will open the Snort main setup page.

Click the '''Global Settings''' tab and perform the following At the top of the page you have three choices for Rule Sets to activate.

Put Check mark on :-Install '''Snort Community''' rules , Install '''Emerging Threats''' rules , Install '''Snort VRT''' rules. And save.


The '''Updates''' tab is used to check the status of downloaded rules packages and to download new updates. The table shows the available rule packages and their current status [[Image:Gpil-020.jpeg]]


Click Update Button to Update the rules.
[[Image:Gpil-021.jpg]]

== Add Snort to an interface ==
Click the Snort Interfaces tab and then the "+" icon to add a new Snort interface.



&nbsp;On the '''WAN Settings''' tab, click the ''Enable'' checkbox.In the drop-down, choose the interface. &nbsp;The WAN interface is the default and is a good first choice.In the ''Description'' textbox, enter a name (WAN again, is fine here).Click the checkbox to "''Send alerts to the main System logs''".leave the other settings at their defaults

[[Image:Gpil-022.jpeg]]

After saving, the browser will be returned to the Snort Interfaces tab. Note the warning icons in the image below showing no rules have been selected for the new Snort interface. Those rules will be configured next. Click the "e" icon to edit the new Snort interface again

[[Image:Gpil-023.jpg]]


== Select which types of rules will protect the network ==
Click the '''Categories''' tab for the new interface

Check [https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=GPLv2_community.rules Snort GPLv2 Community Rules (VRT certified)] Box .

And Manual Rules :-

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-botcc.rules emerging-botcc.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_blacklist.rules snort_blacklist.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_exploit-kit.so.rules snort_exploit-kit.so.rules] 

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_ddos.rules snort_ddos.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_dos.rules snort_dos.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_exploit-kit.rules snort_exploit-kit.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-malware.rules emerging-malware.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-mobile_malware.rules emerging-mobile_malware.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-tor.rules emerging-tor.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-trojan.rules emerging-trojan.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_malware-backdoor.rules snort_malware-backdoor.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_virus.rules snort_virus.rules]


[[Image:Gpil-024.jpg]]

Click SAVE when finished to save the selection and build the rules 

After that restart the service 

[[Image:Gpil-025.jpg]]

'''Managing Pass lists:-'''

'''Pass Lists are lists of IP addresses that Snort should never block. These may be created and managed on the Pass Lists tab. When an IP address is listed on a Pass List, Snort will never insert a block on that address even when malicious traffic is detected.'''


'''To create a new Pass List, click "+". To edit an existing Pass List, click the "e". To delete a Pass List, click "x". Note that a Pass List may not be deleted if it is currently assigned to one or more Snort interfaces.'''


We have added GIPL IP’s in Pass list . i.e''' <u>203.77.192.0/20'''</u>


[[Image:Gpil-026.jpg]]


== IP Alias and Port Alias ==
IP aliases allow you to create a group of IP addresses that you can assign by group name instead of specifying each IP address individually. This can be great for specifying a group of servers that need ssh access and then in the firewall rules you can create a rule that allows ssh traffic for the ssh servers group.


Along the top menu hover over Firewall and click on Aliases.

[[Image:Gpil-027.jpg]]


The next tab is for setting up Port Aliases. &nbsp;Similar to the IP Aliases you can setup groups but on this tab you are creating groups of ports instead of IP addresses.

[[Image:Gpil-028.jpeg]]


IP Aliases Created.


[[Image:Gpil-029.jpg]]


PORT ALIAS CREATED

[[Image:Gpil-030.jpg]]


== Firewall Rules :- ==
Reference:- [https://doc.pfsense.org/index.php/Firewall_Rule_Basics https://doc.pfsense.org/index.php/Firewall_Rule_Basics]

Firewall rules control what traffic is allowed to enter an interface on the firewall. Once traffic is passed on the interface it enters an entry in the state table is created. A state table entry allows through subsequent packets that are part of that connection.

Firewall rules are managed at Firewall > Rules. Multiple rules may be selected for some actions by clicking on their row or checking the box at the start of their row. Rules may be deleted or reordered in bulk in this way. See Managing Lists of Items on pfSense for more information on the meaning of the icons when manipulating rules.

* '''any''' - ''0.0.0.0'' to ''255.255.255.255'', or all IPv6 addresses 
* '''Single host or alias''' - Select this and enter one IP address (''1.2.3.4'', ''aa:bb:cc:dd::1'') or type the name of an Alias that has already been configured ('''Firewall > Aliases''') 
* '''Network''' - Select this and enter a network and mask (''10.99.0.0/16'', ''aa:bb:cc:dd::0/64'') 
* '''LAN net''' - The subnet configured on the LAN interface under '''Interfaces > LAN'''. On pfSense 2.2+, this also includes static route networks on that interface. 
* '''LAN address''' - The IP address configured on the LAN interface under '''Interfaces > LAN''' 
* '''zzz Net''' / '''zzz address''' - Works the same as LAN above but for other interfaces (WAN, OPT1, OPT2, etc.) 
* '''PPTP clients''' - Automatically locate and use the addresses of PPTP clients 
* '''L2TP clients''' - Automatically locate and use the addresses of L2TP clients 
* '''This Firewall (self)''' - Any IP address assigned to any interface on this firewall (pfSense 2.2+) 

Firewall rules are generally processed starting with Floating Rules, then Interface Group rules, then Interface tab rules


Rules Created on bridge interface, for DMZ access


[[Image:Gpil-031.jpg]]


[[Image:Gpil-032.jpg]]

'''LAN interface Rules Created:-'''


[[Image:Gpil-033.jpg]]


== Configuration Of Squid and Squidguard:- ==
'''Reference - '''[https://doc.pfsense.org/index.php/SquidGuard_package https://doc.pfsense.org/index.php/SquidGuard_package]


Login to your pfsense's Web Administrator, and click on "Server -> Packages", scroll down the list and find squid and click on "+" button to install, wait for the process to finish then return to the packages section and look for squidguard and install that package as well.

[[Image:Gpil-034.jpg]]


Now go to "Services" menu and look for Proxy Server & Proxy Filter 

[[Image:Gpil-035.jpg]]

(We are setting up the proxy server as a transparent proxy)


Click on Services -> Proxy Server.

On the General Tab, you want to set the following settings, the Proxy Interface Option should be set to "LAN", to set up transparent proxy server, tick the "Transparent Proxy" check box.


[[Image:Gpil-036.jpg]]


Tick the "Enabled Logging" Checkbox, set the log store to the default location " /var/squid/logs " rotate your logs every 30 days, set your proxy port to port number 3128 We have By-passed Proxy for 203.77.192.49/28, These are the Local Servers.


Next click on the "Cache Mgmt." tab, by default the Hard Disk Cache Size is set to 100mb, we have allocated 100GB , Memory Cache Size 3072 .


[[Image:Gpil-037.jpg]]

Click on Save.

Click on the Access Control Tab next, in the allowed subnets field type in your required subnets. As we have multiple Subnets, so we are going to define all.


[[Image:Gpil-038.jpg]]

'''203.77.201.129/29'''

'''10.1.224.1/24'''

'''203.77.192.49/28'''

'''203.77.206.57/29'''

'''203.77.206.17/29'''

'''203.77.201.137/29'''

'''10.33.50.1/27'''

Click On Save 


Now that’s is the proxy server configured, next we are going to configure SquidGuard, click on the Services menu and select the Proxy Filter button, tick the following 3 check boxes "Enable", "Enable GUI Log" and "Enable Log" then click the Save button, once the page has reloaded click on apply and then confirm that the Squidguard service is running by making sure the SquidGuard status is set to STARTED.


[[Image:Gpil-039.jpg]]


Click on the Black list tab and add URL '''http://www.shallalist.de/Downloads/shallalist.tar.gz''' to the Update Address and click on Download. Wait for the process to complete.

[[Image:Gpil-040.jpg]]

[[Image:Gpil-041.jpg]]

'''Now we can set up common ACL’s'''

[[Image:Gpil-042.jpg]]

[[Image:Gpil-043.jpg]]


'''Click on Save and restart the Squid and SquidGuard from Services. '''


== Configuration of SARG:- ==
After Installing SARG package, we can configure SARG from Status > Sarg Reports


[[Image:Gpil-044.jpg]]


Select Proxy Servers as SQUID proxy . And leave Rest of Field set to Default

And Save.


'''Now Go to Next Tab Schedule'''


Click “+” Symbol to create new schedule 


[[Image:Gpil-045.jpg]] 


'''Reports can be viewed From “View Reports”'''


[[Image:Gpil-046.jpg]]


== Configuration Of Bandwidthd:- ==
After Installing Package '''bandwidthd''' , Configuration can be done via

Services > bandwidthd

[[Image:Gpil-047.jpg]]


[[Image:Gpil-048.jpg]]

Enable Bandwidthd by checking the BOX.

Now Select the Interface: - LAN.

Enter The Subnets from LAN interface.


Click Save and Restart bandwidthd service from Services.

Now Bandwidthd can be accessed:-

[https://203.77.200.91:8080/bandwidthd/index.html https://203.77.200.91:8080/bandwidthd/index.html]


== Configuration Of ntopng:- ==
After installing ntopng package, it appears under Diagnostics > ntopng. It will even track where connections were made by local PCs, and how much bandwidth was used on individual connections.


[[Image:Gpil-049.jpg]]


First we have to configure ntopng settings. Via Diagnostics > ntopng settings.


[[Image:Gpil-050.jpg]]


<nowiki># Setup Admin Password </nowiki>

<nowiki># Select the Interfaces on Which ntopng will be monitoring traffic.</nowiki>

We have selected LAN, DMZ and BRIDGEINTERFACE


To save the changes Click “Change”

Ntopng can be accessed via [http://203.77.200.91:3000/login.html http://203.77.200.91:3000/login.html]

With username admin and password assigned in previous step.


= Configuring OpenVPN  =
A VPN (virtual private network) allows us to connect directly to our home private network over the internet

The certificate authority or CA will sign the certificates that we will be creating for the server and client side when we configure OpenVPN. You can access the certificate configuration by going over to System–>Cert Manager.

[[Image:Gpil-051.jpg]]


Under the CAs tab you might already have a CA created if you followed one of my previous articles as we needed to created one in order to sign an internal certificate to be used for securing the pfSense web interface.


=== Certificate Authority ===
Fill in the fields to '''create a new Certificate Authority''' 

* '''Descriptive Name''' - Used as the Common Name (CN) for the CA. Do not spaces, punctuation or special characters (ex: ''VPN Server CA'') 
* '''Key Length''' - Default is OK, the higher the better but will use more CPU. 
* '''Lifetime''' - Default is OK, but can be lowered if it must be changed out more often. 
* '''Country Code''', '''State/Province''', '''City''', '''Organization''' - Enter values for this location/company. 
* '''E-mail''' - Used as a reference on the certificate, does not receive any mail from the system. 

Click '''Add New CA''' 


[[Image:Gpil-052.jpg]]


After you finished setting up the CA the next step is to create some certificates that the recently created CA will sign for us. Since these are self-signed certificates most browsers will give you a warning


=== Server Certificate ===
Fill in the fields to create a new '''Server Certificate'''. Similar Fields as CA entry, most of the fields carry over and do not need changed. 

Click '''Create new Certificate''' 


[[Image:Gpil-053.jpg]]


Now that we have all the components in place we can configure OpenVPN. Head over to VPN–>OpenVPN.

.

[[Image:Gpil-054.jpeg]]


Select “Wizards” from the tab at the top which will guide us step by step to configure OpenVPN


[[Image:Gpil-055.jpeg]]


[[Image:Gpil-056.jpeg]]

We will select the local user access database provided by pfSense

In the next step we will be selecting the CA that we created at the beginning of this article.

[[Image:Gpil-057.jpg]]


Following is the Server Certificate that we will be using which is the Certificate that we recently created.


[[Image:Gpil-058.jpg]]

'''OpenVPN Server Configuration'''

* '''TLS Authentication''' -- Leave this checked, along with the box underneath to generate a new key. Using a TLS key is technically optional, but ''highly'' recommended
* '''Tunnel Network''' -- Should be a new, unique network that does not exist anywhere in the current network or routing table. 

[[Image:Gpil-059.jpg]]

[[Image:Gpil-060.jpg]]

[[Image:Gpil-061.jpg]]

Click '''Next''' 

=== Firewall Rules ===
The next screen offers the choice to add firewall rules automatically. For convenience, check both unless the rules will be managed manually. 

Click '''Next''' 

=== End of the Wizard ===
Click '''Finish''' to exit the wizard and the new settings will be saved and applied automatically. 

== Adding a User with a Certificate ==
Navigate to '''System > User Manager'''

Click "+" To add a '''user'''

Fill in '''Username'''

Fill in '''Password / Confirm password'''

Check Click to create a '''user certificate.'''

Fill in the Descriptive Name as the username

[[Image:Gpil-062.jpeg]]

[[Image:Gpil-063.jpg]]


The OpenVPN Client Export Package allows exporting configurations formatted for a wide variety of platforms. It also allows exporting a pre-packaged Windows installer executable which includes the configuration bundled inside for a painly client installation. 

=== Installing the OpenVPN Client Export Package ===
To Install the OpenVPN Client Export Package 

* Navigate to '''System > Packages''', '''Available Packages''' tab 
* Find '''OpenVPN Client Export Package''' in the list 

=== Exporting a Configuration ===
* Navigate to '''VPN > OpenVPN''' on the '''Client Export''' tab 
* Choose the VPN from the '''Remote Access Server''' drop-down list 
* Find the user in the list at the bottom of the page and select the appropriate configuration type to export. 

[[Image:Gpil-064.jpg]]


[[Image:Gpil-065.jpg]]


Multiple instance of VPN server can be created with different tunnel network 

[[Image:Gpil-066.jpg]]


Firewall Rules are applied as per the requirement on tunnel network .


[[Image:Gpil-067.jpeg]]


= Firewall Logs =
The Firewall logs at '''Status > System Logs''' on the '''Firewall''' tab show all events logged by the firewall.


Each entry is displayed with the action ( pass or block, reject is only logged as block), time, interface, source, destination, and protocol.


Configuration Of rsyslog Server for Logs Storage:-

Status: >System logs > Settings


[[Image:Gpil-068.jpg]]


'''Configuration of rsyslog on Centos :-'''


===== Setup Log File Location =====
Now edit Rsyslog configuration file and configure the location’s to generate log files in system.

<nowiki># vim /etc/rsyslog.conf</nowiki>


and add following lines as the end of file.

$template TmplAuth, "/var/log/%HOSTNAME%/%PROGRAMNAME%.log" 


authpriv.* ?TmplAuth

<nowiki>*.info,mail.none,authpriv.none,cron.none </nowiki>?TmplMsg


===== Enable Module and UDP Protocol =====
Also remove comment from following lines ( remove starting # ) in rsyslog configuration file to enable UDP.

$ModLoad imudp

$UDPServerRun 514


===== Restart Rsyslog  =====
After making above changes in Rsyslog central server, restart service using following command.

<nowiki># service rsyslog restart</nowiki>


'''Logrotation:-'''

Create file''' :- '''/etc/logrotate.d/pfsense


'''And enter:-'''


'''/var/log/pfsense/filterlog.log'''

'''{'''

'''daily'''

'''missingok'''

'''rotate 60'''

'''compress'''

'''notifempty'''

'''create 640 root root'''

'''postrotate'''

'''/etc/init.d/rsyslog restart >/dev/null'''

'''endscript'''

'''}'''


'''Save and Quit.'''


'''RRD Graphs:-'''


These are located under '''Status > RRD Graphs'''. Several graphs are presented for each monitored item, with varying time intervals and averages. 

These graphs measure things such as CPU usage, memory usage, state table usage, throughput (in bytes as well as packets), link quality, traffic shaping queue usage, and so on. 


[[Image:Gpil-069.jpg]]