PF Sense Firewall Implementation at GIPL

PF Sense Firewall Implementation at GIPL , GandhiNagar

Installation

pfSense is an open source firewall/router computer software distribution based on FreeBSD. It is installed on a computer to make a dedicated firewall/router for a network and is noted for its reliability[1] and offering features often only found in expensive commercial firewalls

Download pfSense

Visit https://www.pfsense.org/download/mirror.php?section=downloads

Step 1 :-

Performing a Full Install (LiveCD)

Power on the target system and connect the install media: Place the CD into the drive or plug the Memstick into a USB port. If the BIOS is set to boot from CD/USB, pfSense will start.

As the operating system boots and pfSense starts, a prompt is presented with some choices and a countdown timer. At this prompt, press i to invoke the installer now.

When the installer detects multiple disks in the system the first screen available provides the option Setup GEOM Mirror. Choose that option, pick the primary disk, the disk to use for the mirror copy, and then proceed with the installation as normal.

The Quick/Easy install choice will target the GEOM mirror automatically

At the Select Task prompt, choose Quick/Easy Install.

The install will proceed, wiping the target disk and installing pfSense. Copying files may take some time to finish.

After the files have been copied to the target disk, a choice is presented to select the console type. Standard defaults to the VGA console. Embedded defaults to serial console

Now the system must reboot so that pfSense may start from the target disk. Select Reboot and then press Enter (remove CD from Drive)

After the system reboots, pfSense will be running from the target disk. The next step is to Assign Interfaces on the Console below.

After installation and assignment, a shell menu is presented on the console with a number of options. pfSense now is ready to be accessed via the network, LAN interface IP 192.168.1.1 is assigned by default.

Open a web browser and navigate to https://192.168.1.1/, using the default username admin and password pfsense to login.

The first visit to the WebGUI will be redirected to the setup wizard.

GUI Configuration Setup

Once The Setup is launched, Fill the details are follows:-

We have defined FQDN as gipl.firewall

DNS servers:- 8.8.8.8 and 4.4.2.2 Global DNS

Click NEXT

Select The Time-Zone as Asia/Kolkata .

And Click NEXT

Here we have Set WAN as Static Interface

With IP address :- 203.77.200.91/25

Gateway :- 203.77.200.1

Click Next.

Here we have Configured LAN interface with IP address 192.168.45.101/24

Click Next.

( note:-As per the client Network Topology , Lan interface have multiple Subnets configured , so we will be configuring Virtual IP’s from GUI )

After Setting Admin Password, Page will be redirected to Pfsense-Dashboard.

We Have Changed Default Port from 443 to 8080 Via :-

System > Advanced

Change TCP Port from Default 443 to 8080 .

Save .

Now pfsense Can be accessed via https://IP:8080

IP Address of Firewall is 203.77.200.91 on WAN interface.

Go to :- interface > assign , and edit Opt1 as DMZ , do not assign IP address to This interface , because we will be creating bridge interface .

Configuration Of Bridge Interface

Now we have to configure Interface Bridges in order to Setup Pfsense in

Transparent mode.

Reference:- https://doc.pfsense.org/index.php/Interface_Bridges

Navigate To :- Interfaces > (assign)

on the Bridges tab Click “ +” symbol to add a new bridge .

Ctrl-Click to select the Member interfaces from the list of available interfaces and type a Description , we have selected WAN + DMZ as bridge0 and create new Interface BRIDGEINTERFACE using bridge0 .

By default, traffic is filtered on the member interfaces and not on the bridge interface itself. This behavior may be changed by toggling the values of net.link.bridge.pfil_member and net.link.bridge.pfil_bridge under System > Advanced on the System Tunables tab. With them set at 0 and 1, respectively, then filtering would be performed on the bridge only.

Now Pfsense is Configured In Bridge Mode with

WAN interface: - 203.77.200.91/25 gateway :- 203.77.200.1

LAN interface:- 192.168.45.101/24

DMZ: - no ip

BRIDGEINTERFACE:- 203.77.200.92/25

Assign Virtual IP’s To LAN interface:-

Now as LAN environment have multiple Subnet configured, we will be assigning Virtual IP address to LAN interface.

Clients on LAN Environment have their Gateway Set from These Virtual IP’s.

203.77.196.230 is added for outside access of Local Servers 203.77.192.49/28.

(203.77.196.230) is configured in 203.77.192.2 switch which will receive any packet for 203.77.192.49/28 from Outside and send it to 203.77.196.230.

Configuration of SNORT

Reference :- https://doc.pfsense.org/index.php/Setup_Snort_Package

Go to the Available Packages tab under the System menu and install the snort package.

 When the installation completes, click on Snort under the Services menu.  This will open the Snort main setup page.

Click the Global Settings tab and perform the following At the top of the page you have three choices for Rule Sets to activate.

Put Check mark on :-Install Snort Community rules , Install Emerging Threats rules , Install Snort VRT rules. And save.

The Updates tab is used to check the status of downloaded rules packages and to download new updates. The table shows the available rule packages and their current status

Click Update Button to Update the rules.

Add Snort to an interface

Click the Snort Interfaces tab and then the "+" icon to add a new Snort interface.

 On the WAN Settings tab, click the Enable checkbox.In the drop-down, choose the interface.  The WAN interface is the default and is a good first choice.In the Description textbox, enter a name (WAN again, is fine here).Click the checkbox to "Send alerts to the main System logs".leave the other settings at their defaults

File:Gpil-022.jpg

After saving, the browser will be returned to the Snort Interfaces tab. Note the warning icons in the image below showing no rules have been selected for the new Snort interface. Those rules will be configured next. Click the "e" icon to edit the new Snort interface again

Select which types of rules will protect the network

Click the Categories tab for the new interface

Check Snort GPLv2 Community Rules (VRT certified) Box .

And Manual Rules :-

emerging-botcc.rules

snort_blacklist.rules

snort_exploit-kit.so.rules

snort_ddos.rules

snort_dos.rules

snort_exploit-kit.rules

emerging-malware.rules

emerging-mobile_malware.rules

emerging-tor.rules

emerging-trojan.rules

snort_malware-backdoor.rules

snort_virus.rules

Click SAVE when finished to save the selection and build the rules

After that restart the service

Managing Pass lists:-

Pass Lists are lists of IP addresses that Snort should never block. These may be created and managed on the Pass Lists tab. When an IP address is listed on a Pass List, Snort will never insert a block on that address even when malicious traffic is detected.

To create a new Pass List, click "+". To edit an existing Pass List, click the "e". To delete a Pass List, click "x". Note that a Pass List may not be deleted if it is currently assigned to one or more Snort interfaces.

We have added GIPL IP’s in Pass list . i.e 203.77.192.0/20

IP Alias and Port Alias

IP aliases allow you to create a group of IP addresses that you can assign by group name instead of specifying each IP address individually. This can be great for specifying a group of servers that need ssh access and then in the firewall rules you can create a rule that allows ssh traffic for the ssh servers group.

Along the top menu hover over Firewall and click on Aliases.

The next tab is for setting up Port Aliases.  Similar to the IP Aliases you can setup groups but on this tab you are creating groups of ports instead of IP addresses.

IP Aliases Created.

PORT ALIAS CREATED

Firewall Rules :-

Reference:- https://doc.pfsense.org/index.php/Firewall_Rule_Basics

Firewall rules control what traffic is allowed to enter an interface on the firewall. Once traffic is passed on the interface it enters an entry in the state table is created. A state table entry allows through subsequent packets that are part of that connection.

Firewall rules are managed at Firewall > Rules. Multiple rules may be selected for some actions by clicking on their row or checking the box at the start of their row. Rules may be deleted or reordered in bulk in this way. See Managing Lists of Items on pfSense for more information on the meaning of the icons when manipulating rules.

• any - 0.0.0.0 to 255.255.255.255, or all IPv6 addresses
• Single host or alias - Select this and enter one IP address (1.2.3.4, aa:bb:cc:dd::1) or type the name of an Alias that has already been configured (Firewall > Aliases)
• Network - Select this and enter a network and mask (10.99.0.0/16, aa:bb:cc:dd::0/64)
• LAN net - The subnet configured on the LAN interface under Interfaces > LAN. On pfSense 2.2+, this also includes static route networks on that interface.
• LAN address - The IP address configured on the LAN interface under Interfaces > LAN
• zzz Net / zzz address - Works the same as LAN above but for other interfaces (WAN, OPT1, OPT2, etc.)
• PPTP clients - Automatically locate and use the addresses of PPTP clients
• L2TP clients - Automatically locate and use the addresses of L2TP clients
• This Firewall (self) - Any IP address assigned to any interface on this firewall (pfSense 2.2+)

Firewall rules are generally processed starting with Floating Rules, then Interface Group rules, then Interface tab rules

Rules Created on bridge interface, for DMZ access

LAN interface Rules Created:-

Configuration Of Squid and Squidguard:-

Reference - https://doc.pfsense.org/index.php/SquidGuard_package

Login to your pfsense's Web Administrator, and click on "Server -> Packages", scroll down the list and find squid and click on "+" button to install, wait for the process to finish then return to the packages section and look for squidguard and install that package as well.

Now go to "Services" menu and look for Proxy Server & Proxy Filter

(We are setting up the proxy server as a transparent proxy)

Click on Services -> Proxy Server.

On the General Tab, you want to set the following settings, the Proxy Interface Option should be set to "LAN", to set up transparent proxy server, tick the "Transparent Proxy" check box.

Tick the "Enabled Logging" Checkbox, set the log store to the default location " /var/squid/logs " rotate your logs every 30 days, set your proxy port to port number 3128 We have By-passed Proxy for 203.77.192.49/28, These are the Local Servers.

Next click on the "Cache Mgmt." tab, by default the Hard Disk Cache Size is set to 100mb, we have allocated 100GB , Memory Cache Size 3072 .

Click on Save.

Click on the Access Control Tab next, in the allowed subnets field type in your required subnets. As we have multiple Subnets, so we are going to define all.

203.77.201.129/29

10.1.224.1/24

203.77.192.49/28

203.77.206.57/29

203.77.206.17/29

203.77.201.137/29

10.33.50.1/27

Click On Save

Now that’s is the proxy server configured, next we are going to configure SquidGuard, click on the Services menu and select the Proxy Filter button, tick the following 3 check boxes "Enable", "Enable GUI Log" and "Enable Log" then click the Save button, once the page has reloaded click on apply and then confirm that the Squidguard service is running by making sure the SquidGuard status is set to STARTED.

Click on the Black list tab and add URL http://www.shallalist.de/Downloads/shallalist.tar.gz to the Update Address and click on Download. Wait for the process to complete.

Now we can set up common ACL’s

Click on Save and restart the Squid and SquidGuard from Services.

Configuration of SARG:-

After Installing SARG package, we can configure SARG from Status > Sarg Reports

Select Proxy Servers as SQUID proxy . And leave Rest of Field set to Default

And Save.

Now Go to Next Tab Schedule

Click “+” Symbol to create new schedule

Reports can be viewed From “View Reports”

Configuration Of Bandwidthd:-

After Installing Package bandwidthd , Configuration can be done via

Services > bandwidthd

Enable Bandwidthd by checking the BOX.

Now Select the Interface: - LAN.

Enter The Subnets from LAN interface.

Click Save and Restart bandwidthd service from Services.

Now Bandwidthd can be accessed:-

https://203.77.200.91:8080/bandwidthd/index.html

Configuration Of ntopng:-

After installing ntopng package, it appears under Diagnostics > ntopng. It will even track where connections were made by local PCs, and how much bandwidth was used on individual connections.

First we have to configure ntopng settings. Via Diagnostics > ntopng settings.

# Setup Admin Password

# Select the Interfaces on Which ntopng will be monitoring traffic.

We have selected LAN, DMZ and BRIDGEINTERFACE

To save the changes Click “Change”

Ntopng can be accessed via http://203.77.200.91:3000/login.html

With username admin and password assigned in previous step.

Configuring OpenVPN

A VPN (virtual private network) allows us to connect directly to our home private network over the internet

The certificate authority or CA will sign the certificates that we will be creating for the server and client side when we configure OpenVPN. You can access the certificate configuration by going over to System–>Cert Manager.

Under the CAs tab you might already have a CA created if you followed one of my previous articles as we needed to created one in order to sign an internal certificate to be used for securing the pfSense web interface.

Certificate Authority

Fill in the fields to create a new Certificate Authority

• Descriptive Name - Used as the Common Name (CN) for the CA. Do not spaces, punctuation or special characters (ex: VPN Server CA)
• Key Length - Default is OK, the higher the better but will use more CPU.
• Lifetime - Default is OK, but can be lowered if it must be changed out more often.
• Country Code, State/Province, City, Organization - Enter values for this location/company.
• E-mail - Used as a reference on the certificate, does not receive any mail from the system.

Click Add New CA

After you finished setting up the CA the next step is to create some certificates that the recently created CA will sign for us. Since these are self-signed certificates most browsers will give you a warning

Server Certificate

Fill in the fields to create a new Server Certificate. Similar Fields as CA entry, most of the fields carry over and do not need changed.

Click Create new Certificate

Now that we have all the components in place we can configure OpenVPN. Head over to VPN–>OpenVPN.

.

Select “Wizards” from the tab at the top which will guide us step by step to configure OpenVPN

We will select the local user access database provided by pfSense

In the next step we will be selecting the CA that we created at the beginning of this article.

Following is the Server Certificate that we will be using which is the Certificate that we recently created.

OpenVPN Server Configuration

• TLS Authentication -- Leave this checked, along with the box underneath to generate a new key. Using a TLS key is technically optional, but highly recommended
• Tunnel Network -- Should be a new, unique network that does not exist anywhere in the current network or routing table.

Click Next

Firewall Rules

The next screen offers the choice to add firewall rules automatically. For convenience, check both unless the rules will be managed manually.

Click Next

End of the Wizard

Click Finish to exit the wizard and the new settings will be saved and applied automatically.

Adding a User with a Certificate

Navigate to System > User Manager

Click "+" To add a user

Fill in Username

Fill in Password / Confirm password

Check Click to create a user certificate.

Fill in the Descriptive Name as the username

The OpenVPN Client Export Package allows exporting configurations formatted for a wide variety of platforms. It also allows exporting a pre-packaged Windows installer executable which includes the configuration bundled inside for a painly client installation.

Installing the OpenVPN Client Export Package

To Install the OpenVPN Client Export Package

• Navigate to System > Packages, Available Packages tab
• Find OpenVPN Client Export Package in the list

Exporting a Configuration

• Navigate to VPN > OpenVPN on the Client Export tab
• Choose the VPN from the Remote Access Server drop-down list
• Find the user in the list at the bottom of the page and select the appropriate configuration type to export.

Multiple instance of VPN server can be created with different tunnel network

Firewall Rules are applied as per the requirement on tunnel network .

Firewall Logs

The Firewall logs at Status > System Logs on the Firewall tab show all events logged by the firewall.

Each entry is displayed with the action ( pass or block, reject is only logged as block), time, interface, source, destination, and protocol.

Configuration Of rsyslog Server for Logs Storage:-

Status: >System logs > Settings

Configuration of rsyslog on Centos :-

Setup Log File Location

Now edit Rsyslog configuration file and configure the location’s to generate log files in system.

# vim /etc/rsyslog.conf

and add following lines as the end of file.

$template TmplAuth, "/var/log/%HOSTNAME%/%PROGRAMNAME%.log"

authpriv.* ?TmplAuth

*.info,mail.none,authpriv.none,cron.none ?TmplMsg

Enable Module and UDP Protocol

Also remove comment from following lines ( remove starting # ) in rsyslog configuration file to enable UDP.

$ModLoad imudp

$UDPServerRun 514

Restart Rsyslog

After making above changes in Rsyslog central server, restart service using following command.

# service rsyslog restart

Logrotation:-

Create file :- /etc/logrotate.d/pfsense

And enter:-

/var/log/pfsense/filterlog.log

{

daily

missingok

rotate 60

compress

notifempty

create 640 root root

postrotate

/etc/init.d/rsyslog restart >/dev/null

endscript

}

Save and Quit.

RRD Graphs:-

These are located under Status > RRD Graphs. Several graphs are presented for each monitored item, with varying time intervals and averages.

These graphs measure things such as CPU usage, memory usage, state table usage, throughput (in bytes as well as packets), link quality, traffic shaping queue usage, and so on.