Lab1.1RoutingandDMZ
To start with, I reset the champuser password to one I know well, and created a new user called "echadbourne" with a separate password. I then gave this new user sudo permissions with sudo usermod -aG sudo echadbourne
I also updated the hostname to rw01-elizabeth with sudo hostnamectl set-hostname rw01-elizabeth
Then I set the ip address to 10.0.17.31 with a gateway and dns of 10.0.17.2 (I accidently typed 10.0.17.21 initially, caught it immediately, went to fix it, and the vm won't accept the new ip address so I restarted)
After the restart things were working well, and I could access the internet, so thats is for the rw01 setup
Once I set up the web server I needed to use netplan to properly configure the networking information and routing to web01 in dmz. It took a few tries, but this is the netplan yaml I settled on (with indentation of 2 spaces)
To apply this netplan I used sudo netplan apply and then I could access both the worldwide internet and my web server
To begin with, I set the hostname of the firewall with set system host-name [name], as seen below
You can check the status of interfaces with show interfaces, and in the initial setup you want to make sure there are no dhcp assignments. If there are any, make sure to delete them:
-
delete interfaces ethernet [interface name] address dhcp(thencommitandsave)
I didn't have any dhcp interfaces, so I moved on
Make sure to set interface descriptions with set interfaces ethernet [interface name] description [description]
Then set the interface ip addresses with set interfaces ethernet eth[x] address [address]/[mask]
Set the default gateway and DNS server to the WAN gateway, 10.0.17.2
set protocols static route 0.0.0.0/0 next-hop 10.0.17.2set system name-server 10.0.17.2
Commit + save
Configure a ruleset to set up ip masquerading from anything on the 172.16.50.0/29 network:
set nat source rule 10 description "NAT FROM DMZ to WAN"-
set nat source rule 10 outbound-interface eth0- sets it to the wan interface, so anything going out from that interface applies -
set nat source rule 10 source address 172.16.50.0/29- defines it for this network -
set nat source rule 10 translation address masquerade- set the address scheme to masquerade
I set the ip information according to IP Assignments using the nmtui tool, then created an "echadbourne" user and added it to the wheel group. I referenced the specifics for this from one of my old labs, found here
Setting up the dns forwarding (on the firewall)
sudo yum install httpd
Then set up the firewall to allow http and https:
sudo firewall-cmd --add-service=http --permanentsudo firewall-cmd --add-service=https --permanentsudo firewall-cmd --reload
Then start the httpd service: sudo systemctl start httpd
I needed to install rsyslog on web01 with sudo yum install rsyslog
And I created the file /etc/rsyslog.d/sec350.conf with the following contents:
This means the following: user=syslog facility notice=syslog priority @=UDP, @@ means TCP, so we are only going to send UDP 172.16.50.5=Remote Syslog Server
To test logging, on log01 do sudo tail -f /var/log/messages, and on the web01 use the local logging tool to send a message via logs, like so:
logger -t test TESTFROMWEB01TOLOG01
This is how the logs appear on Log01
I used the same methods to set up the ip and hostname information for log01 according to IP Assignments and for setting up my "echadbourne" user
I checked the status of rsyslog with systemctl status rsyslog and it was installed and running
I then permanently added ports 514 for tcp and udp to the firewall with:
sudo firewall-cmd --permanent --add-port=514/tcpsudo firewall-cmd --permanent --add-port=514/udpsudo firewall-cmd --reload
Note: you can check the current firewall rules with
sudo firewall-cmd --list-all
Them uncomment the lines under "Provides UDP syslog reception" and "Provides TCP syslog reception" in the file /ect/rsyslog
And restart the rsyslog service with sudo systemctl restart rsyslog
Verify that log01 is listening on the appropriate ports with netstat -tupan | grep 514
