Lab1.1RoutingandDMZ

RW01

To start with, I reset the champuser password to one I know well, and created a new user called "echadbourne" with a separate password. I then gave this new user sudo permissions with sudo usermod -aG sudo echadbourne

I also updated the hostname to rw01-elizabeth with sudo hostnamectl set-hostname rw01-elizabeth

Then I set the ip address to 10.0.17.31 with a gateway and dns of 10.0.17.2 (I accidently typed 10.0.17.21 initially, caught it immediately, went to fix it, and the vm won't accept the new ip address so I restarted)

After the restart things were working well, and I could access the internet, so thats is for the rw01 setup

Networking and access to the DMZ

Once I set up the web server I needed to use netplan to properly configure the networking information and routing to web01 in dmz. It took a few tries, but this is the netplan yaml I settled on (with indentation of 2 spaces)

To apply this netplan I used sudo netplan apply and then I could access both the worldwide internet and my web server

FW01

To begin with, I set the hostname of the firewall with set system host-name [name], as seen below

You can check the status of interfaces with show interfaces, and in the initial setup you want to make sure there are no dhcp assignments. If there are any, make sure to delete them:

• delete interfaces ethernet [interface name] address dhcp (then commit and save)

I didn't have any dhcp interfaces, so I moved on

Make sure to set interface descriptions with set interfaces ethernet [interface name] description [description]

Then set the interface ip addresses with set interfaces ethernet eth[x] address [address]/[mask]

Gateway and DNS

Set the default gateway and DNS server to the WAN gateway, 10.0.17.2

• set protocols static route 0.0.0.0/0 next-hop 10.0.17.2
• set system name-server 10.0.17.2

Commit + save

Configuring for NAT and DNS Forwarding

Configure a ruleset to set up ip masquerading from anything on the 172.16.50.0/29 network:

• set nat source rule 10 description "NAT FROM DMZ to WAN"
• set nat source rule 10 outbound-interface eth0 - sets it to the wan interface, so anything going out from that interface applies
• set nat source rule 10 source address 172.16.50.0/29 - defines it for this network
• set nat source rule 10 translation address masquerade - set the address scheme to masquerade

Web01

I set the ip information according to IP Assignments using the nmtui tool, then created an "echadbourne" user and added it to the wheel group. I referenced the specifics for this from one of my old labs, found here

Setting up the dns forwarding (on the firewall)

Installing httpd:

sudo yum install httpd

Then set up the firewall to allow http and https:

• sudo firewall-cmd --add-service=http --permanent
• sudo firewall-cmd --add-service=https --permanent
• sudo firewall-cmd --reload

Then start the httpd service: sudo systemctl start httpd

Log01

I used the same methods to set up the ip and hostname information for log01 according to IP Assignments and for setting up my "echadbourne" user

I checked the status of rsyslog with systemctl status rsyslog and it was installed and running

I then permanently added ports 514 for tcp and udp to the firewall with:

• sudo firewall-cmd --permanent --add-port=514/tcp
• sudo firewall-cmd --permanent --add-port=514/udp
• sudo firewall-cmd --reload