Skip to content

Lab3.1Segmentation

Jump to bottom
Beth edited this page Feb 5, 2025 · 9 revisions

WKS and MGMT02 Initial Setup

Set up a new admin user with lusrmgr.msc, adding it to the administrators group, set ip configuration according to IP Assignments

FW01 Setup

Set the rules for the new mgmt02

  • set nat source rule 30 description "NAT FROM MGMT TO WAN"
  • set nat source rule 30 outbound-interface eth0
  • set nat source rule 30 source address 172.16.200.0/28
  • set nat source rule 30 translation address masquerade

FWMGMT Setup

I set up the interfaces according to the VYOS entry, with the following results:

image

I also set the static routing and firewall to fw01's LAN interface (172.16.150.2) with the guidelines from the above linked tech journal

Then the DNS forwarding, like so:

image

Setting RIP protocol

On fw01:

  • set protocols rip interface eth2 - enable rip
  • set protocols rip network 172.16.50.0/29 - advertise dmz network

On fwmgmt:

  • set protocols rip interface eth0
  • set protocols rip network 172.16.200.0/28

Wazuh

Added a new user

NOTE make sure to use adduser for a more complete experience and to avoid a home directory not being created for a user

Netplan config:

image

Remove old configs

On web01 remove the custom rsyslog config:

  • sudo rm /etc/rsyslog.d/sec350.conf
  • sudo systemctl restart rsyslog

On fw01 remove the rsyslog host setting

  • delete system syslog host 172.16.50.5

Export configs from both firewalls with:

  • show configuration commands | grep -v "syslog global\|ntp\|login\|console\|config\|hw-id\|loopback\|conntrack"

Other Notes

BEFORE INSTALLING WAZUH:

  • Update jump
  • Install jdk
  • Install Wazuh 4.10

After installing wazuh take a picture of the default password

Clone this wiki locally