Lab4.1Firewalls

Firewall01

I figured out the syntax using this:

Basically you are writing things to a configuration file using commands, such as set firewall name WAN-to-DMZ rule 10 destination port 80 inserts "port 80" into the destination configuration of rule 10 for the firewall name WAN-to-DMZ, as shown in the screenshots. As such, this lab will mostly just be screenshots of the final configuration and not the commands, since that's faster.

You can also check configuration changes before committing and saving:

WAN/DMZ connections

Rules for allowing only web01 website to the internet

Rule 1 allowing established connections to continue

LAN/DMZ Connections

Zone Policies

Rules for allowing wazuh messages from the agent to the server

Rule 1 allowing established connections to continue

Reference wazuh setup to set the following ports in the firewall:

• 80/tcp LAN to web01
• 22/tcp mgmt01 to DMZ

To start with I made a new rule for http communication from LAN to web01, defining the address 172.16.150.2 and port 80 (those of the web server and http) to be allowed in the firewall

Turns out I made a little mistake on rule 10, I put the address 172.16.150.2 instead of 172.16.50.3, in order to fix this I "deleted" that line in the old config: delete firewall name LAN-to-DMZ rule 10 destination address 172.16.150.2 and replaced it with the proper set: set firewall name LAN-to-DMZ rule 10 destination address 172.16.50.3 then commit and save After this little fix the connection from wks and web01 worked fine

Then I made a rule for mgmt01 and port 22, using source instead of destination

I actually had to change this later to specify the source as the address, and the destination with just the port, since ports don't work with source

WAN/LAN Connections

For this section I set it up similar to the DMZ with the following config:

Allow established connections to continue:

Then associated those policies with their appropriate zones

Firewall MGMT

Create LAN and MGMT Zones

• Eth0 -