Lab4.1Firewalls

Firewall01

I figured out the syntax using this:

Basically you are writing things to a configuration file using commands, such as set firewall name WAN-to-DMZ rule 10 destination port 80 inserts "port 80" into the destination configuration of rule 10 for the firewall name WAN-to-DMZ, as shown in the screenshots. As such, this lab will mostly just be screenshots of the final configuration and not the commands, since that's faster.

You can also check configuration changes before committing and saving:

WAN/DMZ connections

Rules for allowing only web01 website to the internet

Rule 1 allowing established connections to continue

LAN/DMZ Connections

Zone Policies

Rules for allowing wazuh messages from the agent to the server

Rule 1 allowing established connections to continue

Reference wazuh setup to set the following ports in the firewall:

• 80/tcp LAN to web01
• 22/tcp mgmt01 to DMZ

To start with I made a new rule for http communication from LAN to web01, defining the address 172.16.150.2 and port 80 (those of the web server and http) to be allowed in the firewall

Turns out I made a little mistake on rule 10, I put the address 172.16.150.2 instead of 172.16.50.3, in order to fix this I "deleted" that line in the old config: delete firewall name LAN-to-DMZ rule 10 destination address 172.16.150.2 and replaced it with the proper set: set firewall name LAN-to-DMZ rule 10 destination address 172.16.50.3 then commit and save After this little fix the connection from wks and web01 worked fine

Then I made a rule for mgmt01 and port 22, using source instead of destination

I actually had to change this later to specify the source as the address, and the destination with just the port, since ports don't work with source

WAN/LAN Connections

For this section I set it up similar to the DMZ with the following config:

Allow established connections to continue:

Then associated those policies with their appropriate zones

Firewall MGMT

Create LAN and MGMT Zones

• Eth0 - LAN
• Eth1 - MGMT

Always set the zones up first

Create the firewalls with default-action drop and enable-default-log

Assign the firewalls to the zones

LAN-to-MGMT

Requirements:

• Allows 1514,1515/tcp from LAN to wazuh
• Allows 443/tcp from mgmt01 on LAN to wazuh
• Allows 22/tcp from mgmt01 on LAN to wazuh
• Allows established traffic back through the related firewall

I started with rule 1 to allow established connections through

Then did the wazuh rule (10), similar to on fw01

Next was 443/tcp from mgmt01 on LAN to wazuh

• Like the previous specific port one, I needed to declare the port on the destination and not the source, only the source address can go in the source section

Next the ssh rule with port 22

MGMT-to-LAN

Requirements:

• Allows MGMT to initiate any connection to the LAN
• Allows MGMT to initiate any connection to the DMZ
• Allows established traffic back again

Again, I started with rule 1 to allow established traffic back again, same as the last ruleset

Then rule 10 to allow any connection to the LAN