Skip to content

Lab7.1AssessmentPrep

Jump to bottom
Beth edited this page Mar 25, 2025 · 27 revisions

Tutorial for installing Nginx:

Tutorial for setting up DHCP on ubuntu:

Initial Setup

Firewall

I used sections of https://github.com/echadbourne/sec-350/blob/main/fw-configs/assessmentprep/fw01.txt as a reference

Start with the firewall, edge02. I had to add a network interface, connect all of those interfaces to the right network, then go into the box and configure the default password, hostname, and the addresses and descriptions of the network adapters.

Next is the default route to the internet via the default gateway of 10.0.17.2

  • set protocols static route 0.0.0.0/0 next-hop 10.0.17.2
  • set system name-server '10.0.17.2'

Then the nat rules, specifically those for the DMZ to the WAN

  • set nat source rule 10 description 'NAT FROM DMZ to WAN'
  • set nat source rule 10 outbound-interface 'eth0'
  • set nat source rule 10 source address '172.16.50.0/29'
  • set nat source rule 10 translation address 'masquerade'

I also went ahead and did the configuration for the other nat rules, so we have MGMT:

  • set nat source rule 30 description 'NAT FROM MGMT TO WAN'
  • set nat source rule 30 outbound-interface 'eth0'
  • set nat source rule 30 source address '172.16.200.0/28'
  • set nat source rule 30 translation address 'masquerade'

And LAN:

  • set nat source rule 110 description 'NAT FROM LAN TO WAN'
  • set nat source rule 110 outbound-interface 'eth0'
  • set nat source rule 110 source address '172.16.150.0/24'
  • set nat source rule 110 translation address 'masquerade'

Next DNS forwarding

  • set service dns forwarding allow-from '172.16.50.0/29'
  • set service dns forwarding allow-from '172.16.150.0/24'
  • set service dns forwarding listen-address '172.16.50.2'
  • set service dns forwarding listen-address '172.16.150.2'
  • set service dns forwarding system

Now to advertise the routes for the DMZ on the LAN so FWMGMT can see it

  • set protocols rip interface eth2 - "eth2" should be whichever interface is the LAN
  • set protocols rip network '172.16.50.0/29'

At this point basic connectivity should be up and running for the LAN and DMZ, and the MGMT firewall remains untouched, so I move on to the nginx and dhcp setups

Nginx

To begin with I needed to do the initial setup for the ubuntu nginx server, including netplan, hostname, and local admin user.

  • Make sure to use adduser on ubuntu rather than useradd
  • usermod -aG [group] [user]

There is an example of a netplan config for another ubuntu server here: https://github.com/echadbourne/sec-350/wiki/Lab3.1Segmentation

Here is how I configured it for this server:

image

Then apply with sudo netplan apply, and check if it applied with ip a

Note: Make sure to use two spaces as the indents for a yaml

Installing Nginx

Do a sudo apt update, then sudo apt install nginx

Traveller

Start with basic setup, change user password and configure ip information

I had an issue where it refused to release the apipa address, the tutorial here helped me: https://gayanstechblog.wordpress.com/2019/08/14/how-to-disable-ip-auto-configuration-in-server/

Next I set a static route so traveler would know where to send packets destined for anything that's behind my firewall:

  • route add 172.16.0.0 MASK 255.255.0.0 10.0.17.131 - From an elevated cmd

ssh keys

https://www.tecmint.com/ssh-passwordless-login-with-putty/

Generate a new ssh key with PuTTYgen, give the key a relevant comment, and a passphrase. Save the public and private keys somewhere safe, copy the public key output on the top, and put that in a file to be sent to jump via github

Get the pubkey to jump by pushing it to github, cloning the repo with mgmt, and copy/pasting the output into the authorized_keys file on jump

Clone this wiki locally