Skip to content

Lab7.1AssessmentPrep

Jump to bottom
Beth edited this page Mar 24, 2025 · 27 revisions

Tutorial for installing Nginx:

Tutorial for setting up DHCP on ubuntu:

Initial Setup

Firewall

I used sections of https://github.com/echadbourne/sec-350/blob/main/fw-configs/assessmentprep/fw01.txt as a reference

Start with the firewall, edge02. I had to add a network interface, connect all of those interfaces to the right network, then go into the box and configure the default password, hostname, and the addresses and descriptions of the network adapters.

Next is the default route to the internet via the default gateway of 10.0.17.2

  • set protocols static route 0.0.0.0/0 next-hop 10.0.17.2
  • set system name-server '10.0.17.2'

Then the nat rules, specifically those for the DMZ to the WAN

  • set nat source rule 10 description 'NAT FROM DMZ to WAN'
  • set nat source rule 10 outbound-interface 'eth0'
  • set nat source rule 10 source address '172.16.50.0/29'
  • set nat source rule 10 translation address 'masquerade'

I also went ahead and did the configuration for the other nat rules, so we have MGMT:

  • set nat source rule 30 description 'NAT FROM MGMT TO WAN'
  • set nat source rule 30 outbound-interface 'eth0'
  • set nat source rule 30 source address '172.16.200.0/28'
  • set nat source rule 30 translation address 'masquerade'

And LAN:

  • set nat source rule 110 description 'NAT FROM LAN TO WAN'
  • set nat source rule 110 outbound-interface 'eth0'
  • set nat source rule 110 source address '172.16.150.0/24'
  • set nat source rule 110 translation address 'masquerade'

Next DNS forwarding

  • set service dns forwarding allow-from '172.16.50.0/29'
  • set service dns forwarding allow-from '172.16.150.0/24'
  • set service dns forwarding listen-address '172.16.50.2'
  • set service dns forwarding listen-address '172.16.150.2'
  • set service dns forwarding system

Now to advertise the routes for the DMZ on the LAN so FWMGMT can see it

  • set protocols rip interface eth2 - "eth2" should be whichever interface is the LAN
  • set protocols rip network '172.16.50.0/29'

At this point basic connectivity should be up and running for the LAN and DMZ, and the MGMT firewall remains untouched, so I move on to the nginx and dhcp setups

Nginx

To begin with I needed to do the initial setup for the ubuntu nginx server, including netplan, hostname, and local admin user.

  • Make sure to use adduser on ubuntu rather than useradd
  • usermod -aG [group] [user]

There is an example of a netplan config for another ubuntu server here: https://github.com/echadbourne/sec-350/wiki/Lab3.1Segmentation

Clone this wiki locally