one building block to secure a corporate LAN – intrusion detection system and DHCP – OPNsense – PFSense – Suricata

06.Jun.2018

Administration / Server, Cybercrime, CyberSec / ITSec / Sicherheit / Security / SPAM, Cyberwar, DNS / BIND / Name Resolving, GNU-Linux, networking, OpenSource

basically the advanced version of PiHole.

WARNING! THIS IS not a complete OPNSense / PFSense tutorial

it is rather just to get started.

right now, one is (still) using iptables without any gui.

there seems to be a lot of documentation on PFSense wich kind of also can be used in OPNSense because OPNSense is a fork of PFSense.

even with OPNSense setting up a custom firewall is not an 3-steps “done in 5min” task.

Just as it-security itself – plan for some iterations:

with iterative i mean, you will have to stay up to day with latest threats again and again.

You will have to repeat answers to theses question again and again:

Q: is the network secure?
Q: what possible vectors are there for ransomeware to get in?
Q: what services are secure / insecure to be used inside the LAN?
you will have to take some time…

now let’s go: what hardware?

I bought two blade-servers Dell Power Edge R300 and HP ProLiant DL360 on eBay for 100EUR each.

They come with 2-3 NICs, Quadcore-Xeons and plenty of RAM and RAID and dual power supplies.

This might be “overkill” and powerusage is (of course) way beyond (around 100Watts) embedded systems such as the (hopefully soon again available Odroid-H2) will use.

you can also get hardware directly from the producers of OPNSense: https://www.deciso.com/product-catalog/

Whatver hardware you use it needs to have:

TWO NETWORK CARDS LAN(intranet) and WAN(internet)
512MB of RAM (they reommend 4GB)
be able to run FreeBSD

src: https://docs.opnsense.org/manual/hardware.html

OPNSense is Open Source 🙂 (github src here)

uname -a
FreeBSD OPNsense.localdomain 11.2-RELEASE-p9-HBSD FreeBSD 11.2-RELEASE-p9-HBSD (stable/19.1) amd64

i have very little experience with FreeBSD, while it does not really have bash and the same sets of commands, it is still Unix and seems a pretty good choice for embedded systems (a lot of routers use it).

very small footprint
focus on security: “The FreeBSD project includes a security team overseeing all software shipped in the base distribution” … even PlayStation3 and 4 is using it (WTF!?) (src: wikipedia.org)
great network stack (i was told)

what i really like about OPNSense (at it is probably the same for pfSense)

it’s Open Source, yes Open Source makes sense, but using PHP on a firewall IMHO does not make sense, because it introduces a lot of security problems. (FritzBox uses lua!? no idea if that is better)
- i really love PHP for it’s easy of use and perfect fit as a server-side web language… but unfortunately it’s purpse is pretty limited to this.
- e.g. searching massive amount of log files is not exactly PHP’s strength, so if you limit PHP usage to display a short set of info that came out of a faster program it might be the right way to use it
- never do anything CPU intensive in PHP, it is not C++ and will stop after 30 sec no matter what.
even as a transparent-filtering-bridge (TFB) OPNSense gives the Admin a nice look into your LAN’s traffic
- what is going on
- who is communicating with how on what port…
- so you can inspect suspicious traffic, but when it comes to log-inspection it seems we hit a PHP-timeout?

while it is also lacking performance (php 30 sec timeout can not be extended, python does not have a timeout).

it’s not a i386 with 5Mhz,

php is not mentioned here -> https://www.quora.com/Which-is-the-best-programming-language-for-embedded-system

it is actually an “overkill” hardware for a firewall:

sysctl -a | egrep -i 'hw.machine|hw.model|hw.ncpu'
hw.machine: amd64
hw.model: Intel(R) Xeon(R) CPU           L5410  @ 2.33GHz
hw.ncpu: 4
hw.machine_arch: amd64

grep memory /var/run/dmesg.boot
real memory  = 17179869184 (16384 MB)
avail memory = 16575963136 (15808 MB)

Where the name?

The project’s name is derived from open and sense and stands for: “OPeN (source) makes sense”

about:

OPNsense is based on HardenedBSD, copyright © The HardenedBSD Project. All rights reserved.OPNsense is a fork of pfSense® (Copyright © 2004-2014 Electric Sheep Fencing, LLC. All rights reserved.), which is a fork of m0n0wall® (Copyright © 2002-2013 Manuel Kasper).OPNsense includes various freely available software packages and ports. The incorporated third party tools are listed here.The authors of OPNsense would like to thank all contributors for their efforts.

overview/dashboard/lobby/screenshot:

Where to place the firewall in your network?

router/gateway/NAT-firewall mode:

most people will let OPNSense firewall act as DHCP server on LAN and directly hook WAN port towith t a DSL-Modem / Internet-Router / Gateway to “the internet”.

In this case the OPNSense firewall will act as a router between two subnets (192.168.1.X (DSL-Modem) and 192.168.0.X (LAN)

transparent filtering bridge (like a switch) bridging firewall mode:

In my case, this (is right now) not an option, i an existing LanCOM-Router is in use for DHCP and VPN (maybe in the future OPNSense will take the role of DHCP, VPN and Firewall).

So i set it up as “switch” / transparent filtering bridge like this documentation/guide: https://docs.opnsense.org/manual/how-tos/transparent_bridge.html

“A bridge works by scanning the addresses of MAC level (Ethernet addresses) of the devices connected to each of its network interfaces and then forwarding the traffic between the two networks only if the source and the destination are on different segments. Under many points of view a bridge is similar to an Ethernet switch with only two ports.”
“A bridge-based firewall can be configured and inserted between the xDSL router and your Ethernet hub/switch without any IP numbering issues.”
nics must be able to do promiscuous mode (most can)

more to know:

“Now it is time to create your own file with custom firewall rules, in order to secure the inside network. There will be some complication in doing this because not all of the firewall functionalities are available on bridged packets.
- Furthermore, there is a difference between the packets that are in the process of being forwarded and packets that are being received by the local machine.
- In general, incoming packets are run through the firewall only once, not twice as is normally the case;
- in fact they are filtered only upon receipt, so rules that use “out” or “xmit” will never match.
- Personally, I use “in via” which is an older syntax, but one that has a sense when you read it.
- Another limitation is that you are restricted to use only “pass” or “drop” commands for packets filtered by a bridge.
  - Sophisticated things like “divert”, “forward” or “reject” are not available
  - Such options can still be used, but only on traffic to or from the bridge machine itself (if it has an IP address).”
“New in FreeBSD 4.0, is the concept of stateful filtering.
This is a big improvement for UDP traffic, which typically is a request going out, followed shortly thereafter by a response with the exact same set of IP addresses and port numbers (but with source and destination reversed, of course).
For firewalls that have no statekeeping, there is almost no way to deal with this sort of traffic as a single session.
But with a firewall that can “remember” an outgoing UDP packet and, for the next few minutes, allow a response, handling UDP services is trivial.
The following example shows how to do it. It is possible to do the same thing with TCP packets.
This allows you to avoid some denial of service attacks and other nasty tricks, but it also typically makes your state table grow quickly in size.”

src: freebsd.org

the bridge will act like a network-switch and connect “WAN” (bge0) and “LAN” (bge1) (which will have NO ip address asigned) to an newly created virtual network device “OPT1” (bridge0) which you can asign an ip that actually can reach “the internet” for updates DNS and so on and so forth.

root@OPNsense:~ # ifconfig
em0: flags=8c02<BROADCAST,OACTIVE,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
	ether 00:15:17:bb:88:6e
	hwaddr 00:15:17:bb:88:6e
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
	media: Ethernet autoselect
	status: no carrier
em1: flags=8c02<BROADCAST,OACTIVE,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
	ether 00:15:17:bb:88:6f
	hwaddr 00:15:17:bb:88:6f
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
	media: Ethernet autoselect
	status: no carrier
bge0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=c0098<VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,VLAN_HWTSO,LINKSTATE>
	ether 00:1e:c9:f8:aa:ef
	hwaddr 00:1e:c9:f8:aa:ef
	inet6 fe80::21e:c9ff:fef8:aaef%bge0 prefixlen 64 scopeid 0x3 
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
	media: Ethernet autoselect (1000baseT <full-duplex,master>)
	status: active
bge1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=c0098<VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,VLAN_HWTSO,LINKSTATE>
	ether 00:1e:c9:f8:aa:f0
	hwaddr 00:1e:c9:f8:aa:f0
	inet6 fe80::21e:c9ff:fef8:aaf0%bge1 prefixlen 64 scopeid 0x4 
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
	media: Ethernet autoselect (1000baseT )
	status: active
enc0: flags=0<> metric 0 mtu 1536
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
	groups: enc 
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
	options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
	inet6 ::1 prefixlen 128 
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6 
	inet 127.0.0.1 netmask 0xff000000 
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
	groups: lo 
pfsync0: flags=0<> metric 0 mtu 1500
	groups: pfsync 
	syncpeer: 0.0.0.0 maxupd: 128 defer: off
pflog0: flags=100 metric 0 mtu 33160
	groups: pflog 
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	ether 02:cf:d1:7a:23:00
	inet 192.168.0.3 netmask 0xffffff00 broadcast 192.168.0.255 
	nd6 options=1
	groups: bridge 
	id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
	maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
	root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
	member: bge1 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
	        ifmaxaddr 0 port 4 priority 128 path cost 55
	member: bge0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
	        ifmaxaddr 0 port 3 priority 128 path cost 55

Warning

The Transparent Filtering Bridge is not compatible with Traffic Shaping.

Do not enable the traffic shaper when using the filtering bridge.

Abstract

A transparent firewall can be used to filter traffic without creating different subnets.

This application is called filtering bridge as it acts as a bridge connection two interfaces and applies filtering rules on top of this.

For more information on Filtering Bridged on FreeBSD, see filtering-bridges

internet not working?

make sure either WAN or “OPT1” bridge have an ip that can reach the dsl-router/gateway.

what about dns?

you could manually config this file and add OpenDNS nameservers 208.67.222.222, 208.67.220.220 or Google DNS Server: 8.8.8.8, 8.8.4.4

root@OPNsense:~ # vi /etc/resolv.conf
domain localdomain
nameserver 127.0.0.1
nameserver 2620:0:ccc::2
nameserver 2620:0:ccd::2
nameserver 208.67.222.222
nameserver 208.67.220.220

You can even use it with OpenDNS (a service that was bought by Cisco in 2015 to filter the web via DNS) in bridge-mode.

Updates not working?

okay first of all you will have to check if any of your interfaces is ip-wise possible to access the internet/reach your gateway on the WAN port: probably something like 192.168.0.1.

try to select a different mirror

getting started:

download from: https://opnsense.org/download/
- unzip: bunzip2 OPNsense-18.1.6-OpenSSL-dvd-amd64.iso.bz2
create a new VirtualBox FreeBSD 64Bit VM and insert the iso
- it will guide you through a live cd run but not install anything on harddisk

https://docs.opnsense.org/manual/install.html

Port Assignments

By default the system will be configured with 2 interfaces LAN & WAN. The first network port found will be configured as LAN and the second will be WAN.

IP ranges & DHCP

The WAN port will have a dhcp client and expects to be assigned an IP adress.
The LAN port will have a dhcp server, a static ip of 192.168.1.1/24 and offers ip adresses in the range of 192.168.1.100-200.

Users & Passwords

Default user: root / password: opnsense

Also good to know

For security reasons ssh is disabled by default and the console access is password protected.

https://wiki.opnsense.org/intro.html

install on harddisk:

ssh into the box with ssh installer@192.168.0.XX (your box’s ip shown in console)
it will greet you with this dialog:
and guide you through setup on disk.

firewall setup:

thanks to Thomas Krenn AG and max-it.de for the cool videos. (sorry right now in German only)

firewall -> aliases

you can block based on ports, ips, ip-lists (URL Table (IPs))

Spamhaus

https://docs.opnsense.org/manual/how-tos/edrop.html

The Spamhaus Don’t Route Or Peer Lists

DROP (Don’t Route Or Peer) and EDROP are advisory “drop all traffic” lists, consisting of netblocks that are “hijacked” or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers). The DROP and EDROP lists are a tiny subset of the SBL, designed for use by firewalls and routing equipment to filter out the malicious traffic from these netblocks.

Source : https://www.spamhaus.org/drop/

Downloads

https://wiki.opnsense.org/manual/aliases.html

VPN Setup:

misc:

alternative Public DNS Servers:

Public DNS Servers

1.1.1.1

1.1.1.1

1.0.0.1

2606:4700:4700::1111

2606:4700:4700::1001
Alternate DNS

198.101.242.72

23.253.163.53
BlockAid Public DNS (or PeerDNS)

205.204.88.60

178.21.23.150
Censurfridns

91.239.100.100

89.233.43.71

2001:67c:28a4::

2002:d596:2a92:1:71:53::
Christoph Hochstätter

209.59.210.167

85.214.117.11
ClaraNet

212.82.225.7

212.82.226.212
Comodo Secure DNS

8.26.56.26

8.20.247.20
DNS.Watch

84.200.69.80

84.200.70.40

2001:1608:10:25::1c04:b12f

2001:1608:10:25::9249:d69b
DNSReactor

104.236.210.29

45.55.155.25
Dyn

216.146.35.35

216.146.36.36
FDN

80.67.169.12

2001:910:800::12
FoeBud

85.214.73.63
FoolDNS

87.118.111.215

213.187.11.62
FreeDNS

37.235.1.174

37.235.1.177
Freenom World

80.80.80.80

80.80.81.81
German Privacy Foundation e.V.

87.118.100.175

94.75.228.29

85.25.251.254

62.141.58.13
Google Public DNS

8.8.8.8

8.8.4.4

2001:4860:4860::8888

2001:4860:4860::8844
GreenTeamDNS

81.218.119.11

209.88.198.133
Hurricane Electric

74.82.42.42

2001:470:20::2
Level3

209.244.0.3

209.244.0.4
Neustar DNS Advantage

156.154.70.1

156.154.71.1
New Nations

5.45.96.220

185.82.22.133
Norton DNS

198.153.192.1

198.153.194.1
OpenDNS

208.67.222.222

208.67.220.220

2620:0:ccc::2

2620:0:ccd::2
OpenNIC

58.6.115.42

58.6.115.43

119.31.230.42

200.252.98.162

217.79.186.148

81.89.98.6

78.159.101.37

203.167.220.153

82.229.244.191

216.87.84.211

66.244.95.20

207.192.69.155

72.14.189.120

2001:470:8388:2:20e:2eff:fe63:d4a9

2001:470:1f07:38b::1

2001:470:1f10:c6::2001
PowerNS

194.145.226.26

77.220.232.44
Quad9

9.9.9.9

2620:fe::fe
SafeDNS

195.46.39.39

195.46.39.40
SkyDNS

193.58.251.251
SmartViper Public DNS

208.76.50.50

208.76.51.51
ValiDOM

78.46.89.147

88.198.75.145
Verisign

64.6.64.6

64.6.65.6

2620:74:1b::1:1

2620:74:1c::2:2
Xiala.net

77.109.148.136

77.109.148.137

2001:1620:2078:136::

2001:1620:2078:137::
Yandex.DNS

77.88.8.88

77.88.8.2

2a02:6b8::feed:bad

2a02:6b8:0:1::feed:bad
puntCAT

109.69.8.51

2a00:1508:0:4::9

tweets:

Tweets by opnsense

Tweets by bsdphk

liked this article?

only together we can create a truly free world
plz support dwaves to keep it up & running!
(yes the info on the internet is (mostly) free but beer is still not free (still have to work on that))
really really hate advertisement
contribute: whenever a solution was found, blog about it for others to find!
talk about, recommend & link to this blog and articles
thanks to all who contribute!

admin