Franske ITC-2480 Lab 10

Lab Procedure

Prerequisites

1. Open an SSH console to your Linux system using the PuTTY software, login with your standard user account
2. Have a browser window set to the webmin interface for your linux VM.

Setup a 2nd NIC Interface

1. To start this lab we will need to create a second network interface called eth1. We will use eth1 as our LAN interface that will allow other computers to connect to the internet.
2. In putty, open up /etc/network/interfaces with your favorite text editor, then go to the bottom of the file and add the following:

auto eth1
iface eth1 inet static
	address 192.168.1.1
	netmask 255.255.255.0

• As this is a LAN only interface, we do not need to define a gateway for the VM, as the VM is the gateway for this network.

1. Once this is done, save the file and then run "ifup eth1". This should bring up the new interface. You can check to see if its enabled by using ifconfig.

Enable NAT

1. Now we will need to enable NAT so we can forward traffic to our LAN interface.
2. In your console, you will need to open up /etc/sysctl.conf with a text editor. This file is used to change and tweak multiple system variables. Scroll down until you find the following:

# Uncomment the next line to enable packet forwarding for IPv4
#net.ipv4.ip_forward=1

1. Uncomment the net.ipv4.ip_forward line. This will enable packet forwarding in the kernel. When you are done, save the file.
2. Changes to the sysctl.conf file require a reboot, but most can be set without a reboot by echoing response codes to files in /proc. We will get into that more in a later chapter, but for now run the following command to enable ip_forwarding without rebooting the machine. echo 1 > /proc/sys/net/ipv4/ip_forward
   • Note: If you are receiving an error when trying to run that command it's likely that the user you are running it as does not have permission to modify the /proc/sys/net/ipv4/ip_forward file (check the permissions by using ls). Read this similar question for more details and possible solutions.
3. Now we will need to use webmin to setup iptables to allow for NAT. In webmin, Go to Networking, then Linux Firewall. You will be taken to a page that will ask you to setup iptables for the first time. To start, select the option "Block all except SSH, IDENT, ping and high ports on interface eth0." Also select the Enable firewall at boot time option, then press Setup Firewall.
4. You will now be shown the firewall setup page. notice how webmin was nice enough to create a handful of default rules for you. We will get into creating custom rules later in this lab, but for now we need to enable NAT in iptables.
5. On the top of the page where it says Showing IPtable:, change the dropdown option to Network address translation (nat).
6. On this page, under the POSTROUTING category, press the Add Rule button. Use the following configuration to enable NAT:

Rule comment: Enable NAT for eth1
Action to take: Masquerade
Source ports for masquerading: any
IPs and ports to SNAT: Default
Source address or network: Equals: 192.168.1.1/24
Outgoing Interfce: Equals: eth0

1. When you are done, press Save at the bottom, and then on the firewall page press Apply Configuration. At this point you can use your linux VM as a router, but only with static IP addresses set on clients. So, next we will setup a DHCP server.

Setup a DHCP Server

1. To setup a DHCP server, we will first need to install the required software. In your SSH console use your favorite package manager to install isc-dhcp-server.
2. After you install the package you may get a warning about isc-dhcp-server being unable to start. This is normal as we have yet to define the interface and settings we want used.
3. Now back in Webmin, select the Refresh Modules option. After it is done, go to Servers, then DHCP Server.
4. Before we define our DHCP range, we need to set our listening interface. Click on the Edit Network Interface option, and select eth1 and press save.
5. Now under Subnets and Shared Networks, select Add a new subnet. Use the following settings:

Subnet description: LAN DHCP Range
Network Address: 192.168.1.0
Netmask: 255.255.255.0
Address Ranges: 192.168.1.100-192.168.1.254

1. When you are done, press Create. Now, click on the network you just created to review the settings, then press Edit Client Options at the bottom.
2. From here we will setup the default gateway and DNS servers for the clients to use. Under Default Routers, set the option to 192.168.1.1 and under DNS servers, set it to 192.168.1.1 as well. Notice how we are setting these options to the IP of eth1 that we setup. This is because our linux VM will act as the router and DNS for our clients as well.
3. When you are done, press save, and then on the Edit Subnet page, press save again.
4. Now that you are back on the DHCP server page, press the Start Server button. If all goes good, the button should change to "Stop Server". If this does not happen, then the server was unable start. If that happens, re-check your DHCP server configurations to make sure everything is correct.

Setup a 2nd VM

1. Now we are going to setup a 2nd VM on the VMware server so we can have a client to connect to our network we just created. For this though, we will be using Linux Mint instead of Debian so we have a user interface to help us with testing.
2. You'll need to connect to the VMware server and verify that you have a machine with the same letter ID as you have been working with so far but with a -II suffix on the end. You'll also want to verify that the machine has the Linux Mint ISO in the virtual CD/DVD drive or correct that by browsing for the ISO in the SAN0 datastore.
3. Boot the VM and get Linux Mint installed, installation settings are not critical as we'll be using the system primarily to explore a Linux GUI and to test web browsing capability from our private network.
4. Once you have Linux Mint installed, reboot the machine and login. Notice how the machine is able to connect to the network. Now, press the Menu idcon in the lower left corner, and enter "Terminal". Then, open the terminal application.
5. You now have a shell on the system. From here, use sudo ifconfig to check your network settings. Notice how you have a IP from the DHCP pool we created earlier. Now try pinging 172.17.50.1. Are you able to ping? If so, NAT is working properly on your network.
6. Now run ping google.com. If you are able to ping, this shows that not only is NAT working, but DNS resolving as well.
7. Open a web browser on the system (you can use a graphical browser this time since you have a GUI) and test browsing to a few websites.
8. At this point we have a fully functional LAN environment.
9. Spend a few more minutes exploring the functionality of the Linux GUI

Port Forwarding and Firewalling

1. Now we are going to enable port forwarding to our VM. This will allow you to access the 2nd VM from the IHITC network.
2. So back in webmin, go to Networking, and then Linux Firewall. Now change the Showing IPTable option to Network Address Translation (nat). Now under PREROUTING, press Add Rule.
3. For our rule we are going to forward port 2222 to port 22 on our Ubuntu VM. You will need to know the IP address of the Ubuntu Machine, but for this example it will be 192.168.1.100
4. Use the following information to create the new rule:

Rule comment: Forward 2222 to SSH
Action to take: Destination NAT
IPs and ports for DNAT: IP range: 192.168.1.100: Port range: 22
Network protocol: Equals: TCP
Destination TCP or UDP Port: Equals: 2222

• Help: Use the following image for extra reference if required: Link

1. When you are done press save, and then Apply Configuration. Now on the Ubuntu VM, make sure openssh-server is installed. From a computer on the IHITC network, try to SSH to port 2222 on your original (Debian) VM. If everything was setup successfully, you will be able to sign into the Ubuntu Desktop VM through the Debian VM.
2. Now that we have our network setup up, it is time to secure it with firewall rules. Go back into Webmin. Go to Networking, then Linux Firewall.
3. When we first setup iptables we used some default rules, but we are going to secure it a bit by limiting access to only allow clients from the 172.17.0.0/16 networks.
4. Under the Incoming packets (INPUT) category, on the top rule, press the upward arrow under the Add category. Use the following options in the ruleset:

Rule comment: Limit Access
Action to take: Drop
Source address or network: Does not equal: 172.17.0.0/16
Incoming interface: Equals: eth0

1. Now press save, then press Apply Configuration. This ends the Firewall setup.

iptables from the command line

1. Now that you know how to create rules with webmin, lets learn how to do it from the command line.
2. If you want to view the current rulesets applied on a system, or you want to backup your current configuration, you would use the iptables-save command. Run it, and review the output. Notice how all of the rules we created in webmin show up.
3. Now if you want to backup your rules, you would use iptables-save > rules.txt. This would dump the current configuration into a file called rules.txt.
4. To reload the rules into iptables, you would use iptables-restore. With the file we created, we would load it back in by running iptables-restore rules.txt
5. Lastly you can create and delete select roles from the command line using the iptables command directly. Use the man page to help you understand the arguments, and try to figure out how to remove the default firewall rule that Accepts packets if the destination port is between 1024 and 65535.
6. At this point, we are now going to create some rules in webmin for the firewall. Back in webmin, go to Networking then Linux Firewall. Notice the default rules Webmin created for us earlier. Delete the following rules, but DO NOT press the apply button:

Drop	If protocol is TCP and destination port is 2049:2050
Drop	If protocol is TCP and destination port is 6000:6063		
Drop	If protocol is TCP and destination port is 7000:7010	

1. Now we need to open ports for our running services. First we will create a rule to allow webmin to continue running. Use the following configuration for the webmin rule:

Action to take: Accept
Network Protocol: Equals: TCP
Destination TCP or UDP port: Equals: 10000

1. Now using the same format above, open ports for all running services. This includes SSH, DNS, SMTP, POP3, IMAP, and HTTP. Make sure to correctly figure out and set the protocol (TCP vs. UDP for each of these)
2. When you are done creating the rules, press apply to have the rules enabled on your system.