WEBVTT 00:00:01.240 --> 00:00:01.660 All right, 00:00:01.660 --> 00:00:04.460 now we're starting the next demo where we're actually going to 00:00:04.470 --> 00:00:06.850 go ahead and segment some of the network off. 00:00:07.640 --> 00:00:09.370 And we already have this set up a little bit. 00:00:09.370 --> 00:00:13.810 As you saw in the previous demo, when we were going through our initial setup, 00:00:13.820 --> 00:00:16.770 we built the interfaces specifically for different purposes. 00:00:16.770 --> 00:00:19.480 So one of the interfaces was our MGMT network, 00:00:19.490 --> 00:00:22.660 and the other one was the USER network. 00:00:23.140 --> 00:00:25.980 This jump host that we're in right now is on the MGMT network. 00:00:25.980 --> 00:00:28.090 It's one of our admin boxes. 00:00:28.090 --> 00:00:30.520 And throughout our network, 00:00:30.520 --> 00:00:34.230 we have each of these networks in a different VLAN to help 00:00:34.230 --> 00:00:35.790 segment them throughout the rest of the network, 00:00:35.790 --> 00:00:37.760 but from the firewalls point of view, 00:00:38.220 --> 00:00:41.350 the links are being trunked into their two interfaces. 00:00:42.040 --> 00:00:42.390 All right, 00:00:42.390 --> 00:00:45.390 so let's go over to the interfaces and check out the USER one just 00:00:45.390 --> 00:00:47.850 to make sure that it's configured correctly. 00:00:47.850 --> 00:00:50.840 And it is, so we should be good. 00:00:50.850 --> 00:00:52.760 We don't need to change anything there. 00:00:54.440 --> 00:00:58.750 And as you can see, this Windows host right here is in our USER network. 00:00:58.750 --> 00:01:01.510 So let's go see if it has an IP address. 00:01:01.510 --> 00:01:02.530 All right. 00:01:02.530 --> 00:01:06.140 So this one's on that USER network, and I'm just going to do an ipconfig, 00:01:06.140 --> 00:01:08.760 and look at that, it has an IP address. 00:01:09.640 --> 00:01:12.000 Let's test out some connectivity real quick. 00:01:12.000 --> 00:01:16.390 First, we'll go to Google, and it's not working. 00:01:16.390 --> 00:01:18.360 Now, why is that? 00:01:19.240 --> 00:01:23.760 Well, it's because we have a default deny rule on this USER interface, 00:01:24.050 --> 00:01:25.340 and I'll show you that right here. 00:01:25.350 --> 00:01:29.580 If we go to the Firewall and Rules and go to the USER interface, 00:01:29.580 --> 00:01:31.090 we don't have anything. 00:01:31.090 --> 00:01:36.760 So that means any traffic that originates on this interface will be blocked. 00:01:37.840 --> 00:01:41.410 So what we have to do is we have to add all of the 00:01:41.420 --> 00:01:43.840 allowed rules that we want in our network. 00:01:43.840 --> 00:01:44.280 Now, 00:01:44.280 --> 00:01:47.320 this is different than the default configuration for 00:01:47.320 --> 00:01:49.700 the LAN or the MGMT network as well. 00:01:50.640 --> 00:01:53.970 This one was the default LAN interface that was created, 00:01:53.970 --> 00:01:55.580 and we renamed it to MGMT. 00:01:55.580 --> 00:02:01.490 And look at this, it has default allow rules in here for both IPv4 and IPv6. 00:02:01.500 --> 00:02:06.510 Anything that originates on that MGMT interface has access to anything. 00:02:06.510 --> 00:02:10.970 Now, that's not the best security posture moving forward, right? 00:02:10.970 --> 00:02:13.650 So, we want to segment both of these networks, 00:02:13.650 --> 00:02:17.750 which we will as we continue to build up the firewall configuration. 00:02:17.750 --> 00:02:18.780 For now, though, 00:02:18.780 --> 00:02:23.240 we want to be able to get access for some of the things for our USER network, 00:02:23.290 --> 00:02:26.030 but block everything else because we don't want our users 00:02:26.030 --> 00:02:29.650 to be able to do things like SSH into our firewall or 00:02:29.820 --> 00:02:31.540 configure our firewall via the GUI. 00:02:31.540 --> 00:02:34.290 We want to restrict that based on the IP addresses 00:02:34.300 --> 00:02:35.760 or the networks that they're on. 00:02:37.120 --> 00:02:39.940 So what we're going to do is we're going to create our firewall 00:02:39.940 --> 00:02:42.930 rules to only allow the services that are needed, 00:02:42.930 --> 00:02:45.100 not the other way around. 00:02:45.100 --> 00:02:48.510 That way we have to open up the firewall whenever a new service 00:02:48.510 --> 00:02:50.750 is implemented or something else is needed. 00:02:51.740 --> 00:02:55.870 So let's go ahead and configure some rules in the USER interface for now. 00:02:55.870 --> 00:02:58.800 And all we have to do is hit these Add buttons right here, 00:02:58.810 --> 00:03:02.250 and we can create separators and groups for the rules. 00:03:02.250 --> 00:03:04.570 We're going to leave this as Pass, 00:03:05.240 --> 00:03:09.980 and we're going to go through and allow some of the basic services that we need, 00:03:09.990 --> 00:03:14.350 like web browsing over port 80 or 443. 00:03:14.350 --> 00:03:19.560 We'll need SAMBA for our file shares and DNS services, of course. 00:03:19.940 --> 00:03:23.200 So we're going to go through and configure all of these rules to 00:03:23.210 --> 00:03:26.450 specifically allow them based off of this method. 00:03:27.440 --> 00:03:28.290 All right, 00:03:28.290 --> 00:03:31.950 that's an example of how we can create the first rule allowing 00:03:31.960 --> 00:03:34.570 these users to connect to anything over port 80. 00:03:34.570 --> 00:03:37.060 Now, if we wanted to restrict that even further, we could. 00:03:37.060 --> 00:03:42.740 We can narrow it down by the destination networks or even the source networks, 00:03:42.740 --> 00:03:43.950 if we needed to. 00:03:43.950 --> 00:03:44.420 Okay. 00:03:44.420 --> 00:03:47.270 So I'm going to go ahead and speed up the video while I'm 00:03:47.270 --> 00:03:49.500 finishing this configuration for the user, 00:03:49.500 --> 00:03:50.950 and we'll talk about the rules after. 00:03:52.640 --> 00:03:53.310 All right. 00:03:53.320 --> 00:03:55.570 And now that we're done configuring these rules, 00:03:55.570 --> 00:03:57.160 we can talk about them a little bit. 00:03:57.160 --> 00:03:58.100 As you can see, 00:03:58.100 --> 00:04:02.670 there's varying combinations of TCP and UDP or TCP or 00:04:02.670 --> 00:04:08.050 UDP as far as the protocol goes, and then the ports that we're using here, 00:04:08.050 --> 00:04:11.170 I just opened up some of the basic services that we need, 00:04:11.170 --> 00:04:16.390 DNS, HTTPS, LDAP, NetBIOS, those sort of things. 00:04:16.390 --> 00:04:20.510 And we can expand upon this, we can create more rules if we need to, 00:04:20.510 --> 00:04:23.360 to open up additional services, if, you know, 00:04:23.360 --> 00:04:26.330 we're doing stuff like handling guest redirect traffic for 00:04:26.340 --> 00:04:28.630 network access control with guest networks, 00:04:28.640 --> 00:04:31.900 other services, such as SNMP, if you have that, 00:04:31.900 --> 00:04:34.130 NetFlow going in and out of your network. 00:04:34.130 --> 00:04:37.930 You'll need to open up your firewall based on the services 00:04:37.930 --> 00:04:42.780 that your network uses and segment it appropriately based on 00:04:42.790 --> 00:04:44.590 who the traffic needs to go to. 00:04:44.980 --> 00:04:48.440 And now let's hop back over to our other box and see 00:04:48.440 --> 00:04:50.530 if we have internet service now. 00:04:50.530 --> 00:04:56.290 And as you can see, we have our access to the firewall that we can get to now, 00:04:56.300 --> 00:04:59.350 and then if we go to Google, we have access to Google. 00:05:01.940 --> 00:05:02.420 All right, 00:05:02.420 --> 00:05:06.290 now let's hop back over and finish configuring some of the other 00:05:06.300 --> 00:05:09.460 interface rules for other services that we might need. 00:05:09.840 --> 00:05:11.610 One thing to keep in mind on this, though, 00:05:11.620 --> 00:05:15.930 is that, yes, we gave our users access to the networks, 00:05:15.930 --> 00:05:16.410 right? 00:05:16.420 --> 00:05:19.870 But as you can see, we were able to hit the firewall's GUI, 00:05:19.870 --> 00:05:21.200 but we might not want that, 00:05:21.200 --> 00:05:24.770 we might not want that from our DMZ network or our USER network, 00:05:24.770 --> 00:05:25.250 even. 00:05:25.250 --> 00:05:27.650 So if you have those sort of restrictions, 00:05:27.660 --> 00:05:32.570 what we'll need to do is modify these for those specific destinations 00:05:32.570 --> 00:05:35.710 that we want or exclude the specific destination. 00:05:35.710 --> 00:05:39.270 So if I don't want that USER network to be able to get to our 00:05:39.270 --> 00:05:41.820 pfSense firewall for administrative purposes, 00:05:41.820 --> 00:05:47.080 what I'm going to have to do is set a rule to block it above the 443 traffic. 00:05:47.080 --> 00:05:51.490 And instead of blocking it for everything, 00:05:51.500 --> 00:05:55.300 what we're going to do is block it for just that single host or alias, 00:05:55.300 --> 00:05:58.280 which is going to be the 30.1 address because that's what we 00:05:58.280 --> 00:06:02.260 have set up as our web configurator address. 00:06:02.940 --> 00:06:03.600 All right. 00:06:03.610 --> 00:06:04.960 And now we have that block rule. 00:06:04.960 --> 00:06:11.050 So if we hop back over to it, then we shouldn't be able to get to the firewall. 00:06:11.050 --> 00:06:14.940 As you can see, it's blocking it, we're not getting a response, 00:06:15.250 --> 00:06:16.760 and nothing's happening. 00:06:18.440 --> 00:06:21.350 We'll be able to validate that in our logs as well. 00:06:21.350 --> 00:06:25.310 So if we go over here and we open up our System Logs, 00:06:25.320 --> 00:06:29.400 let's do it in a new tab, go over to the Firewall. 00:06:30.740 --> 00:06:32.480 And looking right here, as you can see, 00:06:32.480 --> 00:06:38.150 we were blocked with the HTTPS traffic going from our host here to the Firewall. 00:06:39.140 --> 00:06:39.610 Now, 00:06:39.610 --> 00:06:43.770 instead of boring you with going through and configuring the MGMT 00:06:43.780 --> 00:06:47.060 interface and the floating rules and everything like that, 00:06:47.070 --> 00:06:48.470 I went ahead and did it. 00:06:48.470 --> 00:06:51.190 So here's the MGMT rules as an example. 00:06:51.220 --> 00:06:54.390 They're pretty similar to the USER interface ones, 00:06:54.400 --> 00:07:00.000 and now we have our network fully segmented to provide basic services in and 00:07:00.000 --> 00:07:03.500 out of the USER network and the MGMT network as we need it. 00:07:03.500 --> 00:07:04.270 Remember, 00:07:04.270 --> 00:07:11.230 your lab or your production environment will likely have different rules here, 00:07:11.280 --> 00:07:14.760 and most likely a lot more than I have in my own lab. 00:07:15.340 --> 00:07:16.700 So keep that in mind. 00:07:16.710 --> 00:07:21.850 You'll want to create these rules to restrict the specific services and ports, 00:07:21.850 --> 00:07:26.650 protocols, networks that you do and do not want to communicate with each other.