Setting up a Firewall for IoT Lab Network

Much of this article was inspired by the following video from NetworkChuck:

This New Device is 10x Better Than Your Router

I test ethernet capabilities of IoT devices daily. This involves loading firmware that may contain vulnerable code still in development. I needed a way for my Hardware-In-The-Loop (HIL) test equipment to access and talk to these IoT devices (i.e. ssh onto these devices, access web protocols, etc.) without exposing these devices to the internet. Additionally, as I am working out of my home, I also needed to separate my work network from my home network. This meant I needed 3 networks: 

  1.  IoT devices that should not have internet access.
  2. Work and test equipment that need internet access to maintain updates.
  3. My home network which mainly uses Wi-Fi.

After some searching I found the perfect router. Note this might be overkill for most network but for my purposes it met my needs:

CWWK Firewall 

This router/bare-metal pc has 4 ethernet ports. While VLANs could be used through a managed switch this setup is better as it allows me to separate networks at the physical layer instead of the data link layer. This will make the networks more secure (i.e. these networks are effectively air-gapped and eliminate VLAN Hoping attacks). All it needs now is OPNSense.

Much of loading OPNSense onto this baremetal pc is discussed in NetworkChucks video but essentially you need to do the following:

  1.  Download OPNSense ISO for amd64 System Architecture, vga image type, using any mirror. At the time of writing the default settings are fine.
  2. Use balenaEtcher or other any other flasher to flash a ExFAT formatted USB drive.
  3. Plug in the USB drive into the firewall.
  4. Get into the BIOS/UEFI and set the primary boot device to the USB drive.
  5. Continue with boot and follow the install instructions.

It may be best to experiment with all of this by plugging your router into your existing router. Note this means your network will be double NATed so you might need to unblock bogon and private networks on the WAN port for the time being until you effectively replace your current router or set your current router into bridge mode.

Now comes the port interface setup. In my case I am using all 4 ports so I setup a WAN port with IPv4 and IPv6 Configuration Types as DHCP. I also setup the other 3 interfaces. Once all 3 interfaces are setup, now comes the exciting part. Configuring the firewall. Without giving too much of my network topology away I have the following general rules:

  1. I block web admin access on both my work and lab network.
  2. I block off access between my home and the work and lab networks but allow my work network to access the lab network.
  3. I block all lab network traffic to WAN to prevent leaks from the lab network out onto the internet.

Effectively, I now have a home network that is on a completely separate network (a ping sweep and port scan from nmap can prove this). My work network has access to the lab network and the ethernet but no administration privileges of my router (yea I'm onto you Bob from IT). This should secure me though additional external and internal pen tests shall be performed.

In conclusion, I believe the money from this router is worth it; especially if you are in IoT security. Having 4 ethernet ports has proved useful in isolating my networks and placing stricter rules on certain networks while having more relaxed rules on others. I have gained peace of mind with this firewall and I recommend setting one up if you are doing IoT testing.

 

Comments

Post a Comment

Popular posts from this blog

Setting Up a Proxy to Protect Your Public IP (An Introduction to Proxies)

Image
I recently purchased a static IP address. While this is great for setting up VPNs, websites, and other major benefits it bothered me that I normally visit CTFs and sites that contain malicious code to accomplish these CTF challenges. There had to be a way I could better protect my public IP from direct exposure in the event I did something stupid while surfing the web. This is where a proxies come into play. A proxy is exactly the same thing meant in the English language; think if computer A who set up the proxy wants to talk to computer C. An intermediary could be introduced (Proxy Server B) so that when computer C talks to computer A it has to go through Proxy Server B. Thus Computer C thinks its talking to Proxy Server B and only sees that IP address; when in reality all traffic is getting forwarded to computer A and vise versa. This creates a layer of abstraction. There are many types of proxies such as reverse proxies which is used mainly for public facing web sites. We are strict...
Read more

Reverse Shell with Ncat

Image
Kali Linux is the defacto for pen testing. While any linux distro (or OS) can work for backdooring into networks, its quickest to just download a Kali Linux iso. It comes with most of the pen testing tools (some of them cost money but most are free) to get you up and running: https://www.kali.org/downloads/   Lets not waste time, we have a windows machine to administer (or connect to for nefarious purposes). Let's say the windows machine is behind a firewall with all inbound connections blocked as shown below: This will prevent us from doing a bind shell with windows, but not a reverse shell. To create a reverse shell, let's have our kali linux machine listen on an unused well known port, 443:  ncat -lvp 443 --ssl The -lvp command means listen verbosely on port 443. --ssl will encrypt all incoming traffic (note ssl is deprecated as of ncat 7.6. To use this option, ncat 7.5 should be installed). By encrypting our traffic, it will make it difficult, albeit not i...
Read more

LDAP Vulnerabilities

Image
Note** The following examples utilize Web for Penetration Testers which I do not own any rights to. These examples provide solutions to the live image of Web for Pentester 1 which can be downloaded at https://pentesterlab.com/exercises/web_for_pentester/course . Please attempt these exercises on your own before reviewing my solutions to gain maximum benefit.   Web for Penetration Testers Example 1 Lightweight Directory Access Protocol (LDAP) can be thought of as a hierarchical directory structure. Using the live iso of Web for Pentester 1 lab we can find that Open LDAP service is running by running performing a nmap scan from our kali box (attacking machine): Figure 1 Using the ldapsearch command with the -b (base dn [top of hierarchy in this case]) -LLL (print responses in LDIF format without comments or version) and -x (simple authentication) flags (-h specifies the host) from our kali box (see Figure 2), we see that there are three common names (cn) entries: admin, ...
Read more