AT&T u-Verse Static IP work around with pfSense

First off, I’d like to give AT&T an honorable mention (sarcasm) for using the fucking worst, P.O.S. garbage, DSL Modems on the planet: 2WIRE. These things are ridiculous. You’d think that if a provider was able to route a /28 subnet to your home/business, that they’d be able to properly manage that subnet through their “firewall” or whatever you want to call it. The way this normally works is through routing a network range to your device. But AT&T and 2WIRE ensure that for every public static IP address you have, it has to have a unique MAC address and it must look like a different device all together. This is asinine.

So, with the help of my business partner, we’ve come up with a solution on how to get a set of static IP addresses to work so that you can host services on AT&T u-Verse. The way we accomplished this was through the use of an open source and free operating system named, “pfSense”. I’m sure there are other systems out there that we could have used, or just done it in Linux, but pfSense is really robust and has a nice interface. So that’s what we went with.

Additionally, I’m sure not everyone and their mother have an HP DL380 running in their basement, but… welcome to the Erdmanor. I have a DL380 in my basement. So what we’ve done is virtualized a firewall. We’re running pfSense in a virtual machine on the DL 380, which is running ESXi 5.5. I know ESXi 6.0 has been out for a few months now, but to be honest, I’m just too damn lazy to upgrade my box.

Anyways, here’s how we configured the virtual firewall. In ESX, we provisioned the system to have 8 network adapters, a 10GB HDD, 2GB RAM, and 1 virtual CPU. From there we added the VM to access the three different network segments (DMZ, Internal, Outside), and created the interfaces within pfSense. Then we programmed the AT&T gateway to use the external addresses that were provided by them, making sure that the proper interfaces and MAC addresses lined up between the ESX server, the AT&T gateway and the pfSense console. Also, in the AT&T gateway, we setup the system to be in DMZplus Mode, which you can read about in the screenshot below.

pfSense1

pfSense2

pfSense3

att-config0

att-config1

att-config2

att-config3



Now that our AT&T gateway is properly forwarding External IP traffic to the proper interfaces on our pfSense firewall, we can go through and create all the inbound NATs, firewall rules and network security that we wish to have.

If you have any further questions on how to set this up, just ask!

Thanks!





VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)
VN:F [1.9.22_1171]
Rating: 0 (from 0 votes)

Creating a Reverse Proxy with Apache2

Sometimes there is a need for hosting multiple websites from one server, or from one external IP address. For whatever your reason or need is, in this tutorial, I’ll just go through what I did to setup Apache server to forward requests.

In my setup here, I have a Debian Wheezy server in my DMZ, and in my tier 2 DMZ I have 5 Web servers. My objective is to host all these server from 1 IP address, and introduce some security.

I found a ton of info out there on setting up Apache as a reverse proxy, but none of them really spelled out exactly what to do, and what the results would be. Some of them did, but it wasn’t what I was looking for. So I took a bunch of stuff I see others doing, modify it to fit my needs and report back to you. I hope this helps.

Lets get started.

You’ll want a base install of Debian Wheezy which you can find at www.debian.org. After you download that, just follow my guide for install if you need: Debian Minimal Install: The base for all operations

As I stated before, I have a bunch of web servers in my tier 2 DMZ, and a Debian box in my Internet facing DMZ. It is my intention that the web servers never actually communicate with the end users. I want my end users to talk to my Debian box, the Debian box to sanitize and optimize the web request, and then forward that request on to the web server. The web server will receive the request from the Debian box, process it, and send back all the necessary data to the Debian server, which will in turn reply to the end user who originally made the request.

It sounds complicated to some people, but in reality it’s pretty simple, and the reverse proxy is transparent to the end user. Most people out there don’t even realize that many sites out there utilize this type of technology.

My Debian server needs some software, so I installed these packages:

sudo apt-get install apache2 libapache2-mod-evasive libapache2-mod-auth-openid libapache2-mod-geoip
libapache2-mod-proxy-html libapache2-mod-spamhaus libapache2-mod-vhost-hash-alias libapache2-modsecurity

From here you’ll want to get into the Apache directory.

cd /etc/apache2

Let’s get going with editing the main Apache config file. These are just recommendations, so you’ll want to tweak these for what ever is best for your environment.

sudo vim apache2.conf

I modified my connections for performance reasons. The default is 100.

# MaxKeepAliveRequests: The maximum number of requests to allow
# during a persistent connection. Set to 0 to allow an unlimited amount.
# We recommend you leave this number high, for maximum performance.
#
MaxKeepAliveRequests 500

Also, what security engineer out there doesn’t know that without logs you have no proof that anything is happening. We’ll cover log rotation and retention in another blog, but for now, I set my logging to “notice”. Default was “warn”.

# LogLevel: Control the number of messages logged to the error_log.
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
#
LogLevel notice

Perfect. Now, you may want to tweak your server a little differently, but for now this is all we need for here.

Now let’s get into some security hardening of the server.

sudo vim /etc/apache2/conf.d/security

We do have security in mind, so let’s not divulge any information that we don’t need to. Set “ServerTokens Prod”

# ServerTokens
# This directive configures what you return as the Server HTTP response
# Header. The default is 'Full' which sends information about the OS-Type
# and compiled in modules.
# Set to one of:  Full | OS | Minimal | Minor | Major | Prod
# where Full conveys the most information, and Prod the least.
#
#ServerTokens Minimal
#ServerTokens OS
#ServerTokens Full
ServerTokens Prod

Now let’s set “ServerSignature Off”

# Optionally add a line containing the server version and virtual host
# name to server-generated pages (internal error documents, FTP directory
# listings, mod_status and mod_info output etc., but not CGI generated
# documents or custom error documents).
# Set to "EMail" to also include a mailto: link to the ServerAdmin.
# Set to one of:  On | Off | EMail
#
#ServerSignature Off
ServerSignature On

And lastly, go ahead and uncomment these three lines in your config. We’ll configure “mod_headers” later.

Header set X-Content-Type-Options: "nosniff"

Header set X-XSS-Protection: "1; mode=block"

Header set X-Frame-Options: "sameorigin"

Sweet, looking good. Go ahead and save that, and we can get “mod_headers” activated. First, I’d like to point out that you can view what modules you have installed by using the “a2dismod” program. Simply enter the command, and it will ask you what modules you’d like to disable. Obviously, if you see it in the list, it’s already enabled. just hit “Ctrl+C” to stop the program.

To enable a module in Apache, you need to first made sure it’s installed, then you can just use the program “a2enmod”… like this:

sudo a2enmod headers

Now that we’ve enabled “mod_header”, lets verify we have the other necessary modules enabled as well.

steve @ reverseproxy ~ :) ᛤ>   a2enmod
Which module(s) do you want to enable (wildcards ok)?
cache
Enabling module cache.
Could not create /etc/apache2/mods-enabled/cache.load: Permission denied
steve @ reverseproxy ~ :( ᛤ>   sudo a2enmod
Which module(s) do you want to enable (wildcards ok)?
cache
Enabling module cache.
To activate the new configuration, you need to run:
  service apache2 restart
steve @ reverseproxy ~ :) ᛤ>   sudo a2enmod
Which module(s) do you want to enable (wildcards ok)?
proxy_ajp
Considering dependency proxy for proxy_ajp:
Module proxy already enabled
Enabling module proxy_ajp.
To activate the new configuration, you need to run:
  service apache2 restart
steve @ reverseproxy ~ :) ᛤ>   sudo a2enmod
Which module(s) do you want to enable (wildcards ok)?
proxy_balancer
Considering dependency proxy for proxy_balancer:
Module proxy already enabled
Enabling module proxy_balancer.
To activate the new configuration, you need to run:
  service apache2 restart
steve @ reverseproxy ~ :) ᛤ>   sudo a2enmod
Which module(s) do you want to enable (wildcards ok)?
proxy_connect
Considering dependency proxy for proxy_connect:
Module proxy already enabled
Enabling module proxy_connect.
To activate the new configuration, you need to run:
  service apache2 restart
steve @ reverseproxy ~ :) ᛤ>   sudo a2enmod
Which module(s) do you want to enable (wildcards ok)?
proxy_ftp
Considering dependency proxy for proxy_ftp:
Module proxy already enabled
Enabling module proxy_ftp.
To activate the new configuration, you need to run:
  service apache2 restart
steve @ reverseproxy ~ :) ᛤ>   sudo a2enmod
Which module(s) do you want to enable (wildcards ok)?
proxy_http
Considering dependency proxy for proxy_http:
Module proxy already enabled
Enabling module proxy_http.
To activate the new configuration, you need to run:
  service apache2 restart
steve @ reverseproxy ~ :) ᛤ>   sudo a2enmod
Which module(s) do you want to enable (wildcards ok)?
rewrite
Enabling module rewrite.
To activate the new configuration, you need to run:
  service apache2 restart
steve @ reverseproxy ~ :) ᛤ>   sudo a2enmod
Which module(s) do you want to enable (wildcards ok)?
vhost_alias
Enabling module vhost_alias.
To activate the new configuration, you need to run:
  service apache2 restart
steve @ reverseproxy ~ :) ᛤ>   sudo a2enmod
Which module(s) do you want to enable (wildcards ok)?
vhost_hash_alias
Enabling module vhost_hash_alias.
To activate the new configuration, you need to run:
  service apache2 restart

Here is a list of the Modules I just enabled:
cache proxy_ajp proxy_balancer proxy_connect proxy_ftp proxy_http rewrite vhost_alias vhost_hash_alias

Now let’s just restart Apache, and keep going.

steve @ reverseproxy ~ :) ᛤ>   sudo service apache2 restart
[ ok ] Restarting web server: apache2 ... waiting .

Perfect, moving right along… Now what we need to do is setup a new file in the “/etc/apache2/conf.d/sites-available” directory. I named mine, “reverseproxy”, as it’s easy to figure out what it is.

Now, to correctly setup your reverse proxy, this server should not be hosting ANY websites. This is a proxy server, not a web host. So go ahead and delete the config sym link for the default website. We don’t want to host that.

sudo rm /etc/apache2/sites-enabled/000-default

Now we can edit our “reverseproxy” file.

sudo vim /etc/apache2/sites-available/reverseproxy

#enter this code into your file

<VirtualHost *:80>
  ServerName yoursite.info
  ServerAlias www.yoursite.info yoursite.info
  ServerAdmin info@yoursite.info
  ProxyPreserveHost On
  ProxyPass / http://www.yoursite.info/
  ProxyPassReverse / http://www.yoursite.info/
  <Proxy *>
        Order allow,deny
        Allow from all
  </Proxy>
  ErrorLog /var/log/apache2/yoursite.info.log
  CustomLog /var/log/apache2/yoursite.info.log combined
</VirtualHost>



<VirtualHost *:80>
  ServerName anothersite.com
  ServerAlias anothersite.com www.anothersite.com
  ServerAdmin info@anothersite.com
  ProxyPreserveHost On
  ProxyPass / http://www.anothersite.com/
  ProxyPassReverse / http://www.anothersite.com/
  <Proxy *>
        Order allow,deny
        Allow from all
  </Proxy>
  ErrorLog /var/log/apache2/anothersite.com.log
  CustomLog /var/log/apache2/anothersite.com.log combined
</VirtualHost>




<VirtualHost *:80>
  ServerName thirdsite.cc
  ServerAlias thirdsite.cc www.thirdsite.cc
  ServerAdmin info@thirdsite.cc
  ProxyPreserveHost On
  ProxyPass / http://www.thirdsite.cc/
  ProxyPassReverse / http://www.thirdsite.cc/
  <Proxy *>
        Order allow,deny
        Allow from all
  </Proxy>
  ErrorLog /var/log/apache2/thirdsite.cc.log
  CustomLog /var/log/apache2/thirdsite.cc.log combined
</VirtualHost>

Awesome, now save that file and we can get it enabled. Just like setting up new modules, we’re going to sym-link our new file to the “sites-enabled” folder.

sudo ln -s /etc/apache2/sites-available/reverseproxy /etc/apache2/sites-enabled

Now we can just reload the Apache server (no restart required) the server so that it picks up the new settings.

sudo service apache2 reload

Now we need to edit the /etc/hosts file so that our reverse proxy server knows where to push site traffic to on our DMZ. So lets do that:

127.0.0.1       localhost
127.0.1.1       reverseproxy.internal.dmz  reverseproxy
192.168.0.26   www.thirdsite.cc
192.168.0.26   thirdsite.cc
192.168.0.26   www.anothersite.com
192.168.0.26   anothersite.com
192.168.0.65   www.yoursite.info
192.168.0.65   yoursite.info

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Sweet, all done!
Now you can test from a computer that all your sites are working. They *should* be! 🙂

I’ll work on a blog eventually to show how to enable mod_security with this setup so that we can sanitize user interaction with our site. Our visitors are probably good people, but attackers and skiddies are always out there trying to damage stuff.

Thanks for reading!!

References:
http://ubuntuguide.org/wiki/Apache2_reverse_proxies
http://www.raskas.be/blog/2006/04/21/reverse-proxy-of-virtual-hosts-with-apache-2/
http://www.askapache.com/hosting/reverse-proxy-apache.html
http://www.integratedwebsystems.com/2010/06/multiple-web-servers-over-a-single-ip-using-apache-as-a-reverse-proxy/
http://httpd.apache.org/docs/current/vhosts/examples.html
http://geek-gogie.blogspot.com/2013/01/using-reverse-proxy-in-apache-to-allow.html
http://www.ducea.com/2006/05/30/managing-apache2-modules-the-debian-way/
http://www.akadia.com/services/apache_redirect.html
http://unixhelp.ed.ac.uk/manual/mod/mod_proxy.html
https://httpd.apache.org/docs/2.2/vhosts/
https://httpd.apache.org/docs/2.2/vhosts/name-based.html
https://httpd.apache.org/docs/2.2/vhosts/examples.html
https://httpd.apache.org/docs/2.2/vhosts/mass.html
https://httpd.apache.org/docs/2.2/vhosts/details.html

VN:F [1.9.22_1171]
Rating: 5.0/5 (1 vote cast)
VN:F [1.9.22_1171]
Rating: 0 (from 0 votes)

Serious network architecture that works for everyone.

I started writing this blog post as a way to setup a reverse proxy for mail inspection, but it turned out that a network architecture blog focused on security of the perimeter was more important. I’ve gone over in my head with all the companies that have told me, “Ohhh we don’t need this” or, “this is too much administrative overhead” or, “We don’t need this much complexity, we’re just manufacturing “widgets” , or something like that. And to those people, I say this: “I am so sick and tired of hearing excuses of why you think it’s okay to be lazy. Do it right, do it now, and save yourself the headaches of a breach.” We’ll talk about the costs associated with being penetrated some other time, but it’s EXPENSIVE!

If you’re planning to do this right, then you’ll want/need to have a multi-tier DMZ for your public facing services. We’re not talking about internal servers or your internal network at this point (though after thinking about it, the exact same concept can be carried out on the Internal network too). In this blog, I’m merely trying to tell you about your externally facing services. This blog will go over proper placement for Internet facing services. The VAST majority of companies out there don’t go to this level of sophistication, but its totally possible for any company to do this and if you really want to secure your network infrastructure, then you’ll at least attempt this.

Before we start, I’ll say this. I’m going to try my best to describe this as granular as possible. There are a TON of intricacies here that need to be thought out. I’ll provide a rudimentary Visio diagram to help on this, but you’ll need to map out your own network and break it down in a way you can understand.

The main point of network segmentation and building a secure network architecture is based on one of the most talked about security areas: The Principle of Least Privilege. Do your end users need access to databases? How about other network services? How about filesharing with eachother? How about shared resources for just once specific department (should engineering folks be able to communicate with financial systems)? Please think about the level of access people should have to services while going through this blog.

You’re first level DMZ should house only your front end web servers (or load balancers in front of those servers), DNS servers and your proxy servers, nothing more. These systems are extremely visible to the public and will be processing thousands of requests per day, so if anything happens to them, trust me people will notice. Remember, these are front end systems, so you don’t need much of anything out there. I’ll be going over how to set those services up on a future blog, but for now just remember, least privilege. Internet users dont need direct access to the webserver, they do need access to a reverse proxy server that inspects the traffic going to the web server(s).

From here, you can create your second tier that will house your web servers (if you have load balancers or proxy servers in front of them out in tier one), mail servers, SFTP servers, if you’re using LDAP or AD you could add a read-only domain controller (RO-DC) for authentication (but NO Internet access), and things like that. These systems should be using local firewalls as well as network layer firewalls to control access to them. Web servers dont need to talk to anything except the back-end SQL BD and the end user. Both of those firewalls should specify that the only systems they’re allowed to talk to is the server in tier 1 that proxies data to it, and if there is a server behind it in tier three.

Then there is an optional third tier where you would house your back-end database servers and any other servers deemed unnecessary for tier two. when I say optional, I dont mean just throw it away and put SQL over in tier 2. I mean, if you dont have a SQL back-end you can eliminate tier 3. Another RO-DC could be posted here for authentication services(again, NO Internet access!). If you’re running MS-SQL or Oracle SQL servers here, you can have services level authentication (or any other services for that matter) authenticating to that RO-DC. Same goes for tier two.

Lastly, I’ll mention a Management network that will have access to all three tiers. You’ll obviously have admins (even if it’s just yourself) that will need to run updates on those boxes or perform other administrative functions on those systems. Don’t forget to allow yourself access to that. But that doesn’t mean “IP ANY ANY” from the management network into those tiers either! Dont be LAZY, be smart and do it right.

In my Visio diagram, I used some old hardware, and multiple physical switches, but don’t forget, you can trunk VLANs and do some pretty cool configurations with Cisco gear, especially the new ASA’s. See it here: DIAGRAM LINK

So from tier 1, your DNS server should only be servicing requests from your 3 DMZs, and the Internet. I would say, you shouldn’t open this up to your internal clients, because you should already have internal DNS servers for Active Directory (or what ever LDAP service you’re using). At most, you should only be allowing 53/udp inbound to that DNS server from the Internet, and allow SSH inbound to that server from your management network. That’s IT! For your proxy server or load balancer, you should allow 80/tcp and 443/tcp inbound from the Internet and allow in whatever port your load balancer needs from the management network. So in this scenario, you should have 80 and 443/tcp and 53/udp open from the Internet to tier 1. Simple, see?

Tier two only has ports open FROM tier 1 into tier 2 (and management network into tier 2). The people out on the Internet will NEVER communicate directly with tier 2, there’s just no need.

And lastly, tier 3 will only accept communications from tier 2 and the management tier. No end user needs to communicate with the SQL DB’s directly, so why let them?

The only thing I’ve left out here is the RO-DCs. What do they communicate with? Well, the way I would set them up is have the 2 real Domain Controllers in the management network. This should be a totally different domain than your internal network. Name the domain whatever you want (fubar.dmz or whatever). Your RO-DCs are only acting as a proxy to the domain. Nothing is stored on them, so you’ve got really nothing to lose.

So that’s really about it. If you’ve got any questions, contact me via my LinkedIn profile. There’s a link to that right on my home page near the bottom of the left column.

 

Enjoy!! 🙂

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)
VN:F [1.9.22_1171]
Rating: 0 (from 0 votes)