LINUX

Implementation of a perimeter firewall with Nftables II

On the stage created in the service module with the Odin (Router), Hela (DMZ), Loki and Thor (LAN) machines and using nftables, it sets up a perimeter firewall on the Odin machine so that the stage continues to function completely taking into account the following points: • The creation of different chains for each traffic flow (from LAN to the outside, from LAN to DMZ, etc.) will be valued. • Default DROP policy for all chains. • You can use the extensions that we create appropriate, but at least you should follow the connection when necessary. • We must implement the firewall to work after a machine reboot. • You must show proof of operation of all rules.

Thursday, March 28, 2024 | 42 minutes Read

Installation of android in GNS3 with KVM

To download the android image you can do it from this page – > https://www.fosshub.com/Android-x86.html: wget https://www.fosshub.com/Android-x86.html?dwl=android-x86_64-9.0-r2.iso Create a KVM machine as if it were a Debian, I’ve given it 2GB of RAM and 2 Cores: In our case we can launch an automatic installation: When you have the machine installed, turn off the machine and we’ll import it in gns3. To do this we will take the KVM disk and import it into the directory where we have installed the GNS3 images, then property the copied disk to your user.

Thursday, March 28, 2024 | 1 minute Read

Remote access VPN with Ipsec StrongSwan

StrongSwan is a VPN (Virtual Private Network) implementation based on IPsec, open source, multiplatform, complete and widely used. It works on operating systems such as Linux, FreeBSD, OS X, Windows, Android and iOS. Mainly, it is a key exchange demon that supports Internet Key Exchange protocols (IKEv1 and IKEv2) to establish security associations (SA) between two pairs. [NOTE] I will start from the VPN post remote access with OpenVPN, so you may refer to this during this article. If you want to have the same scenario go first to this.

Thursday, March 28, 2024 | 6 minutes Read

Remote access VPN with OpenVPN and x509 certificates

One of the two teams (which will act as a server) will be connected to two networks For the authentication of the extremes, digital certificates shall be used, which shall be generated using openssl and stored in the / etc / openvpn directory, together with the Diffie- Helman parameters and the certificate of the Certification Authority itself. Network addresses 10.99.99.0 / 24 will be used for VPN virtual addresses. The address 10.99.99.1 shall be assigned to the VPN server. The server and client configuration files will be created in the / etc / openvpn directory of each machine, and will be called servor.conf and cliente.conf respectively. After the establishment of the VPN, the client machine must be able to access a machine on the other network to which the server is connected. Riding the stage To perform this exercise I have mounted the following scenario on GNS3:

Thursday, March 28, 2024 | 17 minutes Read

VPN site to site Wireguard

[!NOTE] I will start from the VPN post remote access with Wireguard, so you may refer to this one during this article. Key generation The first thing we will do is to install both the Wireguard package in both machines: root@servidor1:~# sudo apt update && sudo apt install wireguard debian@servidor2:~$ sudo apt update && sudo apt install wireguard Let’s generate the pairs of keys that will be used to encrypt the connection. We will need a key for the server and a couple of additional keys for each client.

Thursday, March 28, 2024 | 5 minutes Read

VPN site to site with IPsec Cisco

In this post I’m going to mount an IPSEC VPN using swan routers. [!NOTE] This post details the configuration of R2 and R3 routers, however R1 is explained in the post of “VPN OpenVPN remote access.” If you want to see the configuration of the latter, look at the section preparing the stage. # Stage configuration As I have changed stage, the 2 new routers have to be set up on the R2 and R3 network.

Thursday, March 28, 2024 | 6 minutes Read

VPN site to site with IPsec Fortinet

In this post I will mount an IPSEC VPN using Fortinet firewalls, for which I will visualize them on GNS3. Stage preparation To create the VPN I will add a new Fortigate to the stage. So let’s proceed to set it up, the first thing will be to know the IP that the DHCP has given you: FortiGate-VM64-KVM login: admin Password: You are forced to change your password. Please input a new password. New Password: Confirm Password: Welcome! FortiGate-VM64-KVM # get system interface physical port1 == [onboard] ==[port1] mode: dhcp ip: 192.168.122.22 255.255.255.0 ipv6: ::/0 status: up speed: 1000Mbps (Duplex: full) FEC: none FEC_cap: none This IP you’ve given me for DHCP will be configured as static.

Thursday, March 28, 2024 | 3 minutes Read

VPN site to site with OpenVPN and x509 certificates

Riding the stage To perform this exercise I have mounted the following scenario on GNS3: Swan router configuration Let’s give each interface the corresponding network configuration: #Interfaz que nos dará internet R1#configure terminal R1(config)#interface fastEthernet 0/0 R1(config-if)#ip add dhcp R1(config-if)#no shut R1(config-if)#exit #Interfaz red Servidor 1 R1(config)#interface fastEthernet 1/0 R1(config-if)#ip add 90.0.0.1 255.255.255.0 R1(config-if)#no shut R1(config-if)#exit #Interfaz red Servidor 2 R1(config)#interface fastEthernet 1/1 R1(config-if)#ip add 100.0.0.1 255.255.255.0 R1(config-if)#no shut R1(config-if)#exit #Ruta por defecto para internet R1(config)#ip route 0.0.0.0 0.0.0.0 192.168.122.1 #Guarda la configuración R1#write #Configuración de SNAT R1#conf term R1(config)#access-list 1 permit 90.0.0.0 0.0.0.255 R1(config)#access-list 1 permit 100.0.0.0 0.0.0.255 R1(config)# ip nat pool NAT-Pool 192.168.122.127 192.168.122.127 prefix-length 24 R1(config)#ip nat inside source list 1 pool NAT-Pool overload R1(config)#interface FastEthernet0/0 R1(config-if)#ip nat outside R1(config)#interface FastEthernet1/0 R1(config-if)#ip nat inside R1(config)#interface FastEthernet1/1 R1(config-if)#ip nat inside Server Configuration 1

Thursday, March 28, 2024 | 16 minutes Read

VPN Wireguard remote access

First I will configure the server machine as a VPN remote access and server server as a VPN client. I will then set up a Windows and Android client. The first thing we will do is to install both the Wireguard package in both machines: root@servidor1:~# sudo apt update && sudo apt install wireguard debian@servidor2:~$ sudo apt update && sudo apt install wireguard Let’s generate the pairs of keys that will be used to encrypt the connection. We will need a key for the server and a couple of additional keys for each client.

Thursday, March 28, 2024 | 9 minutes Read

Compilation of a C-program using a Makefile

Introduction The compilation of programs in programming language C is a fundamental process in software development. It allows the source code written by the programmers to be translated into computer-friendly instructions. One of the challenges associated with the compilation is the efficient management of the project files and units, which becomes even more crucial when working on large and complex projects. This work aims to explore one of the most used mechanisms to compile projects in C: the use of a Makefile file. A Makefile is a configuration file that describes how to compile the source files of a project and how to manage the units between them. In addition, it allows to automate the compilation process and facilitates the task of maintaining and updating the code.

Wednesday, November 29, 2023 | 4 minutes Read

Compilation of a kernel

Introduction For the practice I will choose the kernel 6.4.4 that I have downloaded from the backports repository: To download the source code we will use apt source: It will create us a directory with the source code If we list the contents of the directory with the source code, we will see that the structure is the same as to compile a package in C.

Wednesday, November 29, 2023 | 4 minutes Read

Creation of an automated installation system

Automatic installation of an iso On the official debian page we will download a debian image, in my case I have selected a netinstall: Once you download the debian image, we will copy its content into a folder to then make some modifications. To do this we will mount the iso as a loop device: Once mounted we can see its content: We’re going to make a copy of the files we’re going to use to a directory of ours to make changes to them, once we do this we can dismount the image:

Wednesday, November 29, 2023 | 3 minutes Read