All right,
now we're starting the next demo where we're actually going to
go ahead and segment some of the network off.
And we already have this set up a little bit.
As you saw in the previous demo, when we were going through our initial setup,
we built the interfaces specifically for different purposes.
So one of the interfaces was our MGMT network,
and the other one was the USER network.
This jump host that we're in right now is on the MGMT network.
It's one of our admin boxes.
And throughout our network,
we have each of these networks in a different VLAN to help
segment them throughout the rest of the network,
but from the firewalls point of view,
the links are being trunked into their two interfaces.
All right,
so let's go over to the interfaces and check out the USER one just
to make sure that it's configured correctly.
And it is, so we should be good.
We don't need to change anything there.
And as you can see, this Windows host right here is in our USER network.
So let's go see if it has an IP address.
All right.
So this one's on that USER network, and I'm just going to do an ipconfig,
and look at that, it has an IP address.
Let's test out some connectivity real quick.
First, we'll go to Google, and it's not working.
Now, why is that?
Well, it's because we have a default deny rule on this USER interface,
and I'll show you that right here.
If we go to the Firewall and Rules and go to the USER interface,
we don't have anything.
So that means any traffic that originates on this interface will be blocked.
So what we have to do is we have to add all of the
allowed rules that we want in our network.
Now,
this is different than the default configuration for
the LAN or the MGMT network as well.
This one was the default LAN interface that was created,
and we renamed it to MGMT.
And look at this, it has default allow rules in here for both IPv4 and IPv6.
Anything that originates on that MGMT interface has access to anything.
Now, that's not the best security posture moving forward, right?
So, we want to segment both of these networks,
which we will as we continue to build up the firewall configuration.
For now, though,
we want to be able to get access for some of the things for our USER network,
but block everything else because we don't want our users
to be able to do things like SSH into our firewall or
configure our firewall via the GUI.
We want to restrict that based on the IP addresses
or the networks that they're on.
So what we're going to do is we're going to create our firewall
rules to only allow the services that are needed,
not the other way around.
That way we have to open up the firewall whenever a new service
is implemented or something else is needed.
So let's go ahead and configure some rules in the USER interface for now.
And all we have to do is hit these Add buttons right here,
and we can create separators and groups for the rules.
We're going to leave this as Pass,
and we're going to go through and allow some of the basic services that we need,
like web browsing over port 80 or 443.
We'll need SAMBA for our file shares and DNS services, of course.
So we're going to go through and configure all of these rules to
specifically allow them based off of this method.
All right,
that's an example of how we can create the first rule allowing
these users to connect to anything over port 80.
Now, if we wanted to restrict that even further, we could.
We can narrow it down by the destination networks or even the source networks,
if we needed to.
Okay.
So I'm going to go ahead and speed up the video while I'm
finishing this configuration for the user,
and we'll talk about the rules after.
All right.
And now that we're done configuring these rules,
we can talk about them a little bit.
As you can see,
there's varying combinations of TCP and UDP or TCP or
UDP as far as the protocol goes, and then the ports that we're using here,
I just opened up some of the basic services that we need,
DNS, HTTPS, LDAP, NetBIOS, those sort of things.
And we can expand upon this, we can create more rules if we need to,
to open up additional services, if, you know,
we're doing stuff like handling guest redirect traffic for
network access control with guest networks,
other services, such as SNMP, if you have that,
NetFlow going in and out of your network.
You'll need to open up your firewall based on the services
that your network uses and segment it appropriately based on
who the traffic needs to go to.
And now let's hop back over to our other box and see
if we have internet service now.
And as you can see, we have our access to the firewall that we can get to now,
and then if we go to Google, we have access to Google.
All right,
now let's hop back over and finish configuring some of the other
interface rules for other services that we might need.
One thing to keep in mind on this, though,
is that, yes, we gave our users access to the networks,
right?
But as you can see, we were able to hit the firewall's GUI,
but we might not want that,
we might not want that from our DMZ network or our USER network,
even.
So if you have those sort of restrictions,
what we'll need to do is modify these for those specific destinations
that we want or exclude the specific destination.
So if I don't want that USER network to be able to get to our
pfSense firewall for administrative purposes,
what I'm going to have to do is set a rule to block it above the 443 traffic.
And instead of blocking it for everything,
what we're going to do is block it for just that single host or alias,
which is going to be the 30.1 address because that's what we
have set up as our web configurator address.
All right.
And now we have that block rule.
So if we hop back over to it, then we shouldn't be able to get to the firewall.
As you can see, it's blocking it, we're not getting a response,
and nothing's happening.
We'll be able to validate that in our logs as well.
So if we go over here and we open up our System Logs,
let's do it in a new tab, go over to the Firewall.
And looking right here, as you can see,
we were blocked with the HTTPS traffic going from our host here to the Firewall.
Now,
instead of boring you with going through and configuring the MGMT
interface and the floating rules and everything like that,
I went ahead and did it.
So here's the MGMT rules as an example.
They're pretty similar to the USER interface ones,
and now we have our network fully segmented to provide basic services in and
out of the USER network and the MGMT network as we need it.
Remember,
your lab or your production environment will likely have different rules here,
and most likely a lot more than I have in my own lab.
So keep that in mind.
You'll want to create these rules to restrict the specific services and ports,
protocols, networks that you do and do not want to communicate with each other.