Hardening, Securing and Privacy configuration!

[Velcro]

Update and follow up:

• Upgraded to 2.4(Beta)

I just wanted to update all on my progress:

I have found this forum extremely helpful in getting me this far and have tried to document my efforts and questions in a way that might help other “newbies”. I have made some strides but hoping for some additional thoughts and feedback. If my steps are not correct please feel free to provide any thoughts, I have also included my specific questions.

Harden Web Gui
System/Advanced/Admin Access

• Max Process to “1”
• Make sure Secure Shell is disabled
• Change Port for SSH port and TCP port (WebGUI)
• Disabled Antilockout rule in System-Advanced-Anti-lockout-Checked (Making sure to add new rule prior with new port).
• Disabled “Secure Shell Server” in “System-Advanced-Admin Access”
  (While I realize not all are major security updates, some were easier to do and I didn't need some of the functionality (I.e. Disable "Secure Shell Server")

My questions:
1. How can I add a key or change the default? Do I need to get this externally from a Comodo or Verisign with my domain? Can I self sign a new certificate?
2. Does removing “User - System: Shell account access” from “System-User Manager-Users-Edit” reduce an attack footprint?
3. How does one turn off HTTP->HTTPS redirect off? Is this on the browser?
(Funny but getting me this far has locked me out my webGUI about 6-7 times!! :-[)

Rules, static leases and white listing:
I first created Static IPs by doing the following:

• In “Services-DHCP Server-“Each of my interfaces””, I made sure “Deny unknown clients” was unchecked.
• I connected all the devices to the interface.
• I then went to “Status-DHCP Leases” and noted all the MAC addresses.
• I then added them as static lease type.
• I then went back to “Services-DHCP Server-“Each individual interface” and made sure  “Deny unknown clients” was checked.
• I then created aliases for each interfaces devices(using the static IPs I created in step 1 in “Firewall-Aliases-IPs”, labelled as “hosts”
• This allowed me very specific “Sources”
• I then went to “Firewall-Rules-“Each of my interfaces”“ and created rules as follows:
  

SEE ATTACHMENT FOR IMAGE OF RULES

(I also have a floating rule (IPv4+6 TCP/UDP * *  Gateway Interfaces      Firewall ports * none) to prevent access to firewall)

My questions/Looking for feedback:
1. For my “Very secure interface” I tried getting more granular with the destinations, some of my email providers had 1-2 IPs but google has so many that the list seemed endless. For example, I was able to get port 80 down to 5-6 IPs but again googles list was too big. How can I make this more granular?
2. Is there a way to allow allow google voice and hangouts only?
3. Is there a more restrictive way to write these rules?
4. Is this the right approach?

OpenVPN used for privacy to access the web:

• I added a VPN client(based on the VPN providers instructions), then added an Interface.
• I also replicated each existing “WAN rule” in NAT-Manual-Outbound/Manual with a new rule for the “OpenVPN client” and a new rule for the “OpenVPN interface”.
• I then proceeded to delete the “OpenVPN client” rules and “WAN rule” specific rules in the “NAT-Outbound/Manual” section for interfaces that I want to use VPN(WIFI Interface) only (kind of a kill switch) and interfaces I want/need to use WAN(AppleTV) only.
• I added rules in the VPN Interface only(not client) similar to the WAN rules blocking everything(bogon networks, private networks, etc.).
• I modified rules in the internal interfaces(WIFI and VLAN) that I only wanted to access the VPN specifying the "VPN Interface" as the "Gateway"(See my rule attachment image)

My questions/Looking for feedback:
1. I tried adding a self signed certificate on my end but it broke the VPN connection. Similar to the web GUI question, do I need to get this externally from a Comodo or Verisign with my domain? In the logs my vpn provider did not appear to accept it.
2. Does setting up an interface just give me more options? I was able to bypass the “AppleTV” by changing each rule Gateway in the AppleTV interface (Extra Options-Display Advanced-Gateway-WAN) to access the WAN
3. I was unable to SHA2, nor AES-128-GCM working with PIA…is this a PIA limitation? Their instructions were pretty specific on setup so I assume it is…any recommendation for another provider?
4. Do I need rules on OpenVPN Interface? Or are these rules covered in WAN?
5. In the dashboard, my VPN Gateway is showing “Offline” yet when I go online to find my IP it is showing my VPN’s? The graph on my Dashboard seems to show activity as well…
6. Do I need to set up a DHCP server for my VPN Interface?
7. Is this the right approach?

Surricata:
Set up “WIFI interface” and “Guest VLAN” interfaces to block offenders. Type of rules I enabled in Services-Suricata-Global settings are(after getting a snort code):

• Install ETOpen Emerging Threats rules
• Install Snort VRT rules
• Install Snort Community rules

I periodically have “Force-Disabled” these rules:

• 1:2002157 ET CHAT Skype User-Agent detected
• 1:2002878 ET POLICY iTunes User Agent
• 1:2210000 SURICATA STREAM 3way handshake with ack in wrong dir

Some rules I am currently reviewing are:

• 1:2210054 SURICATA STREAM excessive retransmissions
• 1:2230003 SURICATA TLS invalid handshake message
• 1:2210044 SURICATA STREAM Packet with invalid timestamp
• 1:2010066 ET POLICY Data POST to an image file (gif)
• 1:2210042 SURICATA STREAM TIMEWAIT ACK with wrong seq
• 1:2221028 SURICATA HTTP Host header invalid
• 1:2200094 SURICATA zero length padN option

I currently have my WAN and VPN interface being monitored only.

My questions/Looking for feedback:
1. Why are Suricata rules triggered on the Wifi Interface/Network(The interface) and GuestVLAN(a VLAN on the WIFI interface), when the app is only on the VLAN I.e. Skype alert on WIFI when it is only accessed on VLAN? Is it more secure to setup 2-3 VLANs on the WIFI network I.e. Secure WIFI(VLAN #1), IOTDevices(VLAN #2) and WIFES(VLAN #3)?
2. I have been unable to get my DNSLB working? I think it has something to do with my DNS resolver, my “RFC_1918_nets “ rule, or my OpenDNS IPs, or something in my “General settings”. I am still working on this…
3. How do I add the 2 golden rules detailed above? pfBasic any thoughts?

Thank you again for any and all feedback!


[pfBasic]

@Velcro:

• Make sure Secure Shell is disabled
• Change Port for SSH port and TCP port (WebGUI)
• Disabled “Secure Shell Server” in “System-Advanced-Admin Access”
  (I.e. Disable "Secure Shell Server")

If you disable SSH then changing the port doesn't do anything. That being said, SSH is very useful to have available and also very secure when using key + user/pass authentication. Moving the SSH port (if you do decide to re-enable it) gices some security through obscurity (useful for script kiddies) but mostly just cleans up your logs, if your SSH is on some random unused port then seeing unexepcted activity being attempted on that port is more useful to you (if you use 22 for SSH then you will see tons of traffic being blocked but it's just useless noise).

@Velcro:

My questions:
1. How can I add a key or change the default? Do I need to get this externally from a Comodo or Verisign with my domain? Can I self sign a new certificate?

Key for what? You can create keys for SSH using any implementation of OpenSSH. A common program to provide this is PuTTYgen since it is often used for SSH access. Import keys in System / User Manager.
You can self sign certificates, manage CAs and Certificates in System / Cert. Manager.

@Velcro:

3. How does one turn off HTTP->HTTPS redirect off? Is this on the browser?

I'm not sure what this is? If you are talking about accessing the WebGUI via HTTP or HTTPS then absolutely without question do not ever set WebGUI access to HTTP. Only HTTPS.

@Velcro:

My questions/Looking for feedback:
1. For my “Very secure interface” I tried getting more granular with the destinations, some of my email providers had 1-2 IPs but google has so many that the list seemed endless. For example, I was able to get port 80 down to 5-6 IPs but again googles list was too big. How can I make this more granular?
…
4. Is this the right approach?

This is too specific for firewall rules. IP addresses can and will change frequently and as soon as that happens your firewall rules are broken and you’re out hunting for more IP’s to whitelist.
Realistic whitelisting of your LAN can control:
The protocol
The traffic type
The source static IP(s) (you’ve already done this)
The source port(s)
The destination port(s)
The gateway(s)
+more in advanced options
Firewall rules are not the place to control the destination IP unless it’s a case where you know the destination doesn’t change.
In most cases blacklisting is better for controlling the destination IP range. This can be done very effectively with pfBlockerNG & DNSBL as they can utilize tons of very well managed IP lists.

@Velcro:

My questions/Looking for feedback:
1. I tried adding a self signed certificate on my end but it broke the VPN connection. Similar to the web GUI question, do I need to get this externally from a Comodo or Verisign with my domain? In the logs my vpn provider did not appear to accept it.

I believe that you are talking about the key pair between your PIA provider and your pfSense box (the client)? If so, you need to use their public key. They are maintaining the private key and publishing the public key for you to use, that is the only key that will work.

@Velcro:

3. I was unable to SHA2, nor AES-128-GCM working with PIA…is this a PIA limitation? Their instructions were pretty specific on setup so I assume it is…any recommendation for another provider?

In order to utilize SHA2, you need to setup your PIA client a little differently, instructions are here:
https://www.privateinternetaccess.com/forum/discussion/20387/guide-setup-pfsense-with-strong-encryption-aes-256
PIA does not currently support AES-GCM, I don’t know if they have any plans to do so ever. pfSense doesn’t support GCM until 2.4.

@Velcro:

4. Do I need rules on OpenVPN Interface? Or are these rules covered in WAN?

No rules are necessary on your VPN client interface(s)

@Velcro:

5. In the dashboard, my VPN Gateway is showing “Offline” yet when I go online to find my IP it is showing my VPN’s? The graph on my Dashboard seems to show activity as well…

Try changing your monitor IP to something public such as 8.8.8.8 or 8.8.4.4 under System / Routing / Gateways

@Velcro:

6. Do I need to set up a DHCP server for my VPN Interface?

No

@Velcro:

Suricata:
Set up “WIFI interface” and “Guest VLAN” interfaces to block offenders. Type of rules I enabled in Services-Suricata-Global settings are(after getting a snort code):

You should only need to inspect packets on the WAN interface.

@Velcro:

• Install ETOpen Emerging Threats rules
• Install Snort VRT rules
• Install Snort Community rules

Disable the Snort Community Rules, they are included in the Snort VRT rules.

@Velcro:

I periodically have “Force-Disabled” these rules:
…

Some rules I am currently reviewing are:
…

You can disable the entire STREAM category, it generates a ton of FPs for everyone that uses internet for normal (home use) reasons. For other research on rules to disable the IDS/IPS subforum has a ton of great info. A lot of the information is valid on both snort and suricata. Generally speaking though, if a rule breaks something you use, disable it.

@Velcro:

My questions/Looking for feedback:
1. Why are Suricata rules triggered on the Wifi Interface/Network(The interface) and GuestVLAN(a VLAN on the WIFI interface), when the app is only on the VLAN…

Just disable suricata on all interfaces except WAN.

@Velcro:

2. I have been unable to get my DNSLB working? I think it has something to do with my DNS resolver, my “RFC_1918_nets “ rule, or my OpenDNS IPs, or something in my “General settings”. I am still working on this…

Check out the following post and the entire thread is full of great info, BBCan177 is the genius behind the pfBlockerNG and an incredibly patient and helpful individual. Read through that thread, and read through the info blocks on pfBlockerNG, any questions you have after that ask in that sub forum and you will get very good help.
https://forum.pfsense.org/index.php?topic=102470.msg572943#msg572943
My first thought on what you described is your DNS settings since DNSBL works through that, are you using Unbound in resolver mode? That is default for pfSense and what I would recommend. I can’t remember off the top of my head whether or not it is a requirement to use DNSBL?
Also, by reading through that thread & subforum you will get great info on lists to use with pfBlockerNG & DNSBL.

@Velcro:

3. How do I add the 2 golden rules detailed above? pfBasic any thoughts?

Before adding those rules you need to make sure that you have any aliases you need properly defined in suricata (these are different than Firewall Aliases). Check out this post for more details on that and feel free to ask any questions you may have.
https://forum.pfsense.org/index.php?topic=78062.msg693829#msg693829
Once you have implemented any aliases necessary….
Services / Suricata / Interfaces
Click to edit the interface
Click the “xxx Rules” Tab
On the “Category” drop down, select custom.rules
Add the rules there

@Velcro:

Thank you again for any and all feedback!

You are very welcome!

[pfBasic]

If I haven't already I wanted to take a post to strongly recommend that you consider purchasing a year of pfSense Gold. I am in no way affiliated with pfSense, I am just a home user like yourself, but I think that it would be very valuable for you to learn the right way to setup your firewall.

Everything you get from me is just stuff I've gleaned from here and other places and from messing around on pfSense. I am not an IT pro, my profession is not at all computer science related.

Everything you get from a Gold Membership (pfSense Book constantly updated, pfSense hangout videos, etc.) comes from the IT Pros behind pfSense.
https://www.pfsense.org/our-services/gold-membership.html

To me this is especially important to you because you are already being targeted while you are trying to learn pfSense. My advice is not good enough.

[Velcro]

Thanks pfBasic…I'll follow up on your advice and input and follow up. I will also included clarification to my questions and unanswered question in a subsequent post.

@pfBasic:

If I haven't already I wanted to take a post to strongly recommend that you consider purchasing a year of pfSense Gold….I am not an IT pro, my profession is not at all computer science related....My advice is not good enough.

I am already a Gold member…there is some great stuff in there. pfBasic your help has been very invaluable...

[Velcro]

To clarify my questions and highlight outstanding questions see below:

Clarifying my questions:

@pfBasic:

@Velcro:

My questions:
1. How can I add a key or change the default? Do I need to get this externally from a Comodo or Verisign with my domain? Can I self sign a new certificate?

Key for what? You can create keys for SSH using any implementation of OpenSSH. A common program to provide this is PuTTYgen since it is often used for SSH access. Import keys in System / User Manager.
You can self sign certificates, manage CAs and Certificates in System / Cert. Manager.

I’ll add back SSH functionality at some point but my question about a key or a CA was specific to the WebGUI. I am thinking a long password and a CA/Key in the browser would enhance security. How is this done in Firefox? I came close by going to “Firefox->Preferences->Advanced->Certificates->View Certificates->Import” I imported a certificate I created in pfSense. The steps I followed were:

System -> Certificate Manager -> Certificates -> “ADD” -> “Create a certificate signing request”….the certificate states: “external - signature pending” in the issuer column (The default webconfigurator states “self-signed”)
System -> Certificate Manager -> “ADD” -> “Create an internal Certificate Authority”
System -> Advanced -> Admin Access - “SSL Certificate” drop down gives me the option to change from web configurator default to ““Create a certificate signing request” certificate I created

My assumption is a CA certificate(that only I have on my Mac) + large password is stronger then just a long password? Is this correct? What steps am I missing?

@pfBasic:

@Velcro:

3. How does one turn off HTTP->HTTPS redirect off? Is this on the browser?

I'm not sure what this is? If you are talking about accessing the WebGUI via HTTP or HTTPS then absolutely without question do not ever set WebGUI access to HTTP. Only HTTPS.

In “System->Advanced” I changed the default port # and have HTTPS enabled, however the browser still asks me to confirm a redirect and approve exception. This is still HTTPS? I believe this pertains to my CA certificate?

@pfBasic:

@Velcro:

My questions/Looking for feedback:
1. I tried adding a self signed certificate on my end but it broke the VPN connection. Similar to the web GUI question, do I need to get this externally from a Comodo or Verisign with my domain? In the logs my vpn provider did not appear to accept it.

I believe that you are talking about the key pair between your PIA provider and your pfSense box (the client)? If so, you need to use their public key. They are maintaining the private key and publishing the public key for you to use, that is the only key that will work.

I was able to setup PIA, downloaded their public key, entered my user name/password but was looking to see how to setup a CA verification only end. I was referencing this video but was unable to get it to work, take note of the internal key that is setup in pfSense and inputed into the OpenVPM client during the initial setup: https://www.youtube.com/watch?v=8jYibgeAV0Y

I will look at other providers to see if it will work but PIA seemed a popular provider, wasn’t sure if anybody managed to set up a “self signed” certificate using PIA as additional authentication.

@Velcro:

…Is it more secure to setup 2-3 VLANs on the WIFI network I.e. Secure WIFI(VLAN #1), IOTDevices(VLAN #2) and WIFES(VLAN #3)?

I originally asked this question in the context of Suricata but Thought it best to clarify as a broader pfSense configuration/security question:

I have 1 wireless controller/access point(Which I think needs a direct wireless connection (to configure. change passwords, etc… )which I want to make sure is secure. I also want to make sure I have I have a Guest/Wife/IOT VLAN and a Super secure wireless network. I am thinking the following:

A) Secure WIFI/Wireless Controller + Guest/Wife/IOT(VLAN #2)

Or

B) Secure WIFI (VLAN #1) + Wireless Controller (Connect direct on Interface only i.e no VLAN) + Guest/Wife/IOT(VLAN #2)

Or

C) Secure WIFI (VLAN #1) + Wireless Controller (Connect direct on Interface only) + Guest/Wife(VLAN #2) + IOT(VLAN #3)

I think C) more secure? Thoughts?

@pfBasic:

@Velcro:

My questions/Looking for feedback:
1. Why are Suricata rules triggered on the Wifi Interface/Network(The interface) and GuestVLAN(a VLAN on the WIFI interface), when the app is only on the VLAN…

Just disable suricata on all interfaces except WAN.

I compared my alerts on the WAN and VPN interface and they are different…Suricata on WAN and VPN interface(since it is also a gateway)?

Outstanding questions:

@Velcro:

Rules, static leases and white listing:
….

2. Is there a way to allow allow google voice and hangouts only?

I managed to find the following from Google:

When deploying Hangouts Meet or classic Hangouts, bandwidth planning is vital.
Concurrent usage estimates are required.
Enable UDP ports 19302 to 19309.
Enable TCP and UDP ports 80 and 443.

I am able to make outgoing calls using hangouts/google voice(via port 80 and 443) but incoming calls are not coming in via WIFI? Is there a secure way to configure this so as to receive incoming calls on WIFI with out compromising security and opening ports wide open?

@Velcro:

OpenVPN used for privacy to access the web:
…

2. Does setting up an interface just give me more options? I was able to bypass the “AppleTV” by changing each rule Gateway in the AppleTV interface (Extra Options-Display Advanced-Gateway-WAN) to access the WAN

I am inclined to think the “KISS” approach is best for me. I think adding a VPN interface and deleting and adding “Mappings” rules/configurations in the “Firewall -> NAT -> Outbound -> Manual Outbound NAT” section for each internal interface gives me a lot more flexibility, is this true? By deleting the WAN “Mappings” rule configuration in effect give me a kill switch(When the internal interface rules reference this gateway only)?

Any and all feedback is greatly appreciated!

[pfBasic]

For the first two questions, pfSense automatically sets up a certificate for the webGUI called webconfigurator.

You will get a Certificate error in your browser when using that certiifcate but that's fine you are still secure. You can identify an https website by a green lock in the url address bar, if there's an error the lock won't be green (as in the case of the webconfigurator certificate) this is usually cause for alarm but since you personally know that you can trust the webconfigurator certificate because it was generated on your personal machine then you know it's safe.
As far as maximizing security on the web GUI, I think someone on here already mentioned using a dedicated machine (or at least a dedicated browser) to access the web GUI and nothing else. If you can do something like this with say an old machine that you do a clean install with something free like linux with a GUI or TrueOS then you are extremely secure.
Additionally you can create a management VLAN (I think you already did this) that is the only access point for the web GUI.

Combining all of these things is an extreme level of security that is very likely beyond what even you need under a targeted attack, you don't need anything beyond this.

–---

So for the PIA certificate what it sounds like you are saying is that you want to use certificate based authentication in order to access your account instead of or in addition to the username password login?
As far as I know this is not supported.
It is probably also not needed. You would still have a username/password combo that you would use to login to your PIA account at their website and that's all that it's doing over the VPN connection.
Your PIA account should not have any personally identifiable information in it (you'll have to log into your PIA account to check what's in there).
So basically, set a strong password for PIA and enable any two-factor authentication if it's available, use strong, obscured "reset questions" if you have any at all and store it all in some sort of password manager that has an incredibly secure password and two-factor authentication. Basically treat it just like any other online account you have.

---

The reason you segregate your internal network is to separate devices that either have different purposes, different levels of security, or different levels of trust. So keeping known insecure IOT devices on their own network with minimal access to the internet and the rest of your internal network is important.
Also keeping a guest network isolated from your internal network is important for guests and untrusted devices.

I've never used a VLAN at all much less on a WAP so I can't tell you anything about that.
I just use my main WAP for my network and a cheap WAP for Guest access. VLANs are probably fine, but I believe that you are going to need an access point that supports VLANs for that?

---

I don't think suricata is going to do much of anything for you on your VPN gateway but I might be wrong. Hopefully someone else can answer this!

---

I don't know anything about google voice/VOIP setup. For any kind of bandwidth planning though you can use the HFSC Traffic Shaper wizard.
I'm pretty sure that if you run suricata in inline mode that it breaks the traffic shaper right now though so you'll have to use legacy mode if you want both.

I've never tried to implement security via NAT. I can't tell you whether or not it is effective or efficient. My guess is that you just use firewall rules for this.

[Velcro]

I haven’t given up!!

I had a lot of cool components with my original effort (VPN, Surricata/Snort, isolations, etc… but I was missing a fundamental component: Good solid Rules, especially with DNS settings! Instead of continuing down the path I was on I decided to scrap my efforts and start again from a default configuration.

I approached my build a little different this time and managed to get the following working on my LAN interface only with “Any, Any, Any” rules…NOT SECURE!:

Siricata monitoring only
pfBlockerNG DNSBL working and showing alerts
A VPN client with PIA and a VPN interface

What rule do I need to put in place on the new interfaces to allow me to use access the internet on VPN and DNS internally via pfBlockerNG?

Any body have some basic rules allow this to work?

Thanks again for any and help…

[pfBasic]

To use your VPN as the gateway for a rle you select your VPN interface gateway under advanced in the rule.

The DNSBL VIP should be automatically configured for you after you setup DNSBL.

BTW, I wanted to mention pfMonitor to you. I'm checking it out right now and it sounds like something that would be really useful for you. Primarily it will give you more information on who your attackers are, and how they are attacking you by giving you summary statistics with something to compare them to, along with notes and links explaining things.

https://forum.pfsense.org/index.php?topic=120972.0

Back on track though, does that answer your question about rules or are you trying to migrate from a blacklist LAN to a whitelist LAN and looking for how to do that?

[Fabio72]

@Velcro:

I compared my alerts on the WAN and VPN interface and they are different…Suricata on WAN and VPN interface(since it is also a gateway)?

If you use vpn as a gateway, and you expose services on it, you can enable suricata on vpn like you do on WAN.
Using suricata on "external" interfaces you can monitor/block attackers but you loose NAT informations. If one of your hosts has a malware, you cannot see its address from WAN side.

Suricata on LAN shows the correct source/ destination IP addresses. But if you have multiple subnet then you should enable suricata on every one.
And enabling suricata on all interfaces probably kill your CPU ;)

You can decide to use pfblocker to stop most of the attackers on WAN/VPN and use suricata on LAN/WIFI

[Velcro]

Thanks Fabio72…While I get this going I have snort running on my VPN and wan...I want to get to PfBlocker in the long term but today I am still using OpenDNS. While not private I think I am getting some extra security. I need to work out how to get PfBlocker working on my LAN and multiple VLANs. Thanks again for he help...