Bridging Lab to the Cloud with Site-to-Site VPN

I chose WireGuard primarily as it is lighter compared to other common VPN protocols like IPsec and OpenVPN. This is important as WireGuard will be running on the AntiX Firewall that has 32-bit CPU. The tunnel will also be used to access Wazuh Dashboard and management ports.
Lab firewall:

 1  [Interface]
 2  Address = 172.16.99.1/24
 3  SaveConfig = false
 4  ListenPort = 51820
 5  PrivateKey = <LAB-FW_PRIVATE-KEY>
 6
 7  [Peer]
 8  PublicKey = <AWS-GW_PUBLIC-KEY>
 9  Endpoint = <AWS-GW_PUBLIC-IP>:51820
10  AllowedIPs = 172.31.20.233/32, 172.31.11.191/32, 172.16.99.2/32
11  PersistentKeepalive = 25

AWS Gateway:

 1  [Interface]
 2  Address = 172.16.99.2/24
 3  SaveConfig = false
 4  ListenPort = 51820
 5  PrivateKey = <AWS-GW_PRIVATE-KEY>
 6  MTU = 1420
 7
 8  [Peer]
 9  PublicKey = <LAB-FW_PUBLIC-KEY>
10  AllowedIPs = 172.16.99.1/32

On the (AntiX) Lab Firewall, On postrouting chain, only traffic destined to AWS gateway or Wazuh Server will be source-NATed to Lab Router IP (172.16.99.1) (See line 102).

1  flush ruleset
2
3  # Interfaces
4  define wireguard = "wg0"
5  define lan = "lan0"
6  define wan = "wan0"
7
8  # Addresses
9  define gateway_public_ip = { 18.138.54.108 }
10  define gateway_private_ip = { 172.31.11.191 }
...
98      chain postrouting {
99          type nat hook postrouting priority srcnat; policy accept;
100
101          oifname $wan masquerade
102          oifname $wireguard ip daddr { $gateway_private_ip, $wazuh_ip} masquerade
103      }

Since AWS Gateway will act mainly as a WireGuard peer, I only allowed wg_port so that Lab Firewall can initiate a connection, ICMP request from lab for troubleshooting, and SSH from lab for management. It will only forward traffic used by Wazuh services.

1  #!/usr/sbin/nft -f
 2
 3  flush ruleset
 4  # -- Interfaces --
 5  define pub_iface = "ens5"
 6  define wg_iface = "wg0"
 7  # -- Target IPs --
 8  define wazuh_ip = { 172.31.20.233 }
 9  define lab_ip = { 172.16.99.1 }
10  # -- Ports --
11  define ssh_ports    = { 22 }
12  define wazuh_ports  = { 1514, 1515, 443 }
13  define syslog_ports = { 514 }
14  define wg_port      = 51820
15
16  table inet filter {
17      chain input {
18          type filter hook input priority filter; policy drop;
19          iif "lo" accept
20          ct state established,related accept
21          ct state invalid drop
22          icmp type echo-request accept
23          iifname $pub_iface udp dport $wg_port accept
24          iifname $wg_iface ip saddr $lab_ip tcp dport $ssh_ports accept
25      }
26
27      chain forward {
28          type filter hook forward priority filter; policy drop;
29          ct state established,related accept
30          ct state invalid drop
31          icmp type echo-request accept
32
33          iifname $wg_iface ip daddr $wazuh_ip tcp dport { $wazuh_ports, $syslog_ports, $ssh_ports } accept
34          iifname $wg_iface ip daddr $wazuh_ip udp dport { $wazuh_ports } accept
35      }
36  }

I also updated the security group of Wazuh Server to only accept through the intended ports. (Antix) Lab Firewall IP is still visible because sNAT is not enabled on the AWS Gateway. This allows Security Group to give different access level for different VPN peers.

In order for return traffic to arrive, I set up a route on the VPC:

On AntiX Firewall, I specified which protocol/ports are allowed to be forwarded to Wazuh. Then allowed SSH and HTTPS from admin IP only. While admin IP can be spoofed, SSH to aws instances still requires ssh key file. Then, to implement SNAT on traffic going out of wireguard interface (See line 99).

 1  flush ruleset
 2
 3  # Interfaces
 4  define wireguard = "wg0"
 5  define lan = "lan0"
 6  define wan = "wan0"
 7
 8  # Addresses
 9  define gateway_public_ip = { 18.138.54.108 }
10  define gateway_private_ip = { 172.31.11.191 }
11  define gateway_wireguard_ip = { 172.16.99.2 }
12  define wazuh_ip = { 172.31.20.233 }
13  define admin_ip = { 10.0.0.50 }
14  define blocked_ip = { 9.9.9.9 }
15
16  # Ports
17  define dns_ports      = { 53 }
18  define web_ports      = { 80,443 }
19  define ntp_ports      = { 123 }
20  define ssh_ports      = { 22 }
21  define wazuh_ports    = { 1514,1515 }
22  define syslog_ports   = { 514 }
23  define vpn_ports      = { 51820 }
24
25  define common_tcp_ports = { 53,80,443 }
26  define common_udp_ports = { 53,123 }
27
28  # FILTER TABLE
29  table inet filter {
...
44      chain forward {
45          type filter hook forward priority filter; policy drop;
46          ct state established,related accept
47          ct state invalid log prefix "NFT-FOR-DROP-INVALID " drop
48          ip daddr $blocked_ip log prefix "NFT-FOR-DROP-QUAD9 " drop
49          iifname $lan oifname $wan tcp dport $common_tcp_ports accept
50          iifname $lan oifname $wan udp dport $common_udp_ports accept
51          iifname $lan oifname $wireguard ip daddr $wazuh_ip tcp dport $wazuh_ports accept
52          ip saddr $admin_ip ip daddr { $gateway_private_ip, $wazuh_ip } tcp dport 22 accept
53          ip saddr $admin_ip ip daddr $wazuh_ip tcp dport 443 accept
54          icmp type echo-request accept
55          log prefix "NFT-FOR-DROP-DEFAULT "
56      }
...
87  table ip nat {
...
95      chain postrouting {
96          type nat hook postrouting priority srcnat; policy accept;
97
98          oifname $wan masquerade
99          oifname $wireguard masquerade
100      }
101  }

AntiX firewall will also accept traffic only if they are intended to Wazuh Server (172.31.20.233) or AWS Gateway (172.16.99.2 / 172.31.11.191). Even if the nftables break, there is another layer of security before it gets tunneled to AWS Gateway.

10  AllowedIPs = 172.31.20.233/32, 172.31.11.191/32, 172.16.99.2/32

File: /etc/wireguard/wg0.conf (Lab Firewall)

While I can just install a Wazuh agent on AntiX firewall, I want to set it up as a real network device where installing an agent is not an option. So I emulated how they would transfer their traffic with rsyslog on the AntiX Firewall (see Line 3 & 8).

 1  # 1. Capture Firewall logs
 2  :msg, contains, "NFT-" /var/log/nftables.log
 3      action(type="omfwd" target="172.31.20.233" port="514" protocol="tcp")
 4      stop
 5
 6  # 2. Capture all DNS queries
 7  if ($syslogtag == 'dnsmasq_log') then {
 8      action(type="omfwd" target="172.31.20.233" port="514" protocol="tcp")
 9      /var/log/dns.log
10      stop
11  }

File: /etc/rsyslog.d/10-firewall.conf (Lab Firewall)

I also added a syslog/TCP remote on Wazuh and specified to only accept logs from the Lab Firewall IP.

10      <alerts_log>yes</alerts_log>
11      <logall>yes</logall>
12      <logall_json>yes</logall_json>
13      <email_notification>no</email_notification>
...
41    <remote>
42      <connection>syslog</connection>
43      <port>514</port>
44      <protocol>tcp</protocol>
45      <allowed-ips>172.16.99.1/32</allowed-ips>
46      <local_ip>172.31.20.233</local_ip>
47    </remote>

File: /var/ossec/etc/ossec.conf (Wazuh Server)

I also installed Wazuh Agent one of the Linux Machine from the lab.

Baseline:

A. Tunneled: iperf3 server on 172.16.99.2
Test 1A:


Test 2A:


Test 3A:

B. External: iperf3 server on 192.168.1.2
Test 1B:


Test 2B:


Test 3B:

SSH on AWS Gateway

PS C:\Users\Ryan> C:\"Program Files (x86)"\Nmap\ncat.exe -zv 172.31.11.191 22
Ncat: Version 7.99 ( https://nmap.org/ncat )
Ncat: Connected to 172.31.11.191:22.
Ncat: 0 bytes sent, 0 bytes received in 0.30 seconds.

SSH on Wazuh Server

PS C:\Users\Ryan> C:\"Program Files (x86)"\Nmap\ncat.exe -zv 172.31.20.233 22
Ncat: Version 7.99 ( https://nmap.org/ncat )
Ncat: Connected to 172.31.20.233:22.
Ncat: 0 bytes sent, 0 bytes received in 0.33 seconds.

HTTPS (for web management) on Wazuh Server

PS C:\Users\Ryan> C:\"Program Files (x86)"\Nmap\ncat.exe -zv 172.31.20.233 443
Ncat: Version 7.99 ( https://nmap.org/ncat )
Ncat: Connected to 172.31.20.233:443.
Ncat: 0 bytes sent, 0 bytes received in 0.33 seconds.
PS C:\Users\Ryan>

Wazuh Ports

PS C:\Users\Ryan> C:\"Program Files (x86)"\Nmap\ncat.exe -zv 172.31.20.233 1514
Ncat: Version 7.99 ( https://nmap.org/ncat )
Ncat: Connected to 172.31.20.233:1514.
Ncat: 0 bytes sent, 0 bytes received in 0.29 seconds.
PS C:\Users\Ryan> C:\"Program Files (x86)"\Nmap\ncat.exe -zv 172.31.20.233 1515
Ncat: Version 7.99 ( https://nmap.org/ncat )
Ncat: Connected to 172.31.20.233:1515.
Ncat: 0 bytes sent, 0 bytes received in 0.40 seconds.

Management Ports

PS C:\Users\Ryan> C:\"Program Files (x86)"\Nmap\ncat.exe -zv 172.31.11.191 22
Ncat: Version 7.99 ( https://nmap.org/ncat )
Ncat: TIMEOUT.
PS C:\Users\Ryan> C:\"Program Files (x86)"\Nmap\ncat.exe -zv 172.31.20.233 22
Ncat: Version 7.99 ( https://nmap.org/ncat )
Ncat: TIMEOUT.
PS C:\Users\Ryan> C:\"Program Files (x86)"\Nmap\ncat.exe -zv 172.31.20.233 443
Ncat: Version 7.99 ( https://nmap.org/ncat )
Ncat: TIMEOUT.