Repurposing 32-bit Laptop as Linux Firewall for Cybersecurity Lab

The logging prefix on my config will follow the pattern NFT-[CHAIN]-[ACTION]-[KEYWORD] to make logs easier to analyze and because the action is not included on nftables logs by default.

1  flush ruleset
2
3  table inet filter {
4      chain input {
5          type filter hook input priority filter; policy drop;
6          iif "lo" accept
7          ct state established,related accept
8          ct state invalid log prefix "NFT-IN-DROP-INVALID " drop
9          ip saddr 10.0.0.50 tcp dport 22 accept
10          tcp dport 53 accept
11          udp dport 53 accept
12          icmp type { echo-reply, echo-request } accept
13          log prefix "NFT-IN-DROP-DEFAULT "
14      }
15
16      chain forward {
17          type filter hook forward priority filter; policy drop;
18          ct state established,related accept
19          ct state invalid log prefix "NFT-FOR-DROP-INVALID " drop
20          ip daddr 9.9.9.9 log prefix "NFT-FOR-DROP-QUAD9 " drop
21          tcp dport { 80, 443 } accept
22          udp dport { 53, 123 } accept
23          icmp type { echo-reply, echo-request } accept
24          log prefix "NFT-FOR-DROP-DEFAULT "
25      }
26
27      chain output {
28          type filter hook output priority filter; policy drop;
29          ct state established,related accept
30          ct state invalid log prefix "NFT-OUT-DROP-INVALID " drop
31          hour "17:00"-"04:00" tcp dport { 80, 443, 53 } log prefix "NFT-OUT-ACCEPT-OFFHOUR_TRAFFIC " accept
32          hour "17:00"-"04:00" udp dport { 53, 123 } log prefix "NFT-OUT-ACCEPT-OFFHOUR_TRAFFIC " accept
33          tcp dport { 53, 80, 443 } accept
34          udp dport { 53, 123 } accept
35          icmp type { echo-reply, echo-request } accept
36          log prefix "NFT-OUT-DROP-DEFAULT "
37      }
38  }
39  table ip nat {
40      chain prerouting {
41          type nat hook prerouting priority dstnat; policy accept;
42          iifname "lan0" udp dport 53 dnat to 172.16.0.1
43          iifname "lan0" tcp dport 53 dnat to 172.16.0.1
44      }
45
46      chain postrouting {
47          type nat hook postrouting priority srcnat; policy accept;
48          oifname "wan0" masquerade
49      }
50  }

File: /etc/nftables.conf

For testing purposes, I blocked the domain chess.com.

1  # DNS sinkhole list
2  address=/chess.com/

File: /ect/dnsmasq.d/blocklist.conf

I intercepted all DNS queries using the nftables.conf via the prerouting chain. Hosts that modified their computer's DNS servers would still be redirected to the DNS sinkhole.

40  chain prerouting {
41    type nat hook prerouting priority dstnat; policy accept;
42    iifname "lan0" udp dport 53 dnat to 172.16.0.1
43    iifname "lan0" tcp dport 53 dnat to 172.16.0.1
44  }

File: /etc/nftables.conf

I disabled the NAT on the Lab Router so that source IP address of Lab Hosts (10.0.0.1-254) will not be translated to the Lab Router's WAN IP address (172.16.0.2), giving visibility on who sent the traffic and where traffic is going to.

I matched the log prefix NFT-[ACTION]-[CHAIN]-[ACTION] that was established on iptables.conf. By matching the first 4 characters, I can make a separate nftables.log file for the nftables log. Without this, firewall logs would be mixed along with other kernel logs in dmesg -w.

While the logs with tags dnsmasq_log are set to dns.log.

1  # 1. Capture Firewall logs
2  :msg, contains, "NFT-" /var/log/nftables.log
3  & stop
4
5  # 2. Capture DNS queries
6  if ($syslogtag == 'dnsmasq_log') then {
7      /var/log/dns.log
8      stop
9  }
10

The dnsmasq_log are assigned by importing imfile on rsyslog. While it might seem redundant as all dnsmasq.log are being stored on dns.log, it allows us to easily add a new DNS service that generate logs into the pipeline.

23  module(load="imfile")
24
25  input(type="imfile"
26        File="/var/log/dnsmasq.log"
27        Tag="dnsmasq_log"
28        Severity="info"
29        Facility="local0")

File: /etc/rsyslog.conf

Since its likely that DNS logs would be a lot more, I set the the dns.log to rotate daily and only store up to 7 log archives at once. While nftables.log is only set to rotate weekly and store 4 log archives at once.

File: /etc/logrotate.d/firewall

I first identified the MAC Addresses of the interface with ip addr, then changed their NAME= value on udev config.

File: /etc/udev/rules.d/70-persistent-net.rules

In line 30, I added a route to LabNetwork (10.0.0.0/24) via firewall's lan0 (172.16.0.1) interface. Without this route, traffic going to LabNetwork (10.0.0.0/24) will be forwarded to 192.168.11.1 (gateway).

...
7
8  auto lo
9  iface lo inet loopback
10
11  # LAN - (Ethernet)
12  auto lan0
13  iface lan0 inet static
14      address 172.16.0.1
15      netmask 255.255.255.0
16
17  # WAN (Wireless)
18  auto wan0
19  iface wan0 inet static
20      address 192.168.11.200
21      netmask 255.255.255.0
22      gateway 192.168.11.1
23      dns-nameservers 8.8.8.8 8.8.4.4
24
25
26
27      wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
28
29  # Route to LAB network
30  up ip route add 10.0.0.0/24 via 172.16.0.2 dev lan0

File: /etc/network/interfaces