Lab 6.1 Port Forwarding and Jump Boxes - ConnorEast/Tech-Journal GitHub Wiki

Box	Command	Purpose / Image
RW01 [CLI]	ip route
RW01 [CLI]	sudo ip route del 172.16.50.0/29 via 10.0.17.132
FW01 [Conf]	set nat destination rule 10 inbound-inteface eth0
FW01 [Conf]	set nat destination rule 10 translation address 172.16.50.3
FW01 [Conf]	set nat destination rule 10 translation port 80
FW01 [Conf]	set nat destination rule 10 protocol tcp
FW01 [Conf]	set nat source rule 10 description "HTTP->web01"
FW01 [Conf]	set nat source rule 10 destination port 80

(FW)[Show interfaces] >>> Use to confirm you know how your device is structured
(FW)[show nat destination rule] >>> Use to confirm proper syntax of rule
(FW)[show firewall] >>> use outside of configure mode to check packets
(FW)[reboot] >>> Reboots the box incase cached data is what's causing the issues
(RW)[ip route] >>> confirms we have removed the appropriate rule
(web01)[systemctl restart httpd] >>> If all else fails restart dependencies.

Jump box is Wazuh
Jump boxes are used for remote access through a a regulated and non-bruteforcable service
Jump boxes typically use SSH/RDP/VPN ports for remote access

Box	Command	Purpose / Image
Vsphere	Right click "jump-SEC350-02" and select properties Change the network adapter to be on the DMZ
*Wazuh (CLI)*	cd /etc/netplan
*Wazuh (CLI)*	vi 00-installer-config.yaml
*Wazuh (CLI)*	sudo netplan apply
*Wazuh (CLI)*	hostnamectl set-hostname jump-east

box	Command	Purpose / Image
FW01 (CLI)	show firewall name LAN-to-DMZ
FW01 (CLI)	show configuration commands \| match service ssh
FW01 (CLI)	del service ssh listen-address 0.0.0.0
FW01 (CLI)	set service ssh listen-address 172.16.150.2

Box	Command	Purpose / Image
FW01 (CLI)	set firewall name DMZ-to-WAN rule 998 action accept
FW01 (CLI)	set firewall name DMZ-to-WAN rule 998 source address 172.16.50.3
FW01 (CLI)	Commit Save
JUMP-east (CLI)	ssh [email protected]
RW01 (CLI)	ssh-keygen -t rsa -C "Sec350-Key"
RW01 (CLI)	cd /home/champuser/.ssh ls
JUMP-east (CLI)	scp [email protected]:/home/champuser/.ssh/id_rsa.pub /home	Downloads the public key from RW01 over to jump and saves it in "cd /home"
FW01 (CLI)	disable firewall name DMZ-to-WAN rule 998
JUMP-east (CLI)	sudo useradd -m -d /home/connor.jump -s /bin/bash connor.jump
JUMP-east (CLI)	sudo mkdir /home/connor.jump/.ssh
JUMP-east (CLI)	sudo cp /home/id_rsa.pub /home/connor.jump/.ssh/authorized_keys
JUMP-east (CLI)	sudo chmod 700 /home/connor.jump/.ssh
JUMP-east (CLI)	sudo chmod 600 /home/connor.jump/.ssh/authorized_keys
JUMP-east (CLI)	sudo chown -R connor.jump:connor.jump /home/connor.jump/.ssh
JUMP-east (CLI)	vi /etc/ssh/sshd_config Located "Pubkey authentication and uncomment it"
JUMP-east (CLI)	systemctl restart sshd

Box	Command	Purpose / Image
FW01 (CLI)	set firewall name WAN-to-DMZ rule 20 action accept
FW01 (CLI)	set firewall name WAN-to-DMZ rule 20 descriptiong ".ssh ability"
FW01 (CLI)	set firewall name WAN-to-DMZ rule 20 destination address 172.16.50.4
FW01 (CLI)	set firewall name WAN-to-DMZ rule 20 destination port 22
FW01 (CLI)	set firewall name WAN-to-DMZ rule 20 protocol tcp
FW01 (CLI)	set nat destination rule 20 description "ssh to jump"
FW01 (CLI)	set nat destination rule 20 inbound-interface eth0
FW01 (CLI)	set nat destination rule 20 destination port 22
FW01 (CLI)	set nat destination rule 20 protocol tcp
FW01 (CLI)	set nat destination rule 20 translation address 172.16.50.4
FW01 (CLI)	set nat destination rule 20 protocol port 22
RW01 (CLI)	ssh -i /home/champuser/.ssh/id_rsa [email protected]

Box	Command	Purpose / Image
JUMP-east (CLI)	sudo useradd -m -d /home/connor -s /bin/bash connor
JUMP-east (CLI)	sudo mkdir /home/connor/.ssh
JUMP-east (CLI)	sudo touch /home/connor/.ssh/authorized_keys
JUMP-east (CLI)	sudo chmod 700 /home/connor/.ssh
JUMP-east (CLI)	sudo chmod 600 /home/connor/.ssh/authorized_keys
JUMP-east (CLI)	sudo chorn -R connor:connor /home/connor/.ssh
JUMP-east (CLI)	echo "connor ALL=(ALL) NOPASSWD:ALL" \| sudo tee /etc/sudoers.d/connor
MGMT01
MGMT01
MGMT01