Assessment Firewall Configuration - Michaelfoop/SEC-350-01 GitHub Wiki

Here it is

set firewall ipv4 name DMZ-to-LAN default-action 'drop'
set firewall ipv4 name DMZ-to-LAN enable-default-log
set firewall ipv4 name DMZ-to-LAN rule 10 action 'accept'
set firewall ipv4 name DMZ-to-LAN rule 10 state 'established'
set firewall ipv4 name DMZ-to-LAN rule 20 action 'accept'
set firewall ipv4 name DMZ-to-LAN rule 20 destination port '1514,1515'
set firewall ipv4 name DMZ-to-LAN rule 20 protocol 'tcp'
set firewall ipv4 name DMZ-to-WAN default-action 'drop'
set firewall ipv4 name DMZ-to-WAN enable-default-log
set firewall ipv4 name DMZ-to-WAN rule 10 action 'accept'
set firewall ipv4 name DMZ-to-WAN rule 10 state 'established'
set firewall ipv4 name DMZ-to-WAN rule 20 action 'accept'
set firewall ipv4 name DMZ-to-WAN rule 20 protocol 'icmp'
set firewall ipv4 name LAN-to-DMZ default-action 'drop'
set firewall ipv4 name LAN-to-DMZ enable-default-log
set firewall ipv4 name LAN-to-DMZ rule 10 action 'accept'
set firewall ipv4 name LAN-to-DMZ rule 10 state 'established'
set firewall ipv4 name LAN-to-DMZ rule 20 action 'accept'
set firewall ipv4 name LAN-to-DMZ rule 20 destination address '172.16.50.3'
set firewall ipv4 name LAN-to-DMZ rule 20 destination port '80'
set firewall ipv4 name LAN-to-DMZ rule 20 protocol 'tcp'
set firewall ipv4 name LAN-to-DMZ rule 30 action 'accept'
set firewall ipv4 name LAN-to-DMZ rule 30 destination port '22'
set firewall ipv4 name LAN-to-DMZ rule 30 protocol 'tcp'
set firewall ipv4 name LAN-to-DMZ rule 30 source address '172.16.150.10'
set firewall ipv4 name LAN-to-WAN default-action 'drop'
set firewall ipv4 name LAN-to-WAN enable-default-log
set firewall ipv4 name LAN-to-WAN rule 10 action 'accept'
set firewall ipv4 name LAN-to-WAN rule 10 state 'established'
set firewall ipv4 name LAN-to-WAN rule 20 action 'accept'
set firewall ipv4 name WAN-to-DMZ default-action 'drop'
set firewall ipv4 name WAN-to-DMZ enable-default-log
set firewall ipv4 name WAN-to-DMZ rule 10 action 'accept'
set firewall ipv4 name WAN-to-DMZ rule 10 state 'established'
set firewall ipv4 name WAN-to-DMZ rule 20 action 'accept'
set firewall ipv4 name WAN-to-DMZ rule 20 destination address '172.16.50.0/29'
set firewall ipv4 name WAN-to-DMZ rule 20 destination port '80,22'
set firewall ipv4 name WAN-to-DMZ rule 20 protocol 'tcp'
set firewall ipv4 name WAN-to-DMZ rule 20 source address '10.0.17.0/24'
set firewall ipv4 name WAN-to-LAN default-action 'drop'
set firewall ipv4 name WAN-to-LAN enable-default-log
set firewall ipv4 name WAN-to-LAN rule 10 action 'accept'
set firewall ipv4 name WAN-to-LAN rule 10 state 'established'
set firewall zone DMZ default-action 'drop'
set firewall zone DMZ from LAN firewall name 'LAN-to-DMZ'
set firewall zone DMZ from WAN firewall name 'WAN-to-DMZ'
set firewall zone DMZ interface 'eth1'
set firewall zone LAN default-action 'drop'
set firewall zone LAN from DMZ firewall name 'DMZ-to-LAN'
set firewall zone LAN from WAN firewall name 'WAN-to-LAN'
set firewall zone LAN interface 'eth2'
set firewall zone WAN default-action 'drop'
set firewall zone WAN from DMZ firewall name 'DMZ-to-WAN'
set firewall zone WAN from LAN firewall name 'LAN-to-WAN'
set firewall zone WAN interface 'eth0'
set interfaces ethernet eth0 address '10.0.17.126/24'
set interfaces ethernet eth0 description 'SEC350-WAN'
set interfaces ethernet eth1 address '172.16.50.2/29'
set interfaces ethernet eth1 description 'SEC350-DMZ'
set interfaces ethernet eth2 address '172.16.150.2/24'
set interfaces ethernet eth2 description 'SEC350-LAN'
set nat source rule 10 description 'lan to wan'
set nat source rule 10 outbound-interface name 'eth0'
set nat source rule 10 source address '172.16.150.0/24'
set nat source rule 10 translation address 'masquerade'
set nat source rule 20 description 'dmz to wan'
set nat source rule 20 outbound-interface name 'eth0'
set nat source rule 20 source address '172.16.50.0/29'
set nat source rule 20 translation address 'masquerade'
set nat source rule 30 description 'NAT from MGMT to WAN'
set nat source rule 30 outbound-interface name 'eth0'
set nat source rule 30 source address '172.16.200.0/28'
set nat source rule 30 translation address 'masquerade'
set protocols rip interface eth2
set protocols rip network '172.16.50.0/29'
set protocols static route 0.0.0.0/0 next-hop 10.0.17.2
set service dns forwarding allow-from '172.16.50.0/29'
set service dns forwarding allow-from '172.16.150.0/24'
set service dns forwarding listen-address '172.16.50.2'
set service dns forwarding listen-address '172.16.150.2'
set service dns forwarding system
set service ssh listen-address '0.0.0.0'
set service ssh listen-address '172.16.150.2'
set system host-name 'edge01-michael'
set system name-server '10.0.17.2'

traveler -> jump ssh [email protected] (Jump username)@(edge01 wan address)

set nat destination rule 10 destination port 22
set nat destination rule 10 inbound-interface name eth0
set nat destination rule 10 protocol tcp
set nat destination rule 10 translation address 172.16.50.4
set nat destination rule 10 translation port 22
set firewall ipv4 name WAN-to-DMZ rule 10 action accept
set firewall ipv4 name WAN-to-DMZ rule 10 destination address 172.16.50.4
set firewall ipv4 name WAN-to-DMZ rule 10 destination port 22
set firewall ipv4 name WAN-to-DMZ rule 10 protocol tcp