Posted on

Homelab: Intrusion Detection System with Snort

In the last post we saw a basic firewall using Ubuntu’s iptables/netfilter.
We have our router host ready. Let’s see how to set up snort in packet sniffer, packet logger, Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) modes on the network.

Packet sniffer mode: snort -v

Packet logger mode: snort -l <logging dir>
By default the logging directory is /var/log/snort

Intrusion detection mode (IDS) mode: Also known as alert mode, Snort requires configuration file, rule set and the path to these files. The default location for the configuration file is /etc/snort/snort.conf. We don’t have to change many variables in this file other than RULE_PATH to the path of your rules file. “include $RULE_PATH/mynew.rules. mynew.rules is the file where I have defined my rules. Coming to rule set, the default location to rules is /etc/snort/rules.
Rules include:
1. Alert when icmp pings are detected in both directions.
2. Alert when connection to facebook.com is done on a web browser by host 10.0.0.4 (Ubuntu-VM Clone)

Fig 1: Snort rules

Let me remind the network that was set up earlier. See Fig 2. Note that snort is running on router host (Ubuntu-VM)

Fig 2: Snort is running on router host

To see if snort alerts us on pinging Router host or modem from 10.0.0.4. See Fig 3.
The syntax for IDS mode is snort -c <path to conf file> -l <path to log file> -I <interface snort should be listening to>. -A console is to display alerts on screen while snort is running. -q is to quiet mode (avoids banners and status report)

Fig 3: 10.0.0.4 is pinging 192.168.1.1=> Ping detected alerts for both ingress and egress pings.

Let’s check what happens when 10.0.0.4 tries to access facebook.com. See Fig 4. Going bak to Fig 1, the rule option used is “content”. Therefore snort checks the content of IP packet to look for a match.

Fig 4: facebook.com is opened on web browser, snort alerts the event.

The last mode is the IPS mode. I will write about it next week.

Posted on

Homelab: Host as a router

Let’s see how to turn a host into a router.

For this purpose, I have two VMs – Ubuntu-VM and Ubuntu-VM Clone.

Let’s say we want to turn Ubuntu-VM into a router. To be able to do that, two NICs have to be enabled and put in two different subnets and ip-forwarding should be enabled on Ubuntu-VM. Remember to have the interfaces on VMs in bridged mode.

Fig 1: Two Ubuntu-VMs
Fig 2: On Ubuntu-VM, turn on Adapter 2; Enable bridged mode on all interfaces

Network setup should look something like this, see Fig 3:

Fig 3: Network Diagram

Once you configure all the interfaces, check internet connectivity on the host (Ubuntu-VM Clone)

Fig 4: Shows that the host has no Internet

At this point, we have to enable ip forwarding on our router host and add some rules to netfilter/iptable.

Fig 5: On Router host, enable ip forwarding by setting /proc/sys/net/ipv4/ip_forward to 1
Fig 6: Firewall rules on router host

It is convenient to make a bash script like the one above.
Host might not still have DNS. You would have to edit /etc/resolv.conf to add “nameserver 8.8.8.8” (8.8.8.8 being Google’s public DNS). Let’s see if our host has internet now.

Fig 7: Host is setup successfully.

It also means that router host is forwarding packets from its external interface to internal interface. One of the functions of a router has been accomplished.




References:
1. Jungwoo Ryoo’s topic on LinkedIn Learning – Host as a router