Docs sg3100 firewall #3620

b-meson · 2018-07-03T00:58:48Z

Status

Ready for review

Description of Changes

Testing

A reviewer should factory reset a SG-3100 and follow the 3NIC configuration steps. After setting the firewall rules, they should be able to run through an end-to-end SecureDrop installation and be able to reach the Source interface, the Journalist Interface, and receive OSSEC alerts.

If you made changes to documentation:

Doc linting (make docs-lint) passed locally

Notes

I noticed at the very bottom of the Disable DHCP server on Firewall screenshot, there is an Admin Gateway IP which we could probably crop out since it may be confusing. Additionally, this PR does not touch the .xml files which I think we should add as its own issue / commit.

codecov-io · 2018-07-03T01:39:15Z

Codecov Report

Merging #3620 into develop will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff            @@
##           develop    #3620   +/-   ##
========================================
  Coverage    85.04%   85.04%           
========================================
  Files           37       37           
  Lines         2367     2367           
  Branches       260      260           
========================================
  Hits          2013     2013           
  Misses         290      290           
  Partials        64       64

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f823deb...2f988cf. Read the comment docs.

emkll

Thanks @b-meson for the very detailed update to the docs ! I've followed this guide and set up a sg-3100 as you've described and the SecureDrop instance and workstation work well.

The one concern I have with the rules as described is that the anti-lockout rule is such that any host on the LAN network can communicate with the firewall over 80 and 443. In this case, the app server which is configured on the LAN network can communicate with the firewall's web interface, which, I think, should be avoided. I see 2 options:

Disable the anti-lockout rule (system -> advanced -> admin access -> disable webConfigurator anti-lockout rule), ensuring that a rule to allow communication from workstationto the router's web interface is in place.

Put the app server on the OPT1 interface and (optionally) disable the anti lockout rule for the LAN interface (which will now have mon server and workstation).

Other minor comments inline.

emkll · 2018-07-03T13:05:22Z

docs/network_firewall.rst

+:ref:`Hardware Guide <hardware_guide>`.
+
+We currently recommend the `pfSense SG-3100
+<https://store.netgate.com/SG-3100.aspx>`__, which has 6 interfaces: WAN,


nit: It actually has 3 interfaces/NICs (WAN, OPT, and LAN) but it does indeed have 6 ports (WAN, OPT and LAN1 through LAN4)

emkll · 2018-07-03T13:07:29Z

docs/network_firewall.rst

@@ -99,6 +99,38 @@ chosen:
 -  Monitor Gateway: ``10.20.3.1``
 -  Monitor Server (OPT2) : ``10.20.3.2``

+3 NIC Example (SG-3100)


It it possible to make the numbering 5. b. for 3 NIC Example and 5. a. for the 4 NIC Example? Admins might think they must complete both.

I attempted to do here but it actually looks much worse and is less clear. I did make that change in the other suggested section.

emkll · 2018-07-03T13:09:21Z

docs/network_firewall.rst

+As described earlier, the SG-3100 has an internal switch on the LAN interface
+which means we can place the *Application Server* and *Admin Workstation* on
+the same subnet and gateway. This example assumes you place the
+*Admin Workstation* on LAN1 and the *Application Server* on LAN2.


I don't think it matters which LAN ports the admin workstation and application server are connected to (as long as it's one of the four LAN ports) since it's a simple switch.

It does not. I was slightly confused about which port to put the App and Admin servers so I figured I would be more verbose just to help future admins.

I just removed the line This example assumes you place the *Admin Workstation* on LAN1 and the *Application Server* on LAN2. As you said, it shouldn't matter but i think having too much language could be confusing.

emkll · 2018-07-03T13:10:11Z

docs/network_firewall.rst

+
+-  Application Subnet: ``10.20.2.0/24``
+-  Application Gateway: ``10.20.2.1``
+-  Application Server (OPT1): ``10.20.2.2``


Application server is now on LAN, not OPT1

emkll · 2018-07-03T13:10:29Z

docs/network_firewall.rst

+
+-  Monitor Subnet: ``10.20.3.0/24``
+-  Monitor Gateway: ``10.20.3.1``
+-  Monitor Server (OPT2) : ``10.20.3.2``


Monitor server in this case in on OPT1, not OPT2

emkll · 2018-07-03T13:14:35Z

docs/network_firewall.rst


   |Configure LAN Interface|

+#. **3 NIC Example (SG-3100):**


Same as above, would it be possible to make them 5.a. and 5.b.?

emkll · 2018-07-03T13:16:47Z

docs/network_firewall.rst

+4 NIC Example
+~~~~~~~~~~~~~
+
+If you are using a firewall that has a dedicated port for each component of


nit: dedicated NIC or dedicated interface

emkll · 2018-07-03T13:35:18Z

docs/network_firewall.rst

+
+**LAN interface:**
+
+|3 NIC Firewall LAN Rules|


nit: you can move the admin workstation TCP / rule under the deny from LAN to OPT1 which should prevent the workstation from reaching the server over any port that 22.

eloquence · 2018-07-03T16:54:41Z

docs/network_firewall.rst

@@ -371,8 +439,28 @@ In order to use the firewall to isolate the *Application Server* and the *Monito
 Server* from each other, we need to connect them to separate interfaces, and then set
 up firewall rules that allow them to communicate.

+Setup the Firewall Rules


Nit: setup->set up (only one word when used as a noun)

eloquence · 2018-07-03T16:55:15Z

docs/network_firewall.rst

+Set Up LAN
+''''''''''
+
+Although we setup the LAN interface during the Setup Wizard we need to make


setup->set up

b-meson · 2018-07-05T20:03:44Z

@emkll instead of this:

Disable the anti-lockout rule (system -> advanced -> admin access -> disable webConfigurator anti-lockout rule), ensuring that a rule to allow communication from workstationto the router's web interface is in place.

Can we instead modify the anti-lockout rule to only allow routing from the admin workstation?

update images

b-meson · 2018-07-05T21:48:17Z

I pushed an update and rebased on top of develop. We are still missing the revisions to the "anti lockout rule" issue that @emkll raised. I am also waiting to hear back on my question:

I noticed at the very bottom of the "Disable DHCP Server on Firewall" screenshot, there is an Admin Gateway IP which we could probably crop out since it may be confusing.

emkll · 2018-07-06T12:57:50Z

I noticed at the very bottom of the "Disable DHCP Server on Firewall" screenshot, there is an Admin Gateway IP which we could probably crop out since it may be confusing.

Good catch ! Since it's fairly straightforward to crop out, I suggest we do so.

Can we instead modify the anti-lockout rule to only allow routing from the admin workstation?

The anti-lockout rule automatically created by pfsense and cannot be modified. I suggest we caution the admin that the rules will need to be applied with care and in order as to not get locked out from the admin UI (as it would require a console reset to regain access to the interface).

b-meson · 2018-07-06T20:40:16Z

I added another commit 2f988cf and rebased it on top of develop. @emkll ready for another round of reviews.

emkll · 2018-07-09T15:40:45Z

docs/network_firewall.rst

+
+|3 NIC LAN Interface|
+
+Disable Anti-Lockout Rule


~~nit: At line 668, we refer to the (old) anti-lockout rule. Can we either move this anti-lockout related section down there or move the warning here to avoid confusion?`~~

EDIT: I take this comment back. While it does help streamline the guide, upon re-review, I think it's important to state these warning at both stages of the configuration.

emkll

Thanks for addressing the review items @b-meson. With those additions, the docs are good to merge from my perspective. Thanks for your attention to detail on these.

One last note, is that it might be a good idea to move the newly created anti-lockout rules to the top in order to minimize the chances of adding a rule that will negate them, but I don't think it should block merge.

emkll suggested changes Jul 3, 2018

View reviewed changes

eloquence reviewed Jul 3, 2018

View reviewed changes

Freddy Martinez added 2 commits July 5, 2018 13:18

recommend the SG-3100 on the firewall configuration

56fe091

add screenshots and add 3NIC options

da24532

update images

b-meson force-pushed the docs-sg3100-firewall branch from c8fef87 to da24532 Compare July 5, 2018 21:46

Add instructions for disabling anti-lockout rule for 3NIC

2f988cf

emkll reviewed Jul 9, 2018

View reviewed changes

emkll approved these changes Jul 10, 2018

View reviewed changes

emkll merged commit ebf3d30 into freedomofpress:develop Jul 10, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Docs sg3100 firewall #3620

Docs sg3100 firewall #3620

b-meson commented Jul 3, 2018

codecov-io commented Jul 3, 2018 •

edited

Loading

emkll left a comment

emkll Jul 3, 2018

emkll Jul 3, 2018

b-meson Jul 5, 2018

emkll Jul 3, 2018

b-meson Jul 5, 2018

b-meson Jul 5, 2018

emkll Jul 3, 2018

emkll Jul 3, 2018

emkll Jul 3, 2018

emkll Jul 3, 2018

emkll Jul 3, 2018

eloquence Jul 3, 2018

eloquence Jul 3, 2018

b-meson commented Jul 5, 2018

b-meson commented Jul 5, 2018

emkll commented Jul 6, 2018

b-meson commented Jul 6, 2018

emkll Jul 9, 2018 •

edited

Loading

emkll left a comment

Docs sg3100 firewall #3620

Docs sg3100 firewall #3620

Conversation

b-meson commented Jul 3, 2018

Status

Description of Changes

Testing

If you made changes to documentation:

Notes

codecov-io commented Jul 3, 2018 • edited Loading

Codecov Report

emkll left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

b-meson commented Jul 5, 2018

b-meson commented Jul 5, 2018

emkll commented Jul 6, 2018

b-meson commented Jul 6, 2018

emkll Jul 9, 2018 • edited Loading

Choose a reason for hiding this comment

emkll left a comment

Choose a reason for hiding this comment

codecov-io commented Jul 3, 2018 •

edited

Loading

emkll Jul 9, 2018 •

edited

Loading