Alright, and now that we have the initial pfSense configuration done,
it's installed and ready to go,
maybe we want to use it as a standalone VPN server in a
DMZ to help us create a honeypot VPN.
And so the goal of something like this would be for us
to create an exposed VPN connection,
and potentially even honeypot virtual machines behind it,
to entice attackers to go after that box.
And this can help us track and define attacker methodologies and TTPs,
but it can also help us identify what user accounts are exposed and compromised.
So the goal of this one right here is to use the MITRE Shield
framework for standing up a decoy VPN server,
in order to check for compromised user accounts.
So the theory behind this is,
this VPN server is not going to be our normal VPN server.
It's not going to be the one that our users know how to connect to,
it's not built into their profiles or anything like that.
This VPN server should not be logged into at all.
And so if we see one of our users logging into this VPN
server and establishing a VPN connection,
we can reasonably assume that that account is then compromised.
And so for this one,
we're trying to stop the exploitation of remote services by
using what's called the decoy system, or a decoy VPN server.
So let's get to it.
Now earlier on in this course,
I talked about the packages that you can install to
add to pfSense's capabilities, and that's what we're going to use here.
Natively, pfSense uses OpenVPN for its VPN server.
And so, in order to be able to download the configuration file for this,
for our test bed, I'm going to have to install an additional package.
Now, an attacker obviously would not be doing this.
They would be trying to get in their own ways,
so we're not going to worry about that from the attacker side,
but we can demonstrate compromised credentials,
just by using an established VPN connection.
So to download some of these packages that we're talking about,
we need to go to the Package Manager for pfSense,
and this is going to show us all of our installed packages.
Currently,
I only have two; one of them is for NMap, and the
other one is for generating NetFlow.
So I'm going to go to the Available Packages,
and for this one, I'm just going to type in OpenVPN.
And as you can see, we have a package for the client export,
which I'm going to go ahead and install it really quick.
Alright, and now that that's done installing,
we can go over and look at the VPN users before we set up the VPN connection.
So we're also going to go to the User Manager here,
and as you can see, we have a local user for Katrina Wilson,
and that's going to be our VPN user that we're going to demonstrate this with.
Now you can set up some authentication servers so that you can tie
this to your back‑end Active Directory server,
as well, if you want to, and in doing so,
you'll be able to see if any of your Active Directory
accounts have been compromised as well.
For the purposes of this course, we're just going to use this local user account,
though.
And now let's go over to the VPN and OpenVPN section to configure the server.
Now we're going to use the pfSense VPN wizard in order to do so.
So, we're going to just go over to the Wizards,
and for the type of server, we're going to do Local User Access.
Our CA is going to be the firewall CA.
Certificate is going to be the firewall certificate.
Now with the VPN server,
we want it to be connected on the WAN link, because we want to
worry about external intruders coming in.
We're going to leave it UDP on IPv4, but we can change that to TCP or IPv4,
and IPv6 if we want to,
but we'll just leave it UDP to make it easier for the demonstration.
Our port is going to be 1196.
I'm going to disable the TLS authentication to make it
easier for our attackers to get in.
Now for the tunnel settings, for a honeypot server,
I want either a non‑routable address,
or I want some sort of network that has our honeypot VN servers connected to it,
for example.
Since this is a 192.168.30 network,
the 10.0.0.0/24 that the VPN client is going to be given will allow it to
not be able to access anything in our internal network.
We're going to force all of the client traffic through the tunnel,
disable compression,
and then give it its DNS server and NTP server information and all that stuff.
We're going to leave all these the same,
and then click Finish, and our VPN server is ready to go.
This was a very simple setup, but for a honeypot server,
we might not want it to be complicated and super secure.
We want to make it potentially a little bit easier
for the attacker to connect to us.
And one thing that we have to change is the mode for the authentication.
I have it set for SSL/TLS+ User Auth,
but in the spirit of making this easier for the attacker
to authenticate with our user accounts,
we're just going to use the user authentication and
get rid of the TLS altogether.
So let me say that again, and we should be good to go.
Now,
one place to go check to make sure your VPN is up and
running is the Status OpenVPN page, and as you can see,
we're good to go here.
This is also where we're going to see the client connections when we connect.
Now,
hopping over to our Windows box that is outside of the network, so we
already have OpenVPN as a client installed on this machine.
Like I said, for the test purposes, that's okay.
Where we want to go is to Firefox, and we want to download that client profile.
So we're going to log into pfSense.
Now if you're setting up this VPN in your enterprise environment,
maybe you don't want each individual user going to
download the client file, and that's okay.
You can push it out via GPO or anything like that. To get
there, we're going to go to that package that we installed
on pfSense for client export.
So we're going to pick the server, which is the one that we created,
the one with port 1196.
We're not going to verify the server CN.
We're going to make sure that its legacy client configurations are downloaded,
and then we should be good to go. And scrolling down,
if you need to install OpenVPN,
you can do so with these EXE files, or you can just download the
actual configuration for the clients and save it.
And now that that's done, we have to import that profile into OpenVPN.
And so this is it right here from our downloads. That import
was successful, and now it's time to connect.
And so when it's setting up the connection for us, it's going
to prompt us for our username and password.
And now that I put it in, as you can see,
it looks like we connected successfully. And we have the IP
address of 10.0.0.2. Now going back over to the firewall, if
I refresh this page right here,
we see that Katrina Wilson connected to the VPN, and is starting to send
and receive a little bit of data through the tunnel,
which is most likely just control traffic.
And we can see the address that she connected to us from.
We can see what virtual address she was given.
Now, in the case of this being an attacker logging into our VPN server,
we want to log these connections, right? So we would get alerts on our SIM
device or via email, or whatever the case may be, that a valid user has
logged into this VPN server, that's a honey pot.
Another thing that we can go check out is the logs associated
with this. So we can see the same information,
but in a little bit of a different way. So we can see the actual
connection attempts and how the connection was initiated, and then we
can see that Kate Wilson was authenticated.
And now so keep this in mind; if you do have honeypot VPN
servers set up, or honeypot virtual machines,
the logging is going to be critical, so you can understand when
attackers are connecting to them, and if or when they're
disconnecting, or trying to get further into the network.
Now, with us setting this up,
we see that a valid user account was used to log in.
So this would be concerning. We would be prompted to have Katrina go
change her password, or change her account altogether.
We'd also want to see if other accounts were compromised.
So we might leave this VPN server out there and continue to welcome
external users to connect to it, so that we can understand how many
of our accounts have been compromised.