All right, now it's time to work on the second objective for this one,
which is going to be blocking exfiltration over
alternate protocols and stuff like that.
And so the basis behind this lab is for us to set up the
firewall to block some file sharing services that may not
be used for our partner network.
So first off,
I'm going to go over to the firewall and look at the
rules that we have for the WAN.
Now, in this lab, the WAN is being mimicked by our partner network,
so let's just say this firewall might be placed in a data center where
we're protecting critical data or something like that,
and this 192.168.10.0 network is our trusted partner network.
And so we want to allow them access to our internal network,
and they need to be able to access things like our
Samba shares and stuff like that.
But we use FTP in that internal network, and we don't want to give them access.
And at least with Samba, we can authenticate via Active Directory.
So, looking at our firewall rules,
there's a couple things that kind of stand out to me.
To start with, we have all IPv4 UDP being allowed through the WAN link.
This means that any UDP packets can get sent.
We also have an IPv4 rule allowing everything,
and this is the default ruled typically in firewalls,
but it's typically set to deny instead of allow.
So right away,
those are two things that we can fix to help mitigate any
potential problems between us and the partner network.
In working with FTP and Samba,
we should create specific firewall rules to allow or deny each one of those.
So for the purposes of this demo, let's hop into our Windows box again.
And as you can see, this box is on the partner network.
It's a 10.231 address.
Now, when I go to connect to a server from within the network over Samba,
I'm able to so we can go in and we can look at the folders
and files that are being shared out.
And this is good.
This is what we want for that partner.
But what we don't want them to be able to do is connect to this via FTP.
And so what I want to do is,
I want to scan our file server host using Nmap and figure out
what the open ports for that server are,
just to make sure.
So we're going to nmap that 30.5 address, which is our file server.
And as you can see, we have FTP open, we have SSH open,
and we have 445, which is Samba, open.
Now, these are okay for this to be open on the server in particular,
but we don't want our firewall to allow the traffic
from the partner network in to FTP it.
Ideally,
we would have a host firewall on here as well to help us
protect our assets and critical data, but in this case,
we're assuming that we're not.
So let's flip back over and go configure some firewall rules.
So the first thing that I want to do is change this IPv4 rule to Block.
We don't want just everything coming through.
Now for this IPv4 UDP one, we want to allow this to pass,
but let's just leave it with the port or port range
that we actually want to pass.
So for this, we want to define the port that we want to allow it to pass.
And so for this one,
we're going to use the VPN port that we created the VPN connection for before.
All right, so that one's changed to 1196 for the destination.
And now the rest of our rules, we're allowing DNS,
we're allowing ICMP, we're allowing NetFlow,
and we're allowing any TCP connections into the LAN net from this external net.
Now that's going to affect our connections that
we're using to transfer this data, so we need to change that one as well.
And so we want to pass it, but we only want to allow the Samba traffic,
let's say.
So the destination's the LAN net, and the port range is going to be Samba.
Let's see if we have it in here is an option.
Yep, 445.
And then let's hit Save.
Now let apply our changes for the firewall and hop over to our Windows 10 host.
Let's refresh this to make sure that we can still connect via Samba,
and let's pull a Hello World!
up.
Okay, so that works.
Now let's try to ftp it.
Looks like it's not letting us.
Let's hop over to the firewall and check out the logs now.
You can hop over to the firewall‑specific logs right here.
And as you can see, we have port 21 blocked right here.
So that means our partners cannot exfiltrate our data
using FTP from that file server.
And now with this,
we can use this on the LAN side for configuring outbound rules so our users
can't transfer via FTP or via Samba to any outside destination.
We can get very granular with these firewall rules and create
whatever we need to create to minimize the risk of data
exfiltration over alternate protocols.
We want to be able to only use Samba in this case
because we can track it and log it better.
Now there are some other ways that we can help with this as well.
We can use proxy connections to be able to restrict certain
traffic going in and out of our network.
We can use network segmentation like we are here, segmenting our
partner network with our corporate network.
We can go further and segment pieces of our network so the campus
devices might have different access, and the DC devices might have
different access, and so on and so forth.
And then we can also use things like IPSs and IDSs to help us detect and
prevent threats for exfiltrating data over alternate protocols.
And there are some really good IPS rules that you can write,
which looks at the payloads of various protocols and can help us identify stuff
like DNS tunneling and other types of exfiltration attacks.
So there are plenty of options.
The basic options, though,
are to create good firewall rules in order for you to control
access in and out of your network like we did here.
So we changed a couple of the rules that had our firewall wide open,
and we were able to allow that Samba traffic through,
but use that default deny rule to block all of the
traffic from that partner network.
To do the same for the outbound connections,
we can just go over to the LAN side and create a rule that blocks
from any source on the LAN net to any destination using FTP as
either the source or destination address,
if we wanted to restrict that even further.