In this demo,
we're going to go over the lab setup that I'm using
for all the demos in this course.
This course lab picks up where the last course left off.
So if you still have access to those machines,
you can skip the rest of this demo.
If you want to ensure that you're using the same environment
or start with a fresh set of machines, feel free to follow along.
As with the last course,
I created an environment in VirtualBox using Vagrant files.
The machines we will use our hosted in the Vagrant cloud
and are deployed using Vagrant files.
You'll need Vagrant and VirtualBox installed to use these files.
If you did not go through the Getting Started course or you
already remove those machines from your computer,
don't worry.
The Vagrant file in this course pulls down a machine with
Suricata already installed and configured.
In the demo files for this course,
you'll find the scripts and directory structure needed to set these up.
Once you have Vagrant and VirtualBox,
you just need a few modifications to the Vagrant file to match your environment.
If you want to deploy a simple lab with one Ubuntu Suricata server and
two Metasploitable machines running inside a LAN,
use this All machines directory.
To deploy each machine individually, you would modify their Vagrant files.
Within the file, you'll need to modify the VM network section here.
Change the bridge value to reflect your local interface.
Next,
you need to modify the shell commands and configure this default gateway
to be your local LAN's default gateway IP address.
This route delete removes the default gateway that Vagrant adds,
which forces all traffic to flow through the interfaces
we configured in the previous step.
You can also change this section to provide the
resources to the machines you desire.
I have this value set to 1 GB of memory allocated to our Suricata server.
Once we add additional rule sets and sources,
you may need to bump this up to as many as 4 GB of memory.
And I'd recommend that if you have the resources, you go ahead and do this now.
I have the Suricata server set with an internal
interface IP address of 10.0.0.251.
For the Metasploitable machine,
this shell script sets the default gateway to that IP and
removes the route added by Vagrant,
forcing its traffic to flow through the Ubuntu server.
I configure the Metasploitable 3 machine the same way.
I have two additional machines that are optional to add to your lab
setup or interchange with the Metasploitable machines if you prefer
a less vulnerable internal network.
The Ubuntu desktop is an Ubuntu server from the
Vagrant cloud with an added desktop, configured to attach to the internal LAN.
This will provide a GUI interface for internal tests.
The last machine is a Kali Linux VM that I'll use to simulate external traffic.
You can obtain this from OffSec or use your host machine to send
this traffic if you prefer. To start the machines,
navigate to the correct directory on your machine
and run the command vagrant up.
Vagrant will read the files,
download the images, and build your VMs for you. Once your lab is installed,
open the Suricata server. The first thing we have to do is enter this
iptables command to set all our traffic to forward to the NFQ.
This allows our Suricata server to operate in inline mode.
We can then test that Suricata runs correctly by running sudo
suricata ‑c /etc/suricata/suricata.yaml, our Suricata configuration
file, and then set it to run in inline mode with ‑q and set our queue
to 0. Now we should be able to pass traffic between the external
network and internal devices.
Let's navigate over to our Kali Linux VM and ping our
internal Metasploitable 2 machine. Great.
We have internal traffic passing.
Now let's see if we can navigate to the web page hosted on Metasploitable 3.
Perfect.
Once you verify connectivity,
go ahead and shut down Suricata, and you're ready for the rest of this course.