Implementing a 1-Port Router

Now that I have a somewhat better handle on the Tor Proxy, I am back to thinking about a 1-Port Router.  One of my next experiments will be to plug the RPi Tor Proxy into a tagged vlan port.  I am hoping that I can use Shorewall and some vlan libraries to make a one port router.  It would appear that this will be safe since there is no physical access to the cable that goes from the managed switch to the RPi ethernet port.  My idea is to use Shorewall as the main routing mechanism to isolate separate vlans from each other (except in certain cases), but still provide dhcp services to a couple of the vlans.  So now I am thinking the following:

1.  The RPi will be connected to a managed switch with a single ethernet connection.  The ethernet connection will be limited to tagged packets on several vlans only.  The vlans that will be considered involve a vlan for Media, for Experimentation, for Personal services, and for Extra-network connection (i.e., to the ActionTec router).  Non-tagged traffic on the switch port will not be allowed.
2. The RPi will provide dhcp services to the Media vlan.
3. The Tor Proxy will provide a firewall to the Extra-network connection; all Tor related traffic will be on this vlan.  Access to the Tor Proxy lan will be via a WPA2 wireless (per the Onion Pi setup).
4. The Tor Proxy lan should be isolated from the RPi itself.
5. The Personal services vlan will be allowed to connect to the Tor Proxy and then to the Extra-network vlan.  The general Tor Proxy lan will not be allowed to access the Personal services vlan.
6. After analysis of the connection to the managed switch, I have come to the conclusion that the only possible problem with the hardware setup is that the wireless connection (for the Tor Proxy) might be able to be compromised.  Perhaps I should think of implementing a RADIUS server of some sort.  I could host it on the RPi but that might be a security issue.
7. I would also like to add a separate wireless access port setup with a separate wireless dongle and ethernet-usb connector.  I would make that one subscribe to one specific vlan.
8. Implement an LCD panel control for all of this?

I am still coming up with ideas at this point but this looks to be a useful device within my network at home.

Carved out a subnet in my home network for PwnPi tests

It was raining this weekend so I decided to finish up putting together a subnet in my home network for testing the Raspberry Pi.  This will also serve as an enclave for using PwnPi to do some penetration testing.  I have decided to get back into the swing of things security wise since I am taking another certification class.  I have been wanting to learn how to do penetration testing in preparation for going after a CEH (Certified Ethical Hacker) certification.  This is outside of the ISC2 certification domain; where I already have a CISSP (Certified Information Systems Security Professional).  I have a multifold purpose for wanting to do this:

1. I want to have a separate (logically and physically) network for penetration testing using PwnPi.
2. Doing penetration testing will not only help me to learn but will also let me know where the weaknesses are in my network.
3. I want to have a separate network setup to support development work on the RPi.
4. I want to have a network setup to test out the new OpenWRT package that runs on the RPi; therefore, I need to be able to place the RPi in a router like position easily.

In my house I have three routers and three managed switches which I can use to define separate networking elements.  On one end of the house I have a Mac Mini which I use as a server for experimentation along with several other physical servers which are normally turned off until I want to do some experiments.  Why?  Because I want to learn something about networks and this way I can immerse myself in some learning topic without having to pay money for classes.  At the other end of the house is the RPi experimenters area.  I have a managed switch close to the Mac Mini and another managed switch close to the RPi experimenters area.  The three managed switches are 1GB ethernet switches, so the ethernet cable between them carries a 1GB stream.  I use this as the backbone for my home network.  I realize that it is overkill, but it allows me to do some interesting things.  For my purposes, I wanted to move one of the routers to the RPi experimenters area and set up the switches so that I could use the Mac Mini to host some virtual machines to be connected to the RPi experimenter area.  Diagrammatically it looks like this (most of the information was removed to help in the discussion):

A secondary ethernet port was added to the Mac Mini by plugging in a USB to ethernet cable.  By setting up the router between two ports on the RPi experimenter managed switch, I am able to use the router to move between two separate Vlans.  Vlans (IEEE 802.1Q) are virtual lans and can have the property that more than one vlan traffic can be moving down the same wire but yet not have packets that interfere with each other.  In my case the 1GB wire between the two managed switches have tagged vlan packets that are logically isolated from each other.  This wire carries information from the VMs running on the Mac Mini through the separate Vlan to the router (LAN side).  This in turn is mixed in with the information on the RPis.  The router provides isolation between the Vlans and in a pinch can be disconnected from the main home network; for extra security.  The RPi managed switch and router are in close proximity and I can unplug the unmanaged switch (connecting the RPis together and plug it into the managed switch on a port which is in the home network as necessary.  This is not the only separated Vlan running through my house but I need the isolation in order to continue PwnPi experiments.  Should be fun.

Was able to get PwnPi up and running

I guess in the grand scheme of things, I am starting to get proficient at moving images over to SD cards on the Mac Mini. The latest one was for the PwnPi image. This is a penetration tester image containing about 200 tools for use in breaking into systems. Since I am interested in obtaining a CEH certification in the future, I thought that I might get ahold of this district and try,out a few of the tools on my own network. I downloaded the image through the http://PwnPi.net website.

I was home anyway because I threw out my back at the gym yesterday.

Might Try My Hand at a Pentester

Last night when I was going through some Raspberry Pi stuff, I happened upon two Pentesting packages for the RPi:

http://sourceforge.net/projects/pwnpi/
http://pwnpi.net/

http://blog.pwnieexpress.com/post/24967860602/raspberry-pwn-a-pentesting-release-for-the-raspberry
https://github.com/pwnieexpress/Raspberry-Pwn

The first two urls are for the PwnPi distro which is self contained, the second url being the home page.  The next two urls are for PwnieExpress which you have to build from the Debian Weezy distro (at http://www.raspberrypi.org/downloads).  The instructions are at the github address to set it up.

This would be a good chance to try out a different use for the RPi and at the same time get some background info for the CEH which I have been studying for.