Project #8 - Update the Network for Security

After taking some classes in CEH, I have decided that I need to really look at my network and make sure that security is taken care of.

Deciding on some alterations to the virtual basis for the network

I just finished taking some online classes for the Certified Ethical Hacker certification.  Now I need to study my butt off in preparation for actually taking the test.

After I succeeded in setting up a pen testing lab to use for the class, it became obvious that I needed to change some things about the layout of my network.  I currently do not have any way of isolating the Mac Mini from the VLAN implementations that are being used in VMWare Fusion.  In other words, I am now realizing that I need to isolate the VLANs to the Fusion network and to not allow access via the Mac Mini.  This really doesn't make a lot of sense except that I am trying to protect the Mac Mini from what I do on the other VLANs.  My problem is how to go about doing this.  I should be able via firewall settings to perform the isolation.  The problem is that Apple doesn't like to give up control of things like the firewall (my supposition since they keep changing the firewall mechanism they use without documenting the same).  I currently have a couple of tools which have not been used until now: IceFloor and fwbuilder.  Both of these tools are highly rated and address some of the shortcomings on using the Apple Mac Mini for my intended purpose.

I am currently running Mavericks on the Mac Mini (10.9.2).  Everything, including the Mavericks Server is up to date.  

Thinking to get back into the LED Cube Project

Now that I have more time to myself, I was thinking of getting back into the LED Cube Project.  I was also thinking of adding a reflective LED projector to the experiment in order to have something that I can use later during the Halloween and Christmas seasons.  The controls are about the same except that the LED projector would have moving mirrors to reflect an LED strip onto a wall (for instance).  The reflection could also be done to a Conical shaped mirror for use on the lawn.

I have also purchased an additional breadboard to get some of the previous ideas prototyped up and working.  Remember, at last juncture I was unable to get enough control lines due to the chip that I was using running out of address space.

Manuevered Some connections around to make way for a special VLAN

Over the weekend I made some changes to my network in preparation for venturing out as an Anonymous user.  My real reason for doing this is to see if I can somehow escape Google's tracking.  This is an interesting twist since I am using Blogger to blog on and that in turn is owned by Google.

I have been reading up on the DarkNet and what that really means.  Since I am getting more involved with security I thought it might be a good thing to explore various anonymization networks, e.g. TOR, to see how they function and what to expect when I am out there.  This obviously involves assuming a pseudo id to mask who I really am - new territory, haven't ventured there before.

I was able to set up a VLAN on the ActionTec router from http://support.actiontec.com/doc_files/Creating_an_Ethernet_VLAN.pdf on the ActionTec site.  The instructions are a little old but after a bit of trying out different things, I was able to have a VLAN (tagged) on a specific port with a DHCP server and a localized subnet.  I then proceeded to change the wiring around a little, moving my MacMini ethernet connections from the tail-end switch to the one just before it.  I set up the first switch to have a tagged input port then connected an Ethernet cable from the ActionTec to it.  Next I set up the switch to send the new VLAN down a trunk line to the second switch and from there to the third and last switch.  In the process of doing this I consolidated a number of Ethernet connections to one switch which actually speeded up my access to the outside.  I was also able to reduce the usage of the last switch in the stream to make it more experimenter like, including adding the new VLAN.

I now have a line from the ActionTec router that has only one port (I will be putting a laptop on this port) isolated from my network that I will be able to use for Anonymity.

I've been out of the loop over the holidays

Sorry for not posting since the end of November.  I have been busy with home life and work and have not had a chance to get back to this blog.  New posts to come shortly.

I now have a personal cloud device in the home network

I just purchased a Western Digital My Cloud drive (3TB) and added it to my network in the Pers vlan.  Right up front I can say that I am very pleased with this drive and how it operates.  The My Cloud drive has a 1GB Ethernet port and a USB 3.0 port on the back.  The 1GB Ethernet gives the drive plenty of flexibility to stream media content within the house, so I am planning on using it to host both video and audio files for use throughout.  I have also connected a 4TB backup drive to the USB 3.0 port on the back, giving a total of 7TB of storage.

I was able to get the drive up and running through the WD website for use with my iOS apps.  The 4TB drive shows up as a share on the drive, which is perfect.  Unfortunately, my work network's proxy server doesn't recognize the WD website, so I had to go through our guest wireless to test out general access via PC from work.  I was able to log into the WD website and select one of the shares to be opened in Windows Explorer, and it came right up.  So that is an interesting way to interface to the drive from the outside.  It appears that Western Digital did their homework.

The problem that I am currently facing is that the My Cloud drive is on my Pers vlan while the media components (that would make use of the video and audio file storage) are on the Media vlan.  At the moment I am in the process of setting up an Ubuntu VM to be the router between the Pers and Media vlans.  My constraints are as follows:

• Use Shorewall firewall on Ubuntu VM to do routing; propose using Media and Pers zones; connection is via the vlans that were created on the Thunderbolt interface.  These show up as different ethX devices in the Ubuntu VM
• Using 1 to 1 NAT, present the Mac Mini and the My Cloud drive on the Media vlan with Media vlan IPs
• Setup firewall to allow connection to iTunes protocol, AFS protocol, SMB protocol, and http protocol on the My Cloud drive from Media vlan
• Setup firewall to allow connection to iTunes protocol, AFS protocol on the Mac Mini from Media vlan

More later.

Some Thoughts on a Remote Wireless Access Device

The thought occurred to me today that I might want to set up a version of the RPi Router that would be able to be an extension of my home system.  What I want to do is take the RPi Router into my office at work, turn it on, and have it use the same SSID, but via an SSH tunnel, go into my system at home.  I would need to be able to:

1. Use dual wi-fi access, provide a connection to the work wi-fi network (with auto authentication) and provide the same SSID as my home.  Not sure if I need two USB wi-fi dongles or not.
2. The connection should use an SSH tunnel which is kept up in the background, allowing me to use any of the systems that I have in my house.
3. Somehow, this RPi Router should provide a DHCP forwarding from my house to whatever device hooks into the router.  I may be able to use my new FVS318N router to accomplish some of this, since it does provide VPN capabilities (in case I cannot get the SSH tunnel to do it).  An RPi based VPN for using the FVS318N anyone?
4. Should be plug and play, i.e. put in the SD card and plug in the RPi to get it to function.  Wishing for the moon at the same time.

This obviously is a variation on some of the 1-Port Router ideas that I have had in the past.