Live Virtual Machine Lab 19-1: Implementing Network Security Measures

Live Virtual Machine Lab 19‑1: Implementing Network Security Measures

Introduction

In today’s interconnected world, safeguarding network infrastructure is essential. That said, Live Virtual Machine Lab 19‑1 offers a hands‑on environment where students and professionals can practice deploying and configuring essential security controls on a virtual network. In real terms, by working within a controlled, isolated VM setup, participants learn how to protect data, detect threats, and maintain compliance without risking real systems. This article walks through the lab’s objectives, prerequisites, step‑by‑step procedures, and key takeaways, ensuring you can replicate the experience and apply the concepts to any network environment The details matter here. That alone is useful..

Lab Objectives

• Understand the fundamentals of network security architecture.
• Configure firewalls, intrusion detection/prevention systems (IDS/IPS), and secure protocols.
• Implement encryption and authentication mechanisms.
• Monitor network traffic for anomalies and respond to simulated attacks.
• Document findings and create a security policy draft based on lab results.

Prerequisites

Before diving into the lab, ensure you have:

Step 1: Setting Up the Virtual Network

1. Create a Virtual Switch

   • In your hypervisor, set up an internal network switch that connects all VMs.
   • Assign a static IP range (e.g., 192.168.100.0/24) to avoid DHCP conflicts.

2. Deploy Core VMs

   • Gateway VM: Install pfSense; this will act as the firewall and router.
   • Server VM: Ubuntu Server hosting a web application.
   • Client VM: Windows 10/11 machine to simulate user traffic.
   • Monitoring VM: Linux machine with Wireshark and Suricata.

3. Verify Connectivity

   • From the Client VM, ping the Server VM.
   • Ensure the Gateway VM can route traffic between the two.

Step 2: Configuring the Firewall (pfSense)

1. Basic Setup

   • Access pfSense via web interface (default: https://192.168.100.1).
   • Set a strong admin password and enable HTTPS.

2. Interface Configuration

   • Assign LAN interface to 192.168.100.1/24.
   • Disable WAN interface if the lab is isolated.

3. Firewall Rules

   • Allow:
     • LAN → LAN for internal traffic.
     • LAN → Server on ports 80, 443, 22.
   • Block:
     • All other inbound traffic from LAN to WAN.
   • Logging: Enable logging for all blocked packets.

4. Advanced Features

   • NAT: Configure NAT if you plan to expose services externally.
   • Traffic Shaping: Set bandwidth limits to simulate real‑world constraints.

Step 3: Deploying IDS/IPS (Suricata)

1. Installation

   • On the Monitoring VM, install Suricata:

     sudo apt update && sudo apt install suricata
     

2. Configuration

   • Edit /etc/suricata/suricata.yaml to enable IDS mode.
   • Point Suricata to the network interface connected to the virtual switch.

3. Rule Sets

   • Download the latest Emerging Threats rule set.
   • Enable rule categories relevant to web traffic (e.g., ET WEB_CLIENT).

4. Testing

   • Generate traffic from the Client VM (e.g., curl http://192.168.100.2).
   • Verify Suricata logs the activity in /var/log/suricata/fast.log.

Step 4: Implementing Encryption and Secure Protocols

1. HTTPS on the Server

   • Generate a self‑signed certificate:

     sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
       -keyout /etc/ssl/private/server.key \
       -out /etc/ssl/certs/server.crt
     

   • Configure Apache/Nginx to use the certificate.

2. SSH Hardening

   • Disable root login: PermitRootLogin no.
   • Change default port from 22 to 2222.
   • Enable key‑based authentication and disable password authentication.

3. VPN Setup (Optional)

   • Deploy OpenVPN on the Gateway VM.
   • Generate client certificates and distribute to the Client VM.
   • Verify that all traffic is routed through the VPN tunnel.

Step 5: Monitoring and Logging

1. Syslog Configuration

   • Configure pfSense to forward logs to the Monitoring VM:
     • System → Log File → Remote Logging.
   • On the Monitoring VM, set up rsyslog to receive logs.

2. Log Analysis

   • Use grep or awk to filter critical events.

Step 6: Vulnerability Scanning and Validation

1. Scanner Deployment

   • Install a vulnerability assessment tool on the Monitoring VM:

     sudo apt install nmap openvas-scanner
     

   • For comprehensive coverage, deploy Greenbone Vulnerability Manager (GVM) via Docker or native packages.

2. Scan Configuration

   • Define target scope: 192.168.100.0/24.
   • Schedule scans during low-traffic windows to prevent lab performance degradation.
   • Enable authenticated scans against the Server VM to detect misconfigurations and missing patches.

3. Result Correlation

   • Export findings in structured formats (CSV, XML) for tracking.
   • Cross-reference scanner output with Suricata alerts to distinguish between theoretical vulnerabilities and actively exploited attack vectors.

4. Remediation Workflow

   • Prioritize fixes using CVSS scores and asset criticality.
   • Apply patches, adjust service configurations, or restrict firewall rules as needed.
   • Re-scan to confirm vulnerability closure and update documentation.

Step 7: Automated Alerting and Incident Response

1. Threshold Definition

   • Configure Suricata to flag high-severity events (priority: 1) and repeated connection attempts (>15/min from a single source).
   • Set pfSense alerts for state table saturation, DHCP exhaustion, or unexpected WAN egress.

2. Notification Pipeline

   • Deploy fail2ban to monitor authentication logs and auto-ban offenders:

     [sshd]
     enabled  = true
     port     = 2222
     filter   = sshd
     logpath  = /var/log/auth.log
     maxretry = 3
     bantime  = 7200
     

   • Route critical alerts to email, Slack, or a local webhook using logwatch or custom Python/Bash scripts.

3. Response Playbooks

   • Document step-by-step procedures for common incidents (e.g., isolate VM via virtual switch port shutdown, rotate compromised credentials, restore from clean snapshot).
   • Automate containment actions using pfctl or pfBlockerNG to dynamically drop malicious IPs based on log triggers.

Step 8: Routine Maintenance and Security Hygiene

1. Patch and Update Cadence

   • Establish a weekly maintenance window for OS, application, and pfSense firmware updates.
   • Validate patches in a cloned lab environment before applying to production-facing configurations.

2. Configuration Management

   • Automate pfSense XML backups and store them off-device or in a version-controlled repository.
   • Track Suricata rule modifications, firewall policies, and SSL certificates using Git for auditability and rollback capability.

3. Lab Lifecycle Practices

   • apply hypervisor snapshots to quickly revert VMs after destructive testing or misconfigurations.
   • Rotate test credentials, regenerate self-signed certificates, and clear log archives quarterly.
   • Maintain a living network diagram and change log to ensure topology accuracy as the environment scales.

Conclusion

A resilient network defense is not built from isolated components, but from the deliberate integration of perimeter controls, traffic inspection, cryptographic safeguards, and continuous visibility. By methodically configuring the firewall, deploying an IDS/IPS, enforcing secure protocols, and centralizing logs, you’ve established a functional security architecture capable of detecting, analyzing, and responding to threats No workaround needed..

Security, however, is inherently iterative. Think about it: as your lab matures, consider expanding into SIEM aggregation, threat intelligence integration, or infrastructure-as-code automation to further streamline operations and scale your capabilities. In real terms, regular validation through scanning, disciplined patch management, and automated alerting transform static configurations into an adaptive defense posture. With this foundation in place, you now have a controlled, repeatable environment to experiment, refine techniques, and confidently apply hardened security principles to real-world networks.

Future Enhancements

As your lab matures, consider these advanced integrations to elevate your security posture:

1. Threat Intelligence Feeds: Integrate real-time threat intelligence into Suricata using feeds like AbuseIPDB or ThreatFox. Automate IP