Log in

View Full Version : Network Security



Skouperd
04-11-2010, 02:32 PM
http://downloads.skoups.com/ctwug/201009%20Skoups%20Network.jpg

Hi everybody. With the recent discussions about networking, I figured that this is as good as any place to ask for some guidance / help of my own. Just some background, when I moved into the house, I’ve laid Cat5 wires into each and every room in the house (reference to the “how to wire your house article”). At that stage, my gaming computers were all located in the study or throughout the house. The switch (a single 24 port switch) located very centrally in the house catered for all of them. This is also the location where I’ve installed the ADSL lines, Alarm systems and all those good stuff.

Eventually, the study became too small and we build on a “games-room”. This room was built on top of my garage. During the building of this room I’ve took the liberty to build on a server room as well, basically, it is a little room hidden underneath the stairs housing the second 24 port switch, the servers and the CTWUG connections.

My concerns with the above network are as follows:

Security
One of my concerns of late is the increase risk of security on my network. The home network breaks out at 5 different places, ADSL Router, 2x2.4Ghz wifi routers, and 2xCTWUG routers. This forced me to lock down everything (as good as I could) and touch wood, no problem as yet.

On the picture I’ve listed all the “risks” on the network. The way I am treating these risks at the moment is to just block all incoming connections, but in the ideal world, I would like to be able to access the network on a VPN (from the outside) while I would also like to be able to give certain WUG users access onto the LAN without them having to jump through several loops.

Routing
The RB433 is capable to do routing directly on the board; however, because I am sitting in two different subnets, My WUG IP’s is 172.18.81.72/29 while my home network is 192.168.0.0/24 I’ve never been able to get both the WUG and the ADSL to work if I route it via the RB. In order to get past the problem, I’ve been using normal software routing on Aragog (Windows Server 2008R2). However, Aragog is also acting as my fileserver, running my VM’s, doing active anti-virus scanning, DHCP, Terminal Server and I don’t even know what else. If Aragog goes down, then it is always a mission to get the network back up and running again. My idea is to get Wugga to be the machine that runs DC client (accessing the data on Aragog) and perhaps act as my webserver as well.

The problem, I would ideally like to give internet access to some of the guys on the WUG, and also I would like to access my network from the internet as well, an added bonus would like to throttle internet downloads when I am playing games.

Remote Access
Given that I’ve went crazy and made sure nobody could access any of my stuff on my internal network, I am unable to get access to things like my webserver, my alarm system, or the HAVA box from outside. That is something that I would really want to solve.


Bandwidth
The problem I’ve always found that when there is more people than what the games room bandwidth could accommodate (11x1Gb ports) then people will plug their leaching machines in either the Study, Braai, or one of the guest rooms (home switch). The problem then became that these machines were sharing a single Gb connection with the games room switch, meaning if more than one person leach from the machines in the house they would be bottlenecked via the 1Gb connection between the two switches.

Since the SMC_2 switch, as per diagram is not really being used, and it is only really getting pushed hard when there is a LAN and people make use of the network located inside the house, I’ve agreed to sell it off to Jarrod. Those that remember the Sunday at Rage, it is this switch that is now with Jarrod (right now, I am just using an old 16 port 100Mb SMC switch in its place)

Solutions
I’ve considered upgrading my two SMC unmanaged switches to Smart Switches thereby enabling Link Aggregation between them which should take care of my bandwidth problem. It could potentially provide me with some added security by way of VLan’s however, I am not sure how good this solution will be for routing.

Smart switches have come down in price a tremendous amount of late, since Jarrod took one of my unmanaged switches off my hands figured that this may be a quick and easy solution.

Some people suggested getting the “risk points” onto their own network completely and at that point controlling everything that goes in or out. This will be a lot easier (in theory) than trying to block down 5 different security points. I’ve looked at the 750G, the problem with that board is that it only have 5 ports and ideally, I would like to push my ADSL, 2x433WUG Routers, and 2xPersonal Wireless Routers though that. However, then I am unable to connect the 750G onto my home network which is pointless. The other solution I’ve considered was the Mikrotik RB1100 but that is way more expensive for what a small home network looks like.


So, to summarise:
Routing is a problem
Security is a problem
Bandwidth between the two switches is a problem on occasions
Ensuring my gaming gets the lowest pings is a potential problem
Being able to share my Internet with certain individuals would be nice
Being able to access my network from outside would be nice
Being able to link my Home Network up with Murgs and then play games would be nice
Obviously, I would like to keep any solutions as cheap as possible

pmurgs
04-11-2010, 08:11 PM
I would say you need a 750G next to your two 433's. And between the 750G and the 433's a pc, running as a socks proxy server. So your friends on wug you want to give internet access to, connect to the socks proxy, since you can't let them openly talk to the internet over the wug as the routing isn't there. Then the 750G lets through all traffic coming from the socks proxy server into your network and onwards to your internet connection. Use the 750G as your choke point for incoming connections on your garage side of the house. Make the 433's just basic routers and not handle your natting. Leave that to the 750G.

A second 750G for incoming connections (your adsl for instance) on the house side of your network can be the choke point on that side. I'd rather use Mikrtotik to protect my pppoe connection than some poor adsl modem firmware.

You can perhaps also have your 2.4 links go through the relevant 750G's on each side and use the 750G to make sure its not some hacker who's managed to get onto your 2.4 network.

To improve the traffic speed between your two big gigabit switches, all I can think of is replacing them and getting ones that support 10Gb or bonding between them.

Thats my advice.

To be honest, im not as security concious (lets put it that way) as you. If I have something important to keep safe, I will lock it down very securely, but everything else that is not so important doesn't need draconian security measures to keep safe. If someone does break in and mess something up, its not that big a deal to fix it usually. If it is a big deal to fix it, then lock it down securely.

Oh Skoups... I'm not hiding behind any nat on my wug side for my two pcs... so my side should be easy to get to for you :) I feel somewhat safe on the wug, since you can look up on wind where people live and go round with baseball bat if they hacking into you :p

Skouperd
05-11-2010, 07:32 AM
Thanks Murgs, first of all, there is no way I should / could / must / need to upgrade to 10Gb connections... There are only a small number of big corporates that run 10Gbe switches, let alone two, and I have not heard about a single individual running it at his home so for the time being, tad bit overkill and way out of my budget!

J_Th4ng
05-11-2010, 07:44 AM
All I can say is, anyone who has managed to network their braai knows more about this stuff than me... ;)

SlipperyDuck
05-11-2010, 10:26 AM
If this were my network, there are a few things that I would do.

1. Agree with Murgz wiff a SOCK5 proxy server, that would go a long way with simplifying your firewalls network rules for who and what can connect to your Internet.

2. I would build a PC with 5 NICs (or more if needed) in it, then build an IPCOP Linux Firewall (http://sourceforge.net/apps/trac/ipcop/wiki) - that way I can control EVERYTHING on the network with a very easy to use and understand tool.
- you can set up the internet in the RED zone, create a DMZ (Orange zone) for your WUG and then a GREEN Zone for your House, you could even create an additional ORANGE zone for different Areas of your house. Furthermore, you can setup a bunch of NAT rules if needed and manipulate what traffic gets what bandwidth. LINUX FTW!

3. In point (1.), since you're setting up a SOCKS5 Proxy server, why not have it do more. I'd have it become a DNS, RADIUS, SOCKS5, DHCP with multiple subnets, requests can come through the firewall, get approved and replied via one smart server.

4. A Server Zone, as the network gets more complicated, it makes sense to centralize the Core services - create a Server Subnet / VLAN and get most of the bandwidth centralized there.

Anyway - theres certainly a lot that can be done.

SlipperyDuck
05-11-2010, 10:37 AM
Oh I nearly forgot smoothwall (http://www.smoothwall.org/about/express-feature-list/) Which is and always has been an EPIC stand alone (as in OS and firewall are installed via installation disc) and it's robust and strong - I'd recommed it too...

Paul
05-11-2010, 11:09 AM
I would like to start a grrr support group called

"Who the Fuck knows what Murgs, Skoup and Lee are talking about?"

Holy shit okes, you take nerd to a whole new level. Good to know we have experts though

SoSheOhPathix
05-11-2010, 11:18 AM
Wot he sed ^

pmurgs
05-11-2010, 01:38 PM
On the garage side of your house...

Well, setup my web proxy for you today Skoups and it got me thinking. Just use the 433's as your firewall nat to the wug, and open a port for people to connect to and the port is forwarded to a pc running proxy software inside your network, which then sends the internet requests out through your adsl. Saves you buying a 750G and putting up another pc. Those 433's will secure your wug side fine with natting and a couple firewall rules.

Just your 2.4 AP thats exposed direct into your lan, so perhaps plug that into a 433's port so the 433 can watch what goes through your 2.4 AP.



there is no way I should / could / must / need to upgrade to 10Gb connections...


Meh I would if I had your network and money wasnt an issue. Two new striped hard drives or an SSD will be limited by a single Gigabit connection. Pity our pc's arn't coming with 10Gb ports yet. New single hard drives already get close to Gigabit speeds.

Take a look at http://www.safesquid.com/. It's what I setup for you. SafeSquid setups can be linked in some fashion I saw when reading through the documentation, but we would have to get a better license than the free 3 user one it comes with. I really like the web interface it comes with to control it.