Cuestións resoltas sobre pfSense

Pregunta 1 – Introducción á ferramenta

Cuestións

1. Qué é PfSense?
2. Qué funcionalidades ten?
3. Cales de ellas coñeces?
4. Por qué xurdíu OpnSense e en qué se diferencian?
5. Qué outras ferramentas con funcionalidade de firewall coñeces?

Solucións

Pregunta 23 - Cuestións básicas de pfSense

Cuestións

1. Cal é o termo que se utiliza para referirse a rede que está separada do resto da rede local e que provee servizos ós usuarios fora da rede local?
2. Cales son os requisitos mínimos de pfSense 2.4 no tocante a CPU, RAM e espazo en disco?
3. Canta memoria require unha entrada da táboa de estados?
4. Por qué e unha boa idea (tanto para pfSense como para a descarga doutro software) facer uso dos checksums?
5. Cal é a mellor elección de sistema de ficheiros para unha organización que (a) require sorporte para encriptación a nivel de sistema de ficheiros e data deduplication? (b) require a maior compatibilidade hacia atrás posible?
6. Identifica os dous lugares onde se pode facer a asignación de interfaces en pfSense
7. Identifica cando menos catro tipos de configuracións válidas para unha interface pfSense
8. Cal é a configuración por defecto para as Block Private Networks e os enderezos de loopback ... (a) na interface WAN ? (b) na interface LAN? (c) por qué?
9. Identifica dous lugares na interfaz gráfica onde se pode configurar a zona horaria
10. Identifica cando menos tres parámetros que poden ser configurados no Setup Wizard

Solucións

1. Zona desmilitarizada.
2. Mínimos --> CPU: 500 MHz; RAM: 512 MB; espazo en disco: 1 GB. Recomendados --> CPU: 500 MHz; RAM: 512 MB; espazo en disco: 1 GB. Fonte: Documentación oficial de pfSense
3. Aproximadamente 1 KB. Fonte: Documentación de pfSense
4. Os checksums son importantes para asegurar a integridade dunha descarga; así verificando o checksum dun binario pódese confirmar que a descarga finalizou correctamente e que non foi alterada por un terceiro
5. (a) ZFS. (b) UFS Comentarios: Consulta que é a data deduplication
6. A través da consola / shell e a través da interface gráfica web
7. Posibles respostas válidas: Static; DHCP; PPTP; PPPoE; PPP; L2TP.
8. (a) Enabled. (b) Disabled. (c) As Block Private Networks están bloquedas na interface WAN porque os enderezos privados por definición non son enrutables e nunca deberían pasar a través da interface WAN interface. Na interface LAN e outras interfaces locais, o habitual e que queramos que funcionen os enderezos privados
9. A través do Setup Wizard e a través de System | General Setup.
10. Posibles respostas válidas: Hostname, Domain, DNS Servers, Timezone, NTP Server, WAN Interface, LAN Interface,Password.

Pregunta 24 - Cuestións avanzadas de pfSense

Cuestións

1. (a) Qué capa de transporte utiliza DHCP BOOTP? (b) Qué portos utiliza DHCP?
2. (a) Qué capa de transporte utiliza BOOTP? (b) Qué portos utiliza BOOTP?
3. Cales son os Router Advertisement (RA) flag settings que corresponden a habilitar Stateless DHCP (coñecido coma SLAAC)?
4. Cales son os dous servizos que pfSense ten para DNS?
5. (a) Qué capa de transporte utiliza DNS? (b) Qué portos utiliza DNS?
6. Que ventaxa ten DDNS sobre os o servizo tradicional DNS?
7. Qué tres tipos de autenticación soporta o servico de portal cautivo de pfSense?
8. Qué campo debe existir na páxina de login do portal cautivo cando está habilitada a autenticación por voucher?
9. Qué son as management information bases (MIBs)?
10. Qué e SNMP? CAl é o seu porto por defecto?

Solucións

1. (a) Transport Control Protocol (TCP). (b) 67 e 68.
2. (a) User Datagram Protocol (UDP). (b) 67 e 68.
3. M flag: 0; O flag: 1; L flag: 1; A flag: 1.
4. DNS Resolver (por defecto) e DNS Forwarder.
5. (a) UDP. (b) 53.
6. Pode ser actualizado moito máis rápido que o DNS tradicional facendoo axeitado para escenarios nos que o enderezo IP asociado cun dominio cambia frecuentemente
7. User Manager, Voucher, and RADIUS.
8. <input name=”auth_voucher” type=”text”>.
9. A estrutura na que os datos de xestión son organizados xerárquicamente nun dispositivo xestionada con SNMP. Fonte: Base de información xestionada
10. O Protocolo simple de administración de rede ou SNMP (do inglés Simple Network Management Protocol) é un protocolo da capa de aplicación que facilita o intercambio de información de administración entre dispositivos de rede. Os dispositivos que normalmente soportan SNMP incluyen routers, switches, servidores, estacións de traballo, impresoras, bastidores de módem e moitos outros. Permitelles ós administradores supervisar o funcionamiento da rede, buscar e resolver os seus problemas, e planifiar o seu crecemento. Os seus portos por defecto son 161/UDP e 162/UDP (Trap)

Pregunta 25 - Configuración de VLANs

Cuestións

1. Cal é o estandar do IEEE para VLAN tagging?
2. Calesson os ID numbers míimos e máximos para VLAN tags?
3. Nomea dous métodos utilizados para VLAN hopping.
4. Cal debe ser o valor do campo priority code point (PCP) para asegurar o tratamento coñecido coma best effort?
5. Cal é a principal vantaxe do QinQ VLAN tagging?
6. Identifica dúas ventadas do uso de link aggregation.
7. Qué regra crea automáticamente o firewall pfSense para unha interface opcional (coma OPT1)?
8. Identifica dous tipos de portos que deben ser configurados no switch para que a configuración VLAN quede completada.
9. Como se chama o VLAN ID por defecto?
10. Identifica métodos para configurar VLANs en switches Cisco.

Solucións

1. 802.1Q.
2. 1, 4094.
3. Switch spoofing, double tagging.
4. 7.
5. Incrementa o número posible de VLANs (16,752,649 con un único nivel de anidamento, sendo posible un número maior con tamén maior nivel de anidamento).
6. Increased throughput (aumento de rendemento) e redundancia.
7. Ningunha (temos que crear nos as regras que permiten accesos dende as VLANs a outras redes).
8. Trunk ports and VLAN ports.
9. PVID.
10. Static, Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP).

Pregunta 26 - Filtrado de tráfico con reglas

Cuestións

1. Cndo creamos regras no filtrado, qué principio deberíamos aplicar?
2. Cal é a diferenza entre Block e Reject no filtrado de tráfico?
3. Our network has two interfaces: WAN and LAN. The only two rules created so far are the IPv4 and IPv6 "Allow LAN to any" rules that pfSense creates when the LAN interface is initially assigned. We create a rule to block Recode with the following settings: Action = Reject; Interface = LAN; Address Family = IPv4 + IPv6; Protocol = TCP; Source = LAN net; Destination = 151.101.21.52 (Recode's IP address). We place the rule at the bottom of the LAN rules table. What happens when we try to access Recode?

Assume we have created the same rule as the one in Question 2, but we place it at the top of the LAN rules table. Now what happens when we try to access Recode?

1. Assume we have the same ruleset as Question 2, but we also create a floating rule with the following settings; Action = Pass; Quick = Disabled; Interface = LAN; Direction = in; Address Family = IPv4+IPv6; Protocol = Any; Source = Any; Destination = Any. The Block Recode rule is at the top of the LAN rules table. (a) After we enable the new floating rule, what happens when we try to access Recode? (b) If we change the Quick setting on this rule to Enabled and reload the firewall rules, what happens when we try to access Recode? (c) After we change the Quick setting to Enabled, what effect do the "Allow LAN to any" rules have on traffic?
2. Nomea catro tipos de alias.
3. Describe tres métodos para crear alias con múltiples enderezos IP.
4. Cal é un tipo de Virtual IP introducido con pfSense 2.0?

Solucións

1. Principio de mínimo privilegio
2. Block descarta o tráfico silenciosamente mentras que Reject devolve un paquete (RST para TCP ou ICMP Port Unreachable para UDP).
3. We will be able to connect to Recode; the block rule will have no effect because it was placed after the "Allow LAN to any" rule.
4. We will not be able to connect to Recode; the block rule will match the traffic to Recode before the “Allow LAN to any” rule.
5. (a) We will not be able to connect to Recode; the new “default allow” rule will be invoked after the block rule. (b) We will be

able to connect to Recode; the new "default allow" rule will be invoked before the block rule. (c) The default "Allow LAN to any" rules have no effect on traffic flow anymore because they are never reached; the floating "default allow" rule is invoked first.

1. IP, Network, Port, URL. Fonte: Documentación oficial sobre alias
2. (a) Navigate to Firewall | Aliases, click on the IP tab, click on Add, and enter each IP address manually; (b) navigate to Diagnostics | DNS Lookup, perform a DNS lookup, and create an alias from it; (c) navigate to Firewall | Aliases, click on the Import button, do a bulk import.
3. IP Alias

Pregunta 27 - NAT

Cuestións

1. Name any two technologies other than NAT developed to deal with the issue of IPv4 address exhaustion.
2. If we initially install pfSense and configure the interfaces with IPv4 addresses only, do we need to alter the Outbound NAT settings? Why or why not?
3. If Automatic Outbound NAT is selected, how many rules are created for each non-WAN interface?
4. We have an FTP server that must be made accessible to the internet and also must be accessible within our private network. We want to assign this server its own public IP address. What type of NAT should we use?
5. What will happen if we create a Port Forwarding entry and set Filter rule association to None, assuming we do not make any

changes to the firewall rules?

1. Why do we normally leave Source set to any on a Port Forwarding entry?
2. Assume we want to create a Port Forwarding entry for Remote Desktop Protocol (which normally runs on port 3389), but want to make RDP accessible from the internet on port 7000. (a) What should the Destination port range be set to? (b) What should the Redirect port range be set to?
3. (a) Name at least one reason to implement NPt on an IPv6 network. (b) What alternative to NPt does the IETF recommend?

Solucións

1. Classless networks (CIDR), private networks (RFC 1918

networks), and IPv6. Any two would be acceptable.

1. No; we do not need to alter the Outbound NAT settings because outbound NAT rules were generated for each of the non-WAN interfaces.
2. Two rules (one for IPsec and the other for all other traffic).
3. 1:1 NAT.
4. The port forwarding traffic will be blocked by the firewall.
5. We normally don’t care what the source of the incoming traffic is.
6. (a) 7000; (b) 3389.
7. (a) Multihoming and route aggregation are both valid answers. (b) DHCPv6.

Pregunta 28 - Traffic Shaping

Cuestións

1. What is the purpose of traffic shaping?
2. (a) Identify the three types of queuing supported by the pfSense traffic shaper. (b) Identify a queuing discipline that tends to

ensure that low-priority traffic is not starved of bandwidth. (c) Identify a queuing discipline that uses a two-part nonlinear curve and decouples bandwidth from latency.

1. Can we implement Layer 7 traffic shaping with the built-in pfSense traffic shaper? Assume we are using the current version of pfSense.
2. Identify the two wizards with which we can implement traffic shaping in pfSense using the built-in traffic shaper.
3. Identify a type of queue which provides for end-to-end notification of network congestion without dropping packets.
4. Under which tab can you find the firewall rules generated by the built-in pfSense traffic shaping wizard? (Hint: It is the only rules category that has a Match option for Action.)
5. What interfaces are enabled by default when we install Snort?
6. How can we determine the length of a pfSense queue?

Solucións

1. To ensure that network traffic conforms to certain predefined constraints.
2. (a) Priority queuing (PRIQ), class-based queuing (CBQ), and Hierarchical Fair-Service Curve (HFSC). (b) Class-based queuing. (c) Hierarchical Fair-Service Curve.
3. No; we can only implement it with third-party packages such as Snort.
4. (a) The Multiple Lan/Wan configuration wizard; (b) the Dedicated Links wizard.
5. Explicit Congestion Notification.
6. The Floating Rules tab.
7. None; we have to manually enable each interface.
8. By navigating to Status | Queues and looking under the Length column.

Pregunta 29 - VPN

Cuestións

1. Name the two most common types of VPN deployments.
2. (a) Identify the three VPN protocols supported by the current version of pfSense. (b) Which protocol does not natively support encryption?
3. Identify the three protocols encompassed by IPsec.
4. If we are setting up an IPsec connection and Key Exchange version is set to Auto, what will happen if we try to initiate a site-to-site connection to (a) a firewall where the Key Exchange version is set to IKEv1? (b) a firewall where the Key Exchange version is set to IKEv2? (Assume that the rest of the configuration is correct.)
5. (a) Which port must always be unblocked for IPsec to function? (b) What is the default OpenVPN port?
6. What are the three authentication options for L2TP?
7. What option was added to the Diffie-Hellman key configurationin pfSense 2.4?
8. With OpenVPN, what alternatives are there to authentication through certificates managed through the pfSense Certificate Authority Manager?

Solucións

1. Peer-to-peer and client-server.
2. (a) IPsec, L2TP, and OpenVPN. (b) L2TP.
3. Authentication Headers (AH), Encapsulating Security Protocol (ESP), and Security Association (SA).
4. (a) The connection will fail because when the Key Exchange version is set to Auto and pfSense is the initiator, it will use IKEv2 (since the other firewall is using IKEv1, there will be a mismatch). (b) The connection will succeed because pfSense as the initiator will again use IKEv2, and the protocols will match.
5. (a) 500; (b) 1194.
6. Challenge-Handshake Authentication Protocol (CHAP)], MSCHAPv2, e Password Authentication Protocol (PAP).
7. Elliptic-curve Diffie-Hellman (ECDH).
8. Lightweight Directory Access Protocol (LDAP) e Remote Authentication Dial-In User Protocol (RADIUS).

Pregunta 30 - Redundancia e alta disponibilidade

Cuestións

1. Identify any three types of load balancing algorithms.
2. (a) What are the advantages of client-side load balancing? (b) What are the advantages of server-side load balancing?
3. What are the two modes of load balancing supported by the built-in pfSense load balancer?
4. If I am using pfSense's load balancer and I add a server to a server pool but no traffic from outside the network is reaching the new server (and traffic from outside the network is reaching other servers within the pool), what is the likely cause? Assume that my server pool setup was functioning correctly before I added the server.
5. Identify which of the following can be synchronized using pfSense's High Availability Sync. (a) firewall rules; (b) packages; (c) virtual IPs; (d) system logs.
6. In a normal CARP configuration, do we need to create a virtual IP for the PFSYNC interface? Why or why not?
7. Assume we have a functioning CARP failover group in which all options are selected in Select options to sync on the System | High Availability Sync page. On the backup firewall, we create a new firewall rule. What happens to this rule when we navigate to Status | Filter Reload and on the master firewall and click on the Force Config Sync button?
8. Why is it important to set the Advertising frequency in a CARP setup with multiple backup firewalls?
9. Assume you are required to implement load balancing on a pfSense firewall using the Least Connections algorithm. What is the easiest way of achieving this?
10. Assume that we need to keep CARP disabled through a reboot. How do we do this?

Solucións

1. Any three of these: random, round robin, weighed round robin, least connection, least traffic, least latency, IP hash, URL hash, SDN adaptive.
2. Client-side load balancing: easy to implement and effective. Server-side load balancing: better able to guarantee load balancing; transparent to client; more secure; we can provide a message to client when all servers are down.
3. Load balancing and Failover.
4. The most likely cause is that I forgot to update the alias for the server pool to include the new server. Since the firewall rule to allow traffic to pass to the server pool uses this alias, it allows traffic to pass to every server except the new one.
5. (a) Yes; (b) no; (c) yes; (d) no.
6. No; we do not have to create a virtual IP for the PFSYNC interface because use it to pass synchronization data between firewalls; we don’t want any redundancy on this interface.
7. The firewall rule will get overwritten when data is synchronized with the master firewall.
8. Because, if the Advertising frequency is the same on two or more backup firewalls, if the master goes down, two or more backup firewalls will try to become master at the same time.
9. Use HAProxy and select Least Connections as the load balancing for Balance when configuring the backend.
10. Navigate to Status | CARP (failover) and click on the Enter Persistent CARP Maintenance Mode button

Pregunta 31 - Múltiples WANs

Cuestións

1. What document is provided by many ISPs that defines the aspects of service to be provided to the client?
2. What is policy-based routing?
3. (a) If we have two separate internet connections and we want to combine them for bandwidth aggregation, what form of redundancy and high availability should we use in our gateway group? (b) If we have two separate internet connections and we only want to use the secondary connection if the first one is down, what form of redundancy and high availability should we use?
4. What will happen if we configure a gateway group and do not add or change the firewall rules? Assume our setup is otherwise correct.
5. In a multi-WAN setup, under what circumstances must you add a static route for an external DNS server?
6. If we add multi-WAN capabilities to a CARP failover group, how many virtual IPs do we need to add?
7. What option can be used to ensure that all traffic to a certain website is routed through the same WAN interface as long as there are states that refer to the connection?
8. If you have set up a gateway group with load balancing and an external "what is my IP" website keeps reporting no change in your IP address, what could be the cause? Identify any three causes.

Solucións

1. Service-Level Agreement (SLA).
2. Routing in which routing decisions are dictated by administrative policy.
3. (a) Load balancing. (b) Failover.
4. Traffic between local interfaces will be routed through the original WAN interface and will never reach the gateway group; pfSense’s default behavior is to route external traffic to the primary WAN interface.
5. You are configuring an OPT_WAN interface and the OPT_WAN’s DNS server is not the same as the Monitor IP. We do not have to configure a static route for the primary WAN interface because external traffic is routed to it by default, and we do not have to configure a static route if the OPT_WAN’s DNS server is the same as the Monitor IP because pfSense will add a static route for the Monitor IP.
6. One for each OPT_WAN interface (and one for each 1:1 NAT mapping, if we have any).
7. Use Sticky Connections.
8. Acceptable answers: The load balancing gateway group isn’t working properly; the web page is cached and therefore isn’t refreshing when we reload it; the connections are weighted such that the secondary connection handles very little traffic; Use Sticky Connections or some other persistent connection option is enabled; other users are on the network and generating a share of the connections going to the nonprimary connections.

Pregunta 32 - Routing e bridging

Cuestións

1. What is the key difference between routing and bridging?
2. (a) What class of routing protocols involves a router only informing its neighbors of topology changes? (b) What class of routing protocols involves each router constructing a map of its connectivity to the network?
3. Identify two methods we can use to deal with the problem of return traffic not following the same route as the traffic originally sent when configuring static routes.
4. (a) We want to utilize RIP v2 as our routing protocol. What pfSense package should we install? (b) We want to utilize OSPF as our routing protocol. What pfSense package can we use?(Identify either one.) (c) What is the best choice if we want to redistribute OSPF routes to BGP neighbors?
5. What is the first step in implementing policy-based routing?
6. Identify the two spanning tree protocols supported by pfSense bridging.
7. We have a CARP failover group and we want to bridge two interfaces on the failover group. What issue will this cause?
8. (a) What diagnostic tool found in the pfSense web GUI can we use to diagnose routing problems? (b) How are static routes denoted in this tool?

Solucións

1. Routing involves moving traffic between networks (internetwork traffic), whereas bridging involves connecting segments on the same network (intranetwork traffic).
2. (a) Distance vector protocols. (b) Link-state protocols.
3. Enable Static route filtering in System | Advanced (Firewall and NAT tab) or create firewall rules to deal with the static routes.
4. (a) routed. (b) Quagga OSPF or FRR (FRRouting). (c) FRR.
5. Adding one or more gateways.
6. Spanning Tree Protocol (STP) and Rapid Spanning Tree Protocol (RSTP).
7. Looping.
8. The routing table found at Diagnostics | Routes.

Pregunta 33 - Paquetes para extender pfSense

Cuestións

1. Qué dous métodos poden ser usados para instalar paquetes no pfSense?
2. Cal é o porto por defecto no que vai escoitar o proxy Squid?
3. Engadimos unha regra no firewall para bloquear o acceso a unha determinada páxina web desde todas as nosas redes locales e confirmamos que funciona correctamente como esperamos. Asumindo para os seguintes escenarios que non fixemos ningunha configuración adicional no Squid, qué acontece... (a) Despois de instalar o servidor proxy Squid... poderemos acceder a ese sitio web? (b) Despois de habilitar o servidor proxy Squid poderemos acceder a ese sitio web? .
4. Qué paquete sería o máis axeitado para de xeito sinxelo bloquear o acceso dende un país a nosa rede?
5. Identifica os diferentes estados de portos interesantes nunha proba Nmap.
6. Qué paquete debemos instalar se queremos engadir un grupo de balanceo de carga e tamén noficacións se un dos serividores do grupo cae?
7. Identifica os tres modos nos que Snort pode correr.
8. Identifica os tres protocolos que poden ser especificados nunha regra de Snort.
9. Identifica paquetes que poden ser utilizados para a monitorización de redes.
10. Cál é a diferenza entre un axente Zabbix e un proxy Zabbix?
11. Queremos monitorizar traps SNMP. Qué paquete de Zabbix debemos instalar?

Solucións

1. A través da interfaz de pfSense e por liña de comandos.
2. 3128.
3. (a) O acceso á páxina web seguirá bloqueado porque a instalación de Squid non arranca o mesmo como habilitado por defecto (b) O acceso á páxina web será posible porque Squid ten precedencia sobre as regras do firewall e non temos engadido o sitoo á blacklist de Squid.
4. pfBlockerNG.
5. Pendente
6. HAProxy.
7. Packet sniffing mode, packet logging mode, and network intrusion prevention mode. Fonte: Modos de Snort
8. TCP, UDP e ICMP. Fonte: Protocolos nas regras Snort
9. Ntopng, nmap, Zabbix, Suricata,....
10. Un axente Zabbix recolle información do host local e pásalla o servidor Zabbix; un proxy Zabbix recolle information de hosts e é capaz de interactuar co servidor Zabbix server de xeito que a carga é distribuída.
11. Zabbix por defecto xa pode monitorizar traps SNMP. Con todo, pode requirir da instalación dos paquetes net-snmp-utils, net-snmp-perl, e net-snmp para o uso do trap receiver snmptrapd coma demonio. Máis información na documentación de Zabbix e no seu blogue.

Pregunta 34 - Diagnóstico e troubleshooting

Cuestións

1. Cal debe ser o paso final no troubleshooting dun problema de rede?
2. Un sitio pode ser alcanzado facendo ping o enderezo pero facendo ping o nome do host falla. Cal é a causa mais probable para isto?
3. Nomea estándares wifi que funcionan no rango de 2.4 GHz range.
4. Que estándar de encriptación wireless envía os challenges en claro e é considerado inseguro?
5. Identifica dous métodos para determinar se unha interfaz está levantada desde a interface gráfica de pfSense.
6. Qué ferramenta pode ser utilizada para monitorear a táboa de estados de pfSense e é posible o seu uso desde liña de comandos e desde a interface gráfica de pfSense?
7. Qué ferramente pode ser utilizada para facer ping a un sitio que bloquea o tráfico ICMP pero non o TCP?
8. Cales son os dous propósitos principais de traceroute?

Solucións

1. Documentar o problema e a solución.
2. Un fallo na configuración ou funcionamento do DNS.
3. 802.11b, 802.11g e 802.11n.
4. Wireless Encryption Privacy (WEP).
5. Status | Interfaces ou usando ou Dashboard.
6. pfTop.
7. tcpping.
8. Amosar a ruta seguida polos paquetes e o tempo empregado en cada paso (delay)