Snort

Snort is a handy Intrusion detection system that is very easy to configure and at the same is free to use, you would actually need a subscription to download premium Snort rules though.

Installing Snort on Windows
You would need the Snort installation file, WinPcaP and Snort rules to make use of Snort in a Windows environment. Snort makes the Snort rules available of free of charge in the Snort community website. These rules file can be downloaded and saved onto the Snort rules folder after installing Snort.
  
Snort rules
When you specify in the “snort.conf” file (located in C:\Snort\etc) of the snort installation how and which rules to be used, you can easily use these rules to detect intrusions. You also need to specify your local network address in snort.conf file to configure snort to work on your local network.
You can specify your local rules in the “local.rules” file in the Snort installation. Which is located in C:\Snort\rules folder.


The general structure of Snort rules
A basic Snort rule is as below, this rule consists of a rule header that defines who, where and what of a packet.

log tcp any any -> 192.168.1.0/24 77


The left side of the rule from the arrow (- and >) specifies the source and the right side is the destination. The above rule records all the TCP traffic from any network and from any port, to the network 192.168.1.0/24 and the port 77.

A rule can specify traffic to,

pass - let the packet go through
log - log the packet
alert - generate an alert, and log the packet
drop - block the packet and log it
reject - block data packet, log the data packet, send TCP reset request if its protocol is TCP or if the protocol is UDP send ICMP port unreachable message
sdrop - block the packet but do not log


PCRE matching
PCRE stands for Pearl Compatible Regular Expressions. PCRE matching provides Snort with a method to match content in a payload of a data packet that we know very little about.


In the below rule we specify the data type we are looking for (ip) and the section

pcre:"/Hello\s+world/" specify the regex pattern we are looking for which is Hello\s+world. Which means look for “Hello world” phrase with one or more spaces in between the two words.


alert ip any any -> any any (sid:1000008;msg:"Hello world phrase found";pcre:"/Hello\s+world/";)


PCRE matching can be used to detect web application attacks such as SQL injection attacks.

Use below rule to detect a SQL injection attack.

alert tcp any any -> 10.18.20.201 any (msg:”SQL Injection attack”; pcre:”/\w*((\%27)|(\’))((\%6F)|o|(\%4F))((\%72)|r|(\%52))/ix”; sid:1000011; rev:1;)


Below are examples of snort rules that will detect packets of data which:

• Contain the phrase    Hello world    with the words Hello and world separated by one or more space characters.

alert ip any any -> any any (sid:1000008;msg:"Hello world phrase found";pcre:"/Hello\s+world/";)

• Are sent by any computer to a mail server and which contain a single word of text enclosed in double quotes, that starts with a capital letter and is between four and seven letters long.

alert ip any any -> any smtp (sid:1000009;msg:"Text enclosed in double quotes sent to mail server found";pcre:"/\"[A-Z][a-zA-Z]{3,6}\"/";)

Use Hardware Firewall with ISP Router

I was able to find a used ASA on eBay finally. Initially it did not boot. However, after re-seating the flash it started bootingfine.

Cisco ASA firewall is the advanced version or the newer version of the Cisco PIX firewall. The ASA IOS command line and features are more user friendlier that the PIX command line. However, the concepts are quite the same in both.  


 

The basic topology


ASA 5505 basic configuration

Configuring VLAN

For the ASA firewall basic configuration, we need an outside and an inside interface

The outside interface is the interface that faces the outside world. Security is by default set to the highest level (0) for this interface. Which is the most restrictive in terms of traffic.

interface Vlan20-------------we use a VLAN to logically separate the outside and inside traffic.
nameif outside
security-level 0
ip address 10.0.1.2 255.255.255.0--------------We set an IP for this logical interface

The inside interface is the interface that faces the inside the “Local Area Network”. Security is by default set to the lowest level (100) for this interface. Which is the least restrictive in terms of traffic. To assign a VLAN to the inside traffic,

interface Vlan10
nameif inside
security-level 100
ip address 10.0.2.1 255.255.255.0

After logically separating outside and inside traffic we assign these logical interfaces to physical interfaces which separate the inside and outside traffic physically. This is what a firewall basically does, it acts as a barrier that protects our inside network (LAN) from the outside world.

interface Ethernet0/1
switchport access vlan 20
interface Ethernet0/0
switchport access vlan 10

You probably have one public ip that is given to you by your ISP to go to the internet. NAT makes it possible for us to use this only one ip address but enable all our devices in the LAN to access the internet. In order for all the devices in your LAN to be able to go to the internet a version of NAT; PAT (Port Address Translation) is used. PAT does a many to one translation of private ips to a single public ip. It uses port numbers to track these PAT of private ips.  

object network patconv
subnet 0.0.0.0 0.0.0.0------ enable any ip address in the LAN a possible candidate for NAT
object network patconv
nat(inside,outside)dynamic interface

In order to forward all the LAN traffic to the internet, we would need a default route  

route outside 0.0.0.0 0.0.0.0 10.0.1.1 1

To make the ASA assign DHCP addresses to its internal network we can use the inside interface. In this instance the ASA acts as a DHCP server. If we are to connect an access point directly to the ASA, we can use this access point to hand in ip addresses automatically within the LAN.

dhcpd address 10.0.2.3-10.0.2.5 inside
dhcpd enable inside

We also need a DNS server for a PC in the LAN to connect to the internet, therefore we can specify in the ASA which DNS server ip address to use. The DNS server ip can be the DNS ip of your ISP.  

dhcpd dns xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx

You can use this topology in your home to connect to the internet through your ISP DSL router, ASA firewall and an access point.