How to audit network as a noob

3 months ago by SomeLemmyUser to c/networking

Hey y'all, I have a small network with opnsense firewall, a unify ap, some client in different subnets, vpn, DNS and some servers.

As I am completely self thought, I got everything to run reading the docs and forums, but I have no idea how to test if what I build is safe and stable.

Are there good up to date tools, or checklists one could follow to audit the different parts of the network (most important the opnsense config)?

What do you check if looking for security issues?

The network mostly relies on client separation through different subnets on different vlans, but I fear I dont understand how for example the vpn and the nas work together in detail to be sure there is no security implication I oversee.

Also: how do you handle client authentication for devices on the same subnet? I know IP/mac-adress ARP entries are easily spoofed and therefore not secure, but I haven't seen how to do it correctly

helix 8 points 3 months ago

Can you please draw a network diagram, e.g. in draw.io (diagrams.net desktop application) and we can tell you what to check where?

You can use nmap to verify if the rules you set actually work.

Try spoofing your IP yourself and see what happens.

You can use RADIUS for client authentication and MACSec to encrypt layer2 data. In my opinion that's overkill for a home network though.

Try to come up with scenarios in which you are hacked and how they'd do it. Then try to actually do it. Implement counter measures and see if it still works or you successfully mitigated that attack vector.

save

path: 0 24729220, hotness: undefined, score: 8, children: 2

Jean_le_Flambeur 2 points 3 months ago

I'll try to do a diagram tomorrow. Its a mixed network of multiple families of whom some want to host a server to the internet. That would mean lots of untrusted traffic, so I get more concerned with auth. If I know the Mac address and IP I want to spoof, I can get the permissions of the device I spoofed, as long as I am in the same subnet, which is the case for wifi (ap can only host 4 different ones, I have more than 4 groups of user permissions so I can't separate them all). That's where some auth would come in in my mind.

The problem is, I just learned about how to use the software, I am far from deep enough in it (and IT-knowledge in general) to actually pen test myself, I would have no idea how someone would worm through my network, if he gets rce on the server of one of the other families, so I can't really say if something like this is possible or not.

save

path: 0 24729220 24743454, hotness: undefined, score: 2, children: 1

helix 2 points 3 months ago

I am far from deep enough in it (and IT-knowledge in general) to actually pen test myself

Yes, but once you try to hack yourself you'll research how it works and this will give you knowledge about how to secure a network.

You basically need to purple team yourself. You're both attacker (red team) and defender (blue team).

Try to make a list of attack surfaces and think about (and research) possible attacks. Then you try to execute said attacks.

There's basically no other way to test if something is safe and stable than to try to break it.

save

path: 0 24729220 24743454 24750149, hotness: undefined, score: 2, children: 0

ramble81 4 points 3 months ago

What it is?
Where it connects?
What can it access?

Those are ultimately what your questions should distill down to. Starting with a network diagram it one of the best ways. Looking at Layers 1-3 will help answer the first two. From there, keep expanding into 4-7 for your firewall rules and NACLs.

save

path: 0 24733414, hotness: undefined, score: 4, children: 0

moonpiedumplings 3 points 3 months ago

Okay I really want to write a longer post to this, but I don't have much time so I'll just jot down my thoughts real fast:

Are there good up to date tools, or checklists one could follow to audit the different parts of the network (most important the opnsense config)?

"Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win."

But I did jot down some tools I found interesting: https://moonpiedumplings.github.io/...

Unfortunately I haven't compared them or found out which is the best yet.

how do you handle client authentication for devices on the same subnet? I know IP/mac-adress ARP entries are easily spoofed and therefore not secure, but I haven’t seen how to do it correctly

On wifi, client isolation, on ethernet, port isolation and private vlans.

save

path: 0 24732576, hotness: undefined, score: 3, children: 3

Jean_le_Flambeur 1 point 3 months ago

Thanks for you thoughts! It will take a while to go through the tools, but having a list really helps.

For the auth, you are suggesting that clients on the same subnet should always have the same permissions?

Usecase would be: We have a WiFi for family A, mother shall get access to the media server on a different subnet, tech savy son should not get acces to it. We have client isolation, but that would not stop the son from "stealing" the IP address his mom uses by spoofing their Mac address. I dont see how client isolation would help here, but I would need some kind of auth approach.

Sure putting them on different subnets would be an elegant solution, but I can only host 4 wifis from my ap and have more than 4 "permission groups"

save

path: 0 24732576 24743361, hotness: undefined, score: 1, children: 2

moonpiedumplings 2 points 3 months ago

We have client isolation, but that would not stop the son from “stealing” the IP address his mom uses by spoofing their Mac address. I dont see how client isolation would help here, but I would need some kind of auth approach.

You can have more than one SSID/Wifi Network, each with their own auth, VLAN, and ofc, access to the network.

Although, the approach I would prefer is to just auth the media server itself.

Sure putting them on different subnets would be an elegant solution, but I can only host 4 wifis from my ap and have more than 4 “permission groups”

Ah. Yeah. Then you have to auth the media server itself.

Although, another approach you can do is have people VPN in (even if already local) and the VPN puts them on different subnets.

Or another approach is to use WPA enterprise, where clients have to use a username and a password to connect to the wifi. With each client having a unique identity, you can then control access or assign them to subnets. But your hardware/software has to support that, and you would also need an LDAP/Radius setup probably, it's the most complicated bundle.

So I guess the above 3 options are listed in order of simple to complex.

save

path: 0 24732576 24743361 24750819, hotness: undefined, score: 2, children: 1

Jean_le_Flambeur 1 point 3 months ago

Thanks a lot, this seems logical, since I am not good enough in IT stuff to rely soley on the auth of the server and I want a second layer of protection to at least reduce the attack surface to known devices, i will look into a local VPN, but if this is also overkill for my skills, I may just buy a second AP for more WiFi networks. Would be beneficial for coverage anyway.

save

path: 0 24732576 24743361 24750819 24873757, hotness: undefined, score: 1, children: 0

frongt 1 point 3 months ago

Verify your assumptions. If your config should prohibit connections between subnets, try connecting.

For the advanced user, set up a separate device and try hacking in.

save

path: 0 24730745, hotness: undefined, score: 1, children: 1

Jean_le_Flambeur 1 point 3 months ago

Well I did that for the parts I did understand (trying to connect to server on different subnet, trying to get an IP in the space of a different subnet to get access, trying to get internet access on networks that should have none)

I just wonder how to test for things I dont understand. I have no plan on how one would go about exploiting a flaw in my NAT or VPN setup, so I can't test it

save

path: 0 24730745 24743383, hotness: undefined, score: 1, children: 0