HOWTO : Build a Fortress for Your Home/SOHO Network

**** Content is updated for SmoothSec 3.4-1 on January 30, 2014 ****

Hardware

(A) Unified Threat Management System (UTM)
Minix Mini HD PC (J&W) :
CPU - Intel ATOM D2550 (dual-core and 4 Hyper-Threading)
Chipset - Intel NM10
GPU - Intel GMA 3600 Series
RAM - 2 x 2GB (DDR3-1066 SO-DIMM) 4GB
Hard Drive - 1 x 2.5-inch Hard Drive (80GB or above)
Networking - Dual Broadcom 57788 Gigabit Ethernet

(B) Intrusion Detection/Prevention System (IDS/IPS)
Minix Mini HD PC (J&W) :
CPU - Intel ATOM D2550 (dual-core and 4 Hyper-Threading)
Chipset - Intel NM10
GPU - Intel GMA 3600 Series
RAM - 2 x 4GB (DDR3-1066 SO-DIMM) 8GB
Hard Drive - 1 x 2.5-inch Hard Drive (120GB or above)
Networking - Dual Broadcom 57788 Gigabit Ethernet
USB Networking - PCi USB 3.0 Gigabit LAN Adapter UE-1000T-G3 or Level One USB Gigabit Ethernet USB-0401

* A switch is also required for this setup if you have more than one computer.

I prefer the setup is as the following :

Internet - SmoothSec (Suricata) - Router (Untangle UTM) - Switch (any switch) - Computers

Software

(A) Untangle 10.0 (64-bit) as UTM
Make sure you install the Lite Package which is free of charge. If you want to purchase their services, such as Standard, you can install Standard Package. For home/SOHO, Lite Package is enough.

After the basic installation, you need to create an account to the untangle.com in order to install Lite Package (or Standard Package).

(B) SmoothSec 3.4-1 (64-bit) as IDS/IPS with Suricata
Before setting up your SmoothSec, you need to upgrade the SmoothSec scripts to 3.6 and follow the instruction at the link just provided.

To set up IDS/IPS with Suricata, you can follow this section. Make sure you select “suricata” as AF_ENGINE in the configure file. Meanwhile, you should follow this section to set up.

For rules handling, you can refer to this link.

To fully understand the setup, you can read this article even it is written for 3.6 (not yet released at the moment) and the concept is the same.

Conclusion

Due to the high performance of AF_PACKET of Suricata, Broadcom 57788 Gigabit Ethernet and the Intel ATOM D2550 CPU, the network can play 1440p Youtube video without problem. The QoS is set to Medium in the Untangle 10.0 is recommended.

Meanwhile, Minix Mini HD PC is around $120-US (barebone without RAM and Hard drive) and the hardware cost is not too expensive to setup a fortress to your home/SOHO network. The running cost of this setup is very low as the software are free of charge. The footprint of the Minix Mini HD PC is very small. Smaller than a standard ITX computer case.

If you do not know how to manage SmoothSec (Suricata), you can install Untangle only.

HOWTO : High Performance IDS/IPS with SmoothSec 3.4

The following Intrusion Detection/Prevention System (IDS/IPS) setup is using AF_PACKET with SmoothSec 3.4. The following setup is for low traffic flow home and SOHO users (or you can say that it is a Proof-of-Concept). If your traffic is heavy, please consider to use a high-end hardware.

(A) Hardware

IDS/IPS -

Motherboard - Intel Desktop Board D510MO
CPU - Intel Atom D510 (Dual-core with HT)
RAM - 4GB (2 x 2GB)
Hard Drive - 320GB
Network Card 0 (eth0) - Onboard Gigabit
Network Card 1 (eth1) - TP-Link TG-3269 Gigabit PCI Network Adapter (with low profile)
Network Card 2 (eth2) - D-Link DUB-E100 USB 2.0 Fast Ethernet Adapter (up to 200MB)

* You can select (1) Level One USB-0401 USB Gigabit Ethernet Adapter or (2) PCi USB 3.0 Gigabit LAN Adapter UE-1000T-G3 for eth2. However, you need to compile and install the driver yourself.

Update : If you are using Backports latest kernel, the Level One USB-0401 and PCi UE-1000T-G3 are workable out of the box.

Router -

Motherboard - Intel Desktop Board D510MO
CPU - Intel Atom D510 (Dual-core with HT)
RAM - 4GB (2 x 2GB)
Hard Drive - 320GB
Network Card 0 (eth0) - Onboard Gigabit
Network Card 1 (eth1) - TP-Link TG-3269 Gigabit PCI Network Adapter (with low profile)

(B) Software

IDS/IPS -

Operating System - Debian 7.0 (Wheezy)
IDS/IPS Pre-configure system - SmoothSec 3.4 (64-bit)
IDS/IPS Engine - Snort (or Suricata)
Unified2 Spooler - Pigsty
Web Interface - Snorby
Rules Management - PulledPork

Router -

Operating System - Untangle 9.4.2 (64-bit)

* Basically, Untangle is a router and Unified Threat Management System (UTM).

(C) Hardware Setup

Internet ---- Router ---- SmoothSec ---- Switch ---- Personal Computers

Router -- eth0 connect to Internet; eth1 connect to SmoothSec

SmoothSec -- eth0 connect to Router; eth1 connect to Switch (uplink or port 1); eth2 connect to Switch (any port at 2 to 4)

* You can use any router to replace Untangle.

(D) Installation of SmoothSec

Download SmoothSec 3.4 at here or here.

Make sure the SmoothSec box can surf the internet; otherwise, installation will be failed. Or, you may re-arrange the cables when necessary.

Updated : Since the scripts for 3.4 has been updated to 3.4.1, you should follow the below link to upgrade the script to 3.4.1.

Upgrade to scripts version 3.4.1

The scripts 3.4.1 will install Backports newest kernel instead of Unstable kernel for Suricata IPS mode with AF_PACKET.

After installed SmoothSec, type the following :

smoothsec.first.setup

Snort -

Select "ips-standard" and following the instruction to install. Please also refer to here for the configuration of the config file. Make sure "AF_ENGINE" is set to "snort". The rules are "et" by default.

After install, reboot your box.

Suricata -

Select "ips-standard" and following the instruction to install. Please also refer to here for the configuration of the config file. Make sure "AF_ENGINE" is set to "suricata". The rules are "et" by default.

A new Linux kernel 3.10.2 will be installed at the end.

After install, reboot your box.

(E) Configuration of IDS/IPS

You may need to disable or/and drop some rules (sid).

Snort -

You may need to configure the /etc/snort/snort.conf :

nano /etc/snort/snort.conf

For example, the subnet is 192.168.1.0/24.

Replace "ipvar HOME_NET any" with "ipvar HOME_NET [192.168.1.0/24]"

Replace "ipvar EXTERNAL_NET any" with "ipvar EXTERNAL_NET ![192.168.1.0/24]"

Restart Snort :

/etc/init.d/snort restart

Disable rules :

nano /etc/pulledpork/snort/disablesid.conf

Drop rules :

nano /etc/pulledpork/snort/dropsid.conf

After doing that, reload the rules :

smoothsec.snort.rules.update

Suricata -

Disable rules :

nano /etc/pulledpork/suricata/disablesid.conf

Drop rules :

nano /etc/pulledpork/suricata/dropsid.conf

After doing that, reload the rules :

smoothsec.suricata.rules.update

* If the rule is too long to disable or drop, you may consider to edit "modifysid.conf". For example, to disable and drop the following rule :

To disable the rule :

2013437 "alert" "##alert";

To drop the rule :

2013437 "alert" "drop";

(F) Configuration of Snorby

For example, the sensor IP address is 192.168.1.180.

Point your browser to https://192.168.1.180. Enter the username and password of Snorby.

Setup the Snorby according to SmoothSec WiKi.

* If you want to sent your Snorby reports by Postfix, you need to install yourself and configure it then.

sudo apt-get install postfix

Select "Internet Site" when asked.

(G) IDS/IPS Tuning

There may be some false positive records. You need to tune the setting by adding the sid to the disablesid.conf or dropsid.conf when necessary. When use with dropsid.conf, yon may need to set firewall at Router to make the job done.

(H) Remarks

In the captioned setting, the SmoothSec acts as IDS and IPS in one box.

If you want to install IDS only, your SmoothSec only requires one Network Card which is connected to Switch.

In addition, SmoothSec 3.4 comes with Distributed IDS/IPS which allows you to deploy multi-sensors with one control panel (Snorby).

Furthermore, you can also reset your box to the fresh install environment :

smoothsec.reset

When using Snorby, you may need to browse for the rules sid. This link is for the rules lookup.

Make sure you create an empty file namely restart.txt under /var/www/snorby/tmp :

touch /var/www/snorby/tmp/restart.txt

That's all! See you.

HOWTO : GoDaddy.com and Google Apps (Email) with your Domain

You can use GMail web mail service with your domain name, such as yourname@yourdomain.com on www.gmail.com.

Follow this link to set up Postfix to use GMail as your SMTP server.

Step 0 :

Apply of free Google Apps (Free) Email :

Google Apps (Free) Email

Step 1 :

Create the MX record at your domain automatically.

Create the MX record at your domain manually.

The MX record are :
ASPMX.L.GOOGLE.COM
ALT1.ASPMX.L.GOOGLE.COM
ALT2.ASPMX.L.GOOGLE.COM
ASPMX2.GOOGLEMAIL.COM
ASPMX3.GOOGLEMAIL.COM

Step 1a :

Create a SPF record

Step 2 :

You will receive a email from Google and ask you to create a adminstrator account with your domain name. Your domain name needs to be authorized to use Google Apps. You should follow the instructions to complete the process.

After that, you can you GMail as your domain's email.

Step 3 (Optional) :

If you are using Untangle as gateway and IPS, you should do the following :

Open a browser and point to Untangle web page as well as login.

Config/Networking/Hostname

Change the following settings :

From -
Hostname : untangle.mydomain.com

To -
Hostname : untangle.mydomain.local

Step 3a (Optional) :

Config/Email/Outging Email Server (SMTP)

Change the following settings :

Send Email using the specified SMTP Server
- Server Address or Hostname : <postifx server IP address>
- Server Port : 25

Known issue

Cannot send to yourself with your domain, e.g. yourname@yourdomain.com via Untangle.

That's all! See you.

HOWTO : Virtualization platform by Proxmox VE

Proxmox Virtual Environment (Proxmox VE) works with virtualization featured CPU (such as Intel VT and AMD-V CPU) and non-virtualization featured CPU. Virtualization featured CPU is working on full virtualization by KVM technology. Non-virtualization featured CPU is working on container virtualization by OpenVZ.

This tutorial is mainly on setting up the Proxmox VE with Virtualization featured CPU only.

Proxmox VE does not work on fake RAID or software RAID (RAID on motherboard may consider as fake or software RAID). Make sure you are using Hardware RAID when necessary.

Why virtualization?
The answer is here.

Remarks : Proxmox VE is working fine on Intel Xeon E5420 Quad Core X 2, 16GB ECC DDR2 RAM and 1TB X 6 Hard Drive on Adaptec RAID 6 with 2 Hot Spare (1.8TB for usage).



Step 1 :

Download the latest Proxmox VE at here. The current version is 1.6-5261-4 (with 2.6.32-4 kernel) at the time of this writing. The ISO image is 64-bit version. The ISO image has a hard drive space limitation to 2TB.

If you want to have larger than 2TB hard drive size, you should follow the procedure at here.

Step 2 :

You should have 3 network interfaces at least where eth0 (vmbr0) is for the Proxmox VE, eth1 (vmbr1) is for connecting to the internet and eth2 (vmbr2) is for the virtual machines. Where the vmbrX is the virtual network interface for the virtual machines that binded to the physical network interfaces.

Step 3 :

Install Proxmox VE and follow the instructions on the screen (a mouse is required). For example, the IP address is 192.68.100.2 and the hostname is proxmox.samiux.com. The primary DNS and gateway are 192.168.100.1.

Step 4 :

After the installation, the system will be rebooted. If you do not have a router connected to the Proxmox box, connect the Proxmox VE to a laptop which is set to the IP address 192.168.100.5 manually. You may require a switch to do so. (I used to install software based router/UTM, so this procedure is necessary, please see Step 9 for details).

On the browser, type http://192.168.100.2 and then you are directed to the Proxmox VE control panel. Username is "root" and password is the password that you created during the installation.

Step 5 :

Go to "Configuration" -- "System". Bind the phyiscal network interfaces to virtual interfaces. vmbr0 is binded to eth0 (IP : 192.168.100.2, subnet mask : 255.255.255.0, Gateway : 192.168.100.1). vmbr1 is binded to eth1 and vmbr2 is binded to eth2. You are required to reboot your system after the network interfaces binding.

Step 6 :

Go to "VM Manger" -- "ISO Images". Upload the Ubuntu 10.10 Server ISO file (for example) to the Proxmox. Assumed that we are using KVM for the virtualization.

Step 7 :

Go to "VM Manager" -- "Virtual Machines". Create a virtual machine by selecting "Create" tab.

Type : Fully virtualized (KVM)
Disk space (GB) : enter your desired size, e.g. 80
Name : any name, e.g. Ubuntu_server
Memory (MB) : at least 512MB

Start at boot : enabled
Disk type : IDE or SCSI (I perfer to SCSI)
Guest type : Linux 2.6
CPU Sockets : 1 (sockets but not cores)

Bridge : vmbr2
Network Card : e1000

Then, press "Create" button.

Step 8 :

The "VMD 101" is created. Select it and you will direct to the details of "KVM 101". Change the value of CPU Sockets and Cores/Socket when necessary.

Go to "Hardware" tab and add the Ubuntu server ISO image to the "CD-ROM drives".

Press "Start" button. Then click on the red coloured "Open VNC console". Java is required for this operation.

Then, install the Ubuntu 10.10 server accordingly.

Step 9 (Optional) :

You can also create a software based router and/or Unified Threat Management (UTM), such as Untangle. You need to blind vmbr1 to eth0 (internet connection) and vmbr2 to eth1 (for connecting to other virtual machines). Where eth0 and eth1 are the interface name of Untangle.

If you are going to install Untangle inside Proxmox VE, you should install Untangle first and then the Ubuntu server and etc.

Step 10 :

Go the the Proxmox box. Login and execute the following commands in order to update the Proxmox as well as the kernel. The most updated kernel is 2.6.35-1 at the time of this writing.

aptitude update
aptitude upgrade
aptitude install proxmox-ve-2.6.35

cd /boot
rm *-2.6.32-4*
update-grub

After that, reboot the Proxmox box.

That's all! See you.

HOWTO : Untangle 7.1 on Intel Desktop Board D510MO

*** UPDATED ON NOVEMBER 20, 2010 : This tutorial is also work for Untangle 8.0 on Intel Desktop Board D510MO. The Realtek wireless card driver is updated to r8168-8.020.00. ***

Intel Desktop Board D510MO equipped with Intel Atom D510 processor and Realtek 8168B PCI-e onboard LAN. It is launched in the first quarter of 2010. The board will be available on Jan 4, 2010 in Hong Kong.

** This tutorial is prepared by me on Jan 2, 2010. Now, I share it here as there are some users do not know how to install Untangle 7.1 on this good motherboard. **

The kernel of Untangle 7.1 does not work on the captioned LAN card on the motherboard. We need to do something to make it work. However, Ubuntu 9.10 do recognized the onboard LAN card.

Step 1 :

Insert another new PCI LAN card to the motherboard. I recommended not to use Realtek chipset LAN card. I use D-Link Gigabit PCI Ethernet Card (DGE-530T) which is equipped with Marvell chipset and it is a low profile design.

The onboard Realtek LAN will be eth1 while the new inserted LAN card will be eth0.

Plug the CAT5e or CAT6 cable to the eth0 which then connect to the internet and the cable that connected to eth1 will be plugged into the gigabit switch.

Step 2 :

Install Untangle as usual. In the first stage of installation, the Untangle will recognize two network interfaces. However, the system reboot automatically and go to stage 2. Make sure to select "Video Safe Mode" to boot to the next stage of installation. Otherwise, you may encounter the display problem - no screen at all. You can press "CTRL+ALT+Plus" one or two times or may be three times to make the display work. However, the resolution is not correct at all.

Then, the Untanlge only see one network interface which is the eth0 - the PCI LAN card. Go ahead to install.

Step 3 :

After the installation, you will go to the web interface. Exit it and go to the "Terminal" at the dock. Type your desired password (you set it this time) twice. Then, you will ask for password again. Key in and a terminal will be displayed.

nano /etc/apt/sources.list

Copy and paste the following lines to the source.list file.

deb http://ftp.debian.org/debian/ lenny main contrib non-free
deb-src http://ftp.debian.org/debian/ lenny main contrib non-free

Save it.

Step 4 :

apt-get update
apt-get install gcc make
apt-get install linux-headers-`uname -r`

ln -s /usr/src/linux-headers-`uname -r` /usr/src/linux

Step 5 :

The current version of Realtek 8168B driver at the time of writing is 8.015.00 which is released on November 27, 2009.

Download the Realtek 8168B driver from the Realtek official site at Realtek Official Site.

Or, download as the following :

wget http://samiux.volospin.com/r8168-8.015.00.tar.bz2

tar -xvjf r8168-8.015.00.tar.bz2
cd r8168-8.015.00

rmmod r8169

sh autorun.sh

lsmod | grep r8168

If it is not exist, do the following :

depmod -a
modprobe r8168

Step 6 :

echo "\nblacklist r8169\n" >> /etc/modprobe.d/blacklist

mv /lib/modules/`uname -r`/kernel/drivers/net/r8169.ko /lib/modules/`uname -r`/kernel/drivers/net/r8169.ko.bak

* The above is two lines of command.

Step 7 :

mv /boot/initrd.img-`uname -r` /boot/initrd.img-`uname -r`.bak

mkinitramfs -o /boot/initrd.img-`uname -r` `uname -r`

* The above is two lines of command.

Step 8 :

Uncomment the two entries that added to the file /etc/apt/sources.list previously with "#". Make sure you do this step; otherwise it will affect the Untangle when there is an update.

Reboot Untangle and then configure the box accordingly.

Reference

Intel D510MO motherboard
Untangle Official Site

Known issue

When the kernel of Untangle is updated, you need to recompile and reinstall the Realtek driver.

That's all! See you.