**Course Title:** Security Best Practices in Software Development **Section Title:** Network Security Fundamentals **Topic:** Configure basic firewall rules for a simulated environment. **Objective:** By the end of this lab, you will be able to configure basic firewall rules for a simulated environment, ensuring that your network is protected from unauthorized access and malicious activities. **Introduction:** Firewalls are a crucial component of network security, controlling incoming and outgoing network traffic based on predetermined security rules. In this lab, you will learn how to configure basic firewall rules for a simulated environment, using a virtual machine or a cloud-based platform. **Materials Needed:** * A virtual machine or a cloud-based platform (e.g., AWS, Azure, Google Cloud) * A firewall appliance (e.g., Cisco ASA, pfSense, Ubuntu UFW) * A text editor or firewall configuration tool **Step-by-Step Instructions:** 1. **Set up your simulated environment:** Create a virtual machine or launch a cloud-based instance with a firewall appliance installed. For this lab, we will use a simple scenario with two subnets: a public subnet for web servers and a private subnet for database servers. 2. **Configure your firewall appliance:** Set up your firewall appliance with a management interface (e.g., HTTP, HTTPS, or SSH) and configure the network interfaces for your subnets. * For a Cisco ASA: Use the ASDM interface to configure the appliance. * For a pfSense appliance: Use the web-based GUI to configure the firewall rules. * For Ubuntu UFW: Use the command-line tool `ufw` to configure the firewall rules. 3. **Create basic firewall rules:** * Block all incoming traffic on the public subnet, except for HTTP (TCP/80) and HTTPS (TCP/443) traffic to your web servers. * Block all incoming traffic on the private subnet, except for database connections (e.g., TCP/5432 for PostgreSQL or TCP/3306 for MySQL) from the public subnet. * Block all outgoing traffic on both subnets, except for essential services (e.g., DNS, NTP). **Example Firewall Rules:** * For a Cisco ASA: ```cisco access-list public_acl extended deny ip any any access-list public_acl extended permit tcp any any eq 80 access-list public_acl extended permit tcp any any eq 443 access-group public_acl in interface public_subnet access-list private_acl extended deny ip any any access-list private_acl extended permit tcp public_subnet any eq 5432 access-list private_acl extended permit tcp public_subnet any eq 3306 access-group private_acl in interface private_subnet ``` * For a pfSense appliance: ```xml <rules> <rule> <source> <any /> </source> <destination> <any /> </destination> <protocol> <tcp /> </protocol> <destination> <port start="80" /> <port end="80" /> </destination> <action> <pass /> </action> </rule> <rule> <source> <any /> </source> <destination> <any /> </destination> <protocol> <tcp /> </protocol> <destination> <port start="443" /> <port end="443" /> </destination> <action> <pass /> </action> </rule> <rule> <source> <any /> </source> <destination> <any /> </destination> <protocol> <tcp /> </protocol> <destination> <port start="5432" /> <port end="5432" /> </destination> <action> <pass /> </action> </rule> </rules> ``` * For Ubuntu UFW: ```bash ufw default deny incoming ufw allow 80/tcp ufw allow 443/tcp ufw allow in on public_subnet to any port 80 ufw allow in on public_subnet to any port 443 ufw allow in on private_subnet to any port 5432 ufw allow in on private_subnet to any port 3306 ``` **Tips and Variations:** * Use more restrictive firewall rules to limit incoming and outgoing traffic. * Implement a DMZ (demilitarized zone) to separate public-facing services from your internal network. * Use a separate firewall appliance for each subnet. * Use a VPN (virtual private network) to encrypt traffic between subnets. **Conclusion:** In this lab, you have configured basic firewall rules for a simulated environment, protecting your network from unauthorized access and malicious activities. Remember to regularly review and update your firewall rules to ensure the security and integrity of your network. **Additional Resources:** * Cisco ASA documentation: <https://www.cisco.com/c/en/us/support/security/asa-firewall-series/products-installation-and-configuration-guides.html> * pfSense documentation: <https://docs.pfsense.org/> * Ubuntu UFW documentation: <https://help.ubuntu.com/community/UFW> **Leave a comment or ask for help:** If you have any questions or need further clarification on any of the steps, please leave a comment below. **Next topic:** Integrating security into the SDLC, from Security in the Software Development Lifecycle (SDLC).