网络课程笔记

00:00 Hello, and welcome to this lecture.

00:01 Now that you understood how AWS network firewall works,

00:05 let's try to implement this on our own.

00:08 And you know that network firewall works differently

00:11 and you have to modify route tables for your subnet

00:16 as well as for internet gateway

00:18 and all these we'll see in this lab.

00:20 So what is the objective of this lab?

00:23 We want to host a web server on EC2 instance,

00:28 that's the basic requirement.

00:29 And then using the network firewall,

00:31 we want to implement few rules.

00:33 For example, we want to add stateless rule block

00:36 to block the ICMP

00:38 that is a ping requests to our web server, right.

00:41 And then we also want to add the stateful rules

00:45 so that from my web server

00:47 I can only go to a certain domain name

00:49 for example, aws.amazon.com, that's my outbound request,

00:54 and that's to only using the TLS connection.

00:58 So I shouldn't be able to use

01:00 a plain HTTP outbound connection to this domain name

01:04 and then all other traffic should be blocked, of course.

01:08 Now this scenario is based on the AWS block, which is here.

01:13 I just slightly modified this requirement here

01:17 and accordingly I also modified my rules.

01:20 So I'll talk about that as we proceed with the labs.

01:23 So this is high-level requirement.

01:25 And now if you look at the architecture

01:27 that we want to build to achieve this,

01:29 it should look something like this, right.

01:31 You should have a VPC, in that VPC you would have to subnets

01:36 in one subnet, which is here, it's a public subnet

01:40 in which you would have public web server.

01:43 And then there will be a firewall subnet

01:45 in which you will provision

01:46 the AWS network firewall endpoint.

01:49 And there will also be internet gateway, of course.

01:52 Now,

01:53 if you look at the route tables for this three components,

01:55 of course, for the public subnet,

01:58 all the outbound internet traffic

02:00 will go through the firewall endpoint.

02:02 Now, in case of firewall endpoint,

02:05 all the traffic will go through the internet gateway

02:08 and for the internet gateway ingress traffic

02:11 for the web server, the traffic should also be routed

02:14 through the firewall endpoint.

02:15 And this is an ingress traffic

02:17 because your internet gateway will do the knotting.

02:20 It will map the public IP of FIPs over to the private IP

02:24 and this private IP is from this subnet

02:26 and that's where you see this entry.

02:28 So at high level,

02:29 these are the route tables that you need to configure

02:31 for your network firewall

02:34 to be able to intercept that traffic.

02:37 So I hope that it's clear

02:39 and now let's understand which rules you want to add here

02:42 in case of stateless and stateful rules.

02:45 So for stateless,

02:47 I will add one rule which will drop the ICMP traffic,

02:50 and then rest of the traffic,

02:53 I want to route through the stateful rule groups, right.

02:56 Because then I want to take decision

02:58 in the stateful rule groups

02:59 where I want to allow the TCP traffic or not.

03:02 And here in case of stateless rules,

03:05 I will attach the priority as 10 and 20

03:08 so that the first rule that is a drop traffic

03:11 will be evaluated first.

03:13 Now, in case of stateful rules, I have added four rules.

03:17 The very first rule is for allowing the SSH,

03:21 that is because from this web server,

03:22 we want to test the outbound connectivity

03:25 so I also want to SSH to this machine.

03:29 Second, I'm only allowing the HTTP traffic,

03:32 that means I have a web server

03:33 so I should be able to reach to web server over port 80,

03:37 that is an HTTP traffic,

03:38 and I should only be able to access my web server

03:42 using the AWS provided DNS name.

03:45 And that's where you see that,

03:47 you know, the DNS name ends in dot amazonaws.com.

03:51 That means I cannot access my web server

03:55 using the public IP of the web server

03:57 but only through the DNS name.

04:00 Third, I will add this entry

04:03 which allows the outbound request from this web server

04:07 to only the domain name that is aws.amazon.com.

04:11 And additionally, the traffic will only be the TLS traffic.

04:15 That means I cannot use plain HTTP traffic or a TCP traffic

04:19 to reach to this aws.amazon.com domain name.

04:23 And finally,

04:24 I have the rule which is drop all other TCP traffic

04:29 so that there is no other traffic

04:32 that can flow in and out of my web server.

04:34 Now you'll be wondering if that is the case

04:37 then how you are allowing the, you know,

04:40 this HTTPS traffic to the aws.amazon.com.

04:45 Because when the PCP handshake happens at that moment,

04:49 the traffic is not DLS, right, it starts with TCP.

04:53 Now, in that case, this drop rule should be applied

04:56 and your traffic will be stopped.

04:58 But for handling this use case,

05:02 we have added this flow.established as a parameter,

05:06 which allows the traffic to be dropped

05:09 only when it is not an established traffic,

05:13 that means for this TLS

05:15 the TCP handshake has already happened

05:18 and that's where it won't use this route

05:21 to drop that traffic.

05:22 But any other traffic, which does not meet this requirement

05:26 will be dropped by this fourth rule.

05:29 So overall, these are our requirements for firewall rules.

05:34 Now, if I want to set this up,

05:36 I need a basic setup to start with, right.

05:39 That means I will need a VPC,

05:41 I will need EC2 machines and all.

05:43 Now, if you follow AWS blogs,

05:45 everything can be set up using a cloud formation template,

05:48 but here I have done that manually.

05:50 So if you want to start, this is very simple.

05:53 There is no AWS firewall, right,

05:56 I'm just creating two subnets and one subnet would be public

05:59 in which I launch a web server

06:01 and then there will be a route table

06:04 where the traffic goes to the internet gateway.

06:06 So there is nothing fancy here, right,

06:08 it's all, you know how to create this setup.

06:11 Just remember one more thing that enabled the DNS hostname

06:15 and DNS resolution on your VPC,

06:17 because otherwise AWS won't locate the public DNS name

06:22 for your EC2 instance.

06:23 So in order to handle that,

06:25 please enable these two settings

06:27 because in our firewall rules, as you have seen,

06:30 we are allowing HTTP traffic only for the web server

06:34 where the DNS name ends in amazonaws.com.

06:39 Okay, so for simplicity,

06:40 what I've done is I already created this VPC

06:45 and this subnets and internet gateway

06:48 and I'll start from there.

06:49 Now, once I have that set up,

06:51 I will just SSH into this web server

06:53 because there is no web server, as of now,

06:55 it's just an EC2 instance,

06:57 and I will install the HTTPD web server there

07:00 and we'll start the HTTPD service.

07:03 Now by launching EC2 machine,

07:04 I also need to provide the security group,

07:06 but I will just allow everything in the security group

07:09 so that I know that traffic is not really getting blocked

07:11 at the security group level

07:13 and I'm not touching the network ACL as well.

07:16 Now then verify that you are able to access the web server

07:20 or a browser using the EC2 instance IP

07:23 and our public DNS.

07:25 Then also verify that you are able to ping to EC2 instance

07:28 using the public IP or the public DNS.

07:31 Now, this is a simple setup

07:33 where there is no network firewall.

07:36 Then we will create the network firewall

07:38 in its designated subnet.

07:40 And then we will also add

07:42 corresponding stateful rule groups

07:44 as well as stateless rule groups.

07:47 Finally, once the firewall has been added,

07:50 we need to modify the route tables, right.

07:52 As I said to you, a route table has to, you know,

07:56 take all this traffic through the firewall

07:58 whether, you know, going to the internet

08:01 or coming from the internet.

08:04 And finally, once that is done,

08:06 we will test the ping to the web server from local machine,

08:10 it shouldn't work.

08:12 And then we'll SSH to the web server,

08:14 which should be successful

08:15 because we have added that in our stateful rule.

08:19 And from there, we will try to get some data

08:21 from say, aws.amazon.com or HTTPS, which we should succeed,

08:27 but any other domain names shouldn't work, right.

08:32 That would be our final test.

08:34 So if this works, that means our firewalls are working well.

08:37 Now, as I said, for route tables

08:40 you need to have the route table,

08:42 something like this for your public subnet

08:45 where your web server site,

08:46 you will have the route table entry.

08:48 You'll say is all the internet traffic

08:51 will go through the firewall endpoint,

08:53 for firewall subnet, all the traffic will be routed

08:57 through the internet gateway

08:59 and for internet gateway,

09:01 any traffic that is going to your protected subnet here,

09:06 it will go through the firewall endpoint.

09:09 Now,

09:10 as of now we haven't seen the route table for the internet.

09:13 Now this is an ingress route table for the internet.

09:16 And how you do that

09:17 is you have to first go to the route table,

09:20 you have to create the route table,

09:22 and then when you associate the route table,

09:24 there is an additional entry there which is age association,

09:28 and at that moment, you can sell it internet gateway there

09:32 and then that route table

09:33 is associated with the internet gateway.

09:35 Otherwise, if you go to the AWS console

09:38 and go to internet gateway,

09:39 you don't see an option to add a route table

09:42 to the internet gateway, right, so just remember that.

09:46 So with that, let's get started

09:49 and now I'll just jump to my console.

09:52 Okay then,

09:53 you can see that I already created this demo VPC

09:56 with DCIDR 10.0.0/16.

09:58 And in this, I created two subnets,

10:00 one subnet for the firewall and one subnet for the web.

10:04 And this CIDRs are 10.0.100.0 and 10.0.0.0.

10:09 Now, for the subnet for the web server

10:13 I just modified the route table

10:14 to add entry for internet gateway and this is very simple,

10:18 I'm not adding the firewall as of now, as I told you, right.

10:22 So it's a public subnet,

10:23 and I haven't touched this firewall sub-net as of now.

10:27 And then if you see the route tables,

10:29 I have two route tables, one for the web server

10:32 and I have the route to internet gateway

10:35 and then I also attached to the corresponding subnet.

10:38 Now for the firewall, also I created a route table

10:43 and I just also need to attach it

10:45 to the firewall subnet here.

10:48 So I'm just doing that.

10:50 Now, I'm not really launching anything

10:52 in the firewall subnet as of now,

10:53 so it doesn't really matter,

10:55 but the setup is really very simple.

10:58 Then what I additionally did is I launched a web server

11:02 inside my VPC in the web server subnet

11:05 and I associated the public IP as well.

11:08 And on the VPC level, I also have the enable DNS resolution

11:14 and the hostname setting steps

11:16 where it also got this public DNS.

11:18 Now, what I did is I just connected to this instance

11:22 or an SSH and now I'll just install the web server.

11:26 So let's do that

11:32 and then also let's start the web server.

11:36 (keyboard clacking)

11:39 And finally, let's just create one dummy file

11:47 so that we can access this web server

11:49 and some web pages displayed.

11:52 This is my web server,

11:59 that's it.

12:00 And now if I access this web server or an IP address,

12:04 it should work.

12:10 Right, it works.

12:11 And similarly, if I get it public DNS name,

12:17 it should also work.

12:19 So using this DNS name I can also access my web server.

12:24 Okay, so that's the test that we did.

12:27 Now, our setup is ready with the starting point

12:31 and now let's get into the, you know,

12:34 mood where we want to set up everything else, right.

12:37 So we want to create now firewalls

12:39 and corresponding group tables and everything.

12:41 So let's do that now.

12:43 So I'm going back to my console and AWS network firewall

12:48 is part of the VPC console, so let's go there.

12:52 There's already one firewall, I'm not going to use that,

12:55 so let's create a new firewall

12:58 and let's give it a demo as the name

13:01 and VPC, we want to choose the one that we created,

13:06 which is demo one, the easy, I want to just have one easy

13:10 and the subnet we have 10.0.100.0, this one.

13:15 Okay, and we want to create a firewall policy

13:20 which is empty.

13:21 To start with, let's give it a name demo firewall policy

13:27 and also just let's change the name to demo firewall here,

13:34 that's it and let's create the firewall.

13:37 So it will take a couple of minutes

13:39 for this firewall to be ready,

13:42 by the time I'm just pausing this video.

13:45 Okay, you can see that the firewall status is ready

13:48 and now let's go to the network firewall rule groups.

13:52 And there're older rule groups, I'm not going to use those.

14:01 Let's create the stateless rule group,

14:04 and let's call it demo stateless.

14:08 And you have to mention some capacity,

14:10 how many rules you want, so let's keep it 100.

14:15 So you can add a priority, as you know,

14:17 the lowest the priority

14:18 the rule will be evaluated in that order.

14:20 So, first we want to have the rule with ICMP

14:25 and here let's give the priority as 10

14:30 so that we can insert a rules later as well.

14:33 And the source is anything and the destination is anything.

14:37 And I want to drop all this traffic, right.

14:40 So I'm just adding this rule

14:42 and then I'll add another rule, which say priority 20

14:46 and all protocols for any IP address,

14:51 I want to just forward this traffic

14:54 to my stateful rule groups, and let me just add that.

15:00 So just this two rules for the stateless rule group

15:03 and we are just creating that now.

15:06 And now also let's create the stateful rule groups,

15:10 and in that case, let's select the stateful,

15:14 let's call it demo stateful, define the capacity as 100.

15:20 Now, in this case, we are not using the 5-tuple format,

15:24 we are not using the domain list,

15:26 but we are using the Suricata compatible IPS rules.

15:31 And you can grab this from the downloadable content

15:35 or you can also just type it here.

15:39 So let me get this rules from my presentation.

15:43 So I have this four rules here

15:47 I'm just copying those and I'll just put it here.

15:52 Okay, you can see that first rule is about allowing the SSH.

15:57 Second is for allowing the HTTP traffic

15:59 so that I can access my web server or the browser.

16:03 And third rule is for connecting to aws.amazon.com

16:07 from my web server.

16:09 And fourth is to drop anything else,

16:12 which is our TCP traffic.

16:14 So let's create this and now I have this two rule groups,

16:18 but understand that as of now,

16:20 we haven't added these rule groups to our firewall policy.

16:24 So let's go to the firewall policy

16:26 and let's add this two rule groups.

16:29 So the first one is the stateless, so let's select that.

16:36 And similarly, let's also add this stateful rule group here.

16:42 So I'm just adding the demo stateful rule group here.

16:47 Okay, so on the firewall side, we are good,

16:50 everything is set up and now what's remaining, if you know,

16:54 is our route tables, right,

16:56 we need to modify all these three root table

16:59 so that traffic can flow through this firewall endpoint.

17:03 So first let's modify the route table for a public subnet.

17:08 Now, in this case, all the traffic to internet

17:14 should go through the firewall endpoint.

17:16 Now, for that, we need to first get the firewall endpoint.

17:20 So if you go to the firewall and go to it's details,

17:24 you will find the firewall endpoint there,

17:27 and we will need this firewall endpoint for our route table

17:31 so I'm just copying this firewall endpoint.

17:34 Right, now let's go to the route tables

17:38 and the web route table, routes

17:42 and I'm just now modifying this.

17:44 Now this is a public subnet when we created earlier,

17:48 but here instead of internet gateway,

17:50 I want to use my firewall endpoint

17:53 and just save the changes, so that is done.

17:57 Now for the firewall route table,

18:01 I want to have all the traffic

18:06 going through the internet gateway, right.

18:09 So let's do that and save the changes.

18:15 If you're confused, just look at this architecture

18:18 and you should be able to understand what I'm doing.

18:21 Now, the third thing which is new to you

18:24 is having the route table for the internet gateway.

18:28 Now, in order to do that,

18:29 let's create a new route table first.

18:32 So let's go to the route table and create a route table,

18:35 say demo igw route table in the VPC,

18:42 and just create that route table

18:46 and then as in routes, we will again add,

18:50 if the traffic is going to the web server subnet,

18:52 which is $10.0.0.0/24,

18:56 again it has to take the route through the firewall endpoint

19:01 and save the changes.

19:02 But as of now, this route table

19:04 is not associated with the internet gateway.

19:07 In order to do that, as I said,

19:09 you need to go to the age association

19:13 and then you need to attach this to the internet gateway.

19:18 So remember, this is important step, right,

19:20 and save the changes.

19:22 Okay, so I think we are done with the architecture

19:25 that we want to try.

19:27 Now, let's verify what's happening here, right.

19:31 First of all,

19:32 let's verify if we are able to access the web server

19:34 using the IP address.

19:36 If you just refresh, this is not working.

19:40 Now, this is because in the stateful rules,

19:43 we said that only HTTP traffic for the domain name

19:47 which ends in amazonaws.com should be allowed.

19:51 Now, if I refresh this page, ideally it should work,

19:54 I can also test this like this and this is working, right,

19:59 that means our stateful rule groups are working.

20:02 Also let's verify if ping is working or not.

20:05 We had blocked all the ping requests

20:07 so let's go to the command prompt

20:09 and let's say ping to the IP address and it is not working.

20:19 Also, let's ping to this public DNS

20:27 and you can see this is also not working

20:30 because in a stateless rule group

20:32 we have defined that block the ping request.

20:35 Now, one more thing we want to try

20:37 is we want to log into this website or our SSH

20:40 and then we want to see if we can reach to, you know,

20:44 aws.amazon.com or our TLS connection.

20:47 So let's go to this session,

20:51 I'm just going to duplicate this

20:55 and you can see I'm able to log into the web server or SSH

20:59 that's because I have allowed that

21:02 in our stateful rule groups.

21:04 Okay, so I'm here, now let's try to do something like this

21:08 curl, first let's try, http://aws.amazon.com.

21:16 Now, even though it's an aws.amazon.com DNS

21:19 that we have white listed in those stateful rule groups

21:22 this one work,

21:23 because we said the condition has to be the TLS.

21:26 That means it should be an HTTPS connection.

21:29 And if I do that, I get the page of aws.amazon.com.

21:34 And at the same time, if I do something different,

21:37 maybe let's try to do https://google.com.

21:41 So it won't work

21:43 because we are white listing only the domain name

21:46 that we are interested in.

21:47 So this is what we wanted to achieve

21:49 and I think this is working perfectly as we expected.

21:53 And that's it about the Network Firewalls.

21:56 So I hope you enjoyed this lecture

21:58 and you understood how these things work.

22:01 Now, make sure that when you do this exercise,

22:03 you delete all your resources

22:05 because everything is charged, right.

22:07 There is an EC2 instance, there's a network firewall

22:09 everything has a price.

22:10 So make sure you delete all those resources.

22:13 So thanks for watching

22:14 and stay tuned for more exciting stuff.

22:17 Thank you.