Notes: Extending Your Network | Pre Security | THM

Introduction to Port Forwarding

Port Forwarding

- important component connecting applications/services to the Internet

- without port forwarding applications/services only available within the network where it exists (Intranet)

- configured at the router of a network

Port Forwarding vs Firewall

- Port forwarding opens specific ports

- Firewalls determine if traffic can travel across ports

Firewalls 101

Firewall

- determine what traffic is allowed to enter/exit the network

- configured to permit or deny traffic based on factors like:

- where the traffic is coming from (accept/deny traffic from certain network)

- where the traffic is going to (accept/deny traffic for a specific network)

- what port is the traffic for (accept/deny traffic for certain ports)

- what protocol is the traffic using (accept/deny traffic using UDP, TCP, or both)

- firewalls perform packet inspection to determine if traffic is accepted or denied

- can be hardware or software (ex.: https://www.snort.org/)

Firewall Category (Firewall Type)

- can be categorised into 2 to 5 categories

- 2 primary is Stateful and Stateless

Stateful

- use entire info from connection to determine accept/deny

- consume many resources

- dynamic decision

- if connection from host is bad, it will block entire device

Stateless

- use static set of rules to determine if individual packets are acceptable or not

- use fewer resources

- dumb: rules need to match exactly to be effective

- great when receiving large amounts of traffic from a set of hosts (like DDoS attacks)

VPN Basics

Virtual Private Network (VPN)

- technology allow devices on separate networks to communicate securely - creating dedicated path (= a tunnel) between devices over the Internet (= form their own private network)

Benefits

- allow networks in different geographical locations to be connected (servers/infrastructure accessed from another office)

- privacy (VPN use encryption to protect data, data not vulnerable to sniffing)

- anonymity (ISP etc. view(track) traffic, level of anonymity depend on how other devices on network repsect privacy, ex.: a VPN that logs all data = not using VPN)

VPN Technology

PPP: used by Point-to-Point Tunneling Protocol (PPTP) to allow authentication and provide encryption of data. Using a private key and public certificate which must match to connect. PPP not capable of leaving a network on its own (non-routable)

PPTP (Point-to-Point Tunneling Protocol): allow data from PPP to travel and leave a network. PPTP is easy to set up, supported by most devices. But weakly encrypted.

IPSec (Internet Protocol Security): encrypt data using Internet Protocol (IP) framework. IPSec is difficult to set up, but strong encryption and it's supported on many devices

TryHackMe use VPN to connect to vulnerable machines - they are not directly accessible on the Internet

- securely interact with THM machines

- ISP etc. won't think you attack another machine on the Internet

LAN Networking Devices

Router

- connect networks

- passing data using routing (Routing = data travelling across networks, involves creating a path between networks. (useful when devices are connected by many paths <- choose most optimal path)

- Layer 3 (OSI Model)

- often feature interactive interface (website/console) to allow administrator to configure rules like port forwarding or firewalling

- dedicated devices

- do not perform the same functions as switches

Switch

- dedicated networking device

- providing a means of connecting to multiple devices

- can facilitate many devices (3-63) using Ethernet cables

- Layer 2 and Layer 3 (OSI Model)

Layer 2 switches

- can NOT operate at Layer 3

- forward frames (IP protocol has been stripped and are no longer packets) onto the connected devices using their MAC address

- responsible for sending frames to correct device

Layer 3 switches

- can perform some of the responsibilities of a router

- will send frames to devices

- route packets to other devices using IP protocol

Virtual Local Area Network (VLAN)

- allow specific devices within a network to be virtually split up

- provides security

- rules determine how certain devices communicate with each other