Cyber Security II. Netzplan

Übersicht

Logischer Netzplan

Anpassen der Maschinen

opnsense

• GW: 192.168.HS.254
• WANIP: 192.168.HS.200+TN
• CERT: wget https://web.samogo.de/certs/it200+TN.xinmen.de.tgz, einspielen und zuornden.

Ort	Typ	Wert
System:Gateways:Configuration:WANGW	Static IPv4	192.168.HS.254
System:Gateways:Configuration:DNSGW	Static IPv4	192.168.HS.88
Interfaces:WAN:IPv4 address	Static IPv4	192.168.HS.XX/24
Interfaces:DMZ:IPv4 address	Static IPv4	10.88.2XX.1/24
System:Settings:General:Domain	Domain	it2XX.xinmen.de
System:Settings:General:DNS servers	IPv4	192.168.HS.88
System:Routes:Configuration	Netz	10.88.0.0/16 über DNSGW
System:Trust:Certificates	Import	*.it2XX.xinmen.de
System:Settings:Administration:SSL Certificate	Auswahl	*.it2XX.xinmen.de
Firewall:Aliases:MAIL	Host(s)	10.88.2XX.10
Firewall:Aliases:WWW	Host(s)	10.88.2XX.20
Firewall:Aliases:WAF	Host(s)	10.88.2XX.30

ovs

• Port1 : untaged:1 taged:21,22,23
• Port2 : untaged:21 device:client
• Port12: untaged:22 device:sensor
• Port13: untaged:22 device:aktor
• Port14: untaged:22 device:mqtt
• Port16: untaged:22 device:win2022

• Port21: untaged:1 device:ids managment
• Port23: mirror:21,22,23 device:ids suricata

waf

• hostnamectl set-hostname waf.it213.xinmen.de
• get-cert.sh
• reboot

www

• hostnamectl set-hostname www.it213.xinmen.de
• get-cert.sh
• reboot

mail

• hostnamectl set-hostname mail.it213.xinmen.de
• get-cert.sh
• make-mail.sh
• reboot

HA Proxy

SOC