> For the complete documentation index, see [llms.txt](https://paul-gleason.gitbook.io/sec-350-enterprise-and-network-security-controls-1/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://paul-gleason.gitbook.io/sec-350-enterprise-and-network-security-controls-1/labs/lab-1.1-routing-and-dmz-vyos-log.md).

# Lab 1.1: Routing and DMZ (VYOS/LOG)

### Summary

During this lab we started to configure fw01, log01, rw01, web01.

### VYOS

#### Version Control:

To change VYOS rules and save:

```bash
configure
<Enter Commands>
commit
save
```

#### hostname:

```bash
set system host-name <HOSTNAME>
```

#### interfaces:

Description:

```bash
set interfaces ethernet <ADAPTER> description <DESCRIPTION>
```

Set IP:

```bash
set interfaces ethernet <ADAPTER> address <IP ADDRESS>/<SUBNET>
```

#### gateway/route:

Command below will route all traffic to the gateway ip:

```bash
set protocols static route 0.0.0.0/0 next-hop <GATEWAY>
```

#### dns:

```bash
set system name-server <NAME SERVER IP>
```

#### nat:

```bash
set nat source rule 10 description <DESCRIPTION>
set nat source rule 10 outbound-interface <ADAPTER>
set nat source rule 10 source address <IP OR NETWORK>/<SUBNET>
set nat source rule 10 translation address masquerade
```

#### dns forwarding:

Below allows listening address to reslove requests from the allowed IP or Network

```bash
set service dns forwarding listen-address <LISTENING IP>
set service dns forwarding allow-from <IP OR NETWORK>/<SUBNET>
set service dns forwarding system
```

### SYSLOG

#### Server

* Install syslog

```bash
sudo yum install rsyslog
```

* Allow 514 tcp and udp. Example below if for firewalld systems

```bash
firewall-cmd --permanent --zone=public --add-port=514/tcp
firewall-cmd --permanent --zone=public --add-port=514/udp
firewall-cmd --reload
```

* Now configure the rsyslog.conf

```bash
sudo vi /etc/rsyslog.conf
```

<figure><img src="https://lh5.googleusercontent.com/s6ICvCO-nxB85VFHpCj5owNr-gDNwWpJuHQO4mRewTlhjSMZhkfBzd0MpyPT9RVO6BB_I2sdCYxvj_BpYLfUWg_y1k4J5zNLHYAs3CByxKqSkjSoJYJRMuSXRlqF9M1Yd_I1yf_98yB7ZuXx0lDudJWh1nrut0UEBk6GQUTcQ-Xi67Cu7erWuulo3fywuw" alt=""><figcaption><p>/etc/rsyslog.conf</p></figcaption></figure>

* Restart and enable rsyslog.service

```bash
sudo systemctl restart rsyslog.service
sudo systemctl enable rsyslog.service
```

* Once you setup the client you will be able to see the client test with:

```bash
sudo tail -f /var/log/messages
```

#### Client

* Install syslog

```bash
sudo yum install rsyslog
```

* Allow 514 tcp and udp. Example below if for firewalld systems

```bash
firewall-cmd --permanent --zone=public --add-port=514/tcp
firewall-cmd --permanent --zone=public --add-port=514/udp
firewall-cmd --reload
```

* Make/edit the file `/etc/rsyslog.d/sec350.conf`

```bash
sudo vi /etc/rsyslog.d/sec350.conf
```

* Add the line

```bash
user.notice @<IP OF LOG Machine>
```

* To test the logger:

```bash
logger -t test TESTTOLOG
```

* Now do step 5 of server and it should show a message like this:

<figure><img src="/files/B2vhz9NbhChgoERmcDIk" alt=""><figcaption></figcaption></figure>

### Notes

#### VYOS Config after this lab:

```bash
set interfaces ethernet eth0 address '10.0.17.127/24'
set interfaces ethernet eth0 description 'SEC350-WAN'
set interfaces ethernet eth1 address '172.16.50.2/29'
set interfaces ethernet eth1 description 'PAUL-DMZ'
set interfaces ethernet eth2 address '172.16.150.2/24'
set interfaces ethernet eth2 description 'PAUL-LAN'
set nat source rule 10 description 'NAT FROM DMZ to WAN'
set nat source rule 10 outbound-interface 'eth0'
set nat source rule 10 source address '172.16.50.0/29'
set nat source rule 10 translation address 'masquerade'
set protocols static route 0.0.0.0/0 next-hop 10.0.17.2
set service dns forwarding allow-from '172.16.50.0/29'
set service dns forwarding listen-address '172.16.50.2'
set service dns forwarding system
set service ssh listen-address '0.0.0.0'
set system host-name 'fw1-paul'
set system name-server '10.0.17.2'
```

#### VYOS Change User passwd:

<https://support.vyos.io/en/kb/articles/set-change-the-password-of-a-user>

```bash
set system login user vyos authentication plaintext-password
```