> ## Documentation Index > Fetch the complete documentation index at: https://journal.daudaldi.my.id/llms.txt > Use this file to discover all available pages before exploring further. # Network # Network Hardening Network hardening is about controlling what traffic flows in, out, and through your environment and making sure that when something malicious does get in, it can't move freely. A lot of breaches that look sophisticated in hindsight were actually enabled by basic network misconfigurations: flat networks with no segmentation, exposed management interfaces, cleartext protocols still running, firewall rules nobody's reviewed in years. This page covers the core principles and practical steps for hardening networks at both the perimeter and internally. ## Core Principles Before getting into specifics, these are the ideas everything else builds on: **Least privilege for network traffic** - traffic should only be allowed if there's an explicit business reason for it. "Allow all outbound" is not a default you want. **Defense in depth** - don't rely on a single control. Layer your defenses: perimeter firewall, internal segmentation, host-based firewall, IDS/IPS. **Visibility first** - you can't defend what you can't see. Logging and monitoring is part of network hardening, not an afterthought. **Assume breach** - design your network assuming an attacker will eventually get inside the perimeter. Segmentation and east-west traffic controls limit how far they can go. ## Network Segmentation A flat network where every device can talk to every other device is an attacker's dream. Segmentation limits lateral movement by controlling which systems can communicate with which. ### VLANs VLANs (Virtual Local Area Networks) are the standard way to segment at Layer 2: ``` Common VLAN structure: - VLAN 10: Management (network devices, servers) - VLAN 20: Servers / DMZ - VLAN 30: Workstations / End users - VLAN 40: Guest / Untrusted devices - VLAN 50: IoT / OT devices - VLAN 99: Native VLAN (untagged - change from default VLAN 1) ``` Key rules: * **Never use VLAN 1** as your native/default VLAN - it's the default on all switches and a known attack vector (VLAN hopping) * Inter-VLAN routing should go through a firewall, not just a router, so you can apply access control * Strictly segregate management traffic - your management VLAN should not be reachable from user VLANs ### Zero Trust Network Architecture The modern approach moves beyond perimeter-based thinking: * Never trust, always verify - even internal traffic * Every access request is authenticated and authorized, regardless of network location * Microsegmentation at the workload level, not just VLAN level * Works well alongside tools like software-defined perimeters and identity-aware proxies ## Firewall Hardening ### Rules Principles ``` Good firewall rule hygiene: 1. Default deny - block everything, then allow explicitly 2. Most specific rules first 3. Each rule has a documented business justification 4. Rules are reviewed and cleaned up regularly (quarterly minimum) 5. No "any/any" rules - ever 6. Separate rules for inbound and outbound 7. Log denied traffic (at minimum) for visibility ``` ### Perimeter Firewall For the external-facing firewall, the questions to answer for every allowed service: * Does this service need to be internet-facing, or can it be VPN-only? * Is access restricted by source IP where possible? * Is the service patched and actively maintained? * Is TLS enforced? * Is there rate limiting or DDoS protection in front of it? ``` Services that should almost never be directly internet-facing: - RDP (3389) - use a VPN or RD Gateway instead - SSH (22) - consider VPN + jump host, or at minimum restrict to known IPs - SMB (445) - never expose to the internet - Telnet (23) - never, full stop - Database ports (3306, 5432, 1433) - never expose directly - SNMP (161) - restrict to management network only - WinRM (5985/5986) - management only, never internet-facing ``` ### Internal Firewall / East-West Controls Most organizations focus on north-south traffic (in/out of the network) but ignore east-west (internal traffic). This is exactly how ransomware and APTs spread: * Deploy internal firewalls between segments * Apply ACLs on inter-VLAN routing * Use host-based firewalls as a second layer (Windows Firewall, UFW) * Consider a software-defined perimeter or microsegmentation solution for cloud/hybrid environments ## Disable Insecure Protocols ### Switch/Router Level On Cisco IOS (adapt for other platforms): ```bash theme={null} # Disable CDP on external-facing interfaces (leaks device info) interface GigabitEthernet0/0 no cdp enable # Disable Telnet - use SSH only line vty 0 15 transport input ssh login local # Enable SSH v2 only ip ssh version 2 crypto key generate rsa modulus 4096 # Disable HTTP management interface - use HTTPS only no ip http server ip http secure-server # Disable unused services no service finger no service tcp-small-servers no service udp-small-servers no ip source-route no ip proxy-arp ``` ### Protocol-Level Decisions | Protocol | Status | Replacement | | --------------------------------- | ---------------- | ---------------------------------- | | Telnet | Disable | SSH | | FTP | Disable | SFTP / FTPS / SCP | | HTTP | Disable/redirect | HTTPS (TLS 1.2+) | | SNMPv1/v2c | Disable | SNMPv3 with auth+priv | | TLS 1.0/1.1 | Disable | TLS 1.2 minimum, TLS 1.3 preferred | | RC4 / MD5 cipher suites | Disable | AES-GCM, ChaCha20 | | Weak Diffie-Hellman (\< 2048-bit) | Disable | ECDHE, DHE with 2048+ | | SMBv1 | Disable | SMBv3 with signing | | LLMNR / NBT-NS | Disable | DNS only | | WEP / WPA | Disable | WPA2/WPA3 Enterprise | ## DNS Hardening DNS is critical infrastructure and a common attack vector - DNS tunneling, hijacking, poisoning. ```bash theme={null} # On resolvers - disable recursion for external queries (prevent open resolver abuse) # BIND example: options { recursion yes; allow-recursion { 10.0.0.0/8; 192.168.0.0/16; }; # Internal only allow-query { any; }; }; # Enable DNSSEC validation on resolvers options { dnssec-validation auto; }; ``` For enterprise environments: * Use **DNS filtering** services (Cisco Umbrella, Cloudflare Gateway, NextDNS) to block malicious domains * Implement **DNS over HTTPS (DoH) or DNS over TLS (DoT)** to prevent DNS eavesdropping * Monitor DNS query logs - unusual patterns (high-entropy domains, uncommon TLDs, large TXT records) can indicate C2 or exfiltration * Restrict which systems can make external DNS queries - route everything through internal resolvers ## Wireless Network Hardening ### Authentication * **WPA3 Enterprise** is the current gold standard for corporate wireless * **WPA2 Enterprise (802.1X)** with EAP-TLS (certificate-based auth) is acceptable if WPA3 isn't available * **Never use WPA2-PSK** (pre-shared key) for corporate networks - a single leaked key compromises everything * **PEAP with MSCHAPv2** is common but has known weaknesses - prefer EAP-TLS ### Network Design ``` Wireless network segmentation: - Corporate SSID: WPA3/WPA2 Enterprise, VLAN to corporate segment - Guest SSID: Isolated VLAN, internet only, no internal access - IoT SSID: Separate VLAN, restricted internal access ``` ```bash theme={null} # Additional wireless hardening (router/AP level): - Disable WPS (Wi-Fi Protected Setup) - has known brute-force vulnerabilities - Disable UPnP - Change default admin credentials on APs before deployment - Use 802.11r (Fast BSS Transition) only if you understand the trade-offs - Enable client isolation on guest networks (clients can't see each other) - Regularly rotate PSKs on any PSK-based networks (e.g., IoT) ``` ### Rogue AP Detection Monitor for unauthorized wireless access points: * Enable **Wireless Intrusion Prevention (WIPS)** on your wireless infrastructure if available * Tools like **Kismet** or **airodump-ng** can detect rogue APs during assessments * Most enterprise wireless controllers (Cisco, Aruba, Ubiquiti Enterprise) have rogue AP detection built in ## SNMP Hardening SNMP (Simple Network Management Protocol) is used for monitoring network devices - and frequently misconfigured. ```bash theme={null} # Never use SNMPv1 or SNMPv2c in production - community strings are plaintext # Use SNMPv3 with authentication and privacy: # SNMPv3 config example (Cisco IOS) snmp-server group MONITORING v3 priv snmp-server user monitoruser MONITORING v3 auth sha AuthPassword123 priv aes 128 PrivPassword123 snmp-server host 10.0.1.5 version 3 priv monitoruser # Restrict which hosts can query SNMP access-list 10 permit 10.0.1.5 snmp-server community REMOVED RO 10 # Remove all v1/v2c communities no snmp-server community public no snmp-server community private ``` ## Network Access Control (NAC) NAC ensures that only authorized, compliant devices can connect to your network: * **802.1X** - Port-based authentication standard. Requires devices to authenticate before getting network access. * **Cisco ISE** - Enterprise NAC platform with rich policy capabilities * **Aruba ClearPass** - Another widely deployed NAC solution * **PacketFence** - Open-source NAC option Typical enforcement policy: * Compliant corporate device + valid certificate = full corporate network access * Personal/unknown device = guest VLAN only * Quarantine VLAN for non-compliant devices (missing patches, AV not running, etc.) ## Network Monitoring and IDS/IPS ### Intrusion Detection / Prevention | Tool | Type | What it does | | ------------------ | -------------------------- | ------------------------------------------------------------------- | | **Snort** | Open-source IDS/IPS | Signature-based detection, widely used | | **Suricata** | Open-source IDS/IPS | Multi-threaded, supports PCAP and inline mode | | **Zeek (Bro)** | Network analysis framework | Generates structured logs for threat hunting | | **Security Onion** | Platform | Bundles Suricata, Zeek, Wazuh, Kibana into a ready-to-use NSM stack | ### NetFlow / Traffic Analysis NetFlow (or IPFIX/sFlow) provides metadata about network conversations without full packet capture - efficient for large environments: ```bash theme={null} # Configure NetFlow export on Cisco IOS ip flow-export destination 10.0.1.100 9996 ip flow-export version 9 ip flow-cache timeout active 1 interface GigabitEthernet0/0 ip flow ingress ip flow egress ``` Collectors: **ntopng**, **Elastiflow**, **Scrutinizer**, **Kentik** ### Packet Capture Points Strategic TAP/SPAN points for full packet capture: * Internet perimeter (ingress/egress) * DMZ boundary * Key internal segments (server VLAN, DC traffic) * Wireless controllers (if possible) ## Management Network (OOB) Your network management infrastructure (switches, routers, firewalls, servers) should be on a separate **out-of-band (OOB) management network**: ``` Management network principles: - Dedicated VLAN/segment for management interfaces - No user traffic crosses the management network - Strict ACLs - only management workstations and jump hosts can access - Separate authentication (don't reuse user domain credentials for network device admin) - All management traffic encrypted (SSH, HTTPS - never Telnet or HTTP) - Log all management sessions (session recording is ideal) ``` Dedicated jump hosts (bastion hosts) provide an audit point for all management access: * All admin sessions go through the jump host * Sessions are logged and optionally recorded * MFA required at the jump host * Jump host itself is heavily hardened and monitored ## DDoS Mitigation For internet-facing services: * **Upstream scrubbing** - Most ISPs offer DDoS scrubbing services at the edge, before traffic reaches your network * **CDN with DDoS protection** - Cloudflare, Akamai, AWS Shield can absorb volumetric attacks * **Rate limiting** - Configure at the firewall, load balancer, and application level * **BGP blackholing** - Work with your ISP to null-route attack traffic upstream * **Anycast routing** - Distributes traffic across multiple points, reducing impact of volumetric attacks ## Useful Tools | Tool | What it's for | | -------------------- | -------------------------------------------------------------- | | **Nmap** | Network discovery and port scanning - know your own exposure | | **Nessus / OpenVAS** | Vulnerability scanning including network devices | | **Wireshark** | Packet analysis | | **Zeek** | Network traffic analysis and log generation | | **Suricata / Snort** | IDS/IPS | | **Security Onion** | Full NSM platform - great for building a monitoring capability | | **Netdisco** | Network device discovery and topology mapping | | **Nipper** | Automated network device configuration auditing | | **testssl.sh** | Test TLS configuration on any HTTPS service | | **sslyze** | Python-based SSL/TLS scanner | | **Scapy** | Python library for crafting and analyzing packets | ## Quick Win Checklist * [ ] Default deny on all firewalls - inbound and internal * [ ] Segment your network - at minimum: servers, workstations, guests, management * [ ] Disable Telnet everywhere - SSH only * [ ] Disable SNMPv1/v2c - migrate to SNMPv3 * [ ] Disable SMBv1 and LLMNR across the environment * [ ] Change default credentials on all network devices * [ ] Put management interfaces on a dedicated VLAN * [ ] Enable logging on all network devices and forward to a central SIEM * [ ] Run Nmap against your own perimeter - know what attackers see * [ ] Review firewall rules - remove anything that doesn't have a documented justification ## Reference * [CIS Benchmarks for Network Devices](https://www.cisecurity.org/cis-benchmarks/) - Cisco, Juniper, Palo Alto, Fortinet specific guides * [NIST SP 800-41](https://csrc.nist.gov/publications/detail/sp/800-41/rev-1/final) - Guidelines on Firewalls and Firewall Policy * [Security Onion Documentation](https://docs.securityonion.net/) - Network security monitoring platform * [testssl.sh](https://testssl.sh/) - Check TLS configs on any HTTPS endpoint *** *Network hardening is largely about discipline - maintaining consistent standards across a fleet of devices that changes constantly, enforcing rules that create friction, and keeping visibility over what's actually happening on the wire.*