firewall-demo.yml

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  FirewallSG:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupName: FirewallAccess
      GroupDescription: Allow Access to the firewall instance
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '1'
          ToPort: '65535'
          CidrIp: "0.0.0.0/0"
      VpcId:
        Ref: InternalVPC
  AttackerSG:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupName: AttackerAccess
      GroupDescription: Allow Access to the attacker instance
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp: "0.0.0.0/0"
        - IpProtocol: tcp
          FromPort: '7000'
          ToPort: '7000'
          CidrIp: "0.0.0.0/0"
        - IpProtocol: tcp
          FromPort: '8000'
          ToPort: '8000'
          CidrIp: "0.0.0.0/0"
        - IpProtocol: tcp
          FromPort: '9000'
          ToPort: '9000'
          CidrIp: "0.0.0.0/0"

      VpcId:
        Ref: ExternalVPC
  ExternalVPC:
    Type: "AWS::EC2::VPC"
    Properties:
      CidrBlock: "192.168.222.0/24"
      EnableDnsSupport: true
      EnableDnsHostnames: true
  ExternalSubnet:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: us-west-2a
      CidrBlock: "192.168.222.0/28"
      VpcId: !Ref ExternalVPC
      MapPublicIpOnLaunch: true
  ExternalRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref ExternalVPC
  ExternalRouteTableAssociation:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId: !Ref ExternalRouteTable
      SubnetId: !Ref ExternalSubnet
  ExternalRouteInternet:
    Type: "AWS::EC2::Route"
    Properties:
      DestinationCidrBlock: "0.0.0.0/0"
      GatewayId: !Ref ExternalInternetGateway
      RouteTableId: !Ref ExternalRouteTable
  ExternalInternetGateway:
    Type: "AWS::EC2::InternetGateway"
  ExternalIGAssociation:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      InternetGatewayId: !Ref ExternalInternetGateway
      VpcId: !Ref ExternalVPC
  InternalVPC:
    Type: "AWS::EC2::VPC"
    Properties:
      CidrBlock: "192.168.123.0/24"
      EnableDnsSupport: true
      EnableDnsHostnames: true
  InternalSubnet:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: us-west-2a
      CidrBlock: "192.168.123.0/28"
      VpcId: !Ref InternalVPC
      MapPublicIpOnLaunch: true
  InternalRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref InternalVPC
  InternalRouteTableAssociation:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId: !Ref InternalRouteTable
      SubnetId: !Ref InternalSubnet
  InternalRouteInternet:
    Type: "AWS::EC2::Route"
    Properties:
      DestinationCidrBlock: "0.0.0.0/0"
      GatewayId: !Ref InternalInternetGateway
      RouteTableId: !Ref InternalRouteTable
  InternalInternetGateway:
    Type: "AWS::EC2::InternetGateway"
  InternalIGAssociation:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      InternetGatewayId: !Ref InternalInternetGateway
      VpcId: !Ref InternalVPC
  Firewall:
    Type: "AWS::EC2::Instance"
    DependsOn: FirewallSG
    Properties:
      ImageId: ami-7105e609
      KeyName: firewall-demo
      InstanceType: t2.nano
      SubnetId: !Ref InternalSubnet
      SecurityGroupIds:
        - !GetAtt FirewallSG.GroupId
      Tags:
        - Key: Name
          Value: firewall
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          apt-get update && apt-get upgrade -y
          apt-get install -y netcat nmap
  Attacker:
    Type: "AWS::EC2::Instance"
    Properties:
      ImageId: ami-7105e609
      KeyName: firewall-demo
      InstanceType: t2.nano
      SubnetId: !Ref ExternalSubnet
      SecurityGroupIds:
        - !GetAtt AttackerSG.GroupId
      Tags:
        - Key: Name
          Value: attacker
      UserData:
       Fn::Base64: !Sub |
          #!/bin/bash
          apt-get update && apt-get upgrade -y
          apt-get install -y knockd

          echo "[options]" | tee /etc/knockd.conf
          echo "  UseSyslog" | tee -a /etc/knockd.conf
          echo "" | tee -a /etc/knockd.conf
          echo "[openSSH]" | tee -a /etc/knockd.conf
          echo "  sequence    = 7000,8000,9000" | tee -a /etc/knockd.conf
          echo "  seq_timeout = 5" | tee -a /etc/knockd.conf
          echo "  command     = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT" | tee -a /etc/knockd.conf
          echo "  tcpflags    = syn" | tee -a /etc/knockd.conf
          echo "" | tee -a /etc/knockd.conf
          echo "[closeSSH]" | tee -a /etc/knockd.conf
          echo "  sequence    = 9000,8000,7000" | tee -a /etc/knockd.conf
          echo "  seq_timeout = 5" | tee -a /etc/knockd.conf
          echo "  command     = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT" | tee -a /etc/knockd.conf
          echo "  tcpflags    = syn" | tee -a /etc/knockd.conf
          service knockd restart
          ufw enable
          ufw allow 7000
          ufw allow 8000
          ufw allow 9000

Vagrantfile

# -*- mode: ruby -*-
# vi: set ft=ruby :

$attacker_script = <<SCRIPT
# Add "firewall" as the default gateway
route add default gw 192.168.102.10

# Make the above step persist across reboots
echo "      gateway 192.168.102.10" >> /etc/network/interfaces
SCRIPT

$firewall_script = <<SCRIPT
# Install ifupdown
apt-get install -y ifupdown-extra

# Turn on ipv4 packet forwarding
sysctl net.ipv4.conf.all.forwarding=1
sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.d/99-sysctl.conf

# Add a route between the two networks
route add -net 192.168.101.0/24 enp0s8
SCRIPT

$secrets_script = <<SCRIPT
# Add "firewall" as the default gateway
route add default gw 192.168.101.10

# Make the above step persist across reboots
echo "      gateway 192.168.101.10" >> /etc/network/interfaces
SCRIPT


Vagrant.configure("2") do |config|

  config.vm.define "attacker" do |attacker|
    attacker.vm.box = "ubuntu/xenial64"
    attacker.vm.hostname = "attacker"
    attacker.vm.network "private_network", ip: "192.168.102.11",
      virtualbox__intnet: "insidenetwork"

    attacker.vm.provision "shell", inline: $attacker_script
  end

  config.vm.define "firewall" do |firewall|
    firewall.vm.box = "ubuntu/xenial64"
    firewall.vm.hostname = "firewall"

    firewall.vm.network "private_network", ip: "192.168.102.10",
      virtualbox__intnet: "outsidenetwork"

      firewall.vm.network "private_network", ip: "192.168.101.10",
      virtualbox__intnet: "insidenetwork"

    firewall.vm.provision "shell", inline: $firewall_script
  end

  config.vm.define "secrets" do |secrets|
    secrets.vm.box = "ubuntu/xenial64"
    secrets.vm.hostname = "secrets"
    secrets.vm.network "private_network", ip: "192.168.101.11",
      virtualbox__intnet: "outsidenetwork"

    secrets.vm.provision "shell", inline: $secrets_script
  end
end