168 lines
8.5 KiB
HTML
168 lines
8.5 KiB
HTML
|
<!DOCTYPE html>
|
||
|
|
<html lang="en">
|
||
|
|
<head>
|
||
|
|
<meta charset="utf-8">
|
||
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
|
|
<meta name="description" content="">
|
||
|
|
<meta name="author" content="">
|
||
|
|
<link rel="shortcut icon" href="../../../../../../assets/img/favicon.png">
|
||
|
|
|
||
|
|
<title>Internet Failover Setup</title>
|
||
|
|
|
||
|
|
<!-- Bootstrap core CSS -->
|
||
|
|
<link href="../../assets/css/bootstrap.css" rel="stylesheet">
|
||
|
|
<link href="../../assets/css/xt256.css" rel="stylesheet">
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<!-- Custom styles for this template -->
|
||
|
|
<link href="../../assets/css/main.css" rel="stylesheet">
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<!-- HTML5 shim and Respond.js IE8 support of HTML5 elements and media queries -->
|
||
|
|
<!--[if lt IE 9]>
|
||
|
|
<script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
|
||
|
|
<script src="https://oss.maxcdn.com/libs/respond.js/1.3.0/respond.min.js"></script>
|
||
|
|
<![endif]-->
|
||
|
|
</head>
|
||
|
|
|
||
|
|
<body>
|
||
|
|
|
||
|
|
<!-- Static navbar -->
|
||
|
|
<div class="navbar navbar-inverse-anon navbar-static-top">
|
||
|
|
<div class="container">
|
||
|
|
<div class="navbar-header">
|
||
|
|
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
|
||
|
|
<span class="icon-bar"></span>
|
||
|
|
<span class="icon-bar"></span>
|
||
|
|
<span class="icon-bar"></span>
|
||
|
|
</button>
|
||
|
|
<a class="navbar-brand-anon" href="\index.html">nihilist`s Blog</a>
|
||
|
|
</div>
|
||
|
|
<div class="navbar-collapse collapse">
|
||
|
|
<ul class="nav navbar-nav navbar-right">
|
||
|
|
|
||
|
|
<li><a href="/about.html">About</a></li>
|
||
|
|
<li><a href="/blog.html">Categories</a></li>
|
||
|
|
<li><a href="https://blog.nihilism.network/donate.html">Donate</a></li>
|
||
|
|
<li><a href="/contact.html">Contact</a></li>
|
||
|
|
</ul>
|
||
|
|
</div><!--/.nav-collapse -->
|
||
|
|
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
<!-- +++++ Posts Lists +++++ -->
|
||
|
|
<!-- +++++ First Post +++++ -->
|
||
|
|
<div id="anon2">
|
||
|
|
<div class="container">
|
||
|
|
<div class="row">
|
||
|
|
<div class="col-lg-8 col-lg-offset-2">
|
||
|
|
<a href="../anon.html">Previous Page</a></br></br><p><img src="../../assets/img/user.png" width="50px" height="50px"> <ba>nihilist@mainpc - 2024-04-07</ba></p>
|
||
|
|
<h1>Internet Failover (dual wan pfsense setup) </h1>
|
||
|
|
<b>Threat Model:</b>
|
||
|
|
<p>Your ISP connection comes with a closed-source router. What makes you think that your ISP isn't giving access to it to an adversary so that he may be able to spy on your home network ? How do you protect against that?</p>
|
||
|
|
<p>That same adversary suspects that you are running a hidden service from home. That adversary makes your ISP shut down your internet connection to check if you are actually running it or not. How do you ensure your hidden service keeps running ?</p>
|
||
|
|
<img src="0.png" style="width:250px">
|
||
|
|
<p>In this tutorial we're going to setup a pfsense VM inside of virt-manager to make sure that our .onion Hidden service is hidden behind an open-source router, rather than a closed-source one. as detailed below:</p>
|
||
|
|
<img src="1.png" class="imgRz">
|
||
|
|
<p>We're going to also make sure that we protect the hidden service from controlled internet downtimes, with a failover internet connection to a mobile hotspot.</p>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
</div><!-- /row -->
|
||
|
|
</div> <!-- /container -->
|
||
|
|
</div><!-- /grey -->
|
||
|
|
|
||
|
|
<!-- +++++ Second Post +++++ -->
|
||
|
|
<div id="anon3">
|
||
|
|
<div class="container">
|
||
|
|
<div class="row">
|
||
|
|
<div class="col-lg-8 col-lg-offset-2">
|
||
|
|
<h2><b>Initial Setup </b></h2>
|
||
|
|
<p>First you're going to need a Libvirtd QEMU hypervisor on your home server, check <a href="../antiforensics/index.html">this</a> tutorial to know how to set it up.</p>
|
||
|
|
<p>So here we create the pfsense VM as shown in <a href="../pf_virt/index.html">this</a> tutorial, and we make sure to adjust it to have the following network configuration:</p>
|
||
|
|
<p>So for the main network interface we setup the network interface as a direct attachment to the host network interface enp8s0 (as a macvtap device in virt-manager):</p>
|
||
|
|
<img src="2.png" class="imgRz">
|
||
|
|
<p>As detailed in the previous tutorial, for the LAN network we setup an isolated network and use it like so:</p>
|
||
|
|
<img src="3.png" class="imgRz">
|
||
|
|
<p>Then from inside pfsense we can set them both like so:</p>
|
||
|
|
<img src="4.png" class="imgRz">
|
||
|
|
<p>Then we setup the second WAN, which is our mobile USB tethering hotspot. First just connect the mobile phone to the homeserver via USB:</p>
|
||
|
|
<img src="5.png" class="imgRz">
|
||
|
|
<p>Once plugged in, you can check if the homeserver detects it via the lsusb command, and if it does, just add the USB host device to the VM directly like so:</p>
|
||
|
|
<img src="6.png" class="imgRz">
|
||
|
|
<img src="7.png" class="imgRz">
|
||
|
|
<p>However that's not enough as when you enable USB tethering the USB device ID changes, so we enable USB tethering like so (ex: in Graphene OS you go to: <b>Settings > Network and Internet > Hotspot & Tethering > Toggle USB Tethering ON</b>) before adding it in the pfsense VM:</p>
|
||
|
|
<img src="8.png" class="imgRz">
|
||
|
|
<p>Now that the device is added, enable USB tethering from your phone , then let's make sure that it is proprely configured as a second WAN interface in pfsense:</p>
|
||
|
|
<img src="9.png" class="imgRz">
|
||
|
|
<p>Here you see the pfsense VM detecting the usb device from console, however to make the setup simpler we'll set it up from the pfsense dashboard, from the VM inside the LAN network:</p>
|
||
|
|
<img src="10.png" class="imgRz">
|
||
|
|
<p>So after clicking "add" we have now the OPT3 interface that we can configure:</p>
|
||
|
|
<img src="11.png" class="imgRz">
|
||
|
|
<p>We rename it to WAN-Mobile, set it to DHCP (as it is the mobile phone that gives the DHCP lease to that interface), and hit save:</p>
|
||
|
|
<img src="12.png" class="imgRz">
|
||
|
|
<img src="13.png" class="imgRz">
|
||
|
|
<p>Here you can also see that pfsense detects that interface as a gateway in the routing section:</p>
|
||
|
|
<img src="14.png" class="imgRz">
|
||
|
|
<p>Now that's done, we need to setup the failover by first having both gateways into the same gateway group: </p>
|
||
|
|
<img src="15.png" class="imgRz">
|
||
|
|
<img src="16.png" class="imgRz">
|
||
|
|
<p>Now here we have a gateway group, we have set our main WAN interface (WANGW, the ethernet connection) to be tier 1 as in first priority, and we have set our secondary WAN interface (WANMOBILE) to be Tier 2 as in second priority. The trigger level to switch between the 2 is going to be Packet Loss. <b>Meaning if the ethernet connection goes down, the internet connection will resume through the mobile USB tethering hotspot</b>: </p>
|
||
|
|
<p>Now we hit save and apply, then we need to edit the LAN firewall rule because otherwise it won't accept any traffic to be routed to the other gateway:</p>
|
||
|
|
<img src="17.png" class="imgRz">
|
||
|
|
<img src="18.png" class="imgRz">
|
||
|
|
<img src="19.png" class="imgRz">
|
||
|
|
<p>Now with this, the lan subnet will automatically route traffic through either gateway as dictated by pfsense. which is what we want. Now hit save and apply:</p>
|
||
|
|
<img src="20.png" class="imgRz">
|
||
|
|
<p>And now we can see it in action when we unplug the ethernet cable like so:</p>
|
||
|
|
<img src="22.png" class="imgRz">
|
||
|
|
<p>As you can see here, the traffic first goes through the default WAN interface, and after i unplug the ethernet cable, the same traffic starts to go through the other WAN interface via the mobile connection. Which concludes today's tutorial.</p>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
</div><!-- /row -->
|
||
|
|
</div> <!-- /container -->
|
||
|
|
</div><!-- /white -->
|
||
|
|
|
||
|
|
<!-- +++++ Footer Section +++++ -->
|
||
|
|
|
||
|
|
<div id="anonb">
|
||
|
|
<div class="container">
|
||
|
|
<div class="row">
|
||
|
|
<div class="col-lg-4">
|
||
|
|
<h4>Nihilism</h4>
|
||
|
|
<p>
|
||
|
|
Until there is Nothing left.
|
||
|
|
|
||
|
|
</p>
|
||
|
|
</div><!-- /col-lg-4 -->
|
||
|
|
|
||
|
|
<div class="col-lg-4">
|
||
|
|
<h4>My Links</h4>
|
||
|
|
<p>
|
||
|
|
|
||
|
|
<a target="_blank" rel="noopener noreferrer" href="http://blog.nihilism.network/rss/feed.xml">RSS Feed</a><br/><a target="_blank" rel="noopener noreferrer" href="https://matrix.to/#/#nihilism:m.datura.network">Matrix Chat</a><br/>
|
||
|
|
|
||
|
|
</p>
|
||
|
|
</div><!-- /col-lg-4 -->
|
||
|
|
|
||
|
|
<div class="col-lg-4">
|
||
|
|
<h4>About nihilist</h4>
|
||
|
|
<p style="word-wrap: break-word;"><u>Donate XMR:</u> 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8</p></br><p><u>Contact:</u> nihilist@nihilism.network (<a href="https://nihilism.network/nihilist.pubkey">PGP</a>)</p>
|
||
|
|
</div><!-- /col-lg-4 -->
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
|
||
|
|
<!-- Bootstrap core JavaScript
|
||
|
|
================================================== -->
|
||
|
|
<!-- Placed at the end of the document so the pages load faster -->
|
||
|
|
|
||
|
|
</body>
|
||
|
|
</html>
|