Jeffreys Ruminations - Network Blog » Network Toolkit

Toolkit: Virtual PC 2007 RTM-RTW

jeffreycentex — Tue, 20 Feb 2007 03:56:57 +0000

OK, I’m late on this one (like usual), but here it goes:

Virtual PC 2007 has been released for download here.

Virtual PC is available free for Windows XP and Vista Boxes (note the limitations on which versions are “supported”). I haven’t seen any downloads for the Virtual PC Tools for Unix variants, but they have been available (in a beta form) from Connect.

For more information, see the full Virtual PC site here.

Also note that a newer version of VMWare Workstation (+ Player) was posted recently that provides better Vista support on both the client and the “server” side. Go to VMWare for more information.

Network Product Review: pfSense 1.0.1 – BSD-based Firewall

jeffreycentex — Mon, 29 Jan 2007 02:26:02 +0000

OK, I promised all of you a product review in my last blog entry. My first entrant is an open-source firewall project that I am currently using at my workplace. I was seeking a relatively “cheap” software-based firewall solution that would provide me with a dual-WAN setup that will allow our office to continue using both our new T1 and the existing DSL connection.

The problems?

Incoming Mail (or Spam Traffic) was maxing out the incoming rate for our DSL line. This resulted in many dropped connections while using the internet in our office. We had incoming services set as the highest priority to limit problems connecting to our company website and email server.
Our VPN connections were pathetically slow. This was due to a combination of the mail traffic problem from above and the fact that our incoming connection pipe was capped by SBC at 51.2 KB/sec.
Our new T1 line is fine and dandy for incoming services and VPN connections. However, we would experience a big dropoff on the web browsing “experience” in the office since the T1 pipe is limited to 150 KB/sec. This would not be acceptable to the company management.
In addition to our office network, we also have two additional “secured” networks that we wanted to bring into the fold.
Finally, our budget for this project was a spare computer and our time. Thus is life when one works for a small/mid-sized business that has historically ranked IT as one of the lowest priority levels (this is slowly changing, however)

Our new requirements for this project included the following:

Push incoming web, email, and VPN traffic in through the T1.
Push office web traffic out via the higher speed DSL connection.
Allow backup access in the event that either transport fails.
Integrate our Surveying and Accounting networks into the new system.
Simple to operate for relatively non-technical people.
Built-in controls to limit P2P and IM traffic
Low cost.

After searching far and wide, including various OSS and commercial software firewalls (such as ISA Server) that I could possibly use, I found only two solutions that could possibly work. However, after installing and testing each product, only one made it through with flying colors – the BSD-licensed open source solution named pfSense. From the pfSense site:

pfSense is a open source firewall derived from the m0n0wall operating system platform with radically different goals such as using OpenBSD’s ported Packet Filter, FreeBSD 6.1 ALTQ (HFSC) for excellent packet queueing and finally an integrated package management system for extending the environment with new features.

(OT: I tried m0n0wall, but it did not contain the support to easily setup and administer a dual-WAN setup.)

pfSense contains many features – more than I will ever want and need. However, it’s interface is fairly simple and straight-forward. Actually, it is very intuitive for anyone with networking experience. This is good since there is very limited documentation available – for many features, the documentation will refer you to the m0n0wall docs.

Here are some of the key features that may be of use to many small- to mid-sized business IT departments:

Wireless Captive Portal
Multiple WAN support
Package Support
Incoming and Outgoing Load Balancing
Wizard-based Traffic Shaping setup

For my configuration, I am using pfSense as a dual-WAN solution (T1 and DSL) and I currently have two networks attached (LAN and GPS). You can configure as many networks as you have network cards. I am using NAT rules to direct incoming web/mail/vpn traffic to the appropriate servers on our private LAN and firewall/QOS rules to enforce the following network policies:

Route all web browsing traffic to a transparent filtering proxy then out through the DSL connection.
Redirect all internal mail transport to our local exchange server, thus limiting our exposure to any wayward laptops or rogue computers exposing us to email viruses/worms.
Restrict all P2P traffic (identified by l7filter) to an incoming and outgoing transfer rate of 1 bit/sec (effectively killing such traffic).
Restricting traffic transport as necessary between separate internal networks.

Installation:

The installation of pfSense uses a BSD Live CD image that contains an options that will allow you to ability to install it to a hard drive. You can run it off the CD and a floppy/memory device, but you will be limited on packages and log storage.

Important Note:

The console of pfSense is NOT secure and a user who has local access can reboot or reset the firewall to factory settings. So remember one of the cardinal rules of security – MAINTAIN PHYSICAL CONTROL OF YOUR SYSTEM.

A screenshot (of an older version) of the console session is available here.

During the setup, you will assign network interfaces and will set up the LAN IP address that you will need (later) to access the web interface.

Post-Installation:

Once you have it installed (and have the console in a “safe” area), you can administer and setup the firewall from a web browser on your local network.

Here is a view of the opening screen after logging on to the firewall (from my install):

(Click on image to open a larger view)

On the left, you can see some of the configuration options that are available in pfSense (see here for more screenshots of these other options).

For a typical setup, you will be staying in the Interfaces and Firewall section. Each section is somewhat self explanatory and have all of the options that you would expect for a normal firewall appliance. The key areas are the NAT and Rules options under the Firewall section.

The NAT section is fairly standard:

As you can see, there are three additional subcategories under NAT – Port Forward, 1:1 (NAT), and Outbound NAT. In my case, all of the rules were either on the Port Forward and the Outbound tabs. The Port Forward tab is self explanatory – it works in the same manner as other firewall appliances. All Firewall rules necessary to add these NAT policies are automatically created on the appropriate interfaces. However, the Outbound NAT tab is where you set up the dual-WAN magic that pfSense allows:

In the case of my configuration, I was allowing two of my internal networks (the LAN and the “GPS” network) access to the 2 different WANs (the DSL and the WAN/T1). That’s all there is to it.

Also, for completeness, here is an example of what the firewall rules interface looks like:

Note that there are 4 tabs on this interface. The number of tabs that you will see depends on the number of interfaces you have defined.

Other Information:

There are a few other features that I find extremely useful on a day-to-day basis:

Real-Time Traffic Graphs
Extensive logging
IMspector – this is a plugin that allows you to capture all instant messaging conversations on MSN, AOL, and Yahoo IM. This is useful to install (pending the appropriate company policies) to help you comply with retention policies, if necessary.
Simple backups – you can backup the entire configuration to an XML file that you can reimport in to a different appliance.

That is about it.. Comment away if you have any questions.

(BTW: pfSense is IPV6-capable, but I am not running my local network on IPV6 “yet”. Maybe when I have more time…)

Project Site: pfSense

Download: Download Site

Screenshots

Vista Related Downloads of Interest

jeffreycentex — Mon, 11 Dec 2006 04:14:26 +0000

Since I have been MIA for the past month, I have slipped with providing links for new Networking-related downloads. Therefore, many of these are definitely on the older side…

MS releases VHD (Virtual Hard Disk) Images for …

jeffreycentex — Mon, 06 Nov 2006 16:37:01 +0000

OK, there was a new surprise this morning when looking at the Downloads site at Microsoft…

Pre-built Virtual Server VHD Images…

The posted builds are for ISA Server, Exchange Server 2007 + Office LCS 2007, Windows 2003 R2, and SQL Server 2007. This is a good start. Now if only they would encourage the formation of a library of pre-built VHD images like what VMWare has on the VMTN site.

System requirements mention the need for Virtual Server 2005 R2, but I am making an “guesstimate” that it would probably work OK in Virtual PC 2007. I’ll test that supposition later tonight if my download finishes (don’t get me started on my very sub-standard DSL connection…)

[EDIT]I forgot the link here[/EDIT]

IE7 finally (officially) released!

jeffreycentex — Thu, 19 Oct 2006 02:16:32 +0000

IE 7 has finally been officially released. It appears that Yahoo jumped the gun earlier today with their customized release with the integrated Yahoo Toolbar. Also note that there is also a trojan program that is purportedly being issued by MS via an email from support@microsoft.com – DO NOT DOWNLOAD THIS VERSION.

Sandi H. has posted a detailed message concerning the IE installation, troubleshooting, and general performance tips over at her Spyware Sucks blog.

I haven’t installed the RTM copy yet, but I am using a fairly recent build in my RC2 install of Windows Vista. It’s better, but I still prefer Firefox due to the plugin support. In a short time, there will be many plugins for IE, but I will wait a while longer before I give it a chance to be my full time web browser. For now, I use it primarily for OWA (Outlook Web Access) and Microsoft web access (i.e., MSDN, Connect, etc).

Actually, my biggest complaint about it is the user interface. I hate the new UI. It is very difficult to do most anything without having to “un-hide” the menu bar. I have the same complaint about the new Explorer interface in Vista. Fortunately, I can use xplorer2 instead of Windows Explorer in Vista. Hopefully Avant or Maxthon will be released or retrofitted to allow use with the new IE7 rendering engine along with the “classic” interface.

As for the page support, IE7 is much better than IE6 or any other IE versions with regards to CSS support. There are still things to be done, but it is much better. And thank you IE team for finally fixing the Page Previews/Printing issues. I have bugged this in every version of Internet Explorer since version 4. Finally, it is significantly faster than any prior release.

Virtual PC 2007 Beta Available

jeffreycentex — Tue, 17 Oct 2006 02:46:17 +0000

OK, this is a bit late, but as of last week, the beta of Virtual PC 2007 is available if you want to sign up at the Connect website.

Not too much different except for the fact that hardware virtualization works if you are using the 64-bit version of Virtual PC on a 64-bit OS. This version doesn’t excite me too much. Hypervisor, on the other hand, will be impressive (Hypervisor is the virtualization “base” that will be included with Longhorn Server). Well, that and System Center Virtual Machine Manager, which will bring much of the Virtual Server world more in line with the ESX server crowd.

My wish to the Virtual PC/Virtual Server group (and yes, I made this suggestion when I met with y’all just more than a week ago) – make importing of VMWare images easier. There is a library of pre-built VMWare appliances available at the VMTN site, but none like this for the Virtual PC/Virtual Server side. There is nothing stopping them from being created other than time. That’s why I must use VMWare Server at work – I don’t have to take the time to create environments (this being on the non-Windows side – I have standard Windows 2K3 and XP images available).

Enough rambling for now…

HPing for Windows XP Service Pack 2

jeffreycentex — Wed, 26 Jul 2006 06:59:35 +0000

From a mailing list I am on:

We are happy to announce that Hping 2 works with Windows XP again!
It is available at http://sourceforge.net/projects/sectools

For those who might not know, hping 2 is a packet crafting tool created by Salvatore Sanfilippo and ported to Windows by Rob Turpin. The unix version is available at http://www.hping.org. When Microsoft removed raw socket support in SP2, hping and a number of other programs broke. This causes problems in situations where Windows is the only thing available.

So we decided to fix the problem. For this, we would like to thank Fyoder and the Nmap developers because they had already overcome the biggest hurdles and we were able to work with their code and make it work within Hping 2.

The Sourceforge site is where you can download the package, source, report bugs or post questions in the forums. You can also contact us, James Fields (james.v.fields@gmail.com) and Kevin Johnson (kjohnson@secureideas.net), at hping@secureideas.net.

It’s available for download, but hopefully you’ll have better luck than I did with Soureforge, which has been very erratic as of late (probably due to the power situation in California).

Tags: hping, windows, sp2

Virtual PC 2004 SP 1 Free

jeffreycentex — Thu, 13 Jul 2006 01:29:20 +0000

Microsoft has made Virtual PC 2004 SP 1 free for all users and has promised to make Virtual PC 2007 available in the future to support Windows Vista…

I don’t think the Mac version of Virtual PC is included in this offer, though, so it’s Windows only for now…

This is just another salvo in the virtualization battle between MS and VMWare.

Click here for the download/information

Tags: VirtualPC, VPC, VMWare

Network Toolkit: The Dude

jeffreycentex — Tue, 11 Jul 2006 01:51:39 +0000

From a mailing list that I am a member of:

The Dude network monitor is a new application by MikroTik which can dramatically improve the way you manage your network enviroment. It will automatically scan all devices within specified subnets, draw and layout a map of your networks, monitor services of your devices and alert you in case some service has problems.

This tool is pretty cool for what it does. And best of all (for those of us who are value conscious) – it is free!

Screenshots:

(Photos from the Developer’s Website)

Click here for the Program’s Homepage

Click here for the online manual

Book: TCP/IP Fundamentals for Microsoft Windows

jeffreycentex — Fri, 26 May 2006 06:18:45 +0000

Joseph Davies (of the Windows Server Networking team and also known as the Cable Guy) has recently released a new online book entitled TCP/IP Fundamentals for Microsoft Windows that is available on Technet.

From Joseph’s posting on the server networking newsgroup:

This online book is a structured, introductory approach to the basic
concepts and principles of the Transmission Control Protocol/Internet
Protocol (TCP/IP) protocol suite, how the most important protocols function,
and their basic configuration in the Microsoft® Windows Server® 2003 and
Windows® XP operating systems.

This online book is available for free and provides a central location for
an existing or aspiring Windows network administrator to get a comprehensive
view of TCP/IP protocols and services in Windows XP and Windows Server 2003.
Unlike many other introductory TCP/IP book, this book provides an integrated
discussion of both Internet Protocol version 4 (IPv4) and Internet Protocol
version 6 (IPv6).