Transcription
In this video, I'm going to show you how to install the OpenSense firewall in VirtualBox to use in your lab environment. Sit back, and let's jump straight in.
[Music]
[Music]
Hey guys, I'm Lal, and welcome back to my channel. So, this is episode 2 of our virtual lab building series. If you're interested in seeing what we're going to be doing throughout the series, I'll link the introduction video above.
So, to start, we're going to be looking at OpenSense, which is a firewall that was forked from a very well-known firewall product called pfSense. OpenSense is a stateful firewall, and it comes with various features such as multi-WAN support for load balancing, virtual private networking. It even has hardware failover, so if one of the firewalls goes down, you could have a secondary one to pick up the load. It has SD-WAN and various intrusion detection and prevention add-ons that you can include. It also comes with all the standing routing protocols, web filtering and proxy, and some next-gen firewall features that we can install using Sensei, where we can monitor web applications and various other things. The next-gen features, I'll be doing in a later video.
So, if we go to the "Get Started" page, this table shows us a set of system requirements that we need. In our case, we are going to be running a virtualized version of this firewall, so we would need one or more virtual cores, a minimum of two gigs of RAM, and we'll be using the ISO image. Minimum recommended virtual disk size is eight gigs. If we scroll down, you can see there's other options as well. So, they'll have like a minimum system requirements, a reasonable, and a recommended. Because we're building this firewall in a lab environment, you could most likely get away with using less RAM and less disk space. However, if it's something that will be going into a production environment, it's best to stick with these with these basic system requirements.
So, if we look at the download and the preparation of the installation media, we will be using the DVD type installation media to create an ISO installer image. We'll click on the downloads section. There's only one system architecture available in this case, which is the AMD64.
[Music]
We will then select the DVD image, and you'll pick the closest mirror to wherever you are, and you'll click the download button. While OpenSense is downloading, we can head over to the bzip2 website. I will put the link in the description below. bzip2 is basically a decompression and compression software. You'll see once once OpenSense has finished downloading that it's been compressed using this particular piece of software. If you're using Windows, you'll need to come over to this section over here and download the setup files, which I've already done. You'll then run the installer and install it onto your system like you would any other piece of software. Alternatives to this are, if you have WSL installed on your Windows machine, you can boot up an Ubuntu or any other Linux distribution, and you can use the bzip utility, which comes pre-installed on that on those particular distros to uncompress the OpenSense image.
So, once OpenSense has finished downloading, you'll go to wherever your download files are located on your machine, and you'll see that there'll be an OpenSense 22.1 OpenSSL dbmd64 ISO image. However, you'll see this is currently compressed using this bzip2 compression, as I mentioned earlier. So, to decompress this file, so you'll need to open a PowerShell and you need to navigate to the directory where you installed your bzip application. I just left mine in the default location where the installer recommended I installed it. So, we will CD into the into the C drive, and this will be in the Program Files (x86) under GNU132 and then in the bin folder. So, if we do into that, we'll see we've got bunzip2 and various other applications that we can run. In our case, we're going to be using the bunzip2.exe. If you dash dash and type help, it'll give you the full list of options that you can use to decompress and compress files and so on. So, in our case, we're going to decompress, so it'll be a -d. So, we will select -d, and then we're going to point it to the directory where our OpenSense ISO was downloaded to. So, in this case, it's on my D drive and it's in the OpenSense directory, and that is the file .bz2. Hit enter, and give it a minute, and it will decompress the ISO.
So, once it's decompressed, you'll see it'll now show up as a disk image, which is exactly what we want, and the file type is now, in fact, an ISO.
The next step, if you haven't done so already, is to download VirtualBox off of the website. I'm not going to do the installation steps, it's pretty straightforward. You install the application like any other. Then, once you're up and running, we'll be able to continue with the installation of the OpenSense firewall.
So, once VirtualBox is installed, you'll open it, and you'll see something similar to what I have on my screen. I've already got a couple of virtual machines installed that I use. So, this section here will be totally empty if it's a new installation. So, what we're going to do is we will select the "New" button, and we're going to be giving our virtual machine a name. So, we'll just call it "OpenSense Firewall". You'll choose wherever you want the machine to be located on your system. I'm just going to leave that as standard, and then we are going to select "BSD" because OpenSense is based on FreeBSD. We will then select "FreeBSD (64-bit)" as there is only one version of OpenSense, and that is the 64-bit version. We'll then click "Next". As per the system requirements, they recommend a minimum of two gigs of RAM, which I've set mine to. If you don't have these resources on your machine, you can install this with less, it'll still work. You'll click "Next".
Then, we're going to set up a hard disk for this. We're just going to create a virtual hard disk now. Click "Create", and we're just going to leave it as a VDI, which is a VirtualBox disk image. We're going to click "Next" again. And then this option here allows us to dynamically allocate the disk image or create a fixed-size disk image. This is up to you. I generally just leave it as a dynamically allocated image because I have a substantial amount of hard disk space, so I don't mind if the images grow. If you want to fix the image to a certain size, you'll select this button just below. So, we'll just leave it as a dynamically allocated image and click "Next". As for the requirements, they recommended a minimum of eight gigs for the image, so we can dial that into eight gigs. We'll just leave it there and we'll click "Create".
So, once those steps have completed, we'll then click on the "OpenSense Firewall" and we'll go into the settings. First thing that I'd like to do here is give it another processor. They said obviously a minimum of one virtual processor, but to speed things up, we'll give it a second. We'll then head over to the network section, and this is where we'll set up our adapters. So, for OpenSense to work correctly, or any other firewall for that matter, you need to have at least two interfaces on on your firewall: one for your WAN that's connected to your internet connection, your Wide Area Network, and the other that's connected to your LAN. So, to simulate that in a virtual environment, we will set Adapter 1 to attach it to NAT setup, which is a Network Address Translation setup, which is standard for VirtualBox. Basically, what it does is it creates a a virtual network that we use, and then it NATs onto our local area network where our Wi-Fi or our LAN is connected to, to allow internet and various other things to be shared across that network. So, in this case, Adapter 1 is going to be our WAN adapter, and we'll leave it at NAT. Then, so it can share our internet connection on our machine. Then, for Adapter 2, we're going to enable the network adapter, and we're going to have this as an "Internal Network", and the name is "intnet". Now, the way this works with VirtualBox is that whatever name you give this internal network, in our case, it's "intnet", this will be the virtual network that it'll connect to, and anything with that name will connect to a virtual switch. I'll explain how this works later when we configure this firewall with a with a WAN and a LAN IP address, but it will make more sense when you see this this in action. But think of "intnet" as our virtual switch that we're going to be connecting this machine to, which is on our LAN. Once this is complete, we'll click "OK", and then we'll start the machine.
So, once the virtual machine has started up, you'll see a prompt may appear if it's the first time that you're installing an image, which will ask you to mount your ISO image. You could just click on the dialog box and follow the Windows prompts, and it will help you to mount the image. In my case, because this is not the first time I've done this, we'll have to go to "Devices", "Optical Drives", and then you can choose a disk file, which will open up a file dialog box where you can go and look for the ISO that we downloaded earlier. In my case, because I've used this before, it's already populated over here for me. So, I'll select the OpenSense ISO image here, and I'll just reset the machine, and you'll see OpenSense will begin its live setup, as they call it, where it will run a live version from this ISO that we're using, basically within the memory of the virtual machine. So, it wouldn't install it onto a virtual disk at this stage. We'll let it run through its course.
So, after a few minutes, you will see that OpenSense has run its course, and it will prompt you the login screen. If you look at the prompt that says that it's running in live mode off the installation media, and it gives us two options: we can either log in as root to continue the live mode if we want to maybe demo it or test it out before we do actual installation, or we can log in as an installer to start the installation onto the actual virtual disk. So, we're going to log in with the username "installer", and the default password is "opensense". We're going to hit enter.
So, the next step is it's going to ask us our default keymap. In okay, so I'm just going to continue with the default keymap, which is currently "us". This is just for the keyboard setup, and we'll hit enter. Then, it's going to ask us to choose one of the following tasks to perform. So, this is how we're going to install it. We can either install it using UFS on a UFS partition or a ZFS partition. In this case, we'll just be using a Unix file system since it's stable and it will work well for our lab. So, it says "Please select this to continue". In this case, we're just going to be using the vbox hard disk, which is the eight gigs that we set up, and we'll hit enter. And then it asks us if we're really sure that we want to install it. It's our last chance to install it on this disk. It's going to completely erase this disk and set up the file system for its own use. So, if there was anything that was there prior, it's going to be completely formatted and erased. We'll click "Yes" and let it run its course.
So, once the installation is complete, it's going to ask you if you'd like to set up your own root password. In this case, I'm going to do so. So, hit enter. You can use anything that you like here, obviously. Once that's complete, you'll select "Complete install", "Exit", and "Reboot", and hit enter.
So, the system will reboot. Then, what you'll need to do is go to "Devices", "Optical Devices", and then you want to remove the virtual disk, and then OpenSense will boot from the hard disk directly that we just installed it on. This will take substantially less time to to boot from the in comparison to running it from the installation media.
So, once it's booted up, you'll see it'll give us a similar looking login screen like we had earlier. You'll see that it's attempted to set up some pre-configured LAN and WAN interface IP addresses, which are the defaults with OpenSense. We are, however, going to change that then, so it can function with our lab correctly. So, we're going to log in with "root", and then we're going to be using the password that we set up earlier, and it's going to give you a menu, and we'll assign the interfaces. So, we'll enter "1".
[Music]
It'll then ask us if we want to install any LAGs. LAG is basically a Link Aggregation Group. So, what we could do is, if we had multiple network cards or network interfaces in this firewall, we could group two or four of them to create a more redundant, high-speed link. That's essentially what a LAG is. So, in this case, for the lab, we're just gonna say "No". And then it's going to ask us, "Do we want to configure any VLANs?" A VLAN is a Virtual LAN. It's a way that we can create segments on our network and switches. I will probably do a video on this later in the series. However, we're going to be selecting "No" because we're not going to be configuring that right now. Then, it's going to ask us to select the interface that we want to use for that WAN interface. In this case, we're going to be using "em0", which is the one that we set up in VirtualBox earlier. We'll click enter, and then it asks us to do the same for the LAN interface, which is going to be "em1". We hit enter, and it's going to ask us if we want to give it any names, optional interface names. I'm just going to hit enter and leave it as default, and then it will print out there for us that the interfaces were assigned as follows, and ask us if we want to proceed. We'll select "Yes", enter, and it'll configure the interfaces for us.
So, once it's done that, we will then need to set the interface IP address for both our WAN and for our LAN. In my lab, I'm not going to be using the 192.168.1 subnet. I've got my own that I'm going to be using. So, in this case, we will select number "2", which is to set the interface IP address, and then we will choose which interface we want to use or change. So, I'm going to change the LAN first. We're going to set that as "1", and then it asks, "Do you want to configure IPv4 address for the LAN via DHCP?" We're going to say "No" because we want the static IP address, and then we're going to enter the address. So, in my case, my lab network, my internal lab network on the virtual switch that we discussed earlier, runs on runs on 10.200. Enter, and then it's going to ask us what subnet range we want to we want to use. In this case, this is a class C network, so we're just going to be using 24, and we'll hit enter. So, in this case, it says for a LAN, we need to press enter if there's none. So, we'll do so, and it asks us if we want to configure any IPv6 on this particular interface. We're going to say "No". We're going to hit enter, and if we want to configure any DHCP for IPv6, we're going to say "No". We need enter. We're not going to use any IPv6 on this interface. So, we'll just say enter for none. And do we want to enable a DHCP server on the LAN? Right now, we're just going to say "No". It then asks us if we want to change our web graphical user interface protocol from HTTPS to HTTP. The choice is yours. Since this is a lab environment, it doesn't really matter, but in a production environment, I would say leave it as HTTPS, it's more secure. So, we'll just say "Yes" in this case, and then it will restore and asks us if we want to restore the web GUI or web graphical user interface to its defaults. We'll just say "Yes", hit enter. It'll then run through its course and do its reconfiguration, and it'll take us back to the previous menu. For the WAN interface, you'll notice that because that was left default as DHCP, it's picked up an IP address from our VirtualBox automatically, which is put it on that virtual NAT network like I showed you previously, and this will now allow us to have internet connectivity and simulate internet connection shared with our local area network connected to the internet on our on our laptop or computer.
So, once all that's completed, we'll now be able to access the firewall using its web GUI. So, we'll do is we'll head over to our Kali machine, which I've already pre-installed into VirtualBox. If you guys are interested to see how to do this, I've got a video that I created some time back. I'll put the link in the I'll put the link above. So, once Kali has been installed, you'll start it up, and if you type in "ifconfig", you'll see that this Kali machine also has two network cards installed. And then on Ethernet 1, it's connected to our virtual switch, which we set up previously, and which we've connected our firewall to. The IP address is on the same network that we set up on our LAN interface on the firewall, and is in the 10.200.200.20 range, and it's a class C IP address. So, it's 255.255.255.0 is the netmask. We should be able to ping the firewall. So, that was 200.200.254.
[Music]
And we get a reply from it. So, we'll open up our browser on Kali.
[Music]
And we will go to 10.200.200.254, and you'll see OpenSense will give us a web GUI to play around with. We will then log in with "root" and the root password that we set up earlier during our installation, and we'll hit enter. And now we have access to our firewall. If you click on the "Lobby" section above the dashboard, it will then give us a nice dashboard showing us the current version of OpenSense that we've installed, and a few graphs, and what services are currently running on the machine, and our gateways and LAN IP addresses and so forth that we set up.
So, to make OpenSense run to the best of its ability within VirtualBox, we're going to be installing the VirtualBox extensions. In order to do this, you'll need to head over to the "System" tab, and inside there, you'll see "Firmware", and then "Status". And once you're there, you'll click "Check for Updates", and OpenSense will go out and go and download all of its latest packages and update everything, and you'll be prompted with a little firmware status prompt that will show you that, you know, that you're all up to date. You'll then head across to "Plugins", and in plugins, we will scroll down, and we will look for the "os-virtualbox-guest-additions" plugin, and we'll click "Install", and it will do the installation for us, and once it's done, it will let us know. Once the guest additions and extensions have been installed, then our OpenSense firewall is ready for us to continue with other configurations, which we will start doing in other parts of this lab and in future videos.
So, to wrap this episode of our lab building series up, we've successfully downloaded, unzipped, and installed OpenSense into VirtualBox, and then we've installed the guest add-ons to make OpenSense run as smoothly as possible. If you've enjoyed this part of the series so far, please do give me a thumbs up and consider subscribing to my channel. It will definitely help me to grow the channel as quickly as possible and bring you some great cybersecurity and IT content in the future. And please stay tuned. I'm going to be continuing with this series over the next couple of weeks, and we're going to be playing around with some really cool technology. The next video that I have planned will further the configurations of this firewall. We're going to be installing some of the next-generation features. Thanks again for watching. I'll see you guys in the next video. Cheers for now.
[Music]
You