Hey y'all,
I have a small network with opnsense firewall, a unify ap, some client in different subnets, vpn, DNS and some servers.
As I am completely self thought, I got everything to run reading the docs and forums, but I have no idea how to test if what I build is safe and stable.
Are there good up to date tools, or checklists one could follow to audit the different parts of the network (most important the opnsense config)?
What do you check if looking for security issues?
The network mostly relies on client separation through different subnets on different vlans, but I fear I dont understand how for example the vpn and the nas work together in detail to be sure there is no security implication I oversee.
Also: how do you handle client authentication for devices on the same subnet? I know IP/mac-adress ARP entries are easily spoofed and therefore not secure, but I haven't seen how to do it correctly
Can you please draw a network diagram, e.g. in draw.io (diagrams.net desktop application) and we can tell you what to check where?
You can use nmap to verify if the rules you set actually work.
Try spoofing your IP yourself and see what happens.
You can use RADIUS for client authentication and MACSec to encrypt layer2 data. In my opinion that's overkill for a home network though.
Try to come up with scenarios in which you are hacked and how they'd do it. Then try to actually do it. Implement counter measures and see if it still works or you successfully mitigated that attack vector.
I'll try to do a diagram tomorrow. Its a mixed network of multiple families of whom some want to host a server to the internet. That would mean lots of untrusted traffic, so I get more concerned with auth. If I know the Mac address and IP I want to spoof, I can get the permissions of the device I spoofed, as long as I am in the same subnet, which is the case for wifi (ap can only host 4 different ones, I have more than 4 groups of user permissions so I can't separate them all). That's where some auth would come in in my mind.
The problem is, I just learned about how to use the software, I am far from deep enough in it (and IT-knowledge in general) to actually pen test myself, I would have no idea how someone would worm through my network, if he gets rce on the server of one of the other families, so I can't really say if something like this is possible or not.
Yes, but once you try to hack yourself you'll research how it works and this will give you knowledge about how to secure a network.
You basically need to purple team yourself. You're both attacker (red team) and defender (blue team).
Try to make a list of attack surfaces and think about (and research) possible attacks. Then you try to execute said attacks.
There's basically no other way to test if something is safe and stable than to try to break it.