Networking and Security

DNS records are responsible for directing internet traffic to email systems, servers, and websites.  DNS record management is a crucial aspect of maintaining domains on the Internet. With a DNS management system, you can ensure that your domain is correctly configured for seamless functionality.

This step-by-step guide provides an overview of how to create and manage DNS records. It also covers record types such as TXT, A, CNAME, MX, and others, for adding your domain, updating nameservers, and testing your configurations. Use our instructions to optimize your domain’s performance and maintain its reliability across various services.

Creating and managing DNS records in Windows Server 2022 involves using DNS Manager tool or PowerShell.

 If DNS Manager tool is not already installed, then use the following process: 

1. Open Server Manager from start menu.

2. Click Manage->Add Roles and Features.

3. In the Add Roles and Features wizard, click Next.

4. Select Role-based or feature-based installation. Click Next.

5. Select your server from the server pool. Click Next.

6. Check the box next to DNS Server under Server Roles.

7. In the new pop-up window, check the box next to Include Management Tools (if applicable). Click Add Features.

8. Click Next.

9. Click Next under Select Features.

10. Click Next under DNS server.

11. Click Install.

12. Once the installation is complete, click Close. 

Restart the server to ensure the role is configured correctly.

13. From the left pane, select DNS in Server Manager.

14. Select your server. Right-click on the server and choose DNS Manager from the drop-down menu.

15. A DNS Manager pop-up window opens. Click on the server’s name.

16. When you are in the DNS Manager console, expand the name of your DNS server to view the Forward Lookup Zones and Reverse Lookup Zones.

Forward Lookup Zones: Forward Lookup Zones are used to resolve domain names to IP addresses. (For example, www.example.com -> 127.0.0.1). Records used are A, AAAA, CNAME, and MX. It is useful for accessing websites using human-readable names.

Reverse Lookup Zones: Reverse Lookup zones are used to map IP addresses to domain names (for example: 127.0.0.1 -> www.example.com). Records used are PTR (Pointer) records. They are used for logging and troubleshooting.

17. If you want to create a new zone, select Forward Lookup Zone or Reverse Lookup Zone.

From the Action menu on the top, Select New Zone (default).

18. The New Zone Wizard pop-up window will open. Click Next.

19. Select the Primary zone (default). Click Next.

20. Specify a zone name (ie, example.com). Click Next.

21. Select Create a new file with this file name (when you are a new user or in doubt). Click Next.

22. Select Do not allow dynamic updates (if you want to update them manually). Otherwise, you can select Allow both nonsecure and secure dynamic updates.

Click Next.

23. Once the New Zone Wizard is completed, you will see the settings that you specified. Click Finish.

24. Once the zone creation is finished, it will be reflected in the middle pane, as shown in the screen below.

Similarly, select Reverse Lookup Zone, from Action menu on the top, select New Zone and follow the same steps mentioned above.

25. After creating a zone, add new records by navigating to your zone under Forward/Reverse lookup zones.

Right-click on the zone and select New Host (A or AAAA).

26. New Host (A or AAAA) is used for mapping a domain to an IP address.

In the New Host (A or AAAA) pop-up window,

• Enter the name (If you have sub domains, you can add it here).
• Specify the IP address (127.0.0.1). If you don’t have a real IP address to associate with the domain, you can use a place holder like 127.0.0.1 (used for testing purposes on your local machine).
• Click Add Host.
  

27. You will get a message saying, “The host record example.com was successfully created.” Click OK.

28. If you want to add more records, you can do that here. Otherwise click Done.

29. You will see that the New Host is reflected in the middle pane, as shown in the screen below.

30. Similarly, right-click on the zone (ie, example.com) and select New Alias (CNAME). This is used for creating an alias for another record.

31. Similarly, right-click on the zone (ie, example.com) and select New Mail Exchanger (MX). This is used for email server routing.

32. Similarly, right-click on the zone (ie, example.com) and select Other New Records. This is used for specialized record types like TXT, SRV, etc.

33. To edit records, right-click on the record and select Properties to modify it.

34. To delete a record, right-click on the record and click Delete.

35. Using PowerShell for DNS Management.

PowerShell is an alternative tool to DNS Manager. Below are the common commands to add, delete, edit, and view record.

In the start menu, type Windows PowerShell and select Run as Administrator.

• To add an A record, run the below command:

     Command: Add-DnsServerResourceRecordA -Name “www” -ZoneName        “example.com” -IPv4Address “192.168.1.10”

• To add a CNAME record:

Command: Add-DnsServerResourceRecordCName -Name “alias” -ZoneName “example.com” -HostNameAlias www.example.com

• To view records in a zone:

Command: Get-DnsServerResourceRecord -ZoneName “example.com” 

• To remove a record:

                Command: Remove-DnsServerResourceRecord -ZoneName “example.com” -Name “www” -Force

36. In the DNS Manager window, you will see the records that are added in the Windows PowerShell are reflected in the middle pane (alias, www).

37. To test DNS configuration, use nslookup. 

Open the command prompt and run the below command:

Command: nslookup example.com 

Note: Replace example.com with your Zone name.

The output you’re seeing indicates that your computer is using Google’s public DNS server (8.8.8.8) for DNS queries. This is not unusual if your network or system is configured to use Google’s DNS instead of your local DNS server.

38. To ensure your query checks your DNS records (ie, example.com), you need to point nslookup to your local DNS server.

Command: nslookup example.com <local-DNS-IP>

Now, you will see the Server, Address, Name, and Address.

OPNSense is one of the most popular open-source firewall and routing platforms. It’s known for its flexibility, robust features, and ease of use. OPNSense is based on FreeBSD, which provides advanced security features such as intrusion detection, VPN, traffic shaping, and monitoring. By deploying OPNSense on the Kamatera cloud platform, you can:

• Adjust server resources based on network traffic.
• Implement complex firewall rules, VPN configurations, and network monitoring without expensive hardware.
• Deploy OPNSense on multiple data centers improving network performance and redundancy.
• Manage and update firewall rules, VPNs and other security systems from anywhere with OPNSense’s web management interface.
  

Let’s go through the steps to deploy an OPNSense Firewall using Kamatera’s service image.

1. Enter your credentials to access the Kamatera management console and click Login.

2. Navigate to My Cloud on the left-hand side and select Servers. On the left-hand side navigation menu, click on Create New Server, or use the Create New Server button on the right-hand side.

3. Choose zone from the following options:

• Asia
• North America
• Europe 
• Middle East

Depending on the zone you select, the available countries will be displayed. 

For this example, we selected the Asia server domain.

4. Choose an image:

Kamatera offers a variety of app and server images to help users set up preconfigured resources. Users can explore the following options: 

• Server OS images
• Desktop OS images
• App images
• Service images 
• My private images

5. Choose Service Images and select OPNSense.

6. In Choose Version, select the latest version of OPNSense Firewall. 

7. Upon selecting the version, OPNSense URL, Username, and Password are displayed.

8. Toggle the Detailed view button to ‘ON’ to view the detailed description, including the price.

9. Choose Server Specs:

Note: Type- B (General), CPU- 2, RAM- 8 GB, SSD DISC#1- 80 GB are selected. You can toggle the Daily Backup and Management Services button to ‘ON.’

10. Choose Networking:

Simple mode:

  Advanced mode:

You can add network by clicking on +Add Network.

11. Advanced configuration:

Hide: to hide the advanced configuration. 

Show: to see the advanced configuration.

12. Finalize Settings:

Finalize settings by setting the password, re-validating it, selecting the number of servers, specifying the server’s name, and enabling the Power On Servers option.

13. Billing Cycle and Pricing:

Once the user enters the details in Finalize Settings, they can select either monthly or hourly billing. After choosing the billing cycle, click on CREATE SERVER.

Note: The Server Summary displays the location, operating system (including server specifications), add-on services, servers, and pricing.

14. The server will be added to the Tasks Queue.

15. Once the server is created, you will see the status as success. The server will appear under Server Management. Click Open, and a new screen will open.

16. On the right side, the overview of Windows Server that you just created is displayed. 

Click CONNECT, and a new screen will open.

17. In the new screen, under the 

• Connection Credentials section: Connection Type, Username and Password are displayed. 
• Remote Console section, click Open Remote Console.  

18. A new tab opens, connecting to the new server displaying LAN, WAN, and other details. Login with username and password and hit Enter.

Now, the firewall is in live environment. We can interact with the live environment using the local console, HTTPS or SSH.

You can login to the shell using the username (go to step-17, to see username) and password (that is entered when you created a server) to operate the live environment via the local console.

The GUI is accessible at https://172.16.0.1/ (that is LAN) using username and password.

Using SSH, we can access the firewall at IP 172.16.0.1.

19. The console menu shows 13 options. From 0 to 13, enter an option and configure the system according to your requirements.

OPNsense has a command line interface (CLI) tool called “opnsense-update”. By entering option 8) Shell from the menu, the user can get to the shell and use opnsense-update.

• Now, you are in shell. For help, type the below command and press Enter.

Command: man opnsense-update

The other method to update the system is via console option 12) Update from console.

You can even assign interfaces by selecting option 1) Assign interfaces.

Ping the host by selecting 7) Ping host and enter your IP address.

• An update can be done through the GUI. Go to System-> Firmware-> Updates.
• Now, you are in OPNSense dashboard.
  The Dashboard is the first page you will see after you log into OPNsense. Additionally, it can be accessed via Lobby ‣ Dashboard. The Dashboard provides an overview of your system status.

• Configuration:

What is shown on the Dashboard can be configured by adding and removing widgets. Some widgets also allow further configuration.

By default, the following widgets are present:

System Information: Shows information about the installed OPNsense version, updates etc.

Memory: Shows memory usage.

Disk: Shows disk usage.

CPU: Shows CPU usage.

Gateways: Shows used gateways.

Interface Statistics: Shows the number of packets, bytes and errors handled by each interface.

Firewall: Collects logged events from the moment the dashboard has loaded to represent a snapshot of what the firewall is currently seeing. Can be expanded to show a live log.

Traffic Graph: Shows traffic passing through the system.

• In the upper right corner of the page, you can find the following buttons:

Edit dashboard (pencil icon): Enter edit mode. Unlocks the dashboard temporarily so you can move, resize, remove, or configure widgets.

Add widget (plus icon): Opens a dialog window with a list of widgets that can be added to the Dashboard. Simply click on an entry in the list to add it to the Dashboard.

Restore default layout (widgets icon): Restores the dashboard to its default configuration discarding all your modifications.

Save: After editing the dashboard, you can make all changes persistent by clicking this button. Otherwise, the changes will be discarded as soon as you reload the page.

• If the dashboard is in edit mode, the following buttons are available in the upper right corner of every widget:

Edit (pencil icon): Click this to modify the widget settings. This button is only present if the widget is configurable.

Remove (cross icon): Removes the widget from the Dashboard.

• If the widget is not in edit mode, you can find a link in the upper right corner of each widget if applicable, which will take you to the relevant configuration page.
• All widgets can be resized by dragging on one of the corners of the widget.

The Disk Usage widget shown as diagram will change to table mode when the widget is enlarged to at least two rows.

Even for the Firewall diagram, when its size is one row, it shows less information.

Enlarging this firewall widget to three rows will turn into table mode and firewall log.

And that’s it! Congratulations, you have succesfully deployed an OPNSense Firewall using Kamatera.

FortiGate VM provides protection from a broad array of network threats. It is a virtualized version of Fortinet’s FortiGate firewall, that is designed to provide the same robust security features as the hardware-based version in a virtual environment. 

It provides robust network security solutions by integrating protective functions into a single machine. Its high performance is ensured by accommodating networks of various sizes and scalability. FortiGate’s user-friendly interface and automation capabilities help organizations maintain robust security while meeting compliance requirements.

Here is a step-by-step guide to configuring FortiGate VM on Kamatera for maximum network security.

First, create an account on Kamatera.

Go to console.kamatera.com and sign up for an account by providing the following information:

1. Verify Your Email: Click the verification link sent to your email by Kamatera.
2. Password: Enter your password.
3. Repeat Password: Re-enter your password and click Create Account.

 
Then, access the Kamatera management console.

Enter your username and password and click Login to access Kamatera Management Console.

1. Navigate to My Cloud on left hand side, select Servers and click on Create New Server.

Choose a zone.

Choose the zone that you need.

• Asia
• North America
• Europe 
• Middle East

Note: For this setup, we used the Asia server domain to set up the Windows Server.

2. Choose an image.

Kamatera offers a variety of App and Server Images to help users set up preconfigured resources. You can explore options such as:

• Server OS Images
• Desktop OS Images
• App Images
• Service Images 
• My Private Images

In this, select Service Images and select FortiGate VM and choose the latest version of FortiGate VM.

Note: Here the latest version of FortiGate is 7.0.1.

You can see the details of FortiGate URL, username, and password.

3. Toggle the Detailed view button to enable you to view the detailed description, including the price.

Choose server specs.

4. Toggle Daily Backup and Management Services buttons enabled or disabled, according to your requirements.

5. Choose networking

You can select the network that works for you, whether it’s a public Internet network or a private local network.

Simple Mode

6. Advanced Configuration 

 Hide – If the user wants to hide the advanced configuration. 

 Show – If you want to see the advanced configuration.

7. Finalize Settings

Finalize settings by setting the password, re-validating it, selecting the number of servers, specifying the server name, and enabling the Power On Servers option.

Note: Once the user enters the details in Finalize Settings, they can select either the Monthly Billing Cycle or Hourly Billing, depending on their requirements.

8. Billing Cycle and Pricing

The user can choose between the Monthly Billing Cycle and Hourly Billing Cycle.

Note: The Server Summary displays the location, operating system (including server specifications), add-on services, servers, and pricing.

Click Create Server.

9. In Tasks Queue, you can see the FortiGate VM server is downloading.

10. Now, you can see the installation is complete.

11. FortiGate VM server is reflected in the Server Management dashboard. Click on Open, beside the FortiGate VM server.

12. Overview tab in the center displays information like Power state, Guest OS, Zone, WAN, LAN and Server ID of the server 

Click on Connect to connect to the server.

13. Click on Open Remote Console.

14. A Command Line Interface opens. Enter your login credentials.

You may encounter problems such as your license has expired, then you need to add the new license by clicking on Upload.

After uploading, click OK.

15. Now, go to browser and enter the IP address of the FortiGate server.

http://xxx.xxx.x.xx

Enter your Username and Password and click on Login.

15. In the FortiGate Setup window, Click on Begin or Later.

Note: Here, we clicked on Begin.

16. Select Optimal or Comprehensive according to your requirements. Click on OK.

Note: Optimal is selected. 

17. Toggle Don’t show again to enable, so that it is not seen every time you login.

Click on OK.

18. Now, you can explore the features of the FortiGate VM dashboard.

19. Bell icon shows the notifications, such as VM evaluation license. If it is expired, then you must redo the process.

20. In the left pane, under Network, select Interfaces.

Network refers to the configuration settings related to how FortiGate VMs will interact and manage network traffic.

Now, in the middle pane, you can see the internal LAN: port 1 and port 2

HTTP is in red, because they are not secure and not recommended.

• Double-click on the IP addresses.

• In the Edit Interface, you can make changes according to your requirements and click on OK.

21. Click on Command prompt (CLI) button in the top right corner to check whether this FortiGate VM can access the Internet.

In the CLI Console, run the below command.

Command: exe ping 8.8.8.8

If you see the message shown in the screen below, then your VM is accessing the Internet.

22. Under Policy & Objects, select Firewall policy. 

Policies are rules that manage, and control networks based on certain predefined criteria. 

• In the middle pane, click on Create New to create a new policy.

• Make the required changes in New Policy, Firewall/Network Options, Security Profiles, Logging Options, Comments.

Note: Select All Sessions in Logging Options.

             Toggle Enable the policy on to enable the policy.

Click on Ok.

23. Congratulations! You have successfully downloaded FortiGate and configured it for maximum network security. You can continue to use FortiGate for your lab activity and explore more features. 

Active Directory (AD) is a database and a suite of services that connect users with the network resources needed to complete their tasks.
 
The directory, or database, contains essential information about the environment, including details about users and computers, as well as their permissions. For example, the database might list 100 user accounts, including each person’s job title, phone number, and password, along with their permissions.
 
The services manage much of the activity within the IT environment. They ensure that each user is authenticated, typically by verifying their user ID and password, and authorized, granting access only to the data and resources they are permitted to use.
 
Here are the steps for user and group management, maintenance and optimization of Active Directory on Kamatera.
 

Install Active Directory Domain Services

To set up Active Directory, you first need to install Active Directory Domain Services on your Windows Server. After the installation, the server can be promoted to a Domain Controller. Follow these steps:

1. From the dashboard:



 

2. Click on Add Roles and Features. A new screen will open.


 

3. At Select Installation Type, select Role-based or feature-based installation. Click Next.


 

4. Select a server from the server pool. In Server Pool, make sure that your local computer is selected. Click Next.



 

5. Select Active Directory Domain Services checkbox from Roles. Click Next.



 

6. Next, you’ll be prompted to add the required features. Click Add Features to proceed. Click Next.


 

7. Click on Add Features to proceed.


 

8. Make sure you read the information on the Active Directory Domain Services dialog. Click Next.


 

9. In the Confirmation dialog, click Install to install the selected roles, role services, and features on your server.



 

10. The installation process will start. Once it’s finished, click Close to exit the wizard.

 
Promote Your Server to Domain Controller

1. When the installation is complete, click Notifications in Server Manager.
2. Click the link titled Promote this server to a domain controller.


 

3. Once the Active Directory Domain Services Configuration Wizard dialog opens, select Add a new forest and enter the Root domain name (ex: ADtestsample.com).



 

In the Domain Controller Options dialog, leave Forest functional level and Domain functional level enabled as default. 

Provide a secure password (kamatera@2024) for Directory Services Restore Mode.

 



 

• Ignore the warning given on the DNS Options dialog. Click Next.



 

• Select Next.

Verify your server’s NetBIOS domain name (ADTESTSAMPLE) and select Next.


 

• Select Next.
• Specify the locations for the following:
• AD DS Database folder
• Log Files folder
• SYSVOL folder 

Unless you have a specific enterprise use case, it’s advisable to leave everything as default.


 

• Review your selections carefully, and once satisfied, click Next to proceed.

 
The installation wizard will perform validation of prerequisites before proceeding with the installation of AD DS. Once all the checks are passed successfully, select Install to initiate the installation process.

 
The installation process will commence.

 
Once the installation is complete, click Close to finish the wizard. The system will restart.

Your Active Directory Services have now been installed successfully. Your machine will be rebooted automatically to apply the changes.
 

How to create, manage, and delete users and groups in Active Directory

1. Create a new user in Active Directory.
   • Type Server Manager in the search bar. A Server dashboard will be displayed. Go to Tools and select Active Directory Users and Computers.

   
    

   • Click on your Domain name from left-hand menu (ex: ADtestsample.com).
   • Depending on whether you are using organizational units or not, find the appropriate object to place user in that. By default, we can use Users object if do not want to create an organizational unit.

   
    
   After selecting the object, right click on it and select New from the menu and select User.

   
    

   • A new window opens, enter First name, Last name, User logon name. Click Next.

   
    

   • Enter the Password and click Next.

   
    

   • Review the summary once and click Finish.

   
    
   Now, click on Users. You can see the new user was created.

   

    

2. Deleting or removing user from Active Directory
   • Type Server manager in the search bar. The Server Manager dashboard is displayed. Go to Tools and select Active Directory Users and Computers.

   
    

   • Right click on your Domain name and select Find. 

   
    

   • Ensure that you select Users, Contacts, and Groups from the Find drop down menu. Type the name of the User you want to delete.

   
    
   
    
   Now, we have 2 options. We can delete the user or disable the user.

    

   • To delete the user, right click the user and select delete. Click Yes or No if you want to delete the user or not.
   • To disable the user, right click the user and select disable. Click Yes or No if you want to disable the user or not.

   Note: Once the user is deleted, you cannot get the user back.

   
    

3. Create a new group within Active Directory
• Type Server manager in the search bar. The Server Manager dashboard is displayed. Go to Tools and select Active Directory Users and Computers.

 


 

• Click on your Domain name from left hand menu.
• Depending on whether you are using organisational units or not, find the appropriate object to place user in that. By default, the built in Microsoft built in Default groups are under Users organisation unit.
• Right click on the object you want to choose, select New and select Group.


 

• A new window is displayed. Enter the Group name.  By default, Global under Group Scope and Security under Group Type is already installed. Do not change the group type to Distribution. Click Ok.


 
Now, a new group is created under Users.


 

• Add or remove users to or from a group
• Type Server manager in the search bar. The Server Manager dashboard is displayed. Go to Tools and select Active Directory Users and Computers.


 

• Click on your Domain name from left hand menu.
• Depending on whether you are using organisational units or not, find the appropriate object to place user in that. By default, the built in Microsoft built in Default groups are under Users organisation unit.

 

Add user to a group from the Group:

 

• Right click on your Domain and select Find. 


 

• Ensure that you select Users, Contacts, and Groups from the Find drop down menu. Enter the name of the group and click Find Now.



 

Right-click the group and select Properties.


 

• Click the Members tab.


 

• To add a user, click Add. Type the username into Enter the object names to select. Click Check Names and click Ok.


 

• To remove a user, select the user and click Remove and click Ok.


 
Add user to the group from the User:

• Right click on your Domain and select Find. 


 

• Ensure that you select Users, Contacts, and Groups from the Find drop down menu. Enter the name of the group and click Find Now.


 

• Right-click the group and select Properties.


 

• Click the Members tab.


 

• To add a user to the group, click Add. Type the groupname into Enter the object names to select. Click Check Names and click Ok.


 

• To remove the user from a group, click the group and click Remove and click Ok.



 

4. Delete a Group within Active Directory
• Type Server manager in the search bar. The Server Manager dashboard is displayed. Go to Tools and select Active Directory Users and Computers.


 

• Click on your Domain name from left hand menu and right click on your Domain and select Find. 


 

• Ensure that you select Users, Contacts, and Groups from the Find drop down menu. Type the Name of the group you want to delete.


 
Right click on the group and select Delete.


 

• Click Yes or No in the confirmation window if, you are sure.


 

• Now, go to Users and check whether your group is deleted. (Ex: scribe group is first created and then deleted.)


 
You have now learned some of the ways to manage your active directory on Kamatera, including how to create, manage, and delete users and groups.

SSL stands for Secure Sockets Layer. SSL certificates are digital certificates which provide a secure connection between the user’s browser and web server. They are useful for securing online transactions. They use Hyper Text Transport Protocol Secure (HTTPS) to create a secure channel over an insecure network.
 
There are four parts to install and renew your SSL certificates on a Windows server.
 

1. Generating a Certificate Signing Request (CSR).
2. Obtaining SSL certificate from a Certificate Authority (CA).
3. Configuring your web server (IIS).
4. Renew SSL certificate.

 
First, let’s generate a CSR.

1. On the start menu, search for ‘IIS Manager’ and open it.

 
2. In the Connections pane, click on server name and double click on Server Certificates icon in the middle pane.

 
3. In the Actions pane, click on Create Certificate Request.

 
4. Fill out the Distinguished Name Properties.

• Common Name: The fully qualified domain name (FQDN) for the site (domain-name.com).
• Organization: The legal name of your organization.
• Organizational Unit: Your department (e.g., IT).
• City/Locality: The city where your organization is located.
• State/Province: The state/province where your organization is located.
• Country/Region: The two-letter country code (e.g., US).

Now, click on Next.

5. Specify Cryptographic Service Provider Properties.

• Choose Microsoft RSA SChannel Cryptographic Provider for the Cryptographic service provider.
• Select 2048 for the Bit length.

Click on Next.   

 
6. Choose the location to save the file and click on Finish.

 
Next, we will obtain the SSL certificate. You can get an SSL certificate from Windows Server 2022. Convert your SSL certificate text file to .crt file.

 
The third part of the process is to install the SSL certificate.

1. Search for IIS Manager in the start menu, and double click on the Server Certificates icon. In the right pane, select the Complete Certificate Request.

Note: Certbot on Windows can automate the renewal process of SSL certificates from Let’s encrypt.  

• Download and install Certbot from the official Certbot website. 
• Follow the instructions on the Certbot website for auto renewal on Windows. 

2. Fill out the Specify certificate Authority Response.

• Enter the path of .crt file.
• Give it a friendly name, in order to quickly identify the certificate.
• Select a certificate store for the new certificate, either personal or web hosting.

Click on OK.

The last step is renewing your SSL certificate.

1. SSL certificates are valid for 1-2 years. Set yourself a reminder to renew them before they expire.
2. Follow the steps in Step 1: Generate a CSR to create a new CSR for renewal.
3. Submit a new CSR to your CA and get a renewed certificate.
4. Follow steps in Step 3: Install the SSL certificate to install renewed certificate.

 
That’s it! You have made it through all four parts involved in installing and renewing your SSL certificates.

A firewall determines whether to permit or block network data based on predefined rules. When you first set up a server or introduce new applications that require internet connectivity, it is crucial to configure the firewall to grant access to the necessary incoming traffic.
 

This article will guide you through the process of opening a port in the firewall on your Windows server on Kamatera.
 

1. Right-click the Start button.
2. Click Search.
3. Type Windows Firewall.
4. Click Windows Firewall.



5. Click Advanced settings.
6. Click Inbound Rules in the left frame of the window.



7. Click New Rule… in the right frame of the window.



8. Click Port.
9. Click Next.
10. Click either TCP or UDP.
11. Click Specific local ports.



12. Type the port number you chose in the registry.
13. Click Next.
14. Click Allow the connection.
15. Click Next.
16. Click any network types you’d like to allow the connection over.
17. Click Next.
18. Type a name for the rule.
19. Click Finish.
20. Restart the server.
21. Connect to the server.
22. Open the firewall again and enter the Inbound Firewall Rules.
23. Search for “Remote Desktop – User Mode (TCP-In)” and “Remote Desktop – User Mode (UDP-In).”
24. Disable those rules by right-clicking on the rules and click on “Disable.”

 
That’s it! You have successfully allowed a port through the firewall on your Kamatera Windows server.

The Remote Desktop Protocol (RDP) provides a convenient way to access Windows computers and servers remotely. By default, RDP listens on port 3389. This well-known port number can potentially attract attention from malicious actors scanning for vulnerabilities.
 
Changing the default RDP port number is a recommended security best practice. By configuring RDP to listen on an alternate, non-standard port, you reduce the perceived attack surface of your system. This makes it less conspicuous to automated port scans and potential attackers attempting to exploit the service remotely.
 

To change the default RDP port, follow these steps:

1. On your local PC, press the “win key + R” keys on your keyboard, a small window called “Run” will come up.
2. In this window in the search bar, write down: “regedit” and press OK.
3. The registry windows will show up. Go to Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\
4. Double click on PortNumber key
5. Change to Decimal
6. Change the number 3389 to a chosen value between 1025-65535. For example: 25456
7. Click OK

To test the new port configuration, follow these steps:

 
Now that you’ve made these configuration changes, it’s crucial to test and confirm that the Remote Desktop service is now listening on the new custom port as intended. Follow these steps to validate the new port setup:
 

1. Test the Remote Desktop Connection
   Initiate a Remote Desktop Connection attempt to the target machine, specifying the new port number you configured. The address should follow the format: TargetIPAddress:NewPortNumber (e.g. 192.168.1.100:33091). If the connection is successful, it confirms the new port is operational for RDP access.
2. Confirm the Port is Listening
   To check that the new port is active and ready for remote desktop connections, use the command ‘netstat -an | find “33091”‘ in the command prompt, which should indicate if the port is listening.

This guide offers a simple overview of how to whitelist IP addresses using Sophos, a network security platform. Here, we will be focusing on enhancing network security by permitting access to specific IPs only. If you’re an admin looking to fortify your network’s defenses, follow these straightforward steps to navigate Sophos settings and configure the necessary firewall rules, ensuring a secure, optimized network infrastructure.

Step 1: Log in

Access your Sophos firewall through the Sophos admin console. Next, go to firewall rules. Find the section for firewall rules under network protection:

Step 2: Create a New Rule

Create a new rule or edit an existing one.

Step 3: Define the Rule

In the rule settings, specify the IP address to be whitelisted in the source field, set the action to allow, and define any additional parameters as required.

Step 4: Add New IP Addresses

To add new IP address, click on + icon under sources. In the services field, you can click on the + icon to specify a specific port for that address. If you want to allow all ports, click on the folder icon and search for “any” in the left menu. Drag and drop the “any” parameter to the services field.

In the destination field, click on the + icon and specify your server IP address.

Note: If your server has a NAT setup, you need to specify your server’s internal IP.

Step 5: Save and Activate

Save the rule and ensure it’s activated.

This guide explains how to allow specific IP addresses through your Linux server’s firewall, a key step in keeping your network secure. By whitelisting IPs, you ensure only trusted traffic can access your system. This simple and practical guide is perfect for anyone looking to enhance their server’s security by controlling access via the internal firewalls.

How to Whitelist IP Addresses Using an Uncomplicated Firewall

If your server uses an Ubuntu operating system, Uncomplicated Firewall (UFW) is a user-friendly interface for managing netfilter firewall rules. Its simplicity makes it easy for administrators to secure their servers. Here’s how you can whitelist an IP address with UFW:

Step 1: Connect to Your Server

You can do this using SSH or the Kamatera management panel console. If you need more help, read our step-by-step guide on connecting to your server.

Step 2: Enable UFW

This entails executing the command ufw enable if it’s not already active.

Step 3: Whitelist an IP Address

Do this by running ufw allow from [IP_ADDRESS].

Step 4: Confirm New Rule

Check ufw status to ensure that your action went through.

How to Safely Add IP Rules with IPTables

IPTables is a robust tool included in most Linux distributions, directly integrated into the Linux kernel. It allows for configuring network packet filtering rules. Follow these steps to whitelist an IP address:

Step 1: Access your server through SSH or the Kamatera console.

Step 2: Insert an IP whitelist rule with the command iptables -I INPUT -s [IP_ADDRESS] -j ACCEPT.

Step 3: Preserve the changes across reboots by saving with sudo iptables-save.

Guide to Using Firewalld for Server Protection

For systems with Firewalld, managing your firewall rules can be straightforward with the right commands. Here’s the process to add an IP to your whitelist:

Step 1: Log into your server via SSH or console connection.

Step 2: Start Firewalld if it’s not running with systemctl start firewalld.

Step 3: Add the IP to the whitelist by executing firewall-cmd –permanent –zone=public –add-source=[IP_ADDRESS].

Step 4: Make the changes effective by reloading Firewalld with firewall-cmd –reload

How to Configure CSF for Enhanced Security

ConfigServer Security & Firewall (CSF) is a popular security solution for servers. To add an IP to your whitelist in CSF, follow these steps:

Step 1: Log into your server where CSF is installed.

Step 2: Whitelist an IP by running csf -a “ip address” or by adding it to /etc/csf/csf.allow.

Step 3: Restart CSF to apply changes using sudo csf -r.

This guide provides a simple-to-follow guide on how to whitelist IP addresses in pfSense. pfSense is a free, open-source firewall and router that features unified threat management, load balancing, multi WAN, and more. This procedure secure your network by allowing only specified IPs through the firewall. If you’re an admin seeking to tighten security, you can follow these step-by-step instructions to configure firewall rules within your pfSense interface.

Step 1: Access the pfSense Web Interface

Log in to your pfSense firewall via the web interface. To access the pfSense management panel, proceed to your preferred web browser and access the pfSense web panel by running https://[Firewall_IP] in the search bar. Proceed to site when you get a security notification. This is a default message, since the pfSense panel is not secured with SSL certificate by default. You can safely ignore this message.

Step 2: Navigate to Firewall Rules

Go to Firewall > Rules located at the top menu of the page

Step 3: Add a New Rule

Click on the green “add” button to add a new rule at the bottom of the page.

Step 4: Choose an Action

In the ‘Action’ field, you can specify to either ALLOW, DROP or REJECT the incoming traffic. Since we want to allow IP addresses, choose ALLOW.

Step 5: Specify a Protocol

Under the protocol field, you can specify to which IP protocol the rules should match. For example Any, TCP, or UDP.

Step 6: Define a Source

In the Source field, click on ANY and pick the Address or Alias option. Specify the source IP address that you want to whitelist.

Step 7: Choose a Destination

In the Destination section, you can leave it “any” if you want to whitelist the source IP address to all servers behind the firewall (if there are more than one). Or choose Address or Alias option and specify the internal IP address of the server.

Apply Changes: Click “Save” and then “Apply Changes” to activate the rule.

Securing NGINX with Let’s Encrypt on Ubuntu 22.04 involves obtaining an SSL/TLS certificate from Let’s Encrypt and configuring NGINX to use this certificate for HTTPS encryption. Here’s a step-by-step guide:

Prerequisites

Before you begin, make sure you have the following:

1. A registered domain name that points to your server’s IP address.
2. NGINX installed on your Ubuntu 22.04 server (you can follow these instructions to install NGINX).
3. A basic NGINX server block (virtual host) configuration set up for your domain.

Now, let’s secure NGINX with Let’s Encrypt:

Step 1: Install Certbot (Let’s Encrypt Client)

1. Update your package list:

```bash

sudo apt update

```

2. Install Certbot using the following command:

```bash

sudo apt install certbot python3-certbot-nginx

```

Step 2: Obtain Let’s Encrypt SSL Certificate

1. Run Certbot to obtain and install the SSL certificate for your domain. Replace `your_domain` with your actual domain name:

```bash

sudo certbot --nginx -d your_domain

```

Certbot will interactively ask you for information and configure NGINX to use the obtained certificate.

2. Certbot will ask if you want to redirect HTTP traffic to HTTPS. Choose the appropriate option based on your preference. Redirecting is recommended for better security.

Step 3: Automatically Renew the Certificate

Certbot will automatically set up a cron job to renew your certificate when it’s close to expiration. Certificates provided by Let’s Encrypt are usually valid for 90 days, so this automatic renewal process is essential to keep your website secure.

Step 4: Verify Certificate Renewal (Optional)

You can verify that the automatic renewal process works by running the following command:

```bash

sudo certbot renew --dry-run

```

If there are no errors, the renewal process is working correctly.

Step 5: Test Your HTTPS Setup

Visit your website using HTTPS (e.g., `https://your_domain`). You should see a secure padlock icon in your browser’s address bar, indicating that your site is now using HTTPS.

Step 6: Adjust Your NGINX Configuration (Optional)

By default, Certbot will create a server block for your domain in `/etc/nginx/sites-available/your_domain`. You can customize this configuration as needed, such as adding additional security headers or configuring specific SSL settings.

Step 7: Verify SSL Configuration

It’s a good practice to verify your SSL/TLS configuration using an online tool like SSL Labs. Enter your domain and check the rating and details of your SSL certificate setup.

Congratulations! You’ve successfully secured NGINX with Let’s Encrypt on Ubuntu 22.04. Your website is now accessible over HTTPS with a valid SSL/TLS certificate.