Basic Security Valvaris Security Config 2019

[valvaris]

Why the config in that way?
As a Application Firewall I use GlassWire and Block Apps that are very talkative.
The next line of defense is my Security Appliance - Sophos XG Home (HW-Firewall) and isolated my IoT devices.
Example:

The Network is build in segments:
192.168.x.x /24 for Smart-TV, IoT and Mobile-Devices
172.16.x.x /30 for my PC
The Managed-SW has a ACL build in and backed my trusted devices in to it. Like that the Ports on it only communicate with those devices.
My Router is a simple AVM-Cable Router and have configured that my my Firewall (XG) as a Exposed-Host like that I do not get double NATed.
Otherwise all other Ports are closed.

Why the XG?
Is very simple it has DPI HTTPs inspection build-in and scans SSL Traffic for Certificates and Malware with a double engine. (Sophos and Avira) The other upside is IPS (Snort) and many other Security features for free...
Test site for Sophos XG features test -> Sophos Web Security and Control Test Site

START ------------------------------------>>> OLD CONFIG <<<---------------------------------------- START
Then why a Pi-Hole?
To block sites at a DNS Level with RegEx entrys and Blocklists provided by The Block List Project and other projects.
I know my DNS query is quite long but it is more secure (My opinion)
Example:
PC ----> XG ----> Pi-Hole ----> Quad9 Filtered/DNS-Sec
IoT ----> Pi-Hole ----> Quad9 Filtered/DNS-Sec
END ------------------------------------>>> OLD CONFIG <<<---------------------------------------- END

NEW Config Setup Update 25.12.2019

What changed?
The Pi-Hole DNS Server Adblocker is gone and has been replaced with eBlocker! (Open-Source)

Why has it been changed?
Have to say the Pi-hole is a great project but I was in the search to offload advanced tracking protection and blocking of various ads. Adguard is a great project as well (Desktop and Browser Extension) but still I wanted to streamline that level of protection to my whole network.

What was my solution?
I switched from the Pi-hole project to eBlocker that is available now over at: eBlockerOS Download - eBlocker Open Source - Free Privacy & Parental Controls Gateway

What does eBlocker do?
- HTTPS Decryption
- Easylist Pattern File Compatible
- Domain Blocklist Compatible
- Squid ACL Compatible
- Parental Controls
- Network wide protection
- DNS Level Domain blocking
- and lots more...

How complicated was it to setup?
5min. install and final fine-tuning max. 30min. with custom lists.

Cert. flow for the XG?
External Site SSL ----> eBlocker ----> XG -----> PC
All I needed to do is to import the cert. from eBlocker to my XG CA Store and done.

Compatibility self-tested:
- PC = Full HTTPs
- iOS = Full HTTPs (Cert. Import from local eBlocker appliance)
- Android-TV = Limited (because Nvidia Shield does not support import from certificates)
- Ubuntu = Full HTTPs (Cert. Import from local eBlocker appliance) since it is in front of the Firewall appliance. ^^
- SMART TV = Limited (Samsung old TV does not support import of certificates to decrypt HTTPs Traffic)

OK OK but why not do a Backup of your OS?
It is just a blank Windows 10 Ent. install with a few Privacy Settings here and there... Connected to my Microsoft Account and all my data is in OneDrive / Important stuff in OneDrive Vault! - For me it is just insert USB - Click thru the Setup, Install a few Drivers and Connect my Account. Done! Since I have a 1Gbit connection downloading games is a matter of min. ^^

If someone has questions or improvement options I am all ears. I am not perfect and open to critique ^^

Sincerely
Val.

 

[harlan4096]

@valvaris:

• As for "Disk Imaging Backup", You may add Macrium Reflect Free.
• As for "Virus and Malware Removal Tools", You may add: MalWareBytes Free and EmsiSoft Emergengy Kit

Please kindly reflect Your changes editing Your config, and announcing them here, thanks for sharing

 

[valvaris]

Hello @harlan4096
For a Disk-image Backup even in Golden-State is too much of an effort. [Only on my Setup] - I do not have local files and since all game-saves are saved on the cloud - [Steam,Origin,GoG and EpicLauncher] I do not feel the need for it.
If I need to do Excel-Sheets, Word and so on -> I use Office 365 for it Autosave FTW on the Cloud ^^
I am sorry for not being clear about my Firewall Setup:
- HTTPs Inspection Rules all Traffic gets decrypted on the FW and if OK gets forwarded to my PC that has a certificate installed from my Firewall like this it is trusted on my browser.
- My Webfilter Rules are harsh plus the added advantage of Pi-Hole filters and block Executables and Systemfiles
- The other Part is that my Rules Block untrusted TLS/SSL Cert. or TLS/SSL Cert. that use a low encryption algorithm or standard.
What my goal was is to offload as much as I can to the FW-Appliance.
Second Opinion Scanner?! Is a little too much on my opinion -> Why?
That is the reason I use Sophos Home Premium:
- Hitman Pro + Hitman Alert and more - All in One
and of course Windows Build In Smart Screen and user behavior
Back to the Backup topic:
Is it not easier to make backups an a weekly basis that contains the drivers and such... In one way YES in another NO
For me it is easier to maintain my boot usb with current drivers. (download files - install on current system awww... broken install from usb with last drivers done!) Like this my usb drive always has the last drivers that worked well with the system and it is just a drag and drop. Even with Incremental backups you have to make sure that all incrementals to that point of failure are consistent! And with no external storage HDD/SSD or NAS the other way can be cloud but with 50Mbit/s upload - I do not see a reason for that. ^^
The Windows installation is fast and easy and the OOBE lets me connect fast to my Microsoft Account and Sync files. I not always need everything and since it is possible to setup OneDrive as Files-On-Demand you save huge bandwidth.

Thanks allot for your advice!!! Gave me the opportunity to clarify why it is how it is.

Sincerely
Val.

 

[valvaris]

Hello to all,

I have updated my config - All changes are logged and explained. If something is unclear do not hesitate to ask. I am here to help ^^

Sincerely
Val.