########################################################################### # Honeywall Initial Setup Information # # by # # The Honeynet Project and the Research Alliance # ########################################################################### Last Modified: 18 Augustt, 2005 PURPOSE ======= To document the required information you will need to complete the initial setup of a new Honeywall CDROM installation. 1. GATEWAY ========== 1.1 IP addresses of honeypots 1.2 Network and Broadcast of honeypots 2. MANAGEMENT ============= 2.1 IP address of management interface 2.2 Network and broadcast of management interface 2.3 DNS server of management interface 2.4 Allowed Inbound TCP connections to mgmt interface 2.5 SRC IP addresses/network to mgmt interface 2.6 Allowed Outbound TCP ports 2.7 Allowed Outbound UDP Ports 3. INBOUND ========== 3.1 Whitelist filename and IP's/networks 3.2 Blacklist filename and IP's/networks 4. OUTBOUND =========== 4.1 Interval for counting connections (seconds, minutes, hours, days) 4.2 Number of connections for protocls (TCP, ICMP, UDP, OTHER) 4.3 Fencelist filename and IP's/networks 5. SEBEK ======== 5.1 Sebek packets out bound (Allow,Drop,Log) 5.2 IP address of destination for Sebek packets 5.3 Port destination of Sebek packets 6. MISC ======= 6.1 Enable alerting 6.2 Email address for alerts 6.3 System Hostname