# Wanguard - Guia de preparacao, instalacao e uso
#=================================================================================
# Site do fabricante: https://www.andrisoft.com/
#
#Agradecimentos:
# Proprietario desta conta git
# Raphael Rodrigues
# Contatos:
# - Site..........: https://raphaelisp.com.br/
# - Site..........: https://flowspec.net.br/
# - WhatsApp / Tel: +55 22 99999-0768
# - Youtube.......: https://www.youtube.com/@raphaelisp
# - Instagram.....: https://www.instagram.com/raphaelispconnect/
#
# Patrick Brandao, Gran-Mestre Supremo em Network e Linux User Power Full
# Contatos:
# - Site..........: http://patrickbrandao.com/
# - WhatsApp / Tel: +55 31 9 8405-2336
# - Youtube.......: https://www.youtube.com/@tol83
# - Instagram.....: https://www.instagram.com/patrickbrd
#
# Referencias:
# https://www.andrisoft.com/de/download
# https://www.andrisoft.com/download/debian11
# https://www.andrisoft.com/download/debian12
#
# Requisitos para uso do software:
# Maquina virtual ou Baremetal (recomendado, ligar direto na borda)
# RAM......: 128 GB (se for VM, colocar como reservada)
# CPU......: o maximo possivel de nucleos
# HD.......: 256 GB (minimo, SSD ou NVME)
# REDE.....: 10gbit (1 gb e' inadimissivel)
#
#
# Voce pode instalar em maquina/vm inferior: pode
# Voce deve: NAO. Vai faltar recursos e rapidez
# e normalmente quem faz esse tipo de
# porcaria sempre culpa o software,
# nunca a sua propria avareza.
#
# Sistema operacional: Debian 13 64 bits
# Utilize a ISO 64 bits NETINSTALL
#
# Durante a instalacao:
# - IP fixo SEMPRE, nao use DHCP
# - Coloque IPv4 e IPv6
# - NAO INSTALE X-WINDOW (Interface Grafica)
# - Instale: SSH e ferramentas do sistema
#
# Recomendado para maximo de aproveitamento:
# - opcional....: gerencia em interface de 1g ou 10g (NAO MANDE FLOW AQUI)
# - obrigatorio.: colega de FLOW numa interface de 10g
# - opcional....: porta de 10g ou 40/100g para receber trafego de port-mirror
#
# Para melhor visualizacao do trafego de entrada, e' recomendado
# que todos os links cheguem em um switch de alta capacidade
# e que sejam entregues ao BGP ligado nesse switch
# Esse tipo de ligacao permite que o port-mirror seja ativado
# no switch para enviar uma copia fiel do trafego de entrada
# ao WanGuard
# O Flow/NetFlow/sFlow nao e' o trafego de entrada real, e sim
# um resumo/amostra/abstracao do trafego.
# Obrigatorio: sincronismo NTP em TODOS os equipamentos envolvidos
# Recomendado: usar o WanGuard como servidor NTP para que o relogio
# dele e de todos os equipamentos sejam sincronizados
# fielmente
#
# Begin :)
apt-get -y update
apt-get -y upgrade
# Instalar pacotes
apt-get -y install apt-transport-https build-essential gnupg wget ntpsec unzip curl net-tools tcpdump
#SNMP
apt install -y snmpd snmp snmptrapd libsnmp-base libsnmp-dev
#SMP - NUMA
apt-get -y install numactl coreutils htop numactl numatop
# time-zone
apt-get -y install ntpsec-ntpdate systemd-timesyncd
# Sincronismo data hora
timedatectl set-timezone America/Sao_Paulo
ntpdate a.ntp.br
# config de data hora:
(
echo
echo '[Time]'
echo 'NTP=200.160.0.8'
echo 'FallbackNTP=2001:12ff::8'
echo '#RootDistanceMaxSec=5'
echo '#PollIntervalMinSec=32'
echo '#PollIntervalMaxSec=2048'
echo
) > /etc/systemd/timesyncd.conf
# Atualizar timectl:
timedatectl set-ntp true
timedatectl status
# repositorios
wget -O - https://www.andrisoft.com/keyring.key | gpg --dearmor --yes --output /usr/share/keyrings/andrisoft-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/andrisoft-keyring.gpg] https://packages.andrisoft.com trixie main" > /etc/apt/sources.list.d/andrisoft.list
# Instalar pacotes essenciais:
apt update
apt-get -y install wanbgp python3-pip exabgp wanconsole wansupervisor wanfilter mariadb-server
# Fixar timezone no PHP 8 (coloque o mesmo timezone do sistema)
sed -i 's#;date.timezone.*#date.timezone=America/Sao_Paulo#g' \
/etc/php/8.4/apache2/php.ini \
/etc/php/8.4/cli/php.ini
# Config do apache:
sed -i 's#/var/www/html#/opt/andrisoft/webroot#g' /etc/apache2/sites-available/000-default.conf
ln -sf /opt/andrisoft/etc/andrisoft_apache.conf /etc/apache2/conf-enabled/andrisoft_apache.conf
# Ajustes MariaDB safe.cnf
(
echo
echo '[mysqld_safe]'
echo 'nice = 0'
echo 'skip_log_error'
echo 'syslog'
echo "timezone='America/Sao_Paulo'"
echo
) > /etc/mysql/mariadb.conf.d/50-mysqld_safe.cnf
# Adicionando senha root
mysqladmin -u root password W4ngu4rd1
# Ajustes MariaDB server.cnf
(
echo
echo '[server]'
echo
echo '[mysqld]'
echo 'user = mysql'
echo 'pid-file = /run/mysqld/mysqld.pid'
echo 'basedir = /usr'
echo 'datadir = /var/lib/mysql'
echo 'tmpdir = /tmp'
echo 'lc-messages-dir = /usr/share/mysql'
echo 'lc-messages = en_US'
echo 'skip-name-resolve'
echo 'skip-external-locking'
echo 'bind-address = 127.0.0.1'
echo 'bind-address = IP-DO-SERVIDOR'
echo 'expire_logs_days = 10'
echo 'character-set-server = utf8mb4'
echo 'collation-server = utf8mb4_general_ci'
echo
echo '# Tuning, 4x'
echo 'key_buffer_size = 512M'
echo 'max_allowed_packet = 1G'
echo 'thread_stack = 2048K'
echo 'thread_cache_size = 32'
echo 'max_connections = 512'
echo 'table_cache = 512'
echo
echo 'table_open_cache = 512'
echo 'sort_buffer_size = 2M'
echo 'read_buffer_size = 2M'
echo 'read_rnd_buffer_size = 8M'
echo 'myisam_sort_buffer_size = 64M'
echo 'query_cache_size = 32M'
echo 'thread_concurrency = 16'
echo
echo '[embedded]'
echo '[mariadb]'
echo '[mariadb-10.11]'
echo
) > /etc/mysql/mariadb.conf.d/50-server.cnf
# Reiniciar MariaDB
systemctl restart mariadb
# Senha Mariadb
mysqladmin -u root password W4ngu4rd1
# Instalar o banco de dados inicial do MariaDB
mysql_secure_installation
# Reiniciar servicos dependentes:
systemctl restart mariadb
systemctl restart apache2
# Sem banner:
echo -n > /etc/motd
rm -f /etc/update-motd.d/10-uname
# Criar login andrisoft
export DEBIAN_FRONTEND=noninteractive
mysql -uroot -pW4ngu4rd1 -e "CREATE DATABASE andrisoft;"
#Configuração do wanguard Wizard interativo
/opt/andrisoft/bin/install_console
/opt/andrisoft/bin/install_supervisor
systemctl start WANsupervisor
systemctl enable WANsupervisor
#influxdb
wget https://repos.influxdata.com/debian/packages/influxdb_1.12.2-1_amd64.deb
dpkg -i ./influxdb_1.12.2-1_amd64.deb
cp /etc/influxdb/influxdb.conf /etc/influxdb/influxdb.conf.backup
cp /opt/andrisoft/etc/influxdb.conf /etc/influxdb/influxdb.conf
systemctl restart influxdb
/opt/andrisoft/bin/install_influxdb
# SysCTL - Tuning universal
#=================================================================================
(
echo "net.core.rmem_default=31457280"
echo "net.core.wmem_default=31457280"
echo "net.core.rmem_max=134217728"
echo "net.core.wmem_max=134217728"
echo "net.core.netdev_max_backlog=250000"
echo "net.core.optmem_max=33554432"
echo "net.core.default_qdisc=fq"
echo "net.core.somaxconn=4096"
) > /etc/sysctl.d/051-net-core.conf
(
echo "net.ipv4.tcp_sack = 1"
echo "net.ipv4.tcp_timestamps = 1"
echo "net.ipv4.tcp_low_latency = 1"
echo "net.ipv4.tcp_max_syn_backlog = 8192"
echo "net.ipv4.tcp_rmem = 4096 87380 67108864"
echo "net.ipv4.tcp_wmem = 4096 65536 67108864"
echo "net.ipv4.tcp_mem = 6672016 6682016 7185248"
echo "net.ipv4.tcp_congestion_control=htcp"
echo "net.ipv4.tcp_mtu_probing=1"
echo "net.ipv4.tcp_moderate_rcvbuf =1"
echo "net.ipv4.tcp_no_metrics_save = 1"
) > /etc/sysctl.d/052-net-tcp-ipv4.conf
echo "net.ipv4.ip_local_port_range=1024 65535" > /etc/sysctl.d/056-port-range-ipv4.conf
echo "net.ipv4.ip_default_ttl=128" > /etc/sysctl.d/062-default-ttl-ipv4.conf
(
echo "net.ipv4.neigh.default.gc_interval = 30"
echo "net.ipv4.neigh.default.gc_stale_time = 60"
echo "net.ipv4.neigh.default.gc_thresh1 = 4096"
echo "net.ipv4.neigh.default.gc_thresh2 = 8192"
echo "net.ipv4.neigh.default.gc_thresh3 = 12288"
echo "net.ipv4.ipfrag_high_thresh=4194304"
echo "net.ipv4.ipfrag_low_thresh=3145728"
echo "net.ipv4.ipfrag_max_dist=64"
echo "net.ipv4.ipfrag_secret_interval=0"
echo "net.ipv4.ipfrag_time=30"
) > /etc/sysctl.d/063-neigh-ipv4.conf
(
echo "net.ipv6.neigh.default.gc_interval = 30"
echo "net.ipv6.neigh.default.gc_stale_time = 60"
echo "net.ipv6.neigh.default.gc_thresh1 = 4096"
echo "net.ipv6.neigh.default.gc_thresh2 = 8192"
echo "net.ipv6.neigh.default.gc_thresh3 = 12288"
echo "net.ipv6.ip6frag_high_thresh=4194304"
echo "net.ipv6.ip6frag_low_thresh=3145728"
echo "net.ipv6.ip6frag_secret_interval=0"
echo "net.ipv6.ip6frag_time=60"
) > /etc/sysctl.d/064-neigh-ipv6.conf
echo "net.ipv4.conf.default.forwarding=1" > /etc/sysctl.d/065-default-foward-ipv4.conf
echo "net.ipv6.conf.default.forwarding=1" > /etc/sysctl.d/066-default-foward-ipv6.conf
echo "net.ipv4.conf.all.forwarding=1" > /etc/sysctl.d/067-all-foward-ipv4.conf
echo "net.ipv6.conf.all.forwarding=1" > /etc/sysctl.d/068-all-foward-ipv6.conf
echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/069-ipv4-forward.conf
(
echo "fs.file-max = 3263776"
echo "fs.aio-max-nr=3263776"
echo "fs.mount-max=1048576"
echo "fs.mqueue.msg_max=128"
echo "fs.mqueue.msgsize_max=131072"
echo "fs.mqueue.queues_max=4096"
echo "fs.pipe-max-size=8388608"
) > /etc/sysctl.d/072-fs-options.conf
echo "vm.swappiness=1" > /etc/sysctl.d/073-swappiness.conf
echo "vm.vfs_cache_pressure=50" > /etc/sysctl.d/074-vfs-cache-pressure.conf
echo "kernel.panic=3" > /etc/sysctl.d/081-kernel-panic.conf
echo "kernel.threads-max=1031306" > /etc/sysctl.d/082-kernel-threads.conf
echo "kernel.pid_max=262144" > /etc/sysctl.d/083-kernel-pid.conf
echo "kernel.msgmax=327680" > /etc/sysctl.d/084-kernel-msgmax.conf
echo "kernel.msgmnb=655360" > /etc/sysctl.d/085-kernel-msgmnb.conf
echo "kernel.msgmni=32768" > /etc/sysctl.d/086-kernel-msgmni.conf
echo "vm.min_free_kbytes = 32768" > /etc/sysctl.d/087-kernel-free-min-kb.conf
# Aplicar:
sysctl -p 2>/dev/null 1>/dev/null
sysctl --system 2>/dev/null 1>/dev/null
# Licenciamento do WanGuard
#=================================================================================
# Acesse:
# https://www.andrisoft.com/store/user/form
#
# E crie uma conta.
#
# Confirme o email de ativacao da conta
#
# Acesse seu servidor via HTTP (nao e' https), porta 80
#
# Vai aparecer a tela do wanguard com o checklist da instalacao
#
# Observe o botao "Upload License Key", precisa usar ele para
# fazer upload da licenca.
#
# 1 - Licenca TRIAL
# Acesse: https://www.andrisoft.com/trial/registration
#
# Preencha o formulario com dados empresariais
#
# Aguarde a licenca de teste no seu e-mail
#
# 2 - Licencas:
# Acesse: https://www.andrisoft.com/store/software
#
# Tipos:
# - Wanguard Sensor license (~ $595)
# - base inicial para anti-ddos
# - monitoramento passivo (netflow, snmp)
# - flowspec-bgp e blackhole-bgp
#
# - Wanguard Filter license (~ $995)
# - permite usar o recurso netfilter/iptables para filtragem
# no proprio wanguard
#
# - Wansight Sensor license (~ $300)
# - somente monitoramento passivo (netflow, snmp)
#
# - DPDK Engine license (~ $1410)
# - semelhante ao Filter mas com DPDK (40g+ trafego)
#
# Primeiro acesso: http://IP-DO-SERVIDOR/
# Login e senha padrao:
# admin / changeme
#
# Mudar senha em:
# - no canto SUPERIOR DIREITO, click no icone do login "admin"
# tem o menu "Change Password"
# > informe a nova senha
# Peering entre o roteador e o WanGuard para injecao BGP (ipv4 e flowspec)
#=================================================================================
# Exemplo HUAWEI (ignore erros)
#---------------------------------------------------------------------------------
route-policy ACCEPT-ALL permit node 65535
#
route-policy DENY-ALL deny node 65535
#
bgp 65001
peer IP-WANGUARD as-number 65001
peer IP-WANGUARD description WANGUARD-IPV4
peer IP-WANGUARD connect-interface LoopBack0
peer IP-WANGUARD timer connect-retry 1
ipv4-family unicast
peer IP-WANGUARD enable
y
peer IP-WANGUARD route-policy ACCEPT-ALL import
peer IP-WANGUARD route-policy DENY-ALL export
peer IP-WANGUARD advertise-community
peer IP-WANGUARD advertise-ext-community
peer IP-WANGUARD advertise-large-community
peer IP-WANGUARD reflect-client
ipv4-family flow
peer IP-WANGUARD enable
y
peer IP-WANGUARD redirect ip rfc-compatible
peer IP-WANGUARD route-policy ACCEPT-ALL import
peer IP-WANGUARD route-policy DENY-ALL export
peer IP-WANGUARD validation-disable
peer IP-WANGUARD advertise-community
peer IP-WANGUARD advertise-large-community
peer IP-WANGUARD reflect-client
route validation-mode include-as
#
commit
run save
y
# Sincronizar data/hora via NTP (usar o proprio WanGuard como NTP Server)
#========================================================================
ntp-service server disable
y
ntp-service ipv6 server disable
y
ntp-service server source-interface all disable
y
ntp-service ipv6 server source-interface all disable
y
# IP de origem padrao de requisicoes NTP:
ntp-service source-interface LoopBack 0
ntp-service ipv6 source-interface LoopBack0
# Usando WanGuard local - Via IPv4
ntp-service unicast-peer IP-WANGUARD source-interface LoopBack 0
# Usando WanGuard local - Via IPv6
ntp-service unicast-peer ipv6 IP-WANGUARD-V6 source-interface LoopBack0
# Via IPv4 em NTP publico (use uma interface que tenha ipv4 publico navegavel)
#ntp-service unicast-peer 200.160.0.8 source-interface LoopBack0
#ntp-service unicast-peer 200.189.40.8 source-interface LoopBack0
# Via IPv6 em NTP publico (use uma interface que tenha ipv6 global navegavel)
#ntp-service unicast-peer ipv6 2001:12F8:9:1::8 source-interface LoopBack0
#ntp-service unicast-peer ipv6 2001:12FF::8 source-interface LoopBack0
commit
run save
y
# Config netstream geral
#========================================================================
ip netstream as-mode 32
ip netstream timeout active 1
ip netstream timeout inactive 15
ip netstream tcp-flag enable
ip netstream export version ipfix peer-as bgp-nexthop ttl
ip netstream export template sequence-number fixed
ip netstream export index-switch 32
ip netstream export template timeout-rate 1
ip netstream sampler fix-packets 1000 inbound
ip netstream sampler fix-packets 1000 outbound
ip netstream export template option sampler
ip netstream export template option application-label
#
ipv6 netstream as-mode 32
ipv6 netstream timeout active 1
ipv6 netstream timeout inactive 15
ipv6 netstream tcp-flag enable
ipv6 netstream export version ipfix peer-as bgp-nexthop ttl
ipv6 netstream export template sequence-number fixed
ipv6 netstream export index-switch 32
ipv6 netstream export template timeout-rate 1
ipv6 netstream sampler fix-packets 1024 inbound
ipv6 netstream sampler fix-packets 1024 outbound
ipv6 netstream export template option sampler
#
# Ativar CPU para flow na controladora
#========================================================================
# F1A:
slot 1
ip netstream sampler to slot self
ipv6 netstream sampler to slot self
commit
# NE 8000 M8
slot 10
ip netstream sampler to slot self
ipv6 netstream sampler to slot self
commit
# Exemplo JUNIPER (ignore erros)
#---------------------------------------------------------------------------------
# Segue dados para estabelecer peer bgp entre Juniper e wanguard.
# Lado Juniper MX204
set routing-options flow term-order standard
set policy-options community wanguard_flowspec members 64496:500
set policy-options community wanguard_flowspec members 64496:500
set policy-options policy-statement flowspec_import term flowspec_in from community wanguard_flowspec
set policy-options policy-statement flowspec_import term flowspec_in from community wanguard_flowspec
set policy-options policy-statement flowspec_import term flowspec_in then accept set routing-options flow term-order standard
set policy-options policy-statement flowspec_import term flowspec_in then accept
set protocols bgp group WANGUARD neighbor IP-BGP local-address IP-PEER
set protocols bgp group WANGUARD family inet flow
set protocols bgp group WANGUARD family inet flow no-validate flowspec_import
set protocols bgp group WANGUARD type internal
set protocols bgp group WANGUARD local-address IP-ROTEADOR
set protocols bgp group WANGUARD family inet unicast
set protocols bgp group WANGUARD family inet flow no-validate flowspec_import
set protocols bgp group WANGUARD neighbor IP-WANGUARD description IBGP_WANGUARD
set protocols bgp group WANGUARD neighbor IP-WANGUARD local-address IP-ROTEADOR
set protocols bgp group WANGUARD neighbor IP-WANGUARD import flowspec_import
set protocols bgp group WANGUARD neighbor IP-WANGUARD family inet flow prefix-limit maximum 100
set protocols bgp group WANGUARD neighbor IP-WANGUARD family inet flow no-validate flowspec_import
set protocols bgp group WANGUARD neighbor IP-WANGUARD family inet flow legacy-redirect-ip-action receive
set protocols bgp group WANGUARD neighbor IP-WANGUARD export deny-all
set protocols bgp group WANGUARD neighbor IP-WANGUARD peer-as ASN-WANGUARD
# *La no MX, confirmar as configs de netflow.*
set forwarding-options sampling instance WANGUARD family inet output flow-inactive-timeout 15
set forwarding-options sampling instance WANGUARD family inet output flow-active-timeout 60
set forwarding-options sampling instance WANGUARD family inet output flow-server IP-WANGUARD port 2055
set forwarding-options sampling instance WANGUARD family inet output flow-server IP-WANGUARD autonomous-system-type origin
set forwarding-options sampling instance WANGUARD family inet output flow-server IP-WANGUARD version-ipfix template WANGUARD
set forwarding-options sampling instance WANGUARD family inet6 output flow-inactive-timeout 15
set forwarding-options sampling instance WANGUARD family inet6 output flow-active-timeout 60
set forwarding-options sampling instance WANGUARD family inet6 output flow-server IP-WANGUARD port 2055
set forwarding-options sampling instance WANGUARD family inet6 output flow-server IP-WANGUARD autonomous-system-type originset
set forwarding-options sampling instance WANGUARD family inet6 output flow-server IP-WANGUARD version-ipfix template WANGUARD-v6
-
set services flow-monitoring version-ipfix template FLOW flow-active-timeout 15
set services flow-monitoring version-ipfix template FLOW flow-inactive-timeout 15
set services flow-monitoring version-ipfix template FLOW template-refresh-rate seconds 30
set services flow-monitoring version-ipfix template FLOW option-refresh-rate seconds 30
set services flow-monitoring version-ipfix template FLOW ipv4-template
set services flow-monitoring version-ipfix template FLOW-v6 flow-active-timeout 15
set services flow-monitoring version-ipfix template FLOW-v6 flow-inactive-timeout 15
set services flow-monitoring version-ipfix template FLOW-v6 template-refresh-rate seconds 30
set services flow-monitoring version-ipfix template FLOW-v6 option-refresh-rate seconds 30
set services flow-monitoring version-ipfix template FLOW-v6 ipv6-template
set forwarding-options sampling instance FLOW family inet output flow-server IP-WANGUARD port 2056
set forwarding-options sampling instance FLOW family inet output flow-server IP-WANGUARD autonomous-system-type origin
set forwarding-options sampling instance FLOW family inet output flow-server IP-WANGUARD version-ipfix template WANGUARD
set forwarding-options sampling instance FLOW-V6 family inet6 output flow-server IP-WANGUARD port 2056
set forwarding-options sampling instance FLOW-V6 family inet6 output flow-server IP-WANGUARD autonomous-system-type origin
set forwarding-options sampling instance FLOW-V6 family inet6 output flow-server IP-WANGUARD version-ipfix template WANGUARD-v6
set policy-options prefix-list ntp-servers
set policy-options prefix-list ntp-servers 200.189.40.8/32
set firewall family inet filter protect-re term aceita-ntp from prefix-list ntp-servers
set firewall family inet filter protect-re term aceita-ntp from prefix-list localhost
set firewall family inet filter protect-re term aceita-ntp from protocol udp
set firewall family inet filter protect-re term aceita-ntp from port ntp
set firewall family inet filter protect-re term aceita-ntp then policer limit-32k
set firewall family inet filter protect-re term aceita-ntp then accept
# *Recomendo adicionar export netflow somente nas interfaces UPLINK e Troca de Trafego - Ex transito IP, IXBR, CDN, PNI, IX Internacional*
# Exemplo CISCO (ignore erros)
#---------------------------------------------------------------------------------
# Segue dados para estabelecer peer bgp entre CISCO e wanguard.
ip nat log translations flow-export v9 udp destination IPDOCOLETADOR 2055
ip nat translation timeout 700
ip nat translation tcp-timeout 100
ip nat translation pptp-timeout 200
ip nat translation udp-timeout 100
ip nat translation finrst-timeout 30
ip nat translation syn-timeout 30
ip nat translation dns-timeout 30
ip nat translation routemap-entry-timeout 30
ip nat translation icmp-timeout 10
ip nat translation port-timeout tcp 443 300
ip nat translation port-timeout udp 443 300
flow record IPDOCOLETADOR
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
collect interface output
collect counter bytes
collect counter packets
export-protocol netflow-v9
Fim 🙂
Você ou seu time querem entender mais sobre mitigação DDoS na prática? Comenta ou me chama no privado.
DDoS moderno não é apenas sobre gigabits por segundo.
É sobre engenharia ofensiva contra redes mal preparadas.
Se você é ISP e ainda depende apenas de firewall tradicional, é apenas uma questão de tempo.
O perfil de ataque está mudando — e a forma de mitigar também.
Abraço.
Raphael
_ _
°v° 🐧😎
/(_)\ https://flowspec.net.br
^ ^
