Prerequisites

Before setting up your web server and securing your network, you'll need the proper Cisco hardware and supporting software to create a reliable and isolated environment. Below are the specific prerequisites:

• Cisco ASA 5520 firewall (or similar model)
• Cisco 2911 router (for VLANs and routing)
• Cisco 2960X or 2960G managed switch (for network segmentation)
• A SOHO router with IP passthrough or bridge mode enabled
• An old laptop or PC running Ubuntu Server for hosting the website
• A registered domain name, preferably managed through Cloudflare for DNS and security
• Basic knowledge of networking, VLANs, ACLs, and Linux administration

Setting Up the Web Server

To host your website, you'll need to set up a web server on your old laptop or PC running Ubuntu Server. This guide will use Apache as the web server software.

• Update the system to ensure all packages are up to date:

sudo apt update && sudo apt upgrade -y

📋 Copy
• Install Apache:

sudo apt install apache2 -y

📋 Copy
• Enable and start the Apache service:

sudo systemctl enable apache2
sudo systemctl start apache2

📋 Copy
• Adjust firewall settings to allow web traffic:

sudo ufw allow 'Apache Full'
sudo ufw enable

📋 Copy
• Verify that Apache is running:

systemctl status apache2

📋 Copy
• Test the server by opening a web browser and navigating to:

http://your-server-ip

📋 Copy

If everything is set up correctly, you should see the default Apache welcome page.

Configuring the SOHO Router for IP Passthrough

To allow your Cisco ASA firewall to handle external network traffic, you need to configure your SOHO router to use IP passthrough (also called Bridge Mode on some devices). This setup ensures that your firewall receives a public IP from your ISP instead of a private NAT address.

Steps to Enable IP Passthrough:

• Log in to your SOHO router’s web interface. Typically, you can access it by navigating to:

http://192.168.1.1

📋 Copy
• Locate the **IP Passthrough** or **Bridge Mode** option under the WAN or LAN settings.
• Select the port number that your firewall is connected to, or choose Manual/Fixed MAC Address and enter the MAC address of your Cisco ASA firewall's external interface.
• Using the port number method ensures that any device plugged into that port will be on its own network. This approach allows for flexibility—if you replace your firewall in the future, you won’t need to reconfigure the router settings.
• Set the passthrough mode to **DHCPS-fixed** (or equivalent, depending on your router).
• Save the settings and reboot the router.
• Before verifying, ensure your ASA firewall is configured to obtain an IP address from the ISP using DHCP. If not, set the interface to acquire an IP dynamically:

interface GigabitEthernet0/0
ip address dhcp setroute
no shutdown

📋 Copy
• Once configured, verify that your ASA firewall is receiving a public IP address by checking the interface status:

show interface ip brief

📋 Copy

Setting Up the ASA Firewall

The Cisco ASA firewall will act as the primary security barrier between your internal network and the internet. In this section, we will configure the basic settings, interfaces, and security levels.

Step 1: Configure the Interfaces

Set up the outside (WAN) and inside (LAN) interfaces:

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address dhcp setroute
 no shutdown

interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 10.20.1.1 255.255.255.0
 no shutdown

Step 2: Enable DHCP for Internal Network

Set up the ASA as a DHCP server for devices on the inside network:

dhcpd address 10.20.1.100-10.20.1.200 inside
dhcpd enable inside

Step 3: Configure NAT/PAT

Enable dynamic NAT for internal devices to access the internet:

object network inside-net
 subnet 10.20.1.0 255.255.255.0
 nat (inside,outside) dynamic interface

Step 4: Allow HTTP/HTTPS Traffic to the Web Server

Set up ACL rules to allow public access to your web server:

access-list OUTSIDE_IN permit tcp any host 10.20.1.10 eq 80
access-list OUTSIDE_IN permit tcp any host 10.20.1.10 eq 443
access-group OUTSIDE_IN in interface outside

Step 5: Save the Configuration

Ensure the changes persist after a reboot:

write memory

Once complete, your ASA firewall should be configured to manage both internal network security and external access to your web server.

Configuring the Router and VLANs

The router will handle inter-VLAN routing and provide network segmentation. We'll configure VLANs, assign IP addresses, and enable DHCP.

Step 1: Create VLANs

Define the VLANs on the router:

vlan 10
 name Web_Server
vlan 20
 name Internal_Network

Step 2: Assign VLANs to Interfaces

Assign switch ports to VLANs:

interface GigabitEthernet1/1
 switchport mode access
 switchport access vlan 10

interface GigabitEthernet1/2
 switchport mode access
 switchport access vlan 20

Step 3: Configure Trunking

Enable trunking on the router interface to communicate with VLANs:

interface GigabitEthernet0/0
 switchport mode trunk

Step 4: Configure Inter-VLAN Routing

Assign IP addresses for inter-VLAN communication:

interface GigabitEthernet0/1.10
 encapsulation dot1Q 10
 ip address 10.20.10.1 255.255.255.0

interface GigabitEthernet0/1.20
 encapsulation dot1Q 20
 ip address 10.20.20.1 255.255.255.0

Step 5: Enable DHCP for Internal Network

Set up DHCP to assign IPs to devices in VLAN 20:

ip dhcp pool VLAN20
 network 10.20.20.0 255.255.255.0
 default-router 10.20.20.1

After these configurations, your router will handle VLAN routing, assign DHCP addresses, and provide network segmentation.

Configuring the Switch

The switch will handle VLAN segmentation and trunking between the router and connected devices. We will configure VLANs, assign ports, and enable trunking.

Step 1: Create VLANs on the Switch

Define VLANs to match those configured on the router:

vlan 10
 name Web_Server
vlan 20
 name Internal_Network

Step 2: Assign Ports to VLANs

Configure access ports for devices connecting to specific VLANs:

interface GigabitEthernet1/1
 switchport mode access
 switchport access vlan 10

interface GigabitEthernet1/2
 switchport mode access
 switchport access vlan 20

Step 3: Configure Trunking Between Switch and Router

Enable trunking to allow VLAN traffic between the switch and router:

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20

Step 4: Enable Spanning Tree Protocol (Optional)

Prevent network loops by enabling Spanning Tree Protocol (STP):

spanning-tree vlan 10,20 priority 4096

Step 5: Save the Configuration

Ensure the changes persist after a reboot:

write memory

With these configurations, your switch will properly segment network traffic and facilitate VLAN communication with the router.

Setting Up NAT/PAT for External Access

To allow internal devices to access the internet and map external requests to your web server, we will configure NAT (Network Address Translation) and PAT (Port Address Translation) on the ASA firewall.

Step 1: Configure Dynamic NAT for Internal Network

Enable dynamic NAT so that internal devices can access the internet using the ASA's public IP:

object network inside-net
 subnet 10.20.1.0 255.255.255.0
 nat (inside,outside) dynamic interface

Step 2: Configure Static NAT for Web Server

Map an external public IP to your internal web server so it is accessible from the internet:

object network web-server
 host 10.20.1.10
 nat (inside,outside) static interface service tcp 80 80
 nat (inside,outside) static interface service tcp 443 443

Step 3: Allow HTTP/HTTPS Traffic from the Internet

Create an access control list (ACL) to permit incoming web traffic:

access-list OUTSIDE_IN permit tcp any host 10.20.1.10 eq 80
access-list OUTSIDE_IN permit tcp any host 10.20.1.10 eq 443
access-group OUTSIDE_IN in interface outside

Step 4: Verify NAT Translations

Check active NAT translations to confirm proper configuration:

show xlate

Step 5: Save the Configuration

Ensure your settings persist after a reboot:

write memory

Once complete, your ASA firewall will translate internal network requests for external access and allow public HTTP/HTTPS traffic to reach your web server securely.

Implementing Access Control Lists (ACLs)

Access Control Lists (ACLs) help secure your network by defining which traffic is allowed or denied. In this section, we will configure ACLs on the ASA firewall to control access to internal resources.

Step 1: Deny Unwanted Traffic from the Internet

To block unnecessary or potentially malicious traffic, create an ACL that denies all inbound traffic except for permitted services:

access-list OUTSIDE_IN deny ip any any log

Step 2: Permit Web Traffic to the Web Server

Allow only HTTP (port 80) and HTTPS (port 443) traffic from the internet to your web server:

access-list OUTSIDE_IN permit tcp any host 10.20.1.10 eq 80
access-list OUTSIDE_IN permit tcp any host 10.20.1.10 eq 443

Step 3: Permit Internal Network Traffic to the Internet

Allow devices on the internal network to access the internet:

access-list INSIDE_OUT permit ip any any

Step 4: Apply the ACLs to the Interfaces

Bind the ACLs to the appropriate interfaces:

access-group OUTSIDE_IN in interface outside
access-group INSIDE_OUT in interface inside

Step 5: Verify ACLs

Check the active ACLs to ensure they are correctly applied:

show access-list

Step 6: Save the Configuration

Ensure the ACLs persist after a reboot:

write memory

With these ACLs in place, your ASA firewall will filter traffic effectively, allowing only authorized requests while blocking potentially harmful connections.

Configuring Cloudflare for Security and DNS

Cloudflare provides DNS management, security features, and performance enhancements for your website. This section will guide you through setting up Cloudflare to protect and optimize your self-hosted website.

Step 1: Add Your Domain to Cloudflare

To get started, sign up for a Cloudflare account and add your domain:

1. Go to Cloudflare Signup and create an account.
2. Enter your domain name (e.g., yourdomain.com) and click Continue.
3. Select a Cloudflare plan (the free plan is sufficient for basic protection).

Step 2: Update Your DNS Records

Cloudflare will scan for existing DNS records. Ensure you have the following entries:

• A Record: Pointing your domain to your public IP address.
• CNAME Record: (Optional) If you have subdomains.

Example DNS Configuration:

A  @       203.0.113.10  (Your Public IP)
A  www     203.0.113.10  (Your Public IP)

Ensure the Proxy Status is enabled (orange cloud ☁️) to route traffic through Cloudflare.

Step 3: Configure SSL/TLS Encryption

To secure your website, configure SSL settings:

1. Navigate to SSL/TLS in the Cloudflare dashboard.
2. Set the encryption mode to Full (Strict) for the highest security.

Step 4: Enable Firewall Rules for Additional Security

To protect your site from malicious traffic, set up firewall rules:

1. Go to Firewall > Firewall Rules.
2. Create a new rule to allow only specific countries or block certain threats.
3. Example: Block all traffic except your country.

Step 5: Optimize Performance with Cloudflare Caching

Enable caching to improve load times:

1. Go to Caching in the Cloudflare dashboard.
2. Set the cache level to Standard to store static content.

Step 6: Verify Cloudflare is Active

Check that Cloudflare is correctly routing traffic to your server:

nslookup yourdomain.com
dig yourdomain.com +short

Step 7: Save and Test

Once all settings are configured:

• Visit your website (https://yourdomain.com) and verify it loads properly.
• Use Cloudflare’s Analytics to monitor traffic and security threats.

By setting up Cloudflare, your self-hosted website will benefit from enhanced security, DDoS protection, and performance optimization.

Testing and Verifying the Setup

After configuring your network and web server, it’s crucial to test connectivity, security, and performance to ensure everything is working as expected.

Step 1: Verify Web Server Accessibility

Check if your web server is accessible from a browser by entering:

http://yourdomain.com

If the page doesn’t load, check if Apache is running:

systemctl status apache2

Step 2: Verify DNS Resolution

Ensure your domain is correctly pointing to your server:

nslookup yourdomain.com
dig yourdomain.com +short

Step 3: Test Firewall and NAT Rules

Check that NAT and ACLs are functioning correctly on the ASA firewall:

show xlate
show nat

Verify applied access control lists:

show access-list

Step 4: Test External Connectivity

Check if your server is reachable from outside your network:

ping yourdomain.com

Step 5: Scan for Open Ports

Ensure only the necessary ports are open:

nmap -Pn yourdomain.com

Step 6: Verify Cloudflare Protection

Check if Cloudflare is active by running:

curl -I https://yourdomain.com

Look for the header server: cloudflare in the response.

Step 7: Save and Monitor Logs

Ensure all changes persist after a reboot:

write memory

Monitor system logs for any errors:

tail -f /var/log/syslog

By completing these tests, you can confirm that your web server, firewall, DNS, and security configurations are functioning properly.

Setup SSH for Remote Administration

Secure Shell (SSH) allows remote administration of your server. By changing the default SSH port to 2222, we reduce the risk of automated attacks targeting port 22. This section covers installing, configuring, and securing SSH access.

Step 1: Install and Enable SSH

Ensure OpenSSH is installed on your server:

sudo apt update
sudo apt install openssh-server -y

Enable and start the SSH service:

sudo systemctl enable ssh
sudo systemctl start ssh

Step 2: Change SSH Port to 2222

Edit the SSH configuration file to change the default SSH port:

sudo nano /etc/ssh/sshd_config

Find the line that says:

#Port 22

Uncomment it and change it to:

Port 2222

Save the file (CTRL+X, then Y, then ENTER), then restart SSH to apply the changes:

sudo systemctl restart ssh

Step 3: Allow SSH on Port 2222 in the Firewall

If UFW (Uncomplicated Firewall) is enabled, allow connections on port 2222:

sudo ufw allow 2222/tcp
sudo ufw reload

If using an ASA firewall, allow SSH access with an ACL:

access-list OUTSIDE_IN permit tcp any host 10.20.1.10 eq 2222

Step 4: Connect to the Server via SSH

From another computer, connect using the new SSH port:

ssh -p 2222 [email protected]

Step 5: (Optional) Disable Root Login for Additional Security

To prevent direct root access over SSH, edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

Find the line:

#PermitRootLogin yes

Change it to:

PermitRootLogin no

Save the file and restart SSH:

sudo systemctl restart ssh

Step 6: Verify SSH is Running on Port 2222

Ensure SSH is listening on the correct port:

ss -tln | grep 2222

After completing these steps, your server will be securely accessible via SSH on port 2222, reducing exposure to automated attacks on port 22.

Additional Security

While changing the SSH port improves security, having it open and protected only by a username and password is not ideal. Automated bots constantly scan for open SSH ports and attempt brute-force attacks. To enhance security, we need to monitor access logs, implement Fail2Ban, and restrict SSH access to specific IP addresses.

Step 1: Monitor SSH Login Attempts

Check SSH authentication logs to see if bots are trying to brute-force access:

sudo journalctl -u ssh --no-pager | grep 'Failed password'

or

sudo tail -f /var/log/auth.log

If you notice multiple failed login attempts from different IP addresses, it indicates brute-force attempts, and additional security measures are needed.

Step 2: Install and Configure Fail2Ban

Fail2Ban helps protect against brute-force attacks by banning IPs that fail multiple login attempts.

sudo apt update
sudo apt install fail2ban -y

After installation, create a local Fail2Ban configuration file:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit the configuration file to enable SSH protection:

sudo nano /etc/fail2ban/jail.local

Find the section for SSH and modify it as follows:

[sshd]
enabled = true
port = 2222
maxretry = 5
bantime = 1h
findtime = 10m

This configuration:

• Enables Fail2Ban for SSH
• Sets the SSH port to 2222
• Bans an IP for 1 hour after 5 failed attempts
• Tracks failed attempts within 10 minutes

Save the file (CTRL+X, then Y, then ENTER) and restart Fail2Ban:

sudo systemctl restart fail2ban
sudo systemctl enable fail2ban

Step 3: Restrict SSH Access to Specific IP Addresses

For even tighter security, limit SSH access to trusted IPs using UFW (Uncomplicated Firewall):

sudo ufw allow from YOUR_IP to any port 2222

Replace YOUR_IP with your trusted IP address.

If using an ASA firewall, restrict SSH access with an ACL:

access-list OUTSIDE_IN permit tcp host YOUR_IP host 10.20.1.10 eq 2222

Step 4: Verify SSH Restrictions

After applying the restrictions, test SSH access from an allowed IP:

ssh -p 2222 [email protected]

Then, test SSH from an unauthorized IP to ensure access is denied.

Step 5: Save and Monitor Security Logs

Ensure all changes persist after a reboot:

sudo systemctl restart ssh
sudo systemctl restart fail2ban

Monitor logs to confirm Fail2Ban is blocking unwanted access:

sudo fail2ban-client status sshd

By implementing these additional security measures, you significantly reduce the risk of brute-force attacks and unauthorized SSH access.

Conclusion

Throughout this guide, we’ve successfully set up and secured a self-hosted web server using Cisco networking gear. We covered:

• Installing and configuring an Apache web server on an old PC or laptop.
• Setting up a SOHO router for IP passthrough to delegate public IP handling to the ASA firewall.
• Configuring the Cisco ASA firewall with NAT/PAT, ACLs, and security rules to allow controlled access to the web server.
• Configuring VLANs and inter-VLAN routing on a Cisco router.
• Setting up a Cisco switch for VLAN segmentation and trunking.
• Securing SSH access by changing the default port, enabling Fail2Ban, and restricting connections to trusted IPs.
• Configuring Cloudflare for DNS, security, and performance optimization.
• Testing and verifying the entire setup to ensure connectivity, security, and performance.

Estimated Time to Complete

For someone with a **CCNA-level** understanding of networking and basic Linux administration, completing this setup should take approximately:

• 2-4 hours if you're familiar with Cisco CLI and Linux commands.
• 4-6 hours if you're less experienced and need to troubleshoot along the way.

If you followed each section manually, you should now have a fully functional and secured self-hosted web server. However, if you want to skip the manual configurations and just copy-paste the settings, I've included the **running configurations for the ASA firewall, router, and switch** below.

With this setup, you now have complete control over your web hosting environment while maintaining enterprise-level security. If you’d like to expand further, consider adding:

• Automated backups for your web server.
• Monitoring and alerting systems for security breaches.
• VPN access for secure remote administration.

Thanks for following along! If you have any questions or run into issues, feel free to reach out.

ASA Running Configuration

If you prefer to skip the manual setup, you can copy and paste the following running configuration directly into your ASA.

!ASA running config working (443 & 2222)

! Set hostname
hostname ASA

! Secure authentication
enable secret YOUR_SECURE_PASSWORD
username admin password YOUR_SECURE_PASSWORD privilege 15
enable password YOUR_SECURE_PASSWORD encrypted
passwd YOUR_SECURE_PASSWORD encrypted
names
!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address dhcp setroute
!
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 10.20.1.1 255.255.255.0
!
interface GigabitEthernet0/1.10
 vlan 10
 nameif VLAN10
 security-level 100
 ip address 10.20.10.1 255.255.255.0
!
interface Management0/0
 nameif management
 security-level 50
 ip address 10.20.0.200 255.255.255.0
!
object network INSIDE-NET
 subnet 10.20.1.0 255.255.255.0
object network WEBSERVER
 host 10.20.10.2
object network WEBSERVER-SSH
 host 10.20.10.2
object-group network SSH-ALLOWED-HOSTS
 network-object host 24.141.144.67
 network-object host 107.190.4.196
access-list OUTSIDE-IN extended permit tcp any host 10.20.10.2 eq https
access-list OUTSIDE-IN extended permit tcp any host 10.20.10.2 eq 2222
!
object network INSIDE-NET
 nat (inside,outside) dynamic interface
object network WEBSERVER
 nat (inside,outside) static interface service tcp https https
object network WEBSERVER-SSH
 nat (inside,outside) static interface service tcp 2222 2222
access-group OUTSIDE-IN in interface outside
!
ssh 10.20.0.0 255.255.255.0 management
ssh timeout 30
ssh version 2
write memory

R1 Running Configuration

!R1 running config
Current configuration : 1678 bytes
!
! Last configuration change at 04:27:02 UTC Wed Feb 5 2025
!
version 15.7
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
! card type command needed for slot/vwic-slot 0/0
!
no aaa new-model
!
!
!
!
!
!
!
!
!
ip dhcp excluded-address 10.20.2.1 10.20.2.10
!
ip dhcp pool VLAN10-WEB
 network 10.20.10.0 255.255.255.0
 default-router 10.20.10.1
 dns-server 8.8.8.8
 domain-name weitzman.info
!
ip dhcp pool VLAN2-DHCP
 network 10.20.2.0 255.255.255.0
 dns-server 8.8.8.8
 default-router 10.20.2.10
 lease 7
!
!
!
ip name-server 8.8.8.8
ip name-server 1.1.1.1
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
license udi pid CISCO2911/K9 sn FGL152012VH
!
!
object-group network OBJ-VLAN10
!
!
redundancy
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 ip address 10.20.1.2 255.255.255.0
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 ip address 10.20.2.10 255.255.255.0
 duplex auto
 speed auto
!
interface GigabitEthernet0/1.10
 encapsulation dot1Q 10
 ip address 10.20.10.1 255.255.255.0
!
interface GigabitEthernet0/2
 no ip address
 shutdown
 duplex auto
 speed auto
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 10.20.1.1
!
!
!
!
control-plane
!
!
 vstack
!
line con 0
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 login
 transport input none
!
scheduler allocate 20000 1000
!
end

SW1 Running Configuration

!SW1 running config
	
! Version and System Settings
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname SW1
boot-start-marker
boot-end-marker

! VLAN and Spanning Tree Configuration
spanning-tree mode pvst
spanning-tree extend system-id
vlan internal allocation policy ascending

! VLAN Configuration
vlan 10
 name Web_Server

! Interface Configurations
interface GigabitEthernet0/1
 switchport trunk allowed vlan 1,10
 switchport mode trunk

interface GigabitEthernet0/2
 switchport mode trunk
 shutdown

interface GigabitEthernet0/10
 switchport access vlan 10
 switchport mode access

interface Vlan1
 ip address 10.20.1.100 255.255.255.0

interface Vlan10
 no ip address

! Default Gateway
ip default-gateway 10.20.1.1

! Enable HTTP/HTTPS (Can be disabled for security)
ip http server
ip http secure-server

! SSH Configuration (Will Require a New RSA Key)
ip ssh version 2

! Console and Remote Access Settings
line con 0
 exec-timeout 30 0

line vty 0 4
 login local
 transport input ssh

line vty 5 15
 login

! Save Configuration
write memory