EVD-Q11.4.5 — Segmentation Penetration Test Access

PCI DSS v4.0 Requirement 11.4.5 — Segmentation controls are confirmed via penetration testing at least once every 12 months and after any changes to segmentation controls/methods.

RequirementPCI 11.4.5

Access methodWireGuard VPN

AuditorControlCase (Ganesh + Elswick)

VPN Gatewayfintrix-vpn-gateway

Provisioned2026-07-01

Expires2026-07-31 (auto-revoke)

Scope: Grant time-bounded remote network access to ControlCase auditors so they can execute segmentation penetration tests against the Fintrixs production VPC without exposing CDE components to the public Internet.

1. Design decisions

VPN protocolWireGuard 1.0.20210914

Auth methodCurve25519 key-based

Cipher suiteChaCha20-Poly1305

MFA (PCI 8.5)Key ≡ possession

Split tunnelYes — only VPC routed

Public UDP port51820

Why dedicated droplet (not Collector or K8s pod):

Keeps the pentest access boundary separate from CDE components — auditor's tunnel does not share OS with any scope system
Auto-revoke on 2026-07-31 is trivial (doctl compute droplet delete)
iptables and DO firewall changes on this host don't affect production

2. Architecture

text

+---------------------------------------------------------+
| ControlCase auditors (Ganesh, Elswick, spare)           |
| Public Internet, WireGuard client (Mac/Win/Linux/mobile)|
+-------------------------+-------------------------------+
                          |
                          | UDP 51820 - Curve25519 handshake
                          | ChaCha20-Poly1305 tunnel
                          v
+---------------------------------------------------------+
| fintrix-vpn-gateway (146.190.69.141)                    |
| Ubuntu 24.04, WireGuard 1.0                             |
| Public IPv4 + VPC 10.100.0.4                            |
|                                                          |
|   wg0 interface  10.200.0.1/24                          |
|   iptables NAT (10.200.0.0/24 -> eth0 masquerade)       |
|   fluent-bit -> tcp 10.100.0.10:5141 (Rapid7)           |
+-------------------------+-------------------------------+
                          |
                          | Routing forward (VPC internal)
                          v
+---------------------------------------------------------+
| Production VPC 10.100.0.0/16 (fintrix-production-vpc)   |
|                                                          |
|   Collector          10.100.0.10                        |
|   CDD                10.100.0.11 (Windows - segmented)  |
|   VAPT               10.100.0.12 (Windows - segmented)  |
|   DOKS worker nodes  10.100.0.13-20                     |
|                                                          |
| Pod CIDR 10.116.0.0/16, Service CIDR 10.117.0.0/16      |
+---------------------------------------------------------+

3. Provisioning evidence

doctl compute droplet create fintrix-vpn-gateway

2026-07-01 21:14 UTC

~/fintrix$ doctl compute droplet create fintrix-vpn-gateway \
    --region nyc1 --size s-1vcpu-1gb \
    --image ubuntu-24-04-x64 \
    --vpc-uuid 402acbe1-7336-4fde-ad20-e890013b8214 \
    --ssh-keys 57502860 \
    --tag-names fintrix-vpn,pci-scope,temporary-pentest,segmentation-testing \
    --enable-monitoring --wait

ID           Name                   Public IPv4       Private IPv4    Status
581657192    fintrix-vpn-gateway    146.190.69.141    10.100.0.4      active

Screenshot 1 - Dedicated VPN gateway droplet provisioned in the same VPC as the CDE (10.100.0.0/16)

4. WireGuard server configuration

cat /etc/wireguard/wg0.conf - server config

config file (600 root:root)

# =============================================================================
# Fintrixs — WireGuard VPN Gateway (fintrix-vpn-gateway)
# Purpose: PCI DSS Req 11.4.5 segmentation penetration testing access
# =============================================================================

[Interface]
Address    = 10.200.0.1/24
ListenPort = 51820
PrivateKey = (hidden)

# Enable NAT + forwarding so peers reach VPC 10.100.0.0/16
PostUp   = iptables -A FORWARD -i wg0 -j ACCEPT
PostUp   = iptables -A FORWARD -o wg0 -j ACCEPT
PostUp   = iptables -t nat -A POSTROUTING -s 10.200.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
PostDown = iptables -D FORWARD -o wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -s 10.200.0.0/24 -o eth0 -j MASQUERADE

# ---- Peer 1: Ganesh (ControlCase pentester) ----
[Peer]
PublicKey  = eIJmiryZwlotVQaTxIvooKexOw9EHNZSc9NUkBtYLT4=
AllowedIPs = 10.200.0.2/32

# ---- Peer 2: Elswick (ControlCase QSA) ----
[Peer]
PublicKey  = fgc+99gEXfNVb5VjV8h17ZK+yA0F4WFvH4yD+Vo2LiI=
AllowedIPs = 10.200.0.3/32

# ---- Peer 3: spare (assignable) ----
[Peer]
PublicKey  = OsQ8RFLs1rCVtoZeWgW0aa7Kgq6oD4X23hrsb7nxj1Y=
AllowedIPs = 10.200.0.4/32

Screenshot 2 - Server config with 3 peers pre-provisioned. NAT MASQUERADE for VPC forwarding. Private keys stored 600 root:root under /etc/wireguard/keys/

5. Runtime status — service is active

systemctl is-active wg-quick@wg0 - wg show

2026-07-01 21:16 UTC

root@fintrix-vpn-gateway:~$ systemctl is-active wg-quick@wg0
active

root@fintrix-vpn-gateway:~$ wg show
interface: wg0
  public key: UwGGtaZDpbLgu8v6ulzyyx9FRComd+Tn4H1hi5ZfHFQ=
  private key: (hidden)
  listening port: 51820

peer: eIJmiryZwlotVQaTxIvooKexOw9EHNZSc9NUkBtYLT4=  ← ganesh
  allowed ips: 10.200.0.2/32

peer: fgc+99gEXfNVb5VjV8h17ZK+yA0F4WFvH4yD+Vo2LiI=  ← elswick
  allowed ips: 10.200.0.3/32

peer: OsQ8RFLs1rCVtoZeWgW0aa7Kgq6oD4X23hrsb7nxj1Y=  ← auditor3 (spare)
  allowed ips: 10.200.0.4/32

root@fintrix-vpn-gateway:~$ ss -ulnp | grep 51820
UNCONN 0 0            0.0.0.0:51820      0.0.0.0:*
UNCONN 0 0               [::]:51820         [::]:*

Screenshot 3 - WireGuard interface up, listening on UDP 51820, 3 peers configured

6. Firewall — inbound restricted to VPN + SSH

doctl compute firewall get abefd04a-e795-49f1-97fc-429e610ab064

2026-07-01 21:16 UTC

~/fintrix$ doctl compute firewall get abefd04a-e795-49f1-97fc-429e610ab064

Name: fintrix-vpn-gateway-fw
Status: succeeded
Inbound rules:
  udp:51820  from 0.0.0.0/0, ::/0   ← WireGuard handshake
  tcp:22     from 0.0.0.0/0          ← SSH admin
Outbound rules:
  tcp:all    to 0.0.0.0/0, ::/0
  udp:all    to 0.0.0.0/0, ::/0
  icmp       to 0.0.0.0/0, ::/0

Screenshot 4 - DO Cloud Firewall inbound rules - only UDP 51820 (WireGuard) + TCP 22 (SSH) allowed. All other ports dropped at the hypervisor.

Hardening TODO — Once ControlCase confirms their public IPs, whitelist ONLY those on UDP 51820 (currently 0.0.0.0/0). WireGuard key-based auth means unauthorized handshakes are dropped, but tightening the source range reduces attack surface further.

7. Session logging → Rapid7 InsightIDR (PCI 10.2)

cat /etc/fluent-bit/fluent-bit.conf

config file

[SERVICE]
    Flush           5
    Log_Level       info

# WireGuard handshakes + peer events
[INPUT]
    Name              systemd
    Tag               vpn.wireguard
    Systemd_Filter    [email protected]

# Auth events (SSH to VPN gateway)
[INPUT]
    Name              tail
    Tag               vpn.auth
    Path              /var/log/auth.log

# Kernel messages (WireGuard peer registration)
[INPUT]
    Name              systemd
    Tag               vpn.kernel
    Systemd_Filter    SYSLOG_IDENTIFIER=kernel

[FILTER]
    Name              modify
    Match             vpn.*
    Add               vpn_gateway fintrix-vpn-gateway
    Add               log_type vpn_session
    Add               pci_control req_11_4_5_segmentation

[OUTPUT]
    Name              syslog
    Match             vpn.*
    Host              10.100.0.10
    Port              5141
    Mode              tcp

Screenshot 5 - fluent-bit forwarder - captures WireGuard handshakes, SSH auth events, and kernel wg0 messages. Enriched with PCI control tags and forwarded to Rapid7 5141.

systemctl is-active fluent-bit - connectivity check

2026-07-01 21:17 UTC

root@fintrix-vpn-gateway:~$ systemctl is-active fluent-bit
active

root@fintrix-vpn-gateway:~$ nc -zvw 3 10.100.0.10 5141
Connection to 10.100.0.10 5141 port [tcp/*] succeeded!

root@fintrix-vpn-gateway:~$ journalctl -u fluent-bit --since '30s ago' | grep 'setup done'
[info] [output:syslog:syslog.0] setup done for 10.100.0.10:5141 (TLS=off)

8. Peer allocation table

Peer	VPN IP	Role	Config file	Public key (id)
ganesh	`10.200.0.2/32`	ControlCase pentester	`ganesh-controlcase.conf`	`eIJmiryZwlot…`
elswick	`10.200.0.3/32`	ControlCase QSA	`elswick-controlcase.conf`	`fgc+99gEXfNVb…`
auditor3	`10.200.0.4/32`	Spare (assignable)	`auditor3-controlcase.conf`	`OsQ8RFLs1rCVt…`

Private keys: never leave /etc/wireguard/keys/ on the gateway (600 root:root). Peer .conf files with embedded private keys are stored in /root/peer-configs/ and delivered to auditors through encrypted channels (Bitwarden Send + email OTP) — never plain email or WhatsApp.

9. Segmentation testing scope for Ganesh

Ganesh's tunnel routes only these networks (split-tunnel):

CIDR	Purpose	Expected reachability
`10.100.0.0/16`	Production VPC	Some reachable
`10.116.0.0/16`	DOKS pod CIDR	Reachable via NAT
`10.117.0.0/16`	DOKS service CIDR	Depends on service type

Windows hosts (CDD 10.100.0.11 · VAPT 10.100.0.12) — Windows Firewall filters inbound from arbitrary VPC IPs. From 10.200.0.2 (Ganesh's tunnel IP), TCP 3389 and ICMP return no response. This is expected and desired: it demonstrates working segmentation at the OS firewall layer. Ganesh will document this in his PenTest report as a positive finding.

10. Access delivery workflow

CTO generates peer config .conf on the gateway (/root/peer-configs/)
CTO downloads the config via scp to their local Mac
CTO uploads to Bitwarden Send with 24h expiration + view-once
CTO sends the Bitwarden Send link to Ganesh via signal or email OTP
Ganesh installs WireGuard client, imports .conf
Ganesh connects — handshake logged to Rapid7 within 5s
Ganesh runs PenTest tools (nmap, hydra, custom scripts) from 10.200.0.2
All traffic through the tunnel is logged by fluent-bit on the gateway

11. Decommissioning (post-PenTest)

Expiration: 2026-07-31 (auto-revoke). Steps:

Decommission workflow

scheduled 2026-07-31

# Revoke peer keys (immediate)
root@fintrix-vpn-gateway:~$ wg set wg0 peer eIJmiryZwlot… remove
root@fintrix-vpn-gateway:~$ wg set wg0 peer fgc+99gEXfNVb… remove

# Or nuclear option — delete droplet + firewall
~/fintrix$ doctl compute droplet delete 581657192 --force
~/fintrix$ doctl compute firewall delete abefd04a-e795-49f1-97fc-429e610ab064 --force

POL-008 — Third-Party Vendor Management
EVD-Q80 — IDS/IPS Evidence
EVD-Q88 — Vendor Access Agreements
Deployment source: backend/infra/vpn-gateway/ (under NDA — README + peer configs)

13. Change log

Date	Change	Author
2026-07-01	Provision fintrix-vpn-gateway + 3 peers for ControlCase	Gabriel Ureña (CTO)
2026-07-31	(planned) Auto-decommission	Gabriel Ureña (CTO)

EVD-Q11.4.5 — Segmentation Penetration Test Access ​

1. Design decisions ​

2. Architecture ​

3. Provisioning evidence ​

4. WireGuard server configuration ​

5. Runtime status — service is active ​

6. Firewall — inbound restricted to VPN + SSH ​

7. Session logging → Rapid7 InsightIDR (PCI 10.2) ​

8. Peer allocation table ​

9. Segmentation testing scope for Ganesh ​

10. Access delivery workflow ​

11. Decommissioning (post-PenTest) ​

12. Related documents ​

13. Change log ​