ECE 544: Middlebox lab Abhigyan Sharma

Amazon EC2 login Go to aws.amazon.com Login: abhigyan.sharma@gmail.com Password: ece544 Download private key file from mail SSH to this VM ssh -i id_rsa ubuntu@52.21.208.29 Then, ssh to any VM you create (ssh to 10.0.0/24) IP address in the VM ssh 10.0.0.123

References IPTABLES SQUID https://www.digitalocean.com/community/tutorials/how-to-set-up-a- firewall-using-iptables-on-ubuntu-14-04 https://www.digitalocean.com/community/tutorials/how-to-list-and-delete- iptables-firewall-rules man iptables https://www.karlrupp.net/en/computer/nat_tutorial SQUID http://xmodulo.com/how-to-set-up-transparent-proxy-on-linux.html

Testbed configuration Subnets: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24 10.0.0.101/24 10.0.0.102/24 10.0.0.103 10.0.1.101/24 10.0.1.102/24 10.0.2.102/24 10.0.2.103/24 A B C *** Update IP Address based on your group number ***

More testbed config Name VMs as <group-num>-a, <group-num>-b, <group-num>-c Choose security group allow-all Disable source/dest check for all interfaces Enable all interfaces (ifconfig up, dhclient) Routing A: add ip route to 10.0.2.0/24 via B B: enable ipv4 forwarding C: add ip route to 10.0.1.0/24 via B

Test ping & firewall From A: ping 10.0.2.103 Should work Now enable iptables firewall to drop packets being forwarded: sudo iptables -P FORWARD DROP sudo iptables -P FORWARD ACCEPT

Setup HTTP server (NODE C) mkdir web cd web echo "hello" > hello.txt echo "hello2" > hello2.txt sudo python3 -m http.server -b 10.0.2.XX3 80

Setup iptables rules to forward only port 80 traffic RULES at B sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT sudo iptables -A FORWARD -p tcp --dport 80 -j ACCEPT sudo iptables -A FORWARD -j DROP Test from A wget http://10.0.2.103/hello.txt wget http://10.0.2.103/hello2.txt Use TCPDUMP at B and log at C to see packets tcpdump -i eth2 Delete rule 2 at B sudo iptables -D FORWARD 2 Wont work!

Setup NAT (Network address translation) Rules at B sudo iptables -F sudo iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE  Start tcpdump: sudo tcpdump -i eth2 Test ping from A ping 10.0.2.103 Test wget from A wget http://10.0.2.103/hello.txt wget http://10.0.2.103/hello2.txt Notice the source ip from tcpdump above

B: Setup Squid caching proxy and iptables sudo apt-get update sudo apt-get install squid Modify /etc/squid/squid.conf http_port 3128 transparent http_access allow all sudo iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 View iptables rules iptables -t nat -L

Test squid Test wget from A View squid log at node B sudo cat /var/log/squid/access.log Access same file again View squid log again

What to submit Describe in your own words the following aspects of this exercise IP routing in linux Firewall middlebox NAT Caching proxy You may include Testbed diagram Screenshots of key steps Explanation of middlebox configuration commands