VPN Lab 2 Zutao Zhu 04/02/2010

Outline How a packet traverse in VPN How to write socket program Certificate

Packet Flow

VMware Port Forwarding How it works?

Routing Table Add route to host –# route add -host dev eth0:0 –# route add -host gw Add route to network –# route add -net netmask eth0 # route add -net netmask gw # route add -net /24 eth1 Add default route –# route add default gw

Routing Table Flags Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) ! (reject route)

IP Forwarding One machine has more than one network adapter # sysctl -w net.ipv4.ip_forward=1 # sysctl net.ipv4.ip_forward # vi /etc/sysctl.conf net.ipv4.ip_forward = 1

Make sure You understand how the packets flow You need to change the IP address in the appropriate point When debugging, print out the values of src_ip, src_port, dst_ip, dst_port in the key points

Socket Programming UDP server –sock = socket(AF_INET, SOCK_DGRAM, 0) –Set struct sockaddr_in server_addr (which port you want to use), client_addr –Bind socket to server_addr –Enter infinite loop, recvfrom(sock,recv_data,1024,0, (struct sockaddr *)&client_addr, &addr_len)

Socket Programming UDP client –sock = socket(AF_INET, SOCK_DGRAM, 0) –Set struct sockaddr_in server_addr (which port you want to use), client_addr –Enter infinite loop, sendto(sock, send_data, strlen(send_data), 0, (struct sockaddr *)&server_addr, sizeof(struct sockaddr))

Certificate Create the configuration file You need to create your own certificates when demo You can define your VPN server’s authenticate policy (for the clients) Design your small protocol to do the key exchange

Control and data channels Control one : TCP Data one : UDP

Key Exchange Use TCP channel Client changes the session key/IV/etc. Client use the new session key to encrypt the data When server is notified, server also changes the session key for this communication Server can decrypt client’s encrypted data

Reference et-programming-tutorial.htmlhttp:// et-programming-tutorial.html