1. ECE 544: Middlebox lab
Abhigyan Sharma

2. Amazon EC2 login Go to aws.amazon.com Login: abhigyan.sharma@gmail.com
Password: ece544
Download private key file from mail
SSH to this VM
ssh -i id_rsa
Then, ssh to any VM you create (ssh to /24) IP address in the VM
ssh

3. References IPTABLES SQUID
firewall-using-iptables-on-ubuntu-14-04
iptables-firewall-rules
man iptables
SQUID

4. Testbed configuration
Subnets: /24, /24, /24
/24
/24
/24
/24
/24
/24 A B C
*** Update IP Address based on your group number ***

5. More testbed config
Name VMs as <group-num>-a, <group-num>-b, <group-num>-c
Choose security group allow-all
Disable source/dest check for all interfaces
Enable all interfaces (ifconfig up, dhclient)
Routing
A: add ip route to /24 via B
B: enable ipv4 forwarding
C: add ip route to /24 via B

6. Test ping & firewall From A: ping 10.0.2.103
Should work
Now enable iptables firewall to drop packets being forwarded:
sudo iptables -P FORWARD DROP
sudo iptables -P FORWARD ACCEPT

7. Setup HTTP server (NODE C)
mkdir web
cd web
echo "hello" > hello.txt
echo "hello2" > hello2.txt
sudo python3 -m http.server -b XX3 80

8. Setup iptables rules to forward only port 80 traffic
RULES at B
sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
sudo iptables -A FORWARD -j DROP
Test from A
wget
wget
Use TCPDUMP at B and log at C to see packets
tcpdump -i eth2
Delete rule 2 at B
sudo iptables -D FORWARD 2
Wont work!

9. Setup NAT (Network address translation)
Rules at B
sudo iptables -F
sudo iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE 
Start tcpdump:
sudo tcpdump -i eth2
Test ping from A
ping
Test wget from A
wget
wget
Notice the source ip from tcpdump above

10. B: Setup Squid caching proxy and iptables
sudo apt-get update
sudo apt-get install squid
Modify /etc/squid/squid.conf
http_port 3128 transparent
http_access allow all
sudo iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
View iptables rules
iptables -t nat -L

11. Test squid Test wget from A View squid log at node B
sudo cat /var/log/squid/access.log
Access same file again
View squid log again

12. What to submit
Describe in your own words the following aspects of this exercise
IP routing in linux
Firewall middlebox
NAT
Caching proxy
You may include
Testbed diagram
Screenshots of key steps
Explanation of middlebox configuration commands