Skip to content

Commit cc41de1

Browse files
author
nmeheus
committed
Guidelines for setting up te experiments
1 parent 94f6f93 commit cc41de1

File tree

2 files changed

+244
-0
lines changed

2 files changed

+244
-0
lines changed

‎IPsec_exp.setup

+162
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
GOAL: Route all traffic from 'Client' through 'Server'
2+
3+
APPROACH:
4+
5+
1. Enable ipv4 forwarding on the server
6+
7+
sudo nano /etc/sysctl.conf
8+
9+
Add/uncomment/change to:
10+
11+
net.ipv4.ip_forward=1
12+
13+
sudo sysctl -p
14+
15+
2. Enable NAT'ed IPv4 internet access on the server
16+
17+
sudo route del default gw 10.2.15.254 && sudo route add default gw 10.2.15.253
18+
sudo route add -net 10.11.0.0 netmask 255.255.0.0 gw 10.2.15.254
19+
sudo route add -net 10.2.32.0 netmask 255.255.240.0 gw 10.2.15.254
20+
21+
3. Disable ipv4 on the enp1s5f0 interface of the client
22+
23+
sudo ip addr del 10.2.0.134 dev enp1s5f0
24+
25+
4. Add default route on client
26+
27+
sudo ip route add default via 192.168.0.1 dev enp1s5f1
28+
29+
5. Enable NAT on server
30+
31+
sudo iptables -t nat -A POSTROUTING -o enp1s5f0 -s 192.168/16 -j MASQUERADE
32+
33+
YAY, internet acces from the client node through the server node!
34+
35+
36+
---------------------------------------------------------------
37+
38+
39+
NEXT GOAL: Add an IPv4 network namespace to the client and fix internet connectivity from the namespace
40+
41+
APPROACH:
42+
43+
1. Delete network namespace ns1, and the link to it, if these already exist
44+
45+
sudo ip netns del ns1 &>/dev/null
46+
47+
2. Create the namespace
48+
49+
sudo ip netns add ns1
50+
51+
3. Create a veth pair to link the ns1 namespace to the default
52+
53+
sudo ip link add v-eth1 type veth peer name v-peer1
54+
sudo ip link set v-peer1 netns ns1
55+
56+
4. Setup IPv4 addresses for both interfaces and bring them up
57+
58+
sudo ip addr add 192.168.1.1/24 dev v-eth1
59+
sudo ip link set v-eth1 up
60+
61+
sudo ip netns exec ns1 ip addr add 192.168.1.2/24 dev v-peer1
62+
sudo ip netns exec ns1 ip link set v-peer1 up
63+
sudo ip netns exec ns1 ip link set lo up
64+
65+
5. Route all traffic from the ns1 namespace through the default namespace
66+
67+
sudo ip netns exec ns1 ip route add default via 192.168.1.1
68+
69+
6. Enable forwarding to route traffic from the namespace to the internet and back.
70+
71+
sudo nano /etc/sysctl.conf
72+
73+
Add/uncomment/change to:
74+
75+
net.ipv4.ip_forward=1
76+
77+
net.ipv4.conf.all.send_redirects = 0
78+
79+
net.ipv4.conf.all.accept_source_route = 0
80+
81+
net.ipv4.conf.all.accept_redirects = 0
82+
83+
sudo sysctl -p
84+
85+
7. Enable forwarding between interfaces
86+
87+
sudo iptables -P FORWARD DROP
88+
sudo iptables -F FORWARD
89+
90+
sudo iptables -A FORWARD -i enp1s5f1 -o v-eth1 -j ACCEPT
91+
sudo iptables -A FORWARD -o enp1s5f1 -i v-eth1 -j ACCEPT
92+
93+
8. Add route on server to the ns1 namespace
94+
95+
sudo ip route add 192.168/16 via 192.168.0.1 dev enp1s5f1
96+
97+
YAY, internet acces from the ns1 namespace!
98+
99+
100+
---------------------------------------------------------------
101+
102+
103+
NEXT GOAL: Encrypt all traffic from the network namespace to the 'Server'-node, using IPsec.
104+
105+
APPROACH:
106+
107+
0. If the needed packages are not installed, install them on both the server and the client.
108+
109+
sudo apt-get install ipsec-tools strongswan-starter
110+
111+
1. Add PSK credentials to both server and client secrets files
112+
113+
sudo nano /etc/ipsec.secrets
114+
115+
add this to the files:
116+
%any : PSK "password"
117+
118+
3. Edit the ipsec configuration files on the server
119+
120+
sudo nano /etc/ipsec.conf
121+
122+
add the follwing connection:
123+
124+
conn my-tunnel
125+
authby=secret
126+
auto=route
127+
keyexchange=ike
128+
left=192.168.0.1
129+
right=192.168.1.2
130+
leftsubnet=0.0.0.0/0
131+
type=tunnel
132+
leftfirewall=yes
133+
rightfirewall=yes
134+
135+
136+
4. Edit the ipsec configuration files on the client
137+
138+
sudo nano /etc/ipsec.conf
139+
140+
add the follwing connection:
141+
142+
conn my-tunnel
143+
authby=secret
144+
auto=route
145+
keyexchange=ike
146+
left=192.168.1.2
147+
right=192.168.0.1
148+
rightsubnet=0.0.0.0/0
149+
type=tunnel
150+
leftfirewall=yes
151+
rightfirewall=yes
152+
153+
154+
5. Start the IPsec service on the server
155+
156+
sudo ipsec start
157+
158+
6. Start the IPsec service in the ns1 network namespace of the client
159+
160+
sudo ip netns exec ns1 ipsec start
161+
162+
YAY, you now have an IPsec connection between the ns1 network namespace and the server!

‎Tor_exp.setup

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
experiment with 3 Nodes:
2+
3+
-Router
4+
-Gateway
5+
-Workstation
6+
7+
### Route traffic from Gateway through Router ###
8+
9+
1. Make Router able to use NAT'ed IPv4 traffic
10+
11+
commands on Router:
12+
13+
sudo route del default gw 10.2.47.254 && sudo route add default gw 10.2.47.253
14+
sudo route add -net 10.11.0.0 netmask 255.255.0.0 gw 10.2.47.254
15+
sudo route add -net 10.2.0.0 netmask 255.255.240.0 gw 10.2.47.254
16+
17+
2. Make Router able to forward IPv4 packets
18+
19+
commands on Router:
20+
21+
sudo nano /etc/sysctl.conf
22+
23+
Add/uncomment/change to:
24+
25+
net.ipv4.ip_forward=1
26+
27+
sudo sysctl -p
28+
29+
3. Make Router the default gateway for Gateway
30+
31+
commands on Gateway:
32+
33+
sudo route del default gw 10.2.47.254 && sudo route add default gw 192.168.2.1
34+
35+
4. Delete IPv4 address from control interface of Gateway (just to be sure)
36+
37+
commands on Router:
38+
39+
sudo ip addr del 10.2.33.226 dev eno1
40+
41+
5. Enable the Router to NAT incomming traffic from 192.168.2/24
42+
43+
commands on Router:
44+
45+
sudo iptables -t nat -A POSTROUTING -o eno1 -s 192.168.2/24 -j MASQUERADE
46+
47+
48+
### The actual isolation proxy setup ###
49+
50+
1. Delete the IPv4 address from the control interface of the Workstation (The workstation should be completely isolated from the public net, but due to the VW environement this is not possible)
51+
52+
commands on Workstation:
53+
54+
sudo ip addr del 10.2.33.222 dev eno1
55+
56+
2. Install tor on the Gateway
57+
58+
commands on the Gateway:
59+
60+
see https://www.torproject.org/docs/debian.html.en#ubuntu
61+
62+
3. Start Tor on the Gateway
63+
64+
commands on Gateway:
65+
sudo /etc/init.d/tor restart
66+
tor
67+
68+
4. Set the default gateway and the DNS server on the Workstation to Gateway
69+
70+
commands on Workstation:
71+
72+
sudo nano /etc/resolv.conf
73+
74+
Add/uncomment/change to:
75+
76+
nameserver 192.168.1.1
77+
78+
sudo route add default gw 192.168.1.1
79+
80+
5. Use the Tor proxy for all connections on the Workstation
81+
82+
enabling applications to use socks proxy

0 commit comments

Comments
 (0)