Networking

Sunday, September 11, 2022

Thursday, October 28, 2021

Iptables and firewall

Introduction tto ip tables: video and part2, watch these 2 vieos or read this blog for basic overview

3 mian tables,

1.Default table - used for filtering

2.Nat table - used for NAT translation.changing ports with system or changin ip address in packet usng DNAT and SNAT

3.Mangel table - used to edit the header of ip packets

Nice article on iptables, filtertable in particular is here

nat table nice video:

Complete work flow picture here

some info on ip masqurading here

Diff between SNAT,DNAT and Masquerading

Source NAT changes the source address in IP header of a packet. It may also change the source port in the TCP/UDP headers. The typical usage is to change the a private (rfc1918) address/port into a public address/port for packets leaving your network.

Destination NAT changes the destination address in IP header of a packet. It may also change the destination port in the TCP/UDP headers.The typical usage of this is to redirect incoming packets with a destination of a public address/port to a private IP address/port inside your network.

Masquerading is a special form of Source NAT where the source address is unknown at the time the rule is added to the tables in the kernel. If you want to allow hosts with private address behind your firewall to access the Internet and the external address is variable (DHCP) this is what you need to use. Masquerading will modify the source IP address and port of the packet to be the primary IP address assigned to the outgoing interface. If your outgoing interface has a address that is static, then you don't need to use MASQ and can use SNAT which will be a little faster since it doesn't need to figure out what the external IP is every time.

What is masquerading?

After study of above answers, this is what caused me to understand:

Masquerading allows an entire network of internal IP addresses to operate through one external IP address and masquerading allows conversion from one protocol to another (wired/wireless).

When the MASQUERADE chain sends a datagram from a computer it...

Takes note of the type of datagram it is, "TCP," "UDP," "ICMP," etc. Note: An unknown might not work correctly through MASQUERADE.
Modifies the datagram so that it looks like it was generated by the router machine itself (the one external address).
Remembers that it has done so, recording the local source and external destination IPs.
Transmits the datagram onto the Internet with the single external IP address.

Note: When the destination host receives this datagram, it believes the datagram has come from the one routing host and sends any reply datagrams back to that address.

When the Linux MASQUERADE chain receives a datagram from its Internet connection,

It looks in its table of established masqueraded connections to see if this datagram actually belongs to a computer on the LAN.
If it does, it reverses the modification it did on the forward path and transmits the datagram to the LAN computer.

The MASQUERADE chain is useful for internally creating and entire private IP address space, and for forwarding packets that would otherwise be incompatible.

The Ethernet, or wired protocol, assumes that the packet comes from the source and reports itself. The Wifi, or wireless protocol, assumes that the packet is being repeated and reports itself and the original source.

For this reason, Wifi and Ethernet cannot be directly bridged because they are incompatible. Masquerading causes the packets to be rebuilt and will thereby handle conversion between wired and wireless standards. Note: There are ways to cause your computer to accept the incompatibility internally and bridge, but without a full masquerade, the bridge spoof will be viewed externally as a security risk and those requests will be rejected.

Difference between OUTPUT and FORWARD chains

OUTPUT is for packets that are emitted by the host. Their destination is usually another host, but can be the same host via the loopback interface, so not all packets that go through OUTPUT are in fact outgoing.

FORWARD is for packets that are neither emitted by the host nor directed to the host. They are the packets that the host is merely routing.

Exmaple of nating:

If you under stand this use case they you are comfortable with ip tables natting:

I've had 2 machines centos_master(192.168.29.53) where i've installed apache webserver and another centos_worker machine(192.168.29.249) where you want to create nat tables.

Writing ip natting code so that, if any traffic comes o centos worker 1 on port 9090, it should hit apache webserver in centos_master.

I know you can't do See this video 2 times to get the answer

Solution:

sudo iptables --append PREROUTING --table nat --protocol tcp --destination 192.168.29.249 --dport 9090 --jump DNAT --to-destination 192.168.29.53:80

sudo iptables --append POSTROUTING --table nat --protocol tcp --destination 192.168.29.53 --dport 80 --jump SNAT --to-source 192.168.29.249:9090

Masquerading Basics

Masquerading is the Linux-specific form of NAT (network address translation). It can be used to connect a small LAN (where hosts use IP addresses from the private range — see Section�21.1.2.2. “Netmasks and Routing”) with the Internet (where official IP addresses are used). For the LAN hosts to be able to connect to the Internet, their private addresses are translated to an official one. This is done on the router, which acts as the gateway between the LAN and the Internet. The underlying principle is a simple one: The router has more than one network interface, typically a network card and a separate interface connecting with the Internet. While the latter links the router with the outside world, one or several others link it with the LAN hosts. With these hosts in the local network connected to the network card (such as eth0) of the router, they can send any packets not destined for the local network to their default gateway or router.

	Using the Correct Network Mask
When configuring your network, make sure both the broadcast address and the netmask are the same for all local hosts. Failing to do so results in a broken network because packets cannot be routed properly.

As mentioned, whenever one of the LAN hosts sends a packet destined for an Internet address, it goes to the default router. However, the router must be configured before it can forward such packets. For security reasons, SUSE LINUX does not enable this in a default installation. To enable it, set the variable IP_FORWARD in the file /etc/sysconfig/sysctl to IP_FORWARD=yes.

The target host of the connection can see your router, but knows nothing about the host in your internal network where the packets originated. This is why the technique is called masquerading. Because of the address translation, the router is the first destination of any reply packets. The router must identify these incoming packets and translate their target addresses, so packets can be forwarded to the correct host in the local network.

With the routing of inbound traffic depending on the masquerading table, there is no way to open a connection to an internal host from the outside. For such a connection, there would be no entry in the table. In addition, any connection already established has a status entry assigned to it in the table, so the entry cannot be used by another connection.

If you are following cka adim course, replace last command to add iptable nat rule with this

$ iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.15.2:80

Wednesday, October 6, 2021

SSh public key authentication and TLS basics

Ssh publuc key authenticaion: video

History of ssl and tsl: here

For authentication,it uses hand shake(Using asymetric keys) and after sucessful authentication for data transfer(using symetric key) it uses record protocal.

Hand shake is very important and it goes like this:

Client: “Hello there. I want to determine secure communication between the two of us. Here are my cipher suites and compatible SSL/TLS version.”

Server: “Hello, Client. I verified your cipher suites and SSL/TLS version. I feel we’re good to travel ahead. Here are my certificate file and my public key. Verify them”

Client: “Let me verify your certificate… (After Verification) Okay, it seems fine, but I want to verify your private key. I will generate and encrypt a pre-master (shared secret key) key using your public key. Decrypt it using your private key, and we’ll use the master key to encrypt and decrypt the information.”

Server: “Done.”

[Now that both parties know who they’re rebuking, the information transferred between them is secured using the master key. When the verification part is over, the encryption takes place only through the master key. This is often called symmetric encryption.]

Client: “I’m sending you this sample message to verify that our master key works. Please send me the decrypted version of this message. If it works, our data is in safe hands.”

Server: “Yeah, it works. I feel we’ve accomplished what we were trying to find.”l we’ve accomplished what we were trying to find.”

Points to remember:

The web server needs a certicate signed by ca authority.
The web server sends that certificate signed by ca which contains the private key of the web server to web browser or clients.
Browsers validate the certificate by using ca authority public keys(ca certicates contains public keys),they are built in all browsers.CA signs the certificates of web servs using their private keys and ca certificate(which in turn contains public key) and ca certificates(or root certificates) of ca are available in all browsers
browser then sends symmetric key encrypted with web server public key and web server decrypts the msg using its private key and now web server and browser both have symetric keys.So then can comminicate using record protocal by simply encrypting msgs using symetric key

Cerficate Generation process :

1.Web server will generate a private key using, openssl genrsa -out ca.key 2048

2.Then web server will create a certificate signing request(csr) , which contains the details of organisation and public key

3.CA authotity verifies the information and if company information is legitimate then that certificate will be signed by ca private key and ca.crt(CA certificate which contains ca public key as well) file .

Note:Incase of kubernetes cluster, ca authority needs to follow same steps but step i.e signing csr will be performed using its own private key generated in step1 and this is called self signed certificate

Generating client certificates

step1 and step2 are same,in the step 3, ca authority will sign the csr of admin or other client certificates using cs.key(private) and ca.crt(ca certificate which contains the public key).

Thursday, September 16, 2021

Subnetting

Sunny Subnetting Playlist:

Note: In varaiable length subnetting subnet mask will change but in fixed length subnetting it will remain same.

Nice blogs:

Practical examples(Best video): link

Fixed length subnet mask vs Variable length subnet mask: link

Variable length subnet masking with example: here

More explanaion of same example

Question:given IP is 192.168.1.0/24, and we need to accomadte ips for

Sales and Purchase: 120
Development: 50
Accounts: 26
Management: 5

Answer: As per given ip and subnet,we can accomodate 2^8=256 IP addresses

Step1: Sort the requirements in descending order and find the numbers of IP addresses required(narest power of 2 ) for each subnet

Sales and Purchase: 120 -> Ips req = 128
Development: 50 > Ips req = 64
Accounts: 26 > Ips req = 32
Management: 5 > Ips req = 8

Step2:Divide the given ip,so into sub nets,so we should accomadate 128 Ips or 126 valid hosts addresses

If we use subdivide like this,then we can have 2 networks with 128 ip's each

1.192.168.1.0/25

2.192.168.1.128/25

We can use first network 192.168.1.0/25,for sales and purchase department as it has 126 valid host address,

The subnet details of Sales and Purchase department:

Network Id: 192.168.1.0/25

BroadCast Id: 192.168.1.127/25

Valid host ip's range: 192.168.1.1 to 92.168.1.126 =126 in total

Subnet mask: /25 or 225.225.225.128

Step 3: Take the 192.168.1.128/25 network and we will sub divide into further networks, thisis the reason why we call VLSM(Variable length subnet masking) as subnetting a subnet.

For development team,we need to have 64 IPs,so subdivide 192.168.1.128/25 to 192.168.1.128/26, then we will have 2 networks of 64 hosts each

1.192.168.1.128/26

2.192.168.1.192/26

We can use first network 192.168.1.128/26,for development department as it has 62 valid host address,

The subnet details of development department:

Network Id: 192.168.1.128/26

BroadCast Id: 192.168.1.127/26

Valid host ip's range: 192.168.1.129 to 92.168.1.191 =62 in total

Subnet mask: /26 or 225.225.225.192

Step 4: Take the 192.168.1.192/26, and we will sub divide it

For Accounts department we need 32 ips,so we divide this network as below

1. 192.168.1.192/27

2. 192.168.1.224/27

We can use first network 192.168.1.192/27,for accounts department as it has 30 valid host address,

The subnet details of accounts department:

Network Id: 192.168.1.192/27

BroadCast Id: 192.168.1.223/27

Valid host ip's range: 192.168.1.193 to 92.168.1.222 =30 in total

Subnet mask: /27 or 225.225.225.224

Step 5: Take 192.168.1.224/27,we will subdivide it.

For Management department we need also 8 ips,so divide 192.168.1.224/27 into 4 networks of 8 ips each, a total =32 ips.

Note:How we determined how many networks is, in CIDR we have 27 and for creating 8 hosts we require 29 CIDR value,so diff between then is 2 and 2^2=4.

The 4 networks looks as below:

1.192.168.1.224/29

2.192.168.1.230/29

3.192.168.1.238/29

4.192.168.1.246/29

We can use first network 192.168.1.1.224/29,for management department as it has 6 valid host address

The subnet details of management department:

Network Id: 192.168.1.224/29

BroadCast Id: 192.168.1.229/29

Valid host ip's range: 192.168.1.225 to 92.168.1.228 =6 in total

Subnet mask: /29 or 225.225.225.248

Note:The aboveexample is easy and we calculated networks easily, but some times we neeed complex maths.

Simple hack to find the subnets of subnets:

To find the last address of a subnet, perform OR operation between the first address of the subnet and the complement of the subnet mask
Add 1 to the last address of the previous subnet to find the first address of the next subnet.

Example: In step2 we had 2 networks 192.168.1.0/25 and 192.168.1.128/25,we calculated 2 nd network normally by adding 128 to last octet but in complex problems we cannot do this.So follow the steps

1.The first address is : 192.168.1.0 (Even we can get it by performing AND between ip and subnet mask)

2.The subnet is: 225.225.225.128

perform OR between 1 and 2,by converting then to binary

we get 192.168.1.127,so the broadcast id of that subnet is 192.168.1.127

Then by add 1 we will get network id of next subnet

Question:Create a vpc in aws, take any ip and create 4 equal subnets(Fixed length subnetting)

Very very simple and basic

Lets say given ip is 10.0.0.0/24,

We have taken /24 as CIDR beacause we want to design a simple network with otal 256 host and 4 subnets with 64 hosts each.

In Fixed length subnetting, subnet mask remains same i.e /26 because we are going to create 4 suntes so we need 2 host bits to convert it into network bits.

Subnet 1: Ip range-10.0.0.0/26-10.0.0.63/26

Subnet 2: Ip range-10.0.0.64/26-10.0.0.127/26

Subnet 3: Ip range-10.0.0.128/26-10.0.0.191/26

Subnet 4: Ip range-10.0.0.192/26-10.0.0.255/26

Note: Consier this problem here(watch at the end)

Given Ip is 10.0.0.0./24, we know we can use 4096 ips(32-20=12 &&2^12=4096)

How can we find last ip????

Well there are many ways, but inkow 2 ways

Way 1(The haard way)

We know we can get 4096 ips,so if we calculate

10.0.1.x - It will take 256 ips

similarly 10.0.2.x takes another 256 ips and we proceed further we know need 16 0f those because (16*256=4096)

So we get last range as 10.0.15.x

and the last ip would be 10.0.15.255

Way 2(Formula based)

1.Get the ip address and convert it to binary

2.Get the complement of subnet mask

3.Perform OR between 1 and 2

In simple words, perform the OR operation between given ip and complement of subnet mask

Incase of above example, the subnet mask of /24 is 11111111.11111111.11110000.00000000 and its complement is 00000000.00000000.00001111.11111111

00001010.00000000.00000000.00000000

00000000.00000000.00001111.11111111

-------------------------------------------------

00001010.00000000.00001111.11111111

and the decimal equivalent of result is 10.0.15.225

In the above video he wans to create subnets with /28 range i.e each subnet will have 16 ips, so he can create 4096/16 i.e 2^8=256 subnets

The networkids of each subnet will be:

10.0.0.0/28

10.0.0.16/28

10.0.0.32/28

10.0.0.64/28

10.0.0.240/28

We will have total 16 of them using 0 in 3 rd octet, similarly we can use 1,23...15 in 3rd octet which results in 16*16=256 subnets

----------------------------------------------------------------------------------------------------------------

To get overview of entire subneting:

Read this pdf, subnetting ultimate guide

Note:In the above pdf,VLSM example was not given, refer above example.

Imp points:

* If we want to do simpe subnetting then we will go for fixed length subneting, where the subnet mask of all subnets are same. There is lot of wastage of ips, if we use his.So people prefer VLSM

* VLSM uses ips more effectively and it is some what tought to implement, practice

If you have more time then go through below all videos in order by technical guftgu:

IP address - video

Subnetting - part1 , part2, part3,part4 and part5

Note:part2 - fixed length subnetting and part4- variable length subnetting

-----------------------------------------------------------------------------------------------------------------------