==OverviewPurpose / Objectives of Lab 6==[[Image:network.png|thumb|right|150px|Setting up networks is an essential operation for a system administrator. Maintaining network connectivity and securing the network are also essential operations for a system administrator.]]

== In this lab, you will learn the basics of networking by using your '''Virtual Machines''' and your '''c7host''' machine. You will first set up a virtual private network among those machines. In addition, you will learn to set up '''network names''' (to associate with server's IP Addresses), '''associate network services with port numbers''' for troubleshooting purposes, and setup '''firewall policies''' via the '''iptables''' command. <u>Main Objectives ==</u> # Configure a private (virtual ) network for Virtual Machinesyour '''VMs''' and your '''c7host''' machine# Use the CentOS GUI program to configure Configure network interfaces with static IP configuration for your Virtual Machines using both '''graphical''' and host name resolution'''command-line''' utilities.# Use the '''findlocal hostname resolution''' command to locate the configuration files modified by the GUI network configuration program# To configure a CentOS VM resolve simple server names with static network configuration without a GUI tooltheir corresponding IP Addresses# To backup Backup more recent files via (eg. '''incremental backup''') using the '''find''' command and a '''date/time-stamp ''' file.# To Use common networking utilities to associate network services with port numbers for troubleshooting purposes# Gain initial exposure to the '''iptables''' command used to configure the linux and maintain a firewall for protection and troubleshooting# Configure '''iptables''' to '''allow/disallow/forward ''' different types of network traffic using simple rules

=INVESTIGATION 1: CONFIGURING A VIRTUAL PRIVATE NETWORK= For the remainder of this course, we will focus on networking involving our VMs and our c7host machine. This lab will focus on setting up a virtual private network ('''VPN'''), connecting our VMs and c7host machine to the VPN, and configuring our VPN to make more convenient to use, troubleshoot and protect. '''Lab 7''' will focus more on configuring SSH and making access to the VPN more secure. Finally, '''lab 8''' will focus on configuring the network for fixed workstations, mobile devices, or both at the same time. There are several reasons for creating '''VPNs'''. The main reason is to '''safely connect servers together''' (i.e. to safely limit but allow share information among computer network users). This allows for a secure connection of computers yet controlling access to and monitoring (protecting) access to permitted users (discussed in more depth in lab7). 

If we are going to setup a private network, we must do 2 major operations: First, '''define a new private network in the Virtual Manager application'''; and second, '''configure each of our VMs to connect to this new private network'''. In Part 1, we will be perform the first operation. In parts 2, 3, and 4, we will be performing the second operation for all VMS (graphical and command-line).  # Perform this section in your '''c7host''' machine.<br><br>'''NOTE:''' Before configuring our network we want to '''turn off dynamic network configuration for our Virtual Machines ''' by turning off the '''"default" ''' virtual network. We will then define our virtual private network. Follow the steps in order to perform these operations. <br><br># Perform this section in your Make certain that <u>'''c7hostALL''' machine.# Turn off your </u> virtual machines# Start Virtual Machine Managerare powered off.

# In the '''Hostsc7host Connection Details''' Details dialog box, select the '''Virtual Networks''' tab# Disable the default configuration from starting at boot by '''<u>deselecting</u>''' '''"Autostart"''' (on boot) checkbox''' check-box and click the '''Apply''' button.# Then Stop the default network configuration by clicking on the '''stop''' button at the bottom left-side of the dialog box.

# Give your new network a name (i.e. '''network1''')then click the '''Forward''' button.# Enter In the next screen, enter in the new network IP address space:

# Disable DHCP DHCP4 by '''deselecting''' the check boxand click the '''Forward''' button twice (accepting the defaults).# Enable Network Forwarding by Selecting '''Forwarding to physical network'''# The , the destination should be '''Any physical device''' and the mode should be '''NAT'''# Proceed with changes, and select click '''Finish'''.{{Admon/note | Repeat these steps for each VM | Complete the following steps on <u>'''each'''</u> of your virtual machines.}}

<li value="1513">Now we need to We will now reconfigure each of our 3 VMs to use our new virtual network '''network1'''

<li value="1">Select the Let's start with our '''centos1 VM'''. Double-click on your '''centos1''' VM , but instead of running the VM, click on the '''view''' menu, and edit the select: '''Virtual Machine Details'''<br />(Note: the Virtual Machine window will appear - do not start virtual machine)</li> <li>Under View select '''Details'''</li>

<li>Change it to '''Virtual Network network1: NAT''' (i.e. the VPN that you just created) and click the '''Apply' : NAT'' button.</li>

# Start '''centos2''' VM and login# On your '''centos hostc7host''' machine, run <codeb>ifconfig</codeb> and make note of the IP address assigned to the <code>'''virbr1</code> ''' (i.e. "Virtual Bridge) interface. This will be the default gateway and DNS server for your VMs.# Start your '''centos1''' VM and login.# Within your centos1 VM, click '''Applications''' menu, then select '''System Tools''', and then '''Settings'''. # In the ''Settings'' Dialog Box, click on the '''Network''' icon.# For the '''Wired''' connection, click the '''settings''' button (The <u>icon</u> appears as a <u>gear</u> located at the bottom right-hand corner of the dialog box).# Select the '''IPv4''' tab. Change Address from ''Automatic (DHCP)'' to '''Manual'''.# Edit the existing wired connection, using the information displayed below:

# In the '''Addresses section''', click '''"Add"'''.# Manually set enter the IP configuration tofollowing information:#: IP Address : '''192.168.235.1211'''#: Subnet Mask : '''255.255.255.0'''#: Default Gateway : The IP address of <code>'''virbr1</code> ''' on your centos host.# Click on the '''DNS''' field and add The IP address of <code>(''virbr1</code> ''' on your centos host. ) as the primary DNS server.# Your network connection may take a couple of minutes to reconfigure connect (view When finished, check your settings, and then click the Network Manager applet in the gnome panel at the top of the screen)'''Apply''' button.# You should be able Open a terminal and issue the '''ifconfig''' command to use confirm the service commands to restart your network:#:<b><code><span style="color:#3366CC;font-size:1.2em;">service network stop</span></code></b>#:<b><code><span style="color:#3366CC;font-size:1IP ADDRESS settings change.2em;">service network start</span></code></b># Verify your new interface by examining the output of <b><code><span style="color:#3366CC;font-size:1.2em;">ifconfig</span></code></b># To verify that centos2 has '''centos1'''VM is now connected to the correct default gateway configured, use VPN by issuing the commands:#:<b><code><span style="colorfollowing command from your '''c7host''' machine:#3366CC;font-size:1.2em;">route -n</span></code></b><br><b><code><span style="color:#3366CC;font-size:1.2em;">ifconfig</span></code></b><br><b><code><span style="color:#3366CC;font-size:1ping 192.168.2em;">nslookup</span></code></b><br><b><code><span style="color:#3366CC;font-size:1235.2em;">ping11</span></code></b>

# Keep your '''centos1''' VM running (you will need it running later in this lab).# Start the '''centos1centos2''' VM and login# Before we configure centos1 centos2 network configuration, we should create a timestamp file that can be used to see which files have changed as a result of using the GUI tool. Issue the following command:

# Run the network configuration tool and enter the following static configuration in the same way that you configured '''centos2centos1'''.#* IP Address: '''192.168.235.1112'''

# Verify the configuration by pinging centos host ('''192.168.235.1''') the VMs and centos2 ('''192.168.235c7host using their IP addresses.12''')#We will now create an '''Incremental Backup'''.#Run the following Linux commandas root:

Our centos3 VM is a '''text-based only''' system, thus we cannot use a graphical tool to configure centos3 to connect to our private network. Therefore we will learn how to perform this task by using command-line tools. # Start Leave your '''centos1''' and '''centos2''' VM running, but start your '''centos3''' VM , login, and login as su to '''root'''.# Use the command <code>'''ifconfig</code> ''' to list active interfaces, you should see one with a name of <code>'''eth0</code> ''' or a similar name.

# To configure your a DNS server for this VM, edit the file <code>'''/etc/resolv.conf</code>'''. Change the <code>nameserver</code> line to beread:#: <b><code><span style="color:#3366CC;font-size:1.2em;">nameserver 192.168.235.1</span></code></b># Save your editing session.# Confirm your settings work by doing the following(you might need to do the steps '''3''' and '''4''' a few times before it works; keep checking with the commands below and wait a bit before each attempt):

#: <b><code><span style="color:#3366CC;font-size:1.2em;">ping</span></code></b> (your other VM's and centos hostc7host)#: <b><code><span style="color:#3366CC;font-size:1.2em;">ssh</span></code></b> ( to your matrix Seneca's Matrix account to test your DNS)

# While we can configure network settings from the command line those settings are not persistent. To configure persistent network configurations we need to edit the configuration files:. # Change to the '''/etc/sysconfig/network-scripts''' directory on <code></codebr>[[Image:new-network-config.png|thumb|600px300px|right|This diagram should show the newer network configuration of your '''c7host''' machine in relation to your '''Virtual Machines'''.]]#* List the contents of the this directory and you . You should see 2 different types of files, network config scripts and network configuration files.#* Look for the config configuration file for your original interface, it should be named <code>'''ifcfg-eth0</code>#* Make a backup of this file for later reference.'''#* Edit the new file for you interface and give it the following settings (or create a brand new file, might be easier than editing the old one):

#::HWADDR="52:54:00:3f:5c:fa" <-- '''use the DO NOT COPY THIS VALUE! Use MAC address for YOUR interfaceusing:''' <code><span style="color:#3366CC;font-size:1.2em;">ifconfig eth0</span></code>

# Save the file and then restart the network connection by issuing the commands: <b><code><span style="color:#3366CC;font-size:1.2em;">ifdown eth1eth0</span></code></b> and then <b><code><span style="color:#3366CC;font-size:1.2em;">ifup eth1eth0</span></code></b>

# Restart the <code>'''centos3</code> ''' VM.# Login and attempt to <code>'''ssh</code> ''' to your matrix account to verify the settings.

=INVESTIGATION 2: CUSTOMIZING THE VIRTUAL NETWORKING ENVIRONMENT TWEAKS AND OTHER USEFUL UTILITIES= Connecting a private network is an important task, but a system administrator also needs to "tweak" the network to make it '''convenient to use''', make it '''safer from unauthorized access''', and use troubleshooting utilities to help '''troubleshoot''' network connectivity problems as they occur. This investigation will expose you to some useful tricks and utilities to help accomplish this task. '''NOTE:''' Lab 7 requires that you understand these concepts and have a good general understanding how to use these troubleshooting utilities (like '''netstat''' and '''iptables'''). 

# Complete this investigation on '''all of your VMVMs'''s and the centos host'''c7host''' machine.# Use the <b><code><span style="color:#3366CC;font-size:1.2em;">hostname</span></code></b> and <b><code><span style="color:#3366CC;font-size:1.2em;">ifconfig</span></code></b> commands on your centos host c7host machine and all of your 3 VM's to gather the information needed to configure the <code>'''/etc/hosts</code> ''' file on the centos host and the 3 VM'sall of your Linux systems.# Edit the <code>'''/etc/hosts</code> ''' file on <u>each</u> of the '''virtual machines and the centos hostmachine'''. Refer to Add the table below for information following contents to enter in the <codeu>bottom</u>of the '''/etc/hosts''' file:<br><br>#::192.168.235.1 c7host#::192.168.235.11 centos1#::192.168.235.12 centos2#::192.168.235.13 centos3<br></codebr> file#Confirm that each host can ping all three of the other hosts by name.

== Part 2: Obtaining MAC (Hardware) addresses on Network Computers =={|classwidth="collapsible40%" stylealign="background: #c0c0c0right" widthcellpadding="50%10"!Sample /etc/hosts file|-valign="top"|<pre># hostname centos1 added {{Admon/note | Obtaining Remote MAC Addresses| The term '''MAC''' address stands for '''Media Access Control''' address, which provides a unique ID to /etc/hosts by anaconda127prevent confusion among computer systems within a network.0While we use '''32bit IP addresse'''s to communicate over an internet, on the local ethernet network packets are delivered to a '''48bit hardware address''' (sometimes called a MAC address).0The '''ARP''' protocol resolves 32bit IP addresses to 48bit MAC addresses by using a broadcast and caching the results.1 localhost.localdomain localhost centos1::1 localhost6.localdomain6 localhost6 centos1 192.168.235.1 c6host192.168.235.11 centos1192.168.235.12 centos2192We can examine the ARP cache to get the MAC addresses of other computers to solve problems involving MAC addresses (such as '''Wake Up on Lan''').168.235.13 centos3</pre>}}

<ol> <li value="3">Confirm that each host can ping all three of the other hosts by name.</li></ol> '''Answer Part 1 observations / questions in your lab log book.''' == Part 2: How do I collect the MAC (Hardware) addresses of computers on my network? =={{Admon/note | Use your CentOS Host | Complete # Perform this investigation section on your CentOS host.}} {{Admon/note | Obtaining Remote MAC Addresses| The term '''MAC'c7host'' address stands for '''Media Access Control''' address, which provides a unique ID to prevent confusion among computer systems within a networkmachine. While we use '''32bit IP addresse'''s to communicate over an internet, on # On the local ethernet network packets are delivered to a centos host '''48bit hardware address''' (sometimes called a MAC address). The ping'''ARP''' protocol resolves 32bit IP addresses to 48bit MAC addresses by using a broadcast and caching the results. We can examine the ARP cache to get the MAC addresses of other computers on our local network.<br /><br />Being able to determine remote MAC address information is useful from troubleshooting networking programs to using '''WOL''' (Wake up on Lan) to automatically boot remote workstations via the network. In this investigation, you will learn how to obtain MAC address information for various network cards.}} # On the centos host <code>ping</code> each of your VM's# Examine the contents of the ARP cache by using the command : <b><code><span style="color:#3366CC;font-size:1.2em;">arp</span></code></b># Check the contents of the cache again by using the command : <b><code><span style="color:#3366CC;font-size:1.2em;">arp -n</span></code></b># What was the difference in output? For what other command did the option '''-n ''' have a similar effect? '''Answer Part 2 observations / questions in # On your lab log book.''' == Part 3: How can I see what network services or ports are active on my CentOS system? == {{Admon/note | Use All Machines | Complete this investigation on all of your VM's and the CentOS host.}} {{Admon/note | Network Ports | When our CentOS system provides any services on a network, those services are accessible through a port number. All network services are configured to be accessed on a particular port number. By examining which ports are active on our system we can know what services (and points of attack) are available on our system. The ability to examine this information is important for troubleshooting network services and securing our systems. One great tool for this is execute the command: <codeb>netstat</code> command.}} <span style="color:# On your CentOS host execute the command3366CC;font-size: <code1.2em;">netstat -at</span></code></b>

# TCP is a connection oriented protocol that uses a handshaking mechanism to establish a connection. Those ports that show a state of LISTEN are waiting for connection requests to a particular service. For example you should see the <code>'''ssh</code> ''' service in a LISTEN state as it is waiting for connections.# From one of your VM's login to your host using <code>'''ssh</code>'''

# On your CentOS host try the command <b><code><span style="color:#3366CC;font-size:1.2em;">netstat -atn</span></code></b>. How is this output different?# Without the <code>-n</code> option <code>netstat</code> attempts to resolve IP addresses to host names (using '''/etc/hosts''') and port numbers to service names (using '''/etc/services''')# Examine the <code>'''/etc/services</code> ''' file and find which ports are used for the services: <code>'''ssh''', ftp'''sftp''', '''http</code>'''# Now execute the command <b><code><span style="color:#3366CC;font-size:1.2em;">netstat -au</span></code></b> What is the difference between <code>the options: '''-at</code> ''' and <code>'''-au</code>'''?

'''Answer Part 3 2 observations / questions in your lab log book.'''

{{Admon/note | Use c6host | Complete When using iptables, the '''Filter''' table is important because it contains the following steps on your essential '''c6hostchains''' machine.}}:<br><br>

{{Admon/note | | [http://en.wikipedia.org/wiki/Iptables Iptables] is Since Linux servers may be connected to the built-in firewall for LINUX. While this program can be controlled by different GUIsInternet, we are going it is very important to investigate the powerful command line interface for this program run a firewall to choose control what data is allowed comes into, out of and through our the computer. Essentially, Iptables is a list of rules. Each rule is placed into a particular chain and when data is sent intosystem, what goes out of or through a PC the data is checked against these rules. If the data matches a particular rulecomputer system, it then must “jump” to a condition. Simple conditions include ACCEPT, DROP and LOG but there are also more complex conditions that can what may be applied and there is even the option forwarded to create your own conditions. Iptables consists of multiple tables, each containing one or more chains of rulesanother computer. For firewall purposes, Linux uses the FILTER table is important; it contains these three chains: – INPUT, OUTPUT and FORWARD. Here as brief explanation of these chains. command called '''OUTPUTiptables''' – When you want to do some research on the Web for something, you open a browser on your PC and navigate to http://www.google.ca. When you do you are attempting to establish an HTTP or HTTPS session with the web server at http://www.google.ca. A data packet is built with appropriate IP and TCP information and sent out of your computer but before it goes out to the Internet it will be compared to all of set the firewall rules in the OUTPUT chain to see if this data is allowed to go “out” of the PC. If it is not allowed then the packet is dropped. '''INPUT''' – If your data was allowed out and a request was sent to http://www.google.ca, this web server will send data back to your PC with an acknowledgement. Before this data Although graphical programs can be processed by your browser, it must first be checked against the INPUT chain used to see if it is allowed into the PC. If it isconfigure iptables, your browser will process the data and move to it's next task. If it is not, the packet will be dropped. '''FORWARD''' – LINUX PC's are often used as routers or gateways important for other PC's. This means that data may have students of Linux Administration to learn how to be passed through this LINUX box, but use the data is not intended iptables command for the LINUX PC nor is it being sent by the LINUX PC. Even though the data will go into this PC more complex and it will exit this PC, the INPUT and OUTPUT chains do not apply here. Because the PC is acting as a router it does not actually send or receive data, it FORWARDS data from one machine to another. When this process happens, the data is checked against the FORWARD chain to see if it is allowed through. If it is the router will forward the data to it's destination. If not, the packet is droppedautomated configuration via shell scripting.}}

#* : <codeb>iptables -F</code> (This flushes out or clears all of your rules from the chains)<span style="color:#* <code3366CC;font-size:1.2em;">iptables -L</codespan># You should see something similar to this:<br /code><br /b>Chain INPUT (policy ACCEPT)#: <br /b><br /code>target prot opt source destination<br /span style="color:#3366CC;font-size:1.2em;">iptables -F<br /span>Chain FORWARD (policy ACCEPT)<br /code><br />target prot opt source destination<br /><br />Chain OUTPUT (policy ACCEPT)<br /><br />target prot opt source destination<br /><br /b># What did those commands issued above do? Refer to the ''manpages'' for ''iptables'' if not certain.# Set the default policy for the INPUT chain to DROPby issuing the command:#* : <b><code><span style="color:#3366CC;font-size:1.2em;">iptables -P INPUT DROP</span></code></b># Now try on your own to change the default policies for the OUPUT OUTPUT and FORWARD chains to DROP

=== Testing policies iptables Policies ===

# Execute the command <b><code><span style="color:#3366CC;font-size:1.2em;">iptables -L</span></code></b> and check that the policies on your INPUT and OUTPUT chain are set to DROP

# In the OUTPUT chain, add the following rule:#* <code>iptables -A OUTPUT -j LOG</code># The above rule tells <code>iptables</code> to log packets and relevant information to <code>/var/log/messages</code>. # This entry in the OUTPUT policy will therefore log all packets being sent out of the machine.# Try to access the Internet again. Because the policies have been set to DROP, you should be unsuccessful. However, every packet of data that your PC attempted to send out was logged. Let's have a look at the log file and analyze the data.#* <code>tail /var/log/messages</code># This command shows us the last 10 lines of the file. While there are many things being logged to this file, the last thing we did was try to access the Internet so we should be able to see the data we need. Look for a line that looks similar to the following:<br /><br /><blockquote><code>Mar 3 09:21:03 koala-laptop kernel: [90775.407304] IN{| width= OUT"40%" align=wlan0 SRC=192.168.1.107 DST=66.249.90.104 LEN=1470 TOS=0x00 PREC=0x00 TTL=64 ID=19752 DF PROTO=TCP SPT=45431 DPT=80 WINDOW=108 RES=0x00 ACK PSH URGP=0</code></blockquote>"right"# Your IP, host names and date will be different, but the one thing that should be the same is the DPT=80 value. # When your computer tried to send OUT a request to connect to the Internet using the WWW, the computer used a destination port of 80. This is the standard port for the WWW. Because we have set the default policy to DROP it drops these packets. The problem is we are dropping all packets. What if we just want to drop the WWW packets?# Using the commands we already know, change the default policies on all of your chains to ACCEPT. # Open a browser and confirm that you can access the world wide web.# Enter the command:#* <code>iptables |-I OUTPUT -p tcp -s0/0 -d 0/0 --dport 80 -j DROP</code>valign="top"# Try to access the Web. If you have done everything right, you should not have been successful.# After you have completed the test execute the following command:#* <code>iptables -F</code>|{{Admon/note| Interpreting iptables commands |Here is the command you just usedissue in step #15:

'''Let's break down the command to see how it works.:'''

|}<ol><li value="6"> In the OUTPUT chain, add the following rule:<br><b><code><span style="color:#3366CC;font-size:1.2em;">iptables -A OUTPUT -j LOG</span></code></b></li><li>The above rule tells '''iptables''' to log packets and relevant information to '''/var/log/messages'''.</li><li>This entry in the OUTPUT policy will therefore log all packets being sent out of the machine.</li><li>Try to access the Internet again. Because the policies have been set to DROP, you should be unsuccessful. However, every packet of data that your PC attempted to send out was logged. Let's have a look at the log file and analyze the data:<br><b><code><span style="color:#3366CC;font-size:1.2em;">tail /var/log/messages</span></code></b></li><li>This command shows us the last 10 lines of the file. While there are many things being logged to this file, the last thing we did was try to access the Internet so we should be able to see the data we need. Look for a line that looks similar to the following:<br /><blockquote><code>Jun 24 12:41:26 c7host kernel: IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=16442 DF PROTO=TCP SPT=57151 DPT=5902 WINDOW=1024 RES=0x00 ACK URGP=0</code></blockquote></li><li>Your IP, host names and date will be different, but the one thing that should be the same is the DPT=80 value.</li><li>When your computer tried to send OUT a request to connect to the Internet using the WWW, the computer used a destination port of 80. This is the standard port for the WWW. Because we have set the default policy to DROP it drops these packets. The problem is we are dropping all packets. What if we just want to drop the WWW packets?</li><li>Using the commands we already know, change the default policies on all of your chains to ACCEPT.</li><li>Open a browser and confirm that you can access the world wide web.</li><li>Enter the command:<br><b><code><span style="color:#3366CC;font-size:1.2em;">iptables -I OUTPUT -p tcp -s0/0 -d 0/0 --dport 80 -j DROP</span></code></b></li><li>Try to access the Web. If you have done everything right, you should not have been successful.</li><li>After you have completed the test execute the following command:<br><b><code><span style="color:#3366CC;font-size:1.2em;">iptables -F</span></code></b><br></li><li>Using the information you have learned, try on your own to achieve the same goal as above (block www access to your computer) by using the INPUT chain instead of the OUTPUT chain.</li><li>After you have completed this task, flush the iptables again.</li><li>Make sure that your ssh server is equivalent running on the host machine and try to:access it from a virtual machine of your choice.</li><li>Once you have confirmed that ssh is running on the host machine, insert an iptables rule on the host machine to prevent access to the ssh server from all VM's on the virtual network.</li><li>Confirm that your rule works by testing from your VM's</li> <li>Does iptables -I OUTPUT -p tcp --dport 80 -j DROPclose the port? Check using '''netstat'''</li><li>Now insert a rule on the CentOS host that would ACCEPT connections from the centos2 VM only.</li><li>Fully test your configuration.</li>}}</ol>

=== Final Tasks Making iptables Policies Persistent ===

# Using It should be noted that all of the information commands that we do here with iptables will not be persistent unless you have learned, try on your own to achieve the same goal as above (block www access to your computer) by using the INPUT chain instead of the OUTPUT chainconfiguration.# After That means if you have completed this taskre-boot, flush the default iptables againconfiguration will be loaded.# Make sure that When your ssh server is running on the host machine and try to access iptables service starts or at boot time it from a virtual machine of your choice. # Once you have confirmed that ssh is running on the host machine, insert an iptables rule on the host machine to prevent access has to load the ssh server rules from all VMthe file ''s on the virtual network.# Confirm that your rule works by testing from your VM's# Does /etc/sysconfig/iptables close the port? Check using <code>netstat</code># Now insert a rule on the CentOS host that would ACCEPT connections from the centos2 VM only.# Fully test your configuration-config'''.

{{Admon/note | iptables Service |When your iptables service starts or at boot time it has to load the rules from the file <code>/etc/sysconfig/iptables</code>.}} <ol> <li value="9">'''Make a backup of the file <code>/etc/sysconfig/iptables</code>'''</li> <li>Examine the file to see how rules are added.</li> <li>Issue the command: <code>iptables-save > /etc/sysconfig/iptables</code> The final section below teaches you to save the rules you added with the iptables command, above.</li> <li>Verify that the file <code>/etc/sysconfig/iptables</code> was updated with your new rules.</li> <li>Restart make your iptables service and test your configuration. </li> <li>Write a short bash script to add a rule allowing the centos1 and centos3 VM's to connect to <code>ssh</code> on the CentOS hostsettings permanent.</li></ol>

# Make a backup of the file '''/etc/sysconfig/iptables''Answer ' by issuing the Investigation 8 observations command:<br><b><code><span style="color:#3366CC;font-size:1.2em;">iptables-save > / questions in your lab log booketc/sysconfig/iptables.bk</span></code></b>#To make the iptables rules '''persistent''' (i.e. keeps rules when system restarts), you issue the command: <br><b><code><span style="color:#3366CC;font-size:1.2em;">iptables-save > /etc/sysconfig/iptables</span></code></b># Verify that the file '''/etc/sysconfig/iptables''' exists.# Restart your iptables service and test your configuration.

Now you should have '''Answer the following network configuration:<br Part 3 observations /><br />[[Image:new-network-configquestions in your lab log book.png]]'''

{{Admon/important|Time for a new backup, INCLUDING YOUR VIRTUAL HARD DRIVE!|If you have successfully completed this lab, make a new backup of your virtual machines. Remember to also make a backup of the new second virtual disk drive on '<br><br>'centos3'' Virtual hard-- drives created lab5 are image files and may have data changed as a result of performing this lab. Therefore, you now have two virtual disks on need to be backed up this hard disk image as well!''centos3'', and therefore two image files, and therefore will need two backup files.}}

# <codeol><li><span style="color:green;font-size:1.5em;">ifconfig&#x2713;</codespan> from all 3 '''centos2''' VM:<blockquote><ul><li>Contents of '''/tmp/lab6's# The contents of '' directory.</li><codeli>'''ssh''' from centos2 to the CentOS host</etcli></hostsul></codeblockquote> on each machine# The contents of your <code/li>arp</codeli><li> cache<span style="color:green;font-size:1.5em;">&# x2713;</span> '''<u>All<code/u>sshVMs''':<blockquote><ul><li>'''ifconfig''' information</codeli><li> from centos2 to the CentOS host.# Contents of '''/etc/hosts''' file<code/li></tmpul></lab6blockquote></codeli><li> directory<span style="color:green;font-size:1.5em;">&# Fresh x2713;</span>'''c7host''' machine<blockquote><ul><li>'''arp''' cache information</li><li>Contents of '''/etc/hosts''' file</li><li>Proof of backup of the virtual machines.# </li><li>A list of your '''iptables''' rules<code/li>iptables</codeul></blockquote></li><li><span style="color:green;font-size:1.5em;">&#x2713;</span> rules'''Lab6''' log-book filled out.</li></ol>

= Preparing for = Practice For Quizzes , Tests, Midterm &amp; Final Exam ==