Changes

Jump to: navigation, search

OPS335 Lab 2b

270 bytes removed, 12:11, 29 January 2021
Online Submission (Ahad Mammadov's Classes only)
== OBJECTIVE & PREPARATION ==
In Lab 2a, we set the firewall rules for your '''host''' machine. In this lab, we will '''create firewall rules for our virtual machines''' within our virtual private network. This lab will also apply '''"best practices"''' and '''"troubleshooting techniques"''' using iptables.
=== Online Resources===
* [http://zenit.senecac.on.ca/wiki/index.php/OPS335_Lab_1#Linux_Network_Connection_Configuration_Troubleshooting Test Network Connectivity] (From Lab1)
* [http://www.microhowto.info/troubleshooting/troubleshooting_iptables.html Troubleshooting iptables]
* [https://community.rackspace.com/products/f/25/t/248 Basic IPTABLES Troubleshooting]
 
==INVESTIGATION 1: CUSTOM IPTABLES RULES ON A VM==
<table border="1" cellspacing="0" cellpadding="5" >
<tr><th>Step</th><td>'''Procedure'''</td><td>'''Explanation'''</td></tr>
<tr> <th>1</th><td>'''Test Network Connectivity'''</td><td>You can use the [httphttps://zenitwiki.senecaccdot.onsenecacollege.ca/wiki/index.php/OPS335_Lab_1#Linux_Network_Connection_Configuration_Troubleshooting steps in lab 1] as a guide, but keep in mind the firewall may be blocking pings and DNS requests.</td></tr>
<tr> <th>2</th><td>'''Verify Service is Running &amp; listening on the correct interfaces'''</td><td>You should learn to read the output of '''ss -atnp''' and '''ss -aunp''' to complement the '''systemctl status''' command.</td></tr>
<tr> <th>3</th><td>'''List your iptables Rules &amp; Perform a "Walk-Thru"'''</td><td>For many decades, when troubleshooting programs that don't run properly, programmers will resort to reading their "source-code" line-by-line and pretend they are the computer to perform the operation. The programmer "walks-through" the code to force them to think like a computer in order to spot and fix subtle problems.<br><br>Therefore, you can follow a packet's path as you understand it should follow. Keep in mind [httphttps://zenitwiki.senecaccdot.onsenecacollege.ca/wiki/index.php/OPS335_Lab_2#How_Firewalls_.28iptables.29_Relate_to_the_Labs_in_this_Course the diagram from the lecture last week]. What chain applies first on which machine? What's the first rule that matches the packet? What happens if no rules match the packet?<br><br>Don't forget that even if you're tracing the path of outgoing traffic - the INPUT chain on your machine still applies (for the response that comes back to your request).</td></tr>
<tr> <th>4</th><td>'''Use the log target to list unexpected traffic'''</td><td>Add a final rule to your input chain to log all traffic. Any traffic you are allowing will have already been accepted and will not reach this rule, so you will start a log of all the packets you are not allowing. Observing the logs while you attempt to use the service that is not being allowed will show you the type of traffic you need to allow.</td></tr>
<tr> <th>5</th><td>'''Verify Network Connectivity by Deleting iptables Rules'''</td><td>As a last resort, if you have no idea what's going on and need to confirm that you're still sane - clear all the iptables rules and check your configuration then. Keep in mind that the '''iptables -F''' command will delete all your rules but will not set the default policies to ACCEPT. This will tell you for sure whether your problem was (or was not) caused by iptables.<br><br>
{{Admon/important |Backup your VMs!|You MUST perform a '''full backup''' of ALL of your VMs whenever you complete your '''OPS335 labs''' or when working on your '''OPS335 assignments'''. You should be using the dump or rsync command, and you should use the Bash shell script that you were adviced to create in order to backup all of your VMs.}}
'''Record your observations in this section on your OPS335 lab log-book'''
 
== COMPLETING THE LAB ==
In completing this lab you have gained further practice using iptables. Each of your machines should now be protected by a custom firewall that we will continue to build on throughout the course. You have also gained experience troubleshooting iptables and determining what rules might need to be changed to allow desired traffic (or block undesired traffic).
===Online Submission (Ahad Mammadov's Classes only)===
Follow the instructions for lab 2b on blackboard.
<!--

Navigation menu