Reference no: EM132160530

Project - SDN Firewall

Goal - In this project, you will use SDN to create a configurable firewall using an OpenFlow enabled switch. This is beyond what is possible with traditional L2 switches, and shows how the simplest of SDN switches are more capable than even the fanciest of L2 switches.

You are going to create an externally configurable? firewall using Pyretic. That means that the firewall rules are provided in a configuration file, so they can be changed without altering the switch code.

This firewall is the type that allows all traffic that isn't expressly disallowed (a blacklist firewall). This is the type of firewall that you would find in an office environment where you wish to restrict access to certain resources from other devices. The alternative is to disallow all traffic that isn't allowed by the policy (whitelist firewall). A whitelist firewall is typically used in edge situations protecting internal resources from the outside/Internet (an example is a home internet router). The code we have provided for this project could be modified to implement this second type of firewall, and would be a worthwhile project for those who are interested in learning further.

In the Project directory, there are many files, described below:

• firewall-policies-bad.pol - This is an example firewall configuration policy that is broken. When parsing, an error message will be thrown. Each line has an error of some type. Try removing lines to see the different possible error messages. This shows how the policy file is parsed by the parse_config? function in firewall.py
• firewall-policies-good.pol - This is an example firewall configuration policy that disallows all devices to connect to port 1080 on all devices. You can use this as the base for the firewall-config.pol file you will generate later in the instructions. The code to implement this firewall policy is included in the Firewall_policy.py file.
• Firewall_policy.py - This is the file where you will implement the firewall using python and pyretic code, based on the policy configuration that is passed in via the configuration files.
• firewall.py - This is the file that sets up pyretic application and reads the firewall config policy into a data object. DO NOT MODIFY THIS FILE. A shell script is provided to help run it. This file contains the code that is used to parse your firewall-config.pol file, so please look here for the import format for your firewall-config.pol.
• firewall-topo.py - This is a mininet program to start your topology. It consists of one switch and two groups of hosts. Modifying this file isn't necessary, but you may choose to try different topologies for testing your code (make sure that your firewall-config.pol works with the original firewall-topo.py, however).
• pyretic_switch.py - This implements a learning switch. You do not need to modify this file.
• run-firewall.sh - This script runs the firewall using pyretic. (It starts the firewall.py application.) The files need to be in the pyretic directory trees, and this script makes that happen. Also, it allows for different configuration files to be used by giving the filename on the command line.
• test-tcp-client.py - This acts as a TCP client: opens a connection, sends a string, then waits to hear it echoed back. You can use this to test your firewall policies.
• test-tcp-server.py - This acts as a TCP server: listens on a specified port, echos back whatever it hears. You can use this together with the test-tcp-client.py program.
• test-udp-client.py - This acts as a UDP client to test your firewall policies.
• test-udp-server.py - This acts as a UDP server which echos back whatever it hears. You can use this together with the test-udp-client.py program.

Instructions - RUN THIS PROJECT ON THE OLD VM, BUT PLEASE USE THE EXTRA CREDIT OPPORTUNITY BY RUNNING THIS PROJECT ON THE NEW VM. THERE WILL BE A PIAZZA THREAD ABOUT THIS PROJECT AND THE NEW VM.

Rules to be implemented:

1. One common implementation for a virtual private network solution utilizes PPTP (Point-to-Point Tunnelling Protocol). It now has many issues related to the way it authenticates users. Write firewall policy rules to block PPTP that will prohibit all systems from accessing a PPTP server running on server2. (TCP Port 1723)

2. SSH is used to provide a remote shell which can be used to forward other ports or to bypass firewalls. Write firewall policy rule(s) that will prohibit all computers/devices from connecting to a SSH server on the east hosts (e1-e3). (TCP and UDP Port 22)

3. One common way to perform a distributed denial of service (DDOS) attack is to use an amplification attack using the Network Time Protocol (NTP) and Domain Name Services (DNS) taking advantage of the UDP protocol to saturate the links. Write firewall policy rule(s) to protect the DNS and NTP Services on server1 and server2 from all hosts. However, the DNS and NTP services on server3 should remain accessible. (UDP Ports 123 and 53, respectively)

4. Write a series of firewall policy rules disallowing hosts w1 and w2 from pinging mobile1. This rule will be satisfied if the full ICMP response is not completed. Analyzing the interactions with Wireshark is helpful, but not required.

5. Write a series of firewall policies to disallow all traffic destined to TCP ports 9950-9952 on host e3 from host e1.

6. Write a series of firewall policies to restrict host mobile1 from communicating to any of the east hosts (e1-e3) on both TCP and UDP protocols.

Questions to Ponder -

To help you implement your firewall policy and configuration rules properly, think about the following topics. Feel free to discuss these on Piazza:

• When creating firewall rules, should you be using BOTH source and destination ports when creating a rule? Why or why not?
• What happens when you block one side of an ICMP request/response? What is the behavior if you block the sender vs the requester?
• Pyretic has specific requirements when port numbers are specified. Why is this so?
• If you do a wireshark traffic dump while testing your rules, why do you sometimes see one-sided responses?
• Given a rule to block access to a port 80 server on host E2, should you be able to access the port 80 service FROM host E2? Why?

Attachment:- Assignment Files.rar