Configuring Internet Security: IP Addresses, Routing Tables, NAT, and Port Forwarding

This guide provides step-by-step instructions and demonstrations on configuring internet security with IP addresses, routing tables, NAT, and port forwarding. It includes setting up SSL certificates on Apache and preventing private addresses. The guide also covers Cross-Site Scripting (XSS) vulnerability exploitation.

Hemasa-1
INTERNET SECURITY

TABLE OF CONTENTS
1. Experiment - 1..................................................................................................................3
1.1 Task 1: Applying IP Addresses.................................................................................3
1.1.1 Introduction........................................................................................................3
1.1.2 Experimental Method........................................................................................4
1.1.3 Results.................................................................................................................4
1.1.4 Discussion............................................................................................................7
1.1.5 Questions.............................................................................................................8
1.1.6 Conclusion...........................................................................................................8
1.2 Task 2: Establishing Routing Tables........................................................................9
1.2.1 Introduction........................................................................................................9
1.2.2 Experiment Method...........................................................................................9
1.2.3 Results...............................................................................................................10
1.2.4 Question............................................................................................................12
1.3 Task 3: Prohibiting Private Addresses...................................................................12
1.3.1 Introduction......................................................................................................12
1.3.2 Experiment Method.........................................................................................12
1.3.3 Results...............................................................................................................14
1.3.4 Discussion..........................................................................................................15
1.3.5 Questions...........................................................................................................15
1.3.6 Challenges.........................................................................................................15
1.3.7 Conclusion.........................................................................................................16
1.4 Task 4: Configuring NAT........................................................................................16
1.4.1 Introduction......................................................................................................16
1.4.2 Experimental Setup..........................................................................................16
1.4.3 Results and Discussion.....................................................................................16
1.4.4 Question............................................................................................................18
1.5 Task 5: Configuring Port Forwarding...................................................................18
1.5.1 Introduction......................................................................................................18
1.5.2 Experimental Setup..........................................................................................19
1.5.3 Results and Discussion.....................................................................................19
1.5.4 Questions...........................................................................................................22
2. Experiment – 3................................................................................................................23
1

2.1 Introduction.............................................................................................................23
2.2 Experimental Setup.................................................................................................23
2.3 Results and Discussion............................................................................................25
2.3.1 Installing Apache..............................................................................................25
2.3.2 Creating a Self-Signed SSL Certificate on Apache.......................................33
2.3.3 Cross-Site Scripting (XSS) Vulnerability Exploitation.................................46
2.4 Conclusion................................................................................................................51
3. References.......................................................................................................................52
2

1. Experiment - 1
1.1 Task 1: Applying IP Addresses
1.1.1 Introduction
This task aims to apply the IP addresses for a 5 node mini-network topology. To apply
a IP address for a network topology by follows the below steps. First, user needs to login on
deter lab. To login deter lab by follows the below steps.
1. Go to deter lab website.
2. Click login to enter the user name and password.
3. After, choose the deter lab experiment. It is shown below.
Figure: Deter Lab Experiment Setup
3

Figure: Initial Network Topology before Applying own IP
1.1.2 Experimental Method
This task was carried out in a controlled environment provided by Deter Lab, with a
Linux OS and virtual workstations & routers set up in place. An experiment Called
“internetworking-FR” was created in Deter Lab, after which a SSH login was made using
by command.
ssh [e-mail]
This process is shown in below (Cane, 2018).
1.1.3 Results
Applying IP Addresses to the Devices was successfully carried out and the result of
doing so resulted in adjacent devices being able to ping each other. However trying to ping
end to end workstations did not yield positive results as the workstations could not send
packets to each other. Then, user needs to examine the node interfaces by enter the following
the command on the command line.
ifconfig -a
4

Figure: Available Interfaces on SWRouter using ‘ifconfig –a’ command
After, user needs to put the address on the cabled interfaces to identify which the
cabled ones are by enter the below command on terminal. This process is shown below.
5

Then, check the connectivity by pining the addresses between the adjacent nodes. This
process is shown below.
Figure: Successful Ping to ISrouter by SWrouter.
Also, allocate the IP address to a workstations and ping to the adjacent devices. This process
is shown below.
Figure 1.4: Allocation of IP address to a Workstation and Ping to adjacent device
6

Figure: Visualization of Network Topology after Successful IP Allocation
1.1.4 Discussion
This task is effective as it depicts a real time situation on how to configure the IP
address for a network topology that is network devices like workstations and routers so as for
them to communicate with each other. Here, we will apply the IP address and enabled the
adjacent devices to communicate with each other network devices. Through, this is not
sufficient in a real time network as a client on one network segment may needs to
communicate with another clients on a various network segment (Netbsd.org, 2018). Here,
we will demonstrate the sample allocations of IP address is shown below.
7

Figure: Sample of IP Allocation using ifconfig
1.1.5 Questions
What is “special” about the network and host addresses used at the two “ends” of the
network, and why are they different from the ones in the middle?
The first number is called as Network address so, 192.168.253.1/24 is the number that
is utilized and it is refer to subnet number or network address. Obviously, the last address is
the broadcast address where communicates are sent to and later pushed down to all customers
on that subnet. In IP networking, you generally remove 2 from the broadcast address to locate
the aggregate sum of addressable IP addresses. 192.168.0.0/24 has a broadcast of
192.168.0.255 and in this way 253 addressable locations. 192.168.0.0/26 has a broadcast of
192.168.0.64 and in this manner 62 addressable locations.
1.1.6 Conclusion
This task is used to provide the understanding of how to setup and configure IP addresses
for devices in a network. Applying IP Addresses to the Devices was successfully carried out
and the result of doing so resulted in adjacent devices being able to ping each other.
8

1.2 Task 2: Establishing Routing Tables
1.2.1 Introduction
In Experiment 1, IP Addresses were allocated to devices on the network. The result
was the devices where able to ping adjacent devices but not those beyond the gateway/router.
Here, the problem is solved so that end-to-end ping of workstations is made possible by
adding routes to the IP Table of those devices. Also, establishing the routing tables for a
router.
1.2.2 Experiment Method
Commands used:
9

Figure: IP Tables Before & After Adding Routes
1.2.3 Results
Upon adding routes to the devices, the devices were able to ping other devices which
are not adjucent. In other words, End-to-end Communication of workstations was made
posible.
10

Figure: End-to-end Ping of Workstations before Configuring the IP Tables
After install the lynx-cur. It is shown below.
11

1.2.4 Question
Why do the two workstations require three routes added to their routing tables while the
intermediate routers only require two?
1.3 Task 3: Prohibiting Private Addresses
1.3.1 Introduction
Here, we will prohibiting the private address Addresses that starts with 10, 192.168 and
some that begin with 172 are “private” and public Internet routers are usually configured to
drop them. In this task, we configured IS router to drop them using the IP Tables (Tech-
faq.com, 2018).
12

1.3.2 Experiment Method
The IS Router was configured to drop private IP Addresses using the commands below.
After, type the lynx 10.0.0.2, it makes the HTTP connection. It is shown below.
13

Then, capture the packets and this process is shown below.
14

1.3.3 Results
After the configuration, any packet with “-d” destination or “-s” source in the specified range
is discarded. All packets to or from the SW or NW networks are therefore excluded. This
process is shown below.
Figure: Prohibiting Private IP Addresses using iptables Command
1.3.4 Discussion
Before prohibiting the IS router to drop Private IP Addresses, we were able to do an
End-to-end Ping from SW workstation to NW workstation. After IS router setup, it is used to
drop private addresses and able to ping SW networks from NW networks.
15

1.3.5 Questions
What do your tcpdump results demonstrate?
Tcpdump prints out a description of the substance of packets on a network interface
that match the boolean articulation; the portrayal is gone before by a time stamp, printed, as a
matter of course, as hours, minutes, seconds, and parts of a second since midnight.
1.3.6 Challenges
Lynx browser installation from the repository using `apt-get install lynx-cur` was not
successful because we are uses the repositories on the VM Ubuntu are obsolete.
1.3.7 Conclusion
This task was successfully prohibited the private address on the network. It also
configured the IS router to drop the packets using the IP tables. After IS router setu, it is used
to drop private addresses and able to ping SW networks from NW networks. Tcpdump
monitors and outputs content of the packets being trasmitted on the network. However when I
run the tcpdump, no packets were captured.
1.4 Task 4: Configuring NAT
1.4.1 Introduction
Here, we will configure the NAT and it is used to allow nodes in a privately addressed
network. This process is used to communication the network over the public internet.
1.4.2 Experimental Setup
16

1.4.3 Results and Discussion
Here, first we will use the internet facing routers their IP addresses to packets with private
ones.
This processes are shown below.
First, we will type the below command on terminal.
After, ping the workstation by enter the below command on terminal
This process is shown below.
17

While pinging, capture the packets by using the tcpdump. To capture the packets by enter the
below command on terminal/
This process is shown below.
18

1.4.4 Question
What happens when you try to ping from NWworkstation1 to SWworkstation1? Has the end-
to-end problem been solved? If not, why not?
The ping command is very helpful for networking commands because it facing the
network reachability problems. Here, we will ping the one workstation to another
workstations because it finf out the wheather a certain host is alive or not. It operates basicaly
on network layer so, it easily identified the trafiic reliability issues. Here, also end to end
problem resolved.
1.5 Task 5: Configuring Port Forwarding
1.5.1 Introduction
This task is used to resolve the end to end problem by configuring the port
forwarding. The port forwarding is used to the packet directed to the server gateway router
with the port are forwarded to the private address of the server.
19

1.5.2 Experimental Setup
1.5.3 Results and Discussion
Here, we will recognize the packets addressed to a web server but that are not
intended for the router. It also forward the packets copies with private address on the local
network. This process are shown below.
Here, we will pre-routing the packets by enter below command.
After, ping the lynx with 3.5.7.17. This process is shown below.
It makes the HTTP connection. It is shown below.
20

After, capture the packets. This process is shown below.
Again ping the lynx to 3.5.7.17. This process shown below.
21

22

1.5.4 Questions
Can you explain the differences between the two tcpdump outputs?
When it comes to tcpdump most administrators fall into two classes; they either know
tcpdump and the greater part of its banners like the back of their hand, or they sort of know it
yet need to utilize a reference for anything outside of the essential use. The explanation
behind this is on the grounds that tcpdump is a really propelled charge and it is truly simple to
get into the profundities of how organizing functions when utilizing it. You can determine the
interface by utilizing the - I flag taken after by the interface name. On most linux frameworks
a unique interface name of any can be utilized to advise tcpdump to tune in on all interfaces, I
discover this to a great degree helpful while investigating servers with different interfaces.
This is particularly obvious when there are directing issues included. The yield of tcpdump is
convention subordinate (Tcpdump.org, 2018).
23

2. Experiment – 3
2.1 Introduction
This experiment aims to set up a SSL certificate on apache on a web server installed in
deter lab testbed environment. Here, we will be demonstrate the following aspects such as
experiment in deter lab, starting an experiment , accessing deter lab virtual node, installing
apache, and setting SSL certificate on Apache installed. Also, Cross-Site Scripting (XSS)
vulnerability exploitation will be demonstrated. These are will be analyzed and discussed in
detail.
2.2 Experimental Setup
First, we will log on deter lab.
Then, open the experiment.
This is shown below.
To take a web interrface, you will enter the username and passowrd. This process is shown
below.
24

After, makes the SSH connection from the control server to the experimental node. It is
shown below.
Then, identify the experimental node IP address by enter the following command on terminal.
It is shown below.
25

Here, initialize the SSH connection.
2.3 Results and Discussion
2.3.1 Installing Apache
To install apache by enter the below commond on terminal. It is shown below.
26

Once, installation of apache is finished. Then, verified if it is installed or not by enter the
below command. It is shown below.
27

After, enable the SSL. It is shown below.
28

Then, restart the apache.
It is shown below.
29

Finally, open the web browser and type the local host and it conforming that apache web
server was installed. This process is shown below.
30

Here, open the index.html file to change the apache title. This process is shown below.
31

32

Once, successfully changed the title.Then, save and close the file. After, go to web
browser. It is display the changed title. Here, we will changed the title as welcome to my
home page deter lab. It is shown below.
33

2.3.2 Creating a Self-Signed SSL Certificate on Apache
Here, we will creating the self signed SSL certification on apache. So, First we will install the
Openssl. This process is shown below.
34

Once openssl is installed, then conforming if it is installed or not by enter following
command on terminal. This process is shown below.
35

After, create the directory server key and the certificate will be stored and it is shown below.
36

Next, generate the keys for the CSR (Certificate Signing Request). This is shown below.
37

After, creates the request for certificates and it requires the some informations. This process is
shown below.
38

After, create the self signed certificate by enter the following command. It is shown in below.
39

After, verify the private key and SSL certificate by ls. It is shown below.
40

Then, move the certificates into the created folder, enabling the SSL and reload the apache.
These are shown below.
41

After, open the web browser https://localhost/. It is displayed in below.
42

Here, we will click the Advanced---->Add exceptions. It is shown below.
After click the get certificate and Confirm Security Exception.
43

44

Here, we will click the security and choose the view certificate. It is shown below.
45

46

2.3.3 Cross-Site Scripting (XSS) Vulnerability Exploitation
Here, we will perform Cross-Site Scripting (XSS) attack.So, PHP must be installed. To
install a PHP by enter the following command. It is shown below.
47

Here, restart the apache2. It is shown below.
48

After create the index.php and name.php file. Also, edit the index.php file. This process is
shown below.
49

Here, open the index.php file, type the below PHP code.
50

Here, open the name.php file, type the below PHP code.
51

Finally, open the web browser and type the localhost:12345/index.php on the URL. It is
shown below.
2.4 Conclusion
This experiment was successfully set up the SSL certificate on apache on a web server
installed in deter lab testbed environment. Here, we successfully demonstrated the following
aspects such as experiment in deter lab, starting an experiment , accessing deter lab virtual
node, installing apache, and setting SSL certificate on Apache installed. Also, Cross-Site
52

Scripting (XSS) vulnerability exploitation was demonstrated. These are analyzed and
discussed in detail.
3. References
Cane, B. (2018). A Quick and Practical Reference for tcpdump | Benjamin Cane. [online]
Benjamin Cane. Available at: https://bencane.com/2014/10/13/quick-and-practical-reference-
for-tcpdump/ [Accessed 10 Aug. 2018].
Netbsd.org. (2018). Chapter�23.�Introduction to TCP/IP Networking. [online] Available
at: https://www.netbsd.org/docs/guide/en/chap-net-intro.html [Accessed 10 Aug. 2018].
Tcpdump.org. (2018). Manpage of TCPDUMP. [online] Available at:
https://www.tcpdump.org/manpages/tcpdump.1.html [Accessed 10 Aug. 2018].
Tech-faq.com. (2018). IP Address Classes. [online] Available at:
http://www.tech-faq.com/ip-address-classes.html [Accessed 10 Aug. 2018].
53