Exercises firewall

Exercise: Firewall

• Topology is the same as that used for loadbalancing

(40P) Simple firewall

• • We will be using the load-balancer experiment as basis
  • put blocker.py (https://projects.gwdg.de/projects/mayutan-public/repository/raw/courses/SDN/2017_2018_WS/exercises/ex3/blocker.py) in pox/ext/blocker.py

  $ sudo mn --topo single,6 --mac --arp --controller remote
  $ ./pox/pox.py forwarding.l2_learning blocker py (Note that there is a space between blocker and py to enable interactive mode)

• • • or

  $ ./pox/pox.py forwarding.l2_learning blocker --ports=80,8888,8000 (not recommended)

• • start Webserver in h1

  h1$ python -m SimpleHTTPServer 80

• • Try to perform curl or wget from h2 to h1

  h2$ curl 10.0.0.1

• • Then block port 80 in pox controller

  pox> block(80)

• • Now, again try the following and report what happens

  h2$ curl 10.0.0.1

(60P) Advanced Firewall ( I will give you hints)

• • Take a look at [1] to know how to set match, action and etc.
  • Take a look here for commands, examples on how to create match, action [2]
  • Topology [3]
  • Aim: Implement a layer 2 firewall that runs alongside the MAC learning module on the POX OpenFlow Controller. Your firewall should be agnostic to the underlying topology. Take MAC pair list as input and install it on the switches in the network
  • Note that MAC learning can be done in conjunction with firewall. Therefore you might have to assign priority to each application.
  • Copy firewall.py from [4] into pox/pox/misc folder
  • Start editing firewall.py (Note that you can enter the MAC ids directly, no need to read from a .csv file as stated in the same code
    • Write code to block h1 to h2 (Mac IDs: 00:00:00:00:00:01, 00:00:00:00:00:02)
  • tip
    • to send the msg to switch, use event.connection.send
    • msg type is of.ofp_flow_mod()
  • Do the following to quickly test code

  $ ./pox/pox.py --verbose forwarding.l2_learning misc.firewall
  $ sudo mn --topo single,3 --controller remote --mac
  $ dpctl dump-flows tcp:127.0.0.1:6634