IPv6 NAT. Open Source Days 9th-10th March 2013 Copenhagen, Denmark. Patrick McHardy
|
|
|
- Megan Hortense Campbell
- 6 years ago
- Views:
Transcription
1 IPv6 NAT Open Source Days 9th-10th March 2013 Copenhagen, Denmark Patrick McHardy
2 Netfilter and IPv6 NAT historically Harald Welte laforge at netfilter.org Wed Mar 30 17:23:16 CEST > When is support NAT table for Ip6tables? Only over my dead body. We will never implement ipv6-to-ipv6 network address translation as long as I have any say in netfilter/iptables development. NAT is evil and causes horrible breakage of end-to-end on the internet. IPv6 has enough addresses and therefore no justification for NAT.
3 What s wrong with NAT? Most cases of NAT need statefulness Commonly used scenario breaks end-to-end (masquerading) Network addresses are usually included as "pseudo header" in transport layer checksums New transport layer protocols need support from NAT Network addresses and port numbers may be included in application layer protocol payload Need ALGs (helpers) for every such application layer protocol Need to intercept new connections negotiated through NATed control protocols and direct them to proper destination (FTP data, SIP RTP,...) Fragments, ICMP translation, IPsec,...
4 Why IPv6 NAT? Security? No. It s a wide spread misconception that NAT provides security. The only reason why the internal hosts of a NATed network are perceived to be "more secure" is because they often use globally unroutable addresses. These addresses are just *globally* unroutable though, anything connected directly to the NAT router on the ouside (next hop router, cable modem neighbours,...) can reach the internal network just fine, unless you use packet filtering.
5 Why IPv6 NAT? Dynamic IPv6 Prefixes Some ISPs assign dynamic IPv6 prefixes, which means your internal networking addresses change at every prefix change. If you want static internal addresses, you have little choice but to choose a different ISP or use NAT. NAT can be performed bi-directional if desired, so incoming connections can be established to the internal hosts using the assigned prefix.
6 Why IPv6 NAT? Server Load Balancing A very easy way to implement server load balancing is to perform destination NAT on incoming requests to multiple addresses of a server farm. There are other options, one advantage of using NAT is that the servers don t need any awareness of being load balanced. As long as NAT doesn t interfere with the proxied protocol, there s nothing wrong with it.
7 Why IPv6 NAT? Proxy redirection Transparent proxy redirection is often implemented using destination NAT to the proxy server/port. There are other options how to implement this, but these are harder to set up. Similar to server load balancing, as long as you know it won t interfere with the proxied protocol, there s nothing wrong with it.
8 Why IPv6 NAT? Easy test network setup When setting up a test network between virtual hosts that need to reach other networks, its very easy to just masquerade the outgoing traffic instead of requesting your own prefix that has to be known to other routers.
9 Why IPv6 NAT? People are doing it anyway Users are asking for IPv6 NAT Linux based router vendors have implemented it Various out of tree patches for netfilter exist Other operating systems have implemented it Providing a single, well debugged implementation for Linux is better than having many different implementations. Users have less bugs Users already know how it works Application developers can predict the behaviour of the NAT
10 Why IPv6 NAT? End-to-end is not always negatively affected End-to-end is not always required or desired Many protocols are not negatively affected by NAT The address space is large enough not to need NAT, that doesn t solve administrative problems Sometimes no other choice It seems unavoidable since users want it
11 Netfilter IPv6 NAT overview Implementation started at the end of 2011, merged in Largely based on the old IPv4-only implementation Address family independant core based on old IPv4-only NAT Address family specific layer 3 protocol modules Address family independant layer 4 protocol modules Address family specific NAT tables Address family independant SNAT/DNAT/NETMAP/REDIRECT targets New MASQUERADE target for IPv6 NAT helpers adjusted to support IPv6 Small improvements to conntrack fragmentation handling
12 Netfilter IPv6 NAT Address family independant core Protocol book keeping NAT mapping setup Address/Port selection core Packet mangling dispatch IPsec session decoding dispatch IPsec policy recomputation Address family specific layer 3 protocol modules (IPv4, IPv6) Address selection Address replacement in packets Checksum updates IPsec session decoding ICMP/ICMPv6 error translations
13 Netfilter IPv6 NAT Address family independant layer 4 protocol modules (TCP, UDP,...) Port selection Port replacement in packets Checksum updates Address family specific NAT tables (iptable_nat, ip6table_nat) Provide user-visible NAT table and chains Bind NAT code to packet processing Invoke IPsec policy recomputation after NAT NAT targets (MASQUERADE, SNAT, DNAT,...) Set up NAT mappings
14 Netfilter IPv6 NAT NAT helpers (FTP, SIP,...) Mangle addresses in application layer protocols Redirect negotiated connections to the proper destination (FTP data, SIP RTP,...)
15 Netfilter IPv6 User perspective User perspective similar to IPv4 NAT IPv6 NAT table PREROUTING/INPUT/OUTPUT/POSTROUTING chains All IPv4 NAT targets supported NAT rules invoked for NEW connections Behaviour wrt. routing and IPsec similar to IPv4
16 Netfilter IPv6 User perspective Chain PREROUTING (policy ACCEPT 13 packets, 3782 bytes) pkts bytes target prot opt in out source destination 0 0 REDIRECT tcp eth0 * ::/0 ::/0 tcp dpt:80 redir ports 3128 Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 MASQUERADE all * wlan0 ::/0 ::/0
17 Stateless Network Prefix Translation (RFC 6296) Stateless method of doing IPv6 NAT Only capable of mapping prefixes Performs checksum neutral address updates Preserves end-to-end reachability Transport agnostic Implemented as ip6tables target (SNPT/DNPT) Setup more complicated than stateful NAT
18 Stateless Network Prefix Translation (RFC 6296) Example of prefix translation for packets from eth0 to eth1: If connection tracking is used, packets using NPT must be exempt ip6tables -t raw -A PREROUTING -i eth0 -s 2001:db8::/64 -j NOTRACK ip6tables -t raw -A PREROUTING -i eth1 -d 2001:f00f::/64 -j NOTRACK Prefix translation needs to be configured for both directions ip6tables -t mangle -A POSTROUTING -o eth1 -s 2001:db8::/64 -j SNPT --src-pfx 2001:db8::/64 --dst-pfx 2001:f00f::/64 ip6tables -t mangle -A PREROUTING -i eth1 -d 2001:f00f::/64 -j DNPT --src-pfx 2001:f00f::/64 --dst-pfx 2001:db8::/64
19 Future plans Current work in progress is NAT64, which allows to translate between IPv6 and IPv4. This allows you to run your network using IPv6 only while still being able to reach IPv4 only hosts. Bulk work of the implementation is complete, some tricky parts remain to be done. Hope to finish the implementation during the hacking days of next weeks Netfilter Workshop.
20 Questions? (YouTube) will answer all your quesions :)
IPtables and Netfilter
in tables rely on IPtables and Netfilter Comp Sci 3600 Security Outline in tables rely on 1 2 in tables rely on 3 Linux firewall: IPtables in tables rely on Iptables is the userspace module, the bit that
Università Ca Foscari Venezia
Firewalls Security 1 2018-19 Università Ca Foscari Venezia www.dais.unive.it/~focardi secgroup.dais.unive.it Networks are complex (image from https://netcube.ru) 2 Example: traversal control Three subnetworks:
NAT and Tunnels. Alessandro Barenghi. May 25, Dipartimento di Elettronica e Informazione Politecnico di Milano barenghi - at - elet.polimi.
NAT and Tunnels Alessandro Barenghi Dipartimento di Elettronica e Informazione Politecnico di Milano barenghi - at - elet.polimi.it May 25, 2011 Recap By now, you should be familiar with... System administration
Worksheet 8. Linux as a router, packet filtering, traffic shaping
Worksheet 8 Linux as a router, packet filtering, traffic shaping Linux as a router Capable of acting as a router, firewall, traffic shaper (so are most other modern operating systems) Tools: netfilter/iptables
Network Security Fundamentals
Network Security Fundamentals Security Training Course Dr. Charles J. Antonelli The University of Michigan 2013 Network Security Fundamentals Module 6 Firewalls & VPNs Topics Firewall Fundamentals Case
Linux. Sirindhorn International Institute of Technology Thammasat University. Linux. Firewalls with iptables. Concepts. Examples
Linux Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 14 October 2013 Common/Reports/-introduction.tex, r715 1/14 Contents 2/14 Linux, netfilter and netfilter:
Network Address Translation
Claudio Cicconetti International Master on Communication Networks Engineering 2006/2007 Network Address Translation (NAT) basically provides a mapping between internal (i.e.,
Network security Exercise 9 How to build a wall of fire Linux Netfilter
Network security Exercise 9 How to build a wall of fire Linux Netfilter Tobias Limmer Computer Networks and Communication Systems Dept. of Computer Sciences, University of Erlangen-Nuremberg, Germany 2.2.
Firewalls. IT443 Network Security Administration Slides courtesy of Bo Sheng
Firewalls IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Internet Security Mechanisms Prevent: Firewall, IPsec, SSL Detect: Intrusion Detection Survive/ Response: Recovery, Forensics
CSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 7.4 Firewalls CSC 474/574 Dr. Peng Ning 1 Outline What are firewalls? Types Filtering Packet filtering Session filtering Proxy Circuit Level Application Level
Network Address Translation. All you want to know about
Network Address Translation All you want to know about (C) Herbert Haas 2005/03/11 Reasons for NAT Mitigate Internet address depletion Save global addresses (and money) Conserve internal address plan TCP
Firewalls N E T W O R K ( A N D D ATA ) S E C U R I T Y / P E D R O B R A N D Ã O M A N U E L E D U A R D O C O R R E I A
Firewalls N E T W O R K ( A N D D ATA ) S E C U R I T Y 2 01 6 / 2 017 P E D R O B R A N D Ã O M A N U E L E D U A R D O C O R R E I A Slides are based on slides by Dr Lawrie Brown (UNSW@ADFA) for Computer
Firewalls and NAT. Firewalls. firewall isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others.
Firews and NAT 1 Firews By conventional definition, a firew is a partition made of fireproof material designed to prevent the spread of fire from one part of a building to another. firew isolates organization
Packet Filtering and NAT
Packet Filtering and NAT Alessandro Barenghi Dipartimento di Elettronica e Informazione Politecnico di Milano barenghi - at - elet.polimi.it May 14, 2014 Lesson contents Overview Netfilter/Iptables Structure
Network Address Translation (NAT) Background Material for Overlay Networks Course. Jan, 2013
Network Address Translation (NAT) Background Material for Overlay Networks Course Jan, 2013 Prof. Sasu Tarkoma University of Helsinki, Department of Computer Science Contents Overview Background Basic
Certification. Securing Networks
Certification Securing Networks UNIT 9 Securing Networks 1 Objectives Explain packet filtering architecture Explain primary filtering command syntax Explain Network Address Translation Provide examples
Introduction to Firewalls using IPTables
Introduction to Firewalls using IPTables The goal of this lab is to implement a firewall solution using IPTables, and to write and to customize new rules to achieve security. You will need to turn in your
Definition of firewall
Internet Firewalls Definitions: firewall, policy, router, gateway, proxy NAT: Network Address Translation Source NAT, Destination NAT, Port forwarding NAT firewall compromise via UPnP/IGD Packet filtering
ECE 435 Network Engineering Lecture 23
ECE 435 Network Engineering Lecture 23 Vince Weaver http://web.eece.maine.edu/~vweaver vincent.weaver@maine.edu 30 November 2017 HW#11 will be posted Announcements Don t forget projects next week Presentation
Network Address Translation (NAT) Contents. Firewalls. NATs and Firewalls. NATs. What is NAT. Port Ranges. NAT Example
Contents Network Address Translation (NAT) 13.10.2008 Prof. Sasu Tarkoma Overview Background Basic Network Address Translation Solutions STUN TURN ICE Summary What is NAT Expand IP address space by deploying
The Research and Application of Firewall based on Netfilter
Available online at www.sciencedirect.com Physics Procedia 25 (2012 ) 1231 1235 2012 International Conference on Solid State Devices and Materials Science The Research and Application of Firewall based
Some of the slides borrowed from the book Computer Security: A Hands on Approach by Wenliang Du. Firewalls. Chester Rebeiro IIT Madras
Some of the slides borrowed from the book Computer Security: A Hands on Approach by Wenliang Du Firewalls Chester Rebeiro IIT Madras Firewall Block unauthorized traffic flowing from one network to another
NDN iptables match extension
NDN iptables match extension L. Bracciale, A. Detti, P. Loreti, G. Rossi, N. Blefari Melazzi May 3, 2017 This module implements a match extension for netfilter 1 to match only certain NDN packets according
Network Security. Routing and Firewalls. Radboud University, The Netherlands. Spring 2018
Network Security Routing and Firewalls Radboud University, The Netherlands Spring 2018 The coming weeks... Monday, May 21: Whit Monday, no lecture Monday, May 28: Security in Times of Surveillance https://www.win.tue.nl/eipsi/surveillance.html
Firewalls. Firewall types. Packet filter. Proxy server. linux, iptables-based Windows XP s built-in router device built-ins single TCP conversation
Firewalls Firewall types Packet filter linux, iptables-based Windows XP s built-in router device built-ins single TCP conversation Proxy server specialized server program on internal machine client talks
Realtime Multimedia in Presence of Firewalls and Network Address Translation
Realtime Multimedia in Presence of Firewalls and Network Address Translation Knut Omang Ifi/Oracle 9 Oct, 2017 1 Overview Real-time multimedia and connectivity Mobile users (roaming between devices) or
Realtime Multimedia in Presence of Firewalls and Network Address Translation. Knut Omang Ifi/Oracle 9 Nov, 2015
Realtime Multimedia in Presence of Firewalls and Network Address Translation Knut Omang Ifi/Oracle 9 Nov, 2015 1 Overview Real-time multimedia and connectivity Mobile users (roaming between devices) or
Network and Filesystem Security
Network and Filesystem Security Powell Molleti powell@in.ibm.com 1 Agenda Netfilter and TCP Wrappers for Network Security including SNORT for NIDS and tools for checking network vulnerabilities Filesystem
Firewalls. Firewall. means of protecting a local system or network of systems from network-based security threats creates a perimeter of defense
FIREWALLS 3 Firewalls Firewall means of protecting a local system or network of systems from network-based security threats creates a perimeter of defense administered network public Internet firewall
Linux Firewalls. Frank Kuse, AfNOG / 30
Linux Firewalls Frank Kuse, AfNOG 2017 1 / 30 About this presentation Based on a previous talk by Kevin Chege and Chris Wilson, with thanks! You can access this presentation at: Online: http://afnog.github.io/sse/firewalls/
Datagram. Source IP address. Destination IP address. Options. Data
Datagram Version H. len Service Datagram length Datagram identifier FR-FR FR-FR-FR-FR Time-to-live Transp. prot. H. Checksum Source IP address Destination IP address Options Data Each line represents a
THE INTERNET PROTOCOL INTERFACES
THE INTERNET PROTOCOL The Internet Protocol Stefan D. Bruda Winter 2018 A (connectionless) network protocol Designed for use in interconnected systems of packet-switched computer communication networks
Firewalls. October 13, 2017
Firewalls October 13, 2017 Administrative submittal instructions answer the lab assignment s questions in written report form, as a text, pdf, or Word document file (no obscure formats please) email to
FireHOL Manual. Firewalling with FireHOL. FireHOL Team. Release pre3 Built 28 Oct 2013
FireHOL Manual Firewalling with FireHOL FireHOL Team Release 2.0.0-pre3 Built 28 Oct 2013 FireHOL Manual Release 2.0.0-pre3 i Copyright 2012, 2013 Phil Whineray Copyright 2004, 2013
The Internet Protocol
The Internet Protocol Stefan D. Bruda Winter 2018 THE INTERNET PROTOCOL A (connectionless) network layer protocol Designed for use in interconnected systems of packet-switched computer communication networks
Design and Performance of the OpenBSD Stateful Packet Filter (pf)
Usenix 2002 p.1/22 Design and Performance of the OpenBSD Stateful Packet Filter (pf) Daniel Hartmeier dhartmei@openbsd.org Systor AG Usenix 2002 p.2/22 Introduction part of a firewall, working on IP packet
IP/ICMP Translation Algorithm (IIT) Xing Li, Congxiao Bao, Fred Baker
IP/ICMP Translation Algorithm (IIT) Xing Li, Congxiao Bao, Fred Baker 2008-11-17 Abstract This document specifies an update to the Stateless IP/ICMP Translation Algorithm described in RFC 2765. The algorithm
Networking Potpourri: Plug-n-Play, Next Gen
Networking Potpourri: Plug-n-Play, Next Gen 14-740: Fundamentals of Computer Networks Bill Nace Material from Computer Networking: A Top Down Approach, 6 th edition. J.F. Kurose and K.W. Ross Administrivia
ECE 435 Network Engineering Lecture 23
ECE 435 Network Engineering Lecture 23 Vince Weaver http://web.eece.maine.edu/~vweaver vincent.weaver@maine.edu 4 December 2018 Announcements HW#9 graded Don t forget projects next week Presentation schedule
IPv6: Are we really ready to turn off IPv4?
IPv6: Are we really ready to turn off IPv4? In-situ transition In-situ transition Phase 1 Early Deployment IPv4 Internet Edge Dual-Stack Networks IPv6 networks interconnect by IPv6-over-IPv4 tunnels In-situ
Ref: A. Leon Garcia and I. Widjaja, Communication Networks, 2 nd Ed. McGraw Hill, 2006 Latest update of this lecture was on
IP Version 4 (IPv4) Header (Continued) Identification (16 bits): One of the parameters of any network is the maximum transmission unit (MTU) parameter. This parameter specifies the maximum size of the
Grandstream Networks, Inc. GWN Firewall Features Advanced NAT Configuration Guide
Grandstream Networks, Inc. GWN7000 - Firewall Features Advanced NAT Configuration Guide Table of Content INTRODUCTION... 3 INPUT/OUPUT POLICIES... 4 Overview... 4 Configuration... 4 SNAT (SOURCE NAT)...
NAT Router Performance Evaluation
University of Aizu, Graduation Thesis. Mar, 22 17173 1 NAT Performance Evaluation HAYASHI yu-ichi 17173 Supervised by Atsushi Kara Abstract This thesis describes a quantitative analysis of NAT routers
CS Computer and Network Security: Firewalls
CS 5410 - Computer and Network Security: Firewalls Professor Patrick Traynor Fall 2017 Reminders Monday: Change of Plans Recording lecture - turn in your rules. Friday: Project Abstract The hardest paragraph
while the LAN interface is in the DMZ. You can control access to the WAN port using either ACLs on the upstream router, or the built-in netfilter
When the LAN interface is in a private IP DMZ, you can write the firewall rule-set to restrict the number of hosts the VBP can communicate with to only those devices. This enhances security. You can also
THE INTERNET PROTOCOL/1
THE INTERNET PROTOCOL a (connectionless) network layer protocol designed for use in interconnected systems of packet-switched computer communication networks (store-and-forward paradigm) provides for transmitting
This is Google's cache of http://www.rigacci.org/wiki/lib/exe/fetch.php/doc/appunti/linux/sa/iptables/conntrack.html. It is a snapshot of the page as it appeared on 24 Oct 2012 08:53:12 GMT. The current
Network Interconnection
Network Interconnection Covers different approaches for ensuring border or perimeter security Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 Lecture
Mohammad Hossein Manshaei 1393
Mohammad Hossein Manshaei manshaei@gmail.com 1393 Mobile IP 2 Mobile Network Layer: Problems and Concerns Entities and Terminology in Mobile IP Mobile Indirect Routing Mobile IP Agent Advertisement Registration
Laboratory 2 Dynamic routing using RIP. Iptables. Part1. Dynamic Routing
Introduction Laboratory 2 Dynamic routing using RIP. Iptables. Part1. Dynamic Routing Static routing has the advantage that it is simple, requires no computing power in router for determining routes (this
Firewalls. Content. Location of firewalls Design of firewalls. Definitions. Forwarding. Gateways, routers, firewalls.
Firewalls INFO 404 - Lecture 10 31/03/2009 nfoukia@infoscience.otago.ac.nz Credit: Cameron Kerr : ckerr@cs.otago.ac.nz Definitions Content Gateways, routers, firewalls Location of firewalls Design of firewalls
sottotitolo A.A. 2016/17 Federico Reghenzani, Alessandro Barenghi
Titolo presentazione Piattaforme Software per la Rete sottotitolo Firewall and NAT Milano, XX mese 20XX A.A. 2016/17, Alessandro Barenghi Outline 1) Packet Filtering 2) Firewall management 3) NAT review
Computer Security Spring Firewalls. Aggelos Kiayias University of Connecticut
Computer Security Spring 2008 Firewalls Aggelos Kiayias University of Connecticut Idea: Monitor inbound/ outbound traffic at a communication point Firewall firewall Internet LAN A firewall can run on any
netfilter/iptables/conntrack debugging
Networking Services Team, Red Hat June 2015 packets disappearing e.g. added some dnat-based port forwarding, but it doesn t seem to work How to debug that? netfilter tracing can be used to find wich rules
CSC 4900 Computer Networks: Network Layer
CSC 4900 Computer Networks: Network Layer Professor Henry Carter Fall 2017 Chapter 4: Network Layer 4. 1 Introduction 4.2 What s inside a router 4.3 IP: Internet Protocol Datagram format 4.4 Generalized
Network Security: Firewalls. Tuomas Aura T Network security Aalto University, Nov-Dec 2013
Network Security: Firewalls Tuomas Aura T-110.5241 Network security Aalto University, Nov-Dec 2013 2 Firewalls: Stateless packet filter Firewall Perimeter defence: Divide the world into the good/safe inside
Politecnico di Milano Scuola di Ingegneria Industriale e dell Informazione. 09 Intranetting. Fundamentals of Communication Networks
Politecnico di Milano Scuola di Ingegneria Industriale e dell Informazione 09 Intranetting Fundamentals of Communication Networks 1 Private networks and Intranets EG subnet IG IG Private network IG o Private
Netfilter. Fedora Core 5 setting up firewall for NIS and NFS labs. June 2006
Netfilter Fedora Core 5 setting up firewall for NIS and NFS labs June 2006 Netfilter Features Address Translation S NAT, D NAT IP Accounting and Mangling IP Packet filtering (Firewall) Stateful packet
Network Address Translation
Network Address Translation All you want to know about (C) Herbert Haas 2005/03/11 Reasons for NAT Mitigate Internet address depletion Save global addresses (and money) Conserve internal address plan TCP
python-iptables Documentation
python-iptables Documentation Release 0.4.0-dev Vilmos Nebehaj Oct 05, 2017 Contents 1 Introduction 3 1.1 About python-iptables.......................................... 3 1.2 Installing via pip.............................................
Subnet Masks. Address Boundaries. Address Assignment. Host. Net. Host. Subnet Mask. Non-contiguous masks. To Administrator. Outside the network
Subnet Masks RFCs 917 922 925 (1984) 932 936 940 950 (1985) First major change to IP after RFC791 Net Host Subnet Mask 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 Net Bits set indicate net number Bits clear indicate
netfilters connection tracking subsystem
netfilters connection tracking subsystem Florian Westphal 4096R/AD5FF600 fw@strlen.de 80A9 20C5 B203 E069 F586 AE9F 7091 A8D9 AD5F F600 Red Hat netdev 2.1, Montreal, April 2017 connection tracking flow
Network Address Translation
Network Address Translation All you want to know about (C) Herbert Haas 2005/03/11 In this chapter we discuss the idea of Network Address Translation and special issues associated to it. Invented in 1994,
Athanassios Liakopoulos Slovenian IPv6 Training, Ljubljana, May 2010
Introduction ti to IPv6 (Part A) Athanassios Liakopoulos (aliako@grnet.gr) Slovenian IPv6 Training, Ljubljana, May 2010 Copy Rights This slide set is the ownership of the 6DEPLOY project via its partners
CSCD58 WINTER 2018 WEEK 6 - NETWORK LAYER PART 1. Brian Harrington. February 13, University of Toronto Scarborough
CSCD58 WINTER 2018 WEEK 6 - NETWORK LAYER PART 1 Brian Harrington University of Toronto Scarborough February 13, 2018 ADMIN Assignments Midterm after reading week (Feb 27) In class Covering everything
Use this section to help you quickly locate a command.
iii iv v Use this section to help you quickly locate a command. vi Use this list to help you locate examples you d like to try or look at. vii viii This document describes the various deployment, installation,
COSC 301 Network Management
COSC 301 Network Management Lecture 21: Firewalls & NAT Zhiyi Huang Computer Science, University of Otago COSC301 Lecture 21: Firewalls & NAT 1 Today s Focus How to protect an intranet? -- Firewall --
Implementing NAT-PT for IPv6
Implementing NAT-PT for IPv6 Last Updated: August 1, 2012 Network Address Translation--Protocol Translation (NAT-PT) is an IPv6 to IPv4 translation mechanism, as defined in RFC 2765 and RFC 2766, allowing
iptables and ip6tables An introduction to LINUX firewall
7 19-22 November, 2017 Dhaka, Bangladesh iptables and ip6tables An introduction to LINUX firewall Imtiaz Rahman SBAC Bank Ltd AGENDA iptables and ip6tables Structure Policy (DROP/ACCEPT) Syntax Hands on
How to use IP Tables
How to use IP Tables ******************************************************************* *** IPTABLES TUTORIAL I. Definitions and similarities to ipchains II. Chain types and options III. Command line
NAT Tutorial. Dan Wing, IETF77, Anaheim March 21, 2010 V2.1
NAT Tutorial Dan Wing, dwing@cisco.com IETF77, Anaheim March 21, 2010 V2.1 1 Agenda NAT and NAPT Types of NATs Application Impact Application Layer Gateway (ALG) STUN, ICE, TURN Large-Scale NATs (LSN,
Cisco Network Address Translation (NAT)
Cisco Network Address Translation (NAT) Introduction IETF NGTrans working group defined several translation mechanisms to enable communications between IPv6-only and IPv4-only hosts. One such example is
History Page. Barracuda NextGen Firewall F
The Firewall > History page is very useful for troubleshooting. It provides information for all traffic that has passed through the Barracuda NG Firewall. It also provides messages that state why traffic
CS-435 spring semester Network Technology & Programming Laboratory. Stefanos Papadakis & Manolis Spanakis
CS-435 spring semester 2016 Network Technology & Programming Laboratory University of Crete Computer Science Department Stefanos Papadakis & Manolis Spanakis CS-435 Lecture #4 preview ICMP ARP DHCP NAT
IPv6: Are we really ready to turn off IPv4? Geoff Huston APNIC
IPv6: Are we really ready to turn off IPv4? Geoff Huston APNIC The IPv6 Timeline 1990 2000 2010 2020 The IPv6 Timeline Yes, we ve been working on this for close to 30 years! 1990 2000 2010 2020 In-situ
IPv6 Protocols and Networks Hadassah College Spring 2018 Wireless Dr. Martin Land
IPv6 1 IPv4 & IPv6 Header Comparison IPv4 Header IPv6 Header Ver IHL Type of Service Total Length Ver Traffic Class Flow Label Identification Flags Fragment Offset Payload Length Next Header Hop Limit
Lecture 17: Network Layer Addressing, Control Plane, and Routing
Lecture 17: Network Layer Addressing, Control Plane, and Routing COMP 332, Spring 2018 Victoria Manfredi Acknowledgements: materials adapted from Computer Networking: A Top Down Approach 7 th edition:
An Industry view of IPv6 Advantages
An Industry view of IPv6 Advantages March 2002 Yanick.Pouffary@Compaq.Com Imagine what IPv6 can do for you! 1 Where we are Today IPv4 a victim of its own success IPv4 addresses consumed at an alarming
cs144 Midterm Review Fall 2010
cs144 Midterm Review Fall 2010 Administrivia Lab 3 in flight. Due: Thursday, Oct 28 Midterm is this Thursday, Oct 21 (during class) Remember Grading Policy: - Exam grade = max (final, (final + midterm)/2)
Remember Extension Headers?
IPv6 Security 1 Remember Extension Headers? IPv6 allows an optional Extension Header in between the IPv6 header and upper layer header Allows adding new features to IPv6 protocol without major re-engineering
Stateful Network Address Translation 64
The feature provides a translation mechanism that translates IPv6 packets into IPv4 packets and vice versa. The stateful NAT64 translator algorithmically translates the IPv4 addresses of IPv4 hosts to
Vendor: Cisco. Exam Code: Exam Name: Implementing Cisco IP Routing (ROUTE v2.0) Version: Demo
Vendor: Cisco Exam Code: 300-101 Exam Name: Implementing Cisco IP Routing (ROUTE v2.0) Version: Demo DEMO QUESTION 1 Refer to the exhibit. The DHCP client is unable to receive a DHCP address from the DHCP
LOGICAL ADDRESSING. Faisal Karim Shaikh.
LOGICAL ADDRESSING Faisal Karim Shaikh faisal.shaikh@faculty.muet.edu.pk DEWSNet Group Dependable Embedded Wired/Wireless Networks www.fkshaikh.com/dewsnet IPv4 ADDRESSES An IPv4 address is a 32-bit address
Communication Systems DHCP
Communication Systems DHCP Computer Science Copyright Warning This lecture is already stolen If you copy it please ask the author Prof. Dr. Gerhard Schneider like I did 2 Internet Protocol the Universal
Internet Control Message Protocol (ICMP)
Internet Control Message Protocol (ICMP) 1 Overview The IP (Internet Protocol) relies on several other protocols to perform necessary control and routing functions: Control functions (ICMP) Multicast signaling
Internet Control Message Protocol
Internet Control Message Protocol The Internet Control Message Protocol is used by routers and hosts to exchange control information, and to inquire about the state and configuration of routers and hosts.
Loadbalancer.org Virtual Appliance quick start guide v6.3
Loadbalancer.org Virtual Appliance quick start guide v6.3 What are your objectives?...2 What is the difference between a one-arm and a two-arm configuration?...2 What are the different load balancing methods
Module: Firewalls. Professor Patrick McDaniel Fall CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Firewalls Professor Patrick McDaniel Fall 2008 1 Midterm results!"#$%&'()*'+,)*-./('-!* +" *" )" (" '" &" %" $" #"!" #!!,*!"-./0" )+,)("-.,0"
Quick Note 05. Configuring Port Forwarding to access an IP camera user interface on a TransPort LR54. 7 November 2017
Quick Note 05 Configuring Port Forwarding to access an IP camera user interface on a TransPort LR54 7 November 2017 Contents 1 Introduction... 3 1.1 Outline... 3 1.2 Assumptions... 3 1.3 Corrections...
Planning for Information Network
Planning for Information Network Lecture 7: Introduction to IPv6 Assistant Teacher Samraa Adnan Al-Asadi 1 IPv6 Features The ability to scale networks for future demands requires a limitless supply of
Hashing on broken assumptions
Hashing on broken assumptions Lorenzo Saino (@lorenzosaino) Fastly Name of Presentation Problem: Spreading traffic across multiple links, paths, hosts Solutions: Link Aggregation Equal Cost Multipath (ECMP)
Mapping of Address and Port Using Translation
The feature provides connectivity to IPv4 hosts across IPv6 domains. Mapping of address and port using translation (MAP-T) is a mechanism that performs double translation (IPv4 to IPv6 and vice versa)
FireHOL + FireQOS Reference
FireHOL + FireQOS Reference FireHOL Team Release 2.0.0-pre7 Built 13 Apr 2014 FireHOL + FireQOS Reference Release 2.0.0-pre7 i Copyright 2012-2014 Phil Whineray Copyright 2004, 2013-2014
Mapping of Address and Port (MAP) an ISPs Perspective. E. Jordan Gottlieb Principal Engineer Charter Communications
Mapping of Address and Port () an ISPs Perspective E. Jordan Gottlieb Principal Engineer Charter Communications jordan.gottlieb@charter.com Agenda What is? Benefits of in Action Algorithms in Action Deployment
Computer Network Fundamentals Spring Week 4 Network Layer Andreas Terzis
Computer Network Fundamentals Spring 2008 Week 4 Network Layer Andreas Terzis Outline Internet Protocol Service Model Addressing Original addressing scheme Subnetting CIDR Fragmentation ICMP Address Shortage
IPv6: An Introduction
Outline IPv6: An Introduction Dheeraj Sanghi Department of Computer Science and Engineering Indian Institute of Technology Kanpur dheeraj@iitk.ac.in http://www.cse.iitk.ac.in/users/dheeraj Problems with
A 10 years journey in Linux firewalling Pass the Salt, summer 2018 Lille, France Pablo Neira Ayuso
A 10 years journey in Linux firewalling Pass the Salt, summer 2018 Lille, France Pablo Neira Ayuso What is Netfilter? Not just iptables Image from Wikipedia (J. Engelhardt, 2018)
4. The transport layer
4.1 The port number One of the most important information contained in the header of a segment are the destination and the source port numbers. The port numbers are necessary to identify the application
Lecture 18: Packet Filtering Firewalls (Linux) Lecture Notes on Computer and Network Security. by Avi Kak
Lecture 18: Packet Filtering Firewalls (Linux) Lecture Notes on Computer and Network Security by Avi Kak (kak@purdue.edu) March 20, 2017 11:49pm c 2017 Avinash Kak, Purdue University Goals: Packet-filtering
Firewall Management With FireWall Synthesizer
Firewall Management With FireWall Synthesizer Chiara Bodei 1, Pierpaolo Degano 1, Riccardo Focardi 2, Letterio Galletta 1, Mauro Tempesta 2, and Lorenzo Veronese 2 1 Dipartimento di Informatica, Università