Notes Networking

Contents
========
inetd
socket.h
Setup Linux Network
Network VM with Virtual Box - Bridged, Internal, Host-Only


inetd
========
inetd - maintains passive sockets on a variety of these well-known ports. When a new connection is created, Inetd starts a program to handle the connection, based upon a configuration table. This way, one program can handle incoming connections for a variety of services. Inetd only runs server programs as they are needed, and will spawn multiple server programs to service multiple network connections. Inetd works best for network services with fairly long duration, so the extra startup overhead becomes negligible.

inetd services - echo, discard, daytime, chargen, time
- Usage: eg. telnet <IP> echo


socket.h
=========
#include <sys/socket.h>
int     accept(int socket, struct sockaddr *address, socklen_t *address_len);
int     bind(int socket, const struct sockaddr *address, socklen_t address_len);
int     connect(int socket, const struct sockaddr *address, socklen_t address_len);
int     getpeername(int socket, struct sockaddr *address, socklen_t *address_len);
int     getsockname(int socket, struct sockaddr *address, socklen_t *address_len);
int     getsockopt(int socket, int level, int option_name, void *option_value, socklen_t *option_len);
int     listen(int socket, int backlog);
ssize_t recv(int socket, void *buffer, size_t length, int flags);
ssize_t recvfrom(int socket, void *buffer, size_t length, int flags, struct sockaddr *address, socklen_t *address_len);
ssize_t recvmsg(int socket, struct msghdr *message, int flags);
ssize_t send(int socket, const void *message, size_t length, int flags);
ssize_t sendmsg(int socket, const struct msghdr *message, int flags);
ssize_t sendto(int socket, const void *message, size_t length, int flags, const struct sockaddr *dest_addr, socklen_t dest_len);
int     setsockopt(int socket, int level, int option_name, const void *option_value, socklen_t option_len);
int     shutdown(int socket, int how);
int     socket(int domain, int type, int protocol);
int     socketpair(int domain, int type, int protocol, int socket_vector[2]);


Setup Linux Network
===================
Based on Fedora 5 exprience

Setup DNS
1. add DNS IP address to file: /etc/resolv.conf; OR
2. Use GUI to enter primary, secondary DNS

Restart Network
1. Reboot; OR
2. /etc/init.d/network restart

Setup Static Routing
- for PC with external IP to connect to a Local network
1. Create a file called /etc/sysconfig/network-scripts/route-eth0
2. Enter this in the file:
      192.168.0.0/16 via 129.78.77.253
   ... where first IP range in internal network and last IP is gateway
Alternatively,  
3. Create a file called /etc/sysconfig/static-route
4. Enter this in the file:
      any net 192.168.0.0/16 gw 129.78.77.253
     
Remove Microsoft IP range
1. Edit file /etc/sysconfig/network, and put:
     NOZEROCONF=1
2. Edit files /etc/sysconfig/network-scripts/ifcfg_eth<0|1|2|...>, put:
     NOZEROCONF=1

Check Kernel IP Table:
    netstat -nr
   
Add route manually,
route add -net 192.168.0.0/16 gw 129.78.77.253 eth0
 

Remove Microsoft Routing




Network VM with Virtual Box - Bridged, Internal, Host-Only
===========================================================

This section covers the three types of networking options between Linux Guest VMs in Virtual Box, in relation to a Windows host.

I. Bridged Networking
Use Case: The Windows host (eg 192.168.1.7) and the Linux VM (eg 192.168.1.9) have independent IP, but are both belong to the same subnet network. In the usual case where the network is dynamic and the DCHP server, assigns an IP to the Windows host, it will also assign an IP to the Linux VM. Like the Windows host, the Linux VM can also connect to the outside world.

Windows Host setup: Nothing to do, if the Windows host is already connected, ie can browse the internet or ping and external IP. To check the network details, type:
   ipconfig /all
Look for the sections, either:
   i) Wireless LAN adapter Wi-Fi:
  Description ...... Qualcomm Atheros.....
   ii) Ethernet Adapter ethernet:
  Description ...... Qualcomm Atheros ....
Since there are many adapters, you need to look for the sections, using description, that relates to the physical adapters installed on your PC / laptop. The adaptes could be LAN ethernet or Wi-Fi, and the Description gives a clue if they are physical or virtual adapters.

Pick the correct physical adapter and note down the following:
IPv4 address:    eg      192.168.1.7
Subnet Mask:     usually 255.255.255.0
Default Gateway: usually 192.168.1.1

Linux Guest VM setup:
In the Virtual Box, VM settings -
- Enable Network Adapter - Check
- Attached to - Bridged Adapter
- Name: Choose your physical adapter (see Windows Host Setup above). Usually it is "... Wireless Adapter ..." or "... Ethernet Controller ..."
- Promiscuous Mode = Deny,
- Mac Address: (Write this down for later use)  eg. ...1D:9A
- Cable Conneceted - Check

Start the Linux VM,
- determine if it is eth0 or eth1 by: ifconfig -a
  WARNING: By default, configuration exist for eth0 only. But VB requires eth1,2,3,4
  So Copy the config file:
       cd /etc/sysconfig/network-scripts
       cp ifcfg-eth0 ifcfg-eth1
- edit /etc/sysconfig/network-scripts/eth1
    DEVICE = eth1   (change this as necessary)
    HWADDR=  enter the MAC address from the VM settings section above
    TYPE=Ethernet
    ....
    ONBOOT=yes
    NM_CONTROLLED=no
    BOOTPROTO=dhcp
- re-activate the interface:
   ifdown eth1
   ifup eth1
   /etc/init.d/network restart
- check by looking at: ifconfig -a
  the results for eth1 are: IP=192.168.1.9, Bcast 192.168.1.255, Mask 255.255.255.0



II. Internal Networking
Use Case: Two or more Linux VMs (eg 192.168.56.110 and 192.168.56.115) are required to communicate with each other, hence the same subnet 192.168.56.x. They are not connected to the outside world and do not communicate with the Windows host (192.168.1.7).

Windows Host setup: Nothing to setup.
Do the following only after the Linux setup is complete, and then come back to Windows to verify the following:
To check the network details, type:
   ipconfig /all
Look for the section:
  Ethernet adapter VirtualBox Host-Only Network:
  Description: VirtualBox Host-Only Ethernet Adapter.
  Physical Address: eg ... 8C:D9. Not needed to be the same from the Linux VM settings below.
  ....
  IPv4 address:    eg      192.168.56.1
  Subnet Mask:     usually 255.255.255.0

Linux Guest VM setup:
In this section, we will setup up the VM above (VM1) and a new VM (VM2) where VM1 uses eth2 to communicate with VM2 which uses eth0. The VM1 uses eth2 because its eth1 is already involved with Bridged networking.

In the Virtual Box, VM settings for both VM1 (Adapter 2 tab) and VM2 (Adapter 1 tab)
- Enable Network Adapter - Check
- Attached to - Internal Network
- Name: intnet
- Promiscuous Mode = Deny, Allow All
- Mac Address: (Write this down for later use)  ( 9F:4B,   ...77:84)
- Cable Conneceted - Check

Start the Linux VM1,
- determine if it is eth0 or eth1 by: ifconfig -a
  WARNING: By default, configuration exist for eth0 only. But VB requires eth1,2,3,4
  Since VM1 has already eth1 for bridged, the eth2 adapter will be used here.
- edit /etc/sysconfig/network-scripts/eth2
    IPADDR=192.168.56.105
    NETMASK=255.255.255.0
    DEVICE = eth2   (change this as necessary)
    HWADDR=  enter the MAC address from the VM settings section above, eg. 9F:4B
    TYPE=Ethernet
    ....
    ONBOOT=yes
    NM_CONTROLLED=no
    BOOTPROTO=static  
- re-activate the interface:
   ifdown eth2
   ifup eth2
   /etc/init.d/network restart
- check by looking at: ifconfig -a
  the results for eth1 are: IP=192.168.56.105, Bcast 192.168.56.255, Mask 255.255.255.0
- add the lines to /etc/hosts
  192.168.56.105  VM1-host  VM1-host.domain
  192.168.56.115  VM2-host  VM2-host.domain
- add the lines to /etc/sysconfig/network
  NETWORKING=yes
  HOSTNAME=VM1-host.domain

Start the Linux VM2,
- determine if it is eth0 or eth1 by: ifconfig -a
  WARNING: By default, configuration exist for eth0 only. But VB requires eth1,2,3,4
- edit /etc/sysconfig/network-scripts/eth0
    IPADDR=192.168.56.115
    NETMASK=255.255.255.0
    GATEWAY=192.168.56.100
    DEVICE = eth0   (change this as necessary)
    HWADDR=  enter the MAC address from the VM settings section above, eg. 77:84
    TYPE=Ethernet
    ....
    ONBOOT=yes
    NM_CONTROLLED=no
    BOOTPROTO=static  
- re-activate the interface:
   ifdown eth0
   ifup eth0
   /etc/init.d/network restart
- check by looking at: ifconfig -a
  the results for eth0 are: IP=192.168.56.115, Bcast 192.168.56.255, Mask 255.255.255.0
- add the lines to /etc/hosts
  192.168.56.105  VM1-host  VM1-host.domain
  192.168.56.115  VM2-host  VM2-host.domain
- add the lines to /etc/sysconfig/network
  NETWORKING=yes
  HOSTNAME=VM2-host.domain
 


III. Host-Only Networking
Use Case: This has features of both Bridged and Internal Networking. The Windows host is connected to the Linux VM (VM1) so that they can communicate (able to ping) with each other (like Bridged network). However the VM1 is not connected to the outside world (like internal network).
The VM1 may see the Windows host as a HOST - hence the name Host only. So the VM1 may not be able to interact with the Windows host like a peer node, but it is able to access it, such as accessing a License server on the Windows Host.

Windows Host setup: This will be using the SECOND VirtualBox Host-Only adapter because the First Host-Only Adapter has been used by the Internal networking above. Do the following only after the Linux setup is complete, and then come back to Windows to verify the following:
To check the network details, type:
   ipconfig /all
Look for the section:
  Ethernet adapter VirtualBox Host-Only Network #2:
  Description: VirtualBox Host-Only Ethernet Adapter #2.
  Physical Address: eg ... 74:F0.
  ....
  IPv4 address:    eg      192.168.39.1
  Subnet Mask:     usually 255.255.255.0

Linux Guest VM setup:
For VM1, since adapter 1 is used for Bridged, adapter 2 is used for Internal, so the adapter 3 will be used here for Host-Only networking
In the Virtual Box, VM settings for Adapter 3 -
- Enable Network Adapter - Check
- Attached to - Host-Only Adapter
- Name: VirtualBox Host-Only Ethernet Adapter #2
- Promiscuous Mode = Deny,
- Mac Address: (Write this down for later use)   eg.  ... 4A:C6
- Cable Conneceted - Check

Start the Linux VM,
- determine if it is eth0 or eth1 by: ifconfig -a
  WARNING: By default, configuration exist for eth0 only. But VB requires eth1,2,3,4
  So Copy the config file:
       cd /etc/sysconfig/network-scripts
       cp ifcfg-eth1 ifcfg-eth3
- edit /etc/sysconfig/network-scripts/eth13
    DEVICE = eth3   (change this as necessary)
    HWADDR=  enter the MAC address from the VM settings section above
    TYPE=Ethernet
    ....
    ONBOOT=yes
    NM_CONTROLLED=no
    BOOTPROTO=dhcp
- re-activate the interface:
   ifdown eth1
   ifup eth1
   /etc/init.d/network restart
- check by looking at: ifconfig -a
  the results for eth1 are: IP=192.168.39.201, Bcast 192.168.39.255, Mask 255.255.255.0
- add the lines to /etc/hosts
  192.168.39.201  VM1-host  VM1-host.domain
- add the lines to /etc/sysconfig/network
  NETWORKING=yes
  HOSTNAME=VM1-host.domain
  GATEWAY=192.168.39.1

When is an NAT router inadequate protection

This article is mirroring the article at : http://www.dslreports.com/faq/9787 . The dslreports.com website seems to be down, and has no expected online time.

24 Apr 2012 - The original site seems to be working again. So go to http://www.dslreports.com/faq/9787

The main points of the article is extracted here:

----------------------------------------------------------------------

When is an NAT router inadequate protection?

1. Depending on your network configuration, an NAT router can be a very cost-effective, inexpensive and reliable addition to your computer's security. At US$40 to $70, they can be worth getting even if you only have one computer.

1.1 You should definitely run a software firewall on any computer that connects to AOL using a different Internet Service Provider (AOL's Bring-Your-Own-Access plan or AOL MAX using an ISP) no matter what kind hardware firewall or NAT router you have.


1.2 If you have to turn on port forwarding or the DMZ to run servers or other applications you should consider either a software firewall or a more expensive SPI firewall.


1.3 Generally software firewalls provide valuable additional protection that supplements the protection provided by NAT routers and SPI firewalls.

Ideally a software firewall should be an additional layer of protection behind an NAT router or external firewall. For homes a free version of a software firewall is normally adequate for this additional layer of protection.

- ZoneAlarm Free
»www.zonelabs.com/store/content/home.jsp
Look for the free version / free download, and continue to ask for it rather than the Pro version.

- Sygate Personal Firewall
»download.com.com/3000-2092-10049···g=button

- Kerio Personal Firewall Limited Free Version (Sunbelt Kerio Personal Firewall)
»www.kerio.com/kpf_download.html
Look for the "limited free" version.

For businesses, computers running public servers, and computers on wireless networks, a paid-for version of a software firewall provides more protection by allowing more customization and more precise control.

2. In selecting an NAT router, software firewall, or hardware firewall, consider its logging and alerts capabilities.

3. If the router or firewall is wireless, secure the wireless interface.

4. Firewalls are not a replacement for adequate backups of data. (Firewalls don't protect against real fires, or burglars.) /faq/10194

5. Other security precautions still need to be taken. For example, operating systems and anti-virus software need to be properly installed, configured and updated.

6. There is no hardware or software you can install that will protect against massive amounts of traffic jamming your communications lines. "SPI firewalls" only protect against certain types of denial of service (DoS) attacks involving malformed packets, or protocol sequence violations and vulnerable software.

7. Historically, the original network firewalls did not do packet inspection. They were rule based, using tables of permitted IP addresses and ports. Packet inspection is not historically in the definition of firewalls.

8. The NAT firewall was a major advance. It limited inbound traffic based on the basic state of communications with the external IP address. Outbound traffic triggered permission for inbound traffic.

9. This is basically how a pure many:1 NAT router works. M:1 is the kind of router commonly used for home and SOHO users to provide a connection for many local computers using one public IP address.


10. Port forwarding bypasses the state table and that source of protection provided by the NAT router. Port forwarding (on a pure NAT router) causes almost all traffic that arrives at a particular port to go to a particular local IP address. (Basic packet filtering is the only protection for the port.)



11. The DMZ should be totally avoided on most NAT routers.

A DMZ is not normally required, provided you know your software. Check the software vendor's website, or email their support area, or search here in BBR, to find out what ports you need to set as trigger ports for which ports, or which ports to forward.

If you really do need a DMZ, use a device that treats the computer in the DMZ as though it was an untrusted computer outside your local network. Ordinary NAT routers do not normally provide this type of DMZ; they normally just forward all unsolicited traffic to the machine in the DMZ, leaving it with no NAT protection.


Here are some security testing sites: /faq/5503

Here is more on securing your home computer: /faq/8463

Here is more on securing a wireless router: /faq/8698

For discussion about your individual circumstances you can post a message in the BBR Security Forum here: /forum/security