SRT210 Lab 5

Objectives

• a

PART 1: PREREQUISITES

• In order to do this lab and the ones to follow you need to make sure that you've completed assignment 1 successfully, which in turn requires that you've completed labs 1 through 4.
• Your c7host should have at least 8GB of RAM allocated to it. Your four nested VMs should be reconfigured to use no more than 1GB of memory (1024MB). That way when we create more nested VMs we won't run out of memory.
• If you've completed the labs correctly, this is what the iptables configuration should look like on your c7host (except the "35" which will be different for all of you):

  [root@c7host ~]# iptables -L -v
  Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
   pkts bytes target     prot opt in     out     source               destination         
     50  3260 ACCEPT     udp  --  virbr1 any     anywhere             anywhere             udp dpt:domain
      0     0 ACCEPT     tcp  --  virbr1 any     anywhere             anywhere             tcp dpt:domain
      0     0 ACCEPT     udp  --  virbr1 any     anywhere             anywhere             udp dpt:bootps
      0     0 ACCEPT     tcp  --  virbr1 any     anywhere             anywhere             tcp dpt:bootps
      0     0 ACCEPT     udp  --  virbr2 any     anywhere             anywhere             udp dpt:domain
      0     0 ACCEPT     tcp  --  virbr2 any     anywhere             anywhere             tcp dpt:domain
      0     0 ACCEPT     udp  --  virbr2 any     anywhere             anywhere             udp dpt:bootps
      0     0 ACCEPT     tcp  --  virbr2 any     anywhere             anywhere             tcp dpt:bootps
    294 31177 ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
      0     0 ACCEPT     icmp --  any    any     anywhere             anywhere            
      7   469 ACCEPT     all  --  lo     any     anywhere             anywhere            
      0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             state NEW tcp dpt:ssh
    576 87997 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-host-prohibited
  
  Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
   pkts bytes target     prot opt in     out     source               destination         
    869 71173 ACCEPT     all  --  any    virbr1  anywhere             192.168.210.0/24     ctstate RELATED,ESTABLISHED
    885 66577 ACCEPT     all  --  virbr1 any     192.168.210.0/24     anywhere            
      0     0 ACCEPT     all  --  virbr1 virbr1  anywhere             anywhere            
      0     0 REJECT     all  --  any    virbr1  anywhere             anywhere             reject-with icmp-port-unreachable
      0     0 REJECT     all  --  virbr1 any     anywhere             anywhere             reject-with icmp-port-unreachable
      0     0 ACCEPT     all  --  virbr2 virbr2  anywhere             anywhere            
      0     0 REJECT     all  --  any    virbr2  anywhere             anywhere             reject-with icmp-port-unreachable
      0     0 REJECT     all  --  virbr2 any     anywhere             anywhere             reject-with icmp-port-unreachable
      0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-host-prohibited
  
  Chain OUTPUT (policy ACCEPT 418 packets, 34375 bytes)
   pkts bytes target     prot opt in     out     source               destination         
      0     0 ACCEPT     udp  --  any    virbr1  anywhere             anywhere             udp dpt:bootpc
      0     0 ACCEPT     udp  --  any    virbr2  anywhere             anywhere             udp dpt:bootpc
  
  
  [root@c7host ~]# iptables -L -v -t nat
  Chain PREROUTING (policy ACCEPT 1448 packets, 149K bytes)
   pkts bytes target     prot opt in     out     source               destination         
  
  Chain INPUT (policy ACCEPT 24 packets, 1671 bytes)
   pkts bytes target     prot opt in     out     source               destination         
  
  Chain OUTPUT (policy ACCEPT 265 packets, 19649 bytes)
   pkts bytes target     prot opt in     out     source               destination         
  
  Chain POSTROUTING (policy ACCEPT 265 packets, 19649 bytes)
   pkts bytes target     prot opt in     out     source               destination         
      3   336 RETURN     all  --  any    any     192.168.210.0/24     base-address.mcast.net/24 
      0     0 RETURN     all  --  any    any     192.168.210.0/24     255.255.255.255     
      0     0 MASQUERADE  tcp  --  any    any     192.168.210.0/24    !192.168.210.0/24     masq ports: 1024-65535
    883 66409 MASQUERADE  udp  --  any    any     192.168.210.0/24    !192.168.210.0/24     masq ports: 1024-65535
      1    84 MASQUERADE  all  --  any    any     192.168.210.0/24    !192.168.210.0/24

• The asg1 network must be an isolated network, with access to the network1 network and the internet via lin1a1 which is configured as a router.

PART 2: DHCP

So far we've used either DHCP provided by the virtualisation systems (Vmware/KVM) or static IP addresses. In this lab we'll set up a DHCP server on the asg1 network.

Lab completion

• Make sure you understand what you've done in this lab, so that you're ready to answer questions about it.
• Have notes in your labbook from this lab.
• Show your work to the professor and have them sign your labbook.