Introduction to Networking - III
Reboot Persistent Gateway-Node Network

Objective

The objective of this lab is to introduce the steps and the concepts involved in setting up a permanent (reboot-persistent) network between two hosts.


This network is available as soon as both hosts are setup to do their roles (either as node or as gateway) and running but unlike Intrdouction to Networking - II (Transient Gateway-Node Network) this setup persists despite reboot on either one or both hosts.

Two Host (CIDR/30) Gateway-Node Network

We will create a 2 host transient network with the following setup:

Description Value
Network Address (Fixed) 192.168.99.0/30
Host 1 (Gateway 2 NIC) 192.168.99.1/30
Host 2 (Node 1 NIC) 192.168.99.2/30
Broadcast Address (Fixed) 192.168.99.3/30

  1. This network is allowed to have two hosts only (see: CIDR/30 or glue network), so we configure one of them as a gateway and the other host as a node in order to understand the role and purpose of the node and the gateway in a typical network. In addition, we learn how to configure this network (both the gateway and the node) so the network, as configured, persists despite reboots on either the gateway or the node.


  2. Unless the node is configured to look for a default gateway by adding a route to the gateway IP in the node's routing table, the node will not have Internet connectivity. The files needed to setup the node are /etc/network/interfaces (to set static IP for node) and /etc/resolv.conf (to set domain name server, DNS, lookup).


  3. Unless the gateway is configured to forward packets, it wont act as a gateway. This means the node which depends on the gateway to route node's network packets wont connect to the Internet even if the node was configured correctly. The gateway, however, will connect to the Internet whether configured correctly or not because the gateway gets a dynamic IP from VirtualBox (and so the gateway is able to route its packets) on the other NIC (network interface card). The files needed to setup the gateway correctly are /etc/network/interfaces (to set static IP for gateway), /etc/sysctl.conf (to setup IP packet forwarding between the two network interface cards on the gateway), /etc/iptables.up.rules (to enable MASQUERADE on gateway for node packets) and /etc/network/if-pre-up.d/iptables (which is a script to automatically load IPTABLES rules at bootup).


  4. Since this network will be permanent, it persists beyond reboots on both the node and the gateway, however, the node wont connect to the Internet should the gateway go offline and will only connect to the Internet when the gateway comes back online.


  5. The gateway is configured to packet forward (which means to pass network packets from one network segment to another network segment) and masquerade (see: How does IP Masquerade Work?) while the node is configured to add a default gateway. When both are configured, the gateway acts as the node's gateway of last resort.


This lab below shows how to setup a (boot-persistent or permanent) network between the node and the gateway. This means the roles of node (configured to add gateway host IP as node's default gateway and domain name server resolver) and gateway (forward packets between the internal network containing the node and the external network containing the Internet) are stored in configuration files that are read whenever each of them reboots thereby ensuring the network, as configured, becomes boot-persistent.


Step 1: Ping gateway from node

Node

  • Check existing setup and verify Internet connectivity.
    ip -4 address show up | sed '/^1/,/forever/d'
ip route
getent ahosts debian.org
ssh <MySeneca-username>@matrix.senecacollege.ca
  • Stop NetworkManager, disable DHCP (enp0s3) interface, remove existing /etc/resolv.conf
    # in case of minimal desktop (no GUI) you can skip the next two steps
systemctl stop NetworkManager
systemctl disable NetworkManager

# disable DHCP on enp0s3
ip link set dev enp0s3 down
dhclient -r enp0s3
ip -4 address show up

# remove existing /etc/resolv.conf
mv /etc/resolv.conf /etc/resolv.conf.original
  • Set enp0s8 on node to IP 192.168.99.2/30 in /etc/network/interfaces

    See Introduction to Networking - I on how to set a reboot-persistent static IP. Ensure gateway IP 192.168.99.1/30 is set on the node so the default gateway is automatically setup on the node when the node boots up.

  • Create (or edit) the domain name server lookup file and put these lines into /etc/resolv.conf
    cat /etc/resolv.conf

    nameserver 10.102.100.21
nameserver 1.1.1.1

    nameserver 10.102.100.22
nameserver 8.8.8.8
  • Reboot node and verify enp0s8 has IP address assigned but no Internet.
    1. Verify node is not connected to the Internet.
    2. Verify node cannot reach gateway (192.168.99.1/32) on the same subnet unless gateway has been setup and configured correctly, in which case the node will be able to ping the gateway.

Gateway

  • Check existing setup and verify Internet connectivity.

    Use the commands, shown in Node example above, to check existing Gateway IP address and route setup. Verify Internet connectivity works in the Gateway before you proceed further.

  • Set enp0s8 on gateway to IP 192.168.99.1/30 in /etc/network/interfaces

    See Introduction to Networking - I on how to set a reboot-persistent static IP.

  • Reboot and verify enp0s8 has assigned IP address.
    1. Verify gateway continues to have Internet connectivity after reboot.
    2. In addition, verify node (192.168.99.2/30) can ping gateway (192.168.99.1/30) but node cannot go outside the 192.168.99.0/30 subnet. This is expected as node should continue to have no Internet connectivity at this step.

Step 2: Enable packet forwarding on gateway

Gateway

cp /etc/sysctl.conf /etc/sysctl.conf.original

# edit /etc/sysctl.conf
# remove # from the start of line 28
# net.ipv4.ip_forward=1

grep "net.ipv4.ip_forward" /etc/sysctl.conf

net.ipv4.ip_forward=1

Step 3: Enable packet masquerading on gateway

Gateway

iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
iptables-save > /etc/iptables.up.rules
cat /etc/iptables.up.rules

The data below is an example only, so the timestamp will be different each time the file is saved. 

# Generated by iptables-save v1.6.0 on Thu Jan 31 14:06:31 2019
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o enp0s3 -j MASQUERADE
COMMIT
# Completed on Thu Jan 31 14:06:31 2019

We need to automatically update the iptables by ensuring it loads correctly during startup. We do that as follows 

touch /etc/network/if-pre-up.d/iptables
chmod a+x /etc/network/if-pre-up.d/iptables
cat /etc/network/if-pre-up.d/iptables

NOTE: Now edit the contents of your empty /etc/network/if-pre-up.d/iptables to be exactly as shown below 

#!/bin/bash
#

/sbin/iptables-restore < /etc/iptables.up.rules

# Entire contents added by MF on Thu Jan 31 2019

Step 4: Verify Internet on node depends on gateway being up

getent ahosts debian.org
ssh <MySeneca-username>@matrix.senecacollege.ca

Practice Questions

NOTE: Answers to the configuration questions are to be based on making changes to files in /etc/ irrespective of whether you are working on the node or on the gateway but it is important know which file to edit on which host to complete that question.


  1. What is a name server? When is a name server needed on a network? Using absolute pathnames, state which file has the default name server and what are some of the data options stored in the file that contains the default name server.


  2. Compare the contents of the file containing the name server on the node and on the gateway. Are the two files different? Why? If they are different, what are the differences between the file containing the name server on the node and the gateway.


  3. What was the contents of /etc/network/interfaces on the node? How is this content different from /etc/network/interfaces on the gateway?


  4. What was the contents of /etc/network/interfaces on the gateway? How is this content different from /etc/network/interfaces on the node?


  5. How did you enable packet forwarding to happen automatically on the gateway? What file(s) did you edit and what changes did you make in that file? How is the enabling of packet forwarding different when done from the command line and when done from the file?


  6. How will you turn off packet forwarding on the gateway for its current live session only (changes to packet forwarding made during this session should not persist a reboot). Give the full command line on both the gateway and the node to verify changes made to packet forwarding in this session were turned off.


  7. What happens if you turn on packet forwarding but have not enabled IP masquerading? Will the node have Internet connectivity? If you answered yes then why would IP masquerading be needed? If you answered no then what does IP masquerading do?


  8. What does the command iptables do? How can you persist the state of iptables so it is available on the next reboot? Show the entire command line to do that?


  9. What does < and > written on a command line do? Give examples of using < and > in this lab. HINT: You could edit /etc/iptables.rules in an editor and read the results back in.


  10. Overall, how is setting up a network from the command line (transient) different from setting up a network so it is reboot persistent (permanent). When would you use each method to setup a network?

Created: 2020-09-22 Tue 18:31