# Data Networking/Spring 2017/JXM
## Motivation

As a network engineer, It's essential to understand and implement network configurations in Linux Operating System. This project aims to design a dynamic network solution using the Domain Name System Server (DNS), Dynamic Host Configuration Protocol Server (DHCP), Web Server, Firewall, Backup Server. The servers and clients will be able to automatically obtain IP addresses by DHCP Server and DNS Server. The clients will be able to get web pages from Web Server. In addition, Firewall and Backup Server will be added to provide a secure and robust network configurations for the company.

### Team Members

Junhao Huang
Xinchen Zhang
Mayank Kashyap

## Behavior of Protocols
### Domain Name System

Domain Name System (DNS) is a hierarchical naming system for computers and services. It translates domain names to numerical IP addresses with different network protocols. A DNS name server stores the DNS records for a domain and replies the answers to its database. There are four most common types of records stored in DNS database:
* A and AAAA: IP addresses
* NS: Name Server, hostname of the authoritative server
* MX: SMTP mail exchangers, transfers electronic mail messages from one computer to anther and translates mail server to the its canonical name
* CANME: A Canonical Name Record is used to translate a domain name to the canonical domain.
* PTR: IP address to hostname translation

### Dynamic Host Configuration Protocol

Dynamic Host Configuration Protocol (DHCP) is a client/server protocol that automatically provides an Internet Protocol (IP) host with its IP address and other related configuration information such as the subnet mask and default gateway. RFCs 2131 and 2132 define DHCP as an Internet Engineering Task Force (IETF) standard based on Bootstrap Protocol (BOOTP), a protocol with which DHCP shares many implementation details. DHCP allows hosts to obtain required TCP/IP configuration information from a DHCP server.
Why is DHCP required?
Every device on a TCP/IP-based network must have a unique unicast IP address to access the network and its resources. Without DHCP, IP addresses for new computers or computers that are moved from one subnet to another must be configured manually; IP addresses for computers that are removed from the network must be manually reclaimed. With DHCP, this entire process is automated and managed centrally. The DHCP server maintains a pool of IP addresses and leases an address to any DHCP-enabled client when it starts up on the network. Because the IP addresses are dynamic (leased) rather than static (permanently assigned), addresses no longer in use are automatically returned to the pool for reallocation. The network administrator establishes DHCP servers that maintain TCP/IP configuration information and provide address configuration to DHCP-enabled clients in the form of a lease offer. The DHCP server stores the configuration information in a database that includes: Valid TCP/IP configuration parameters for all clients on the network.
Valid IP addresses, maintained in a pool for assignment to clients, as well as excluded addresses.
Reserved IP addresses associated with particular DHCP clients. This allows consistent assignment of a single IP address to a single DHCP client.
The lease duration, or the length of time for which the IP address can be used before a lease renewal is required.
A DHCP-enabled client, upon accepting a lease offer, receives: A valid IP address for the subnet to which it is connecting.
Requested DHCP options, which are additional parameters that a DHCP server is configured to assign to clients. Some examples of DHCP options are Router (default gateway), DNS Servers, and DNS Domain Name. For a full list of DHCP options, see DHCP Tools and Options.
–2601:197:800:2EFA:B827:C938:5A64:EDBE (discuss) 02:52, 7 April 2017 (UTC)

### Webserver

Storing, processing and delivering webpages to clients is the basic function of a web server, which means that web servers host webpages to clients.
Apache2 is quite popular among people who would like to make a web server in Linux. phpmyadmin is good for configuring a web server.

### Firewall

Firewall is a kind of computer system which is used to protect the network from internet attack. It is a barrier to between a internal network and other outside network.
By setting some rules to the server we can accept all the service we want and block others to make our internal network safe from the potential dangers from the Internet.

### Backup

In case of the damage of the web server, a backup server is used to store the file and data on a network. So that the file and data would not be missed after the web server gets some error.

## Requirements

* Configure a DNS server to resolve domain names and reverse domains
* Configure a DHCP server to assign IPv4 and IPv6 addresses dynamically
* Implement a web server to host a web page
* Implement a backup server to automatically install the server files using SSH and a NFS server
* Create a firewall to provide the security

## Steps and Commands
### DNS

Master DNS
Step1: Install the BIND9 DNS server:
Step2: Change hostname and host files:
Step3: Edit the name servers:
Step4: Edit the forwarders:
Step5: Edit forward and reverse zones:
Step6: Create the zone files:
Step7: Restart the bind9
Slave DNS
Step1: Edit forward and reverse zones:
Step2: Restart the bind9

### DHCP

To install DHCP server, open a new Ubuntu VM to serve as DHCP server for your network. Once configured, this server cannot access internet anymore because of changes in the domain name and name servers. We will be using ISC (Internet Systems Consortium) DHCP server in our project and below are the steps for installation:
Step 1: Install ISC's dhcp server in terminal:
Step 2: Indicate the network interface "ens33" in the isc-dhcp-server file located in /etc/default/ and also enable IPv6 through editing "OPTIONS=-6"
Step 3: Make edits and changes to the DHCP configuration file for IPv4
Step 4: Make changes to the virtual machine's interfaces by changing the interfaces file in /etc/network/
Step 5: Edit the resolve file
Step 6: Enable IPv4 and IPv6 forwarding
Step 7: Install radvd for IPv6 advertising using the following command
Step 8: Configure dhcpd6.conf to add IPv6 address pool
Step 9: Edit radvd configuration file
Step 10: Restart the network interface (NOTE: THIS WILL DISABLE YOUR INTERNET CONNECTION IN THE VM)
Step 11: Start the DHCP server for IPv4 and IPv6

### Web server

Step 1: We need to use Apache to as our web server, so we install Apache first Command:
Step 2: Install PHP Command:
Step 3: Install MySQL, and set the password as“linux” Command:
Step 4: Check if mysql is working Command:
Step 5: Install phpmyadmin, choose apache when installing, and also set the password as "linux" Command:
Step 6: To create the phpmyadmin like we have to use chmod command to change the authority of /var/www Command:
Step 7: Create the phpmyadmin link between /usr/share/phpmyadmin and /var/www/html, after that we can see there is a phpmyadmin file in /var/www/html Command:
Step 8: Create a basic webpage “Index.htm”, and we can see a index.html file in /var/www/html
Step 9: Go into the configuration of apache2 and change the default webpage catalog “/var/www” to “/home/ttno1”, and there is no '/' after directory path Command:
Step 10: Go into the configuration of 000-default and change the default webpage catalog “/var/www/html” to “/home/ttno1” Command:
Step 11: We need to restart the apache Command:
Step 11: Use the browser on another host to visit the web server with its IP address.

### Firewall

Step 1: List the current rules in iptables, and if you never set up your server before, you should see:
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Command:
Step 2: To allow established sessions to get traffic
Command:
And if the command above does not work, try the following one:
Step 3: Set up SSH, HTTP, FTP, TFTP, DHCP, DNS, VPN
Command:
Step 4: To send network packets to let computers' serveics cummunicate with each other.
Command:
Step 5: Accept all traffic on loopback interface
Command:
Step 6: To establish outgoing connections
Command:
Step 7: Set up from internal to external
Command:
Step 8: To drop Invalid Packets
Command:
Step 9: The function of deny ping
Command:
Step 10: For each client we set up a 10 connection limit for them
Command:
Step 11: To prevent HTTP flood
Command:
Step 12: If there is a need of block an IP Address
Command:
Step 13: If you would like to cancel the block IP address
Command:
Step 14: Make permittion for VPN
Command:
Step 15: Deny other settings
Command:
Step 16: To preserve your IPTABLES rules upon reboot, install iptables-persistant
Command:
Step 17: Once the rules are changed, run the following commands to save and reload them before and after reboot
Command:

### Backup

Step1: We use rsync to set up backup server.
Step 2: Then we install SSH on web server and backup server.
Step3: Generate a rsa key
Step4: We generate the keys to another host.
Step5: Create a backup zip file on the master server:
Step6: The files are zipped and compressed:
Step7: The zip is transferred to the backup server
Step8: Unzip the original files

## Testing Procedure
### DNS

Step1: Use "nslookup" command to lookup the DNS server for different hostnames.
Step2: Use "dig" command to check the DNS records and zone files.
Step3: Turn the master DNS off and check nslookup.

### DHCP

Step 1: Use the following command to check the status of dhcp server
Step 2: To check if DHCP is leasing out addresses and other updates like acknowledgments and requests, use the following command after connecting DHCP to client. The red text represents the errors.
Step 3: Check output at client's and other hosts' end. If the hosts receive the addresses that were specified as static addresses by DHCP and if client receives an address in the range defined by DHCP, then our test procedure is successful.

### Web Server

Step1: Turn on your web server.
Step2: Open a browser on a client and enter the IP address of the web server to check if we can get access to the webpage of the server.

### Firewall
#### Method 1

Ping client's IP address in the terminal of web server's ubuntu and it successes.
Ping web server's IP address in the terminal of client and it shows destination port unreachable.

#### Method 2

Step 1: Open a browser and enter the IP address of the web server in a client.
Step 2: Block the IP address of the client by adding a IPtable on the terminal of the web server.
Step 3: Refresh the webpage in the client side. And see if the webpage can be refreshed.
Step 4: Delete the IPtable to allow the client get access to web server.
Step 5: Try again to refresh the webpage in the client side.

### Backup

Check the files after the set time in crontab.
Integrated Testing

## Adds-on
### ARP

Step 1: We use scapy and python to make our ARP Poinsoning, so we install scapy first. Command:
Step 2: To be the superuser and get higher authority, we reset the root password. Command:
Step 3: Start iptables after reboot Command:
Step 4: Turn on IP forwarding Command:
Step 5: Configure Scapy arp poison Command:
Step 6: Make a fake web page Command:
Step 7: Forward the traffic Command:

### IPSec

IPSec can be configured in any two virtual machines. In our case, we are configuring IPSec between two Ubuntu VMs with IP addresses: 192.168.10.21 and 192.168.10.25.
Step 1: Install ipsec in the first host using the following command
Step 2: Go to the ipsec.conf file at /etc/ to update the parameters
Step 3: Configure the secrets file in both hosts
Step 4: Use this command to restart the ipsec processes
Step 5: Check the ipsec status

### NFS

NFS-Server
Step 1: Inatall nfs-kernel-server Command:
Step 2: Make share folder Command:
Step 3: Edit configuration Command:
Step 4: Restart service Command:
Step 5: Test Command:
NFS-Clients
Step 1: Inatall nfs-common for clients Command:
Step 2: Make share folder Command:
Step 3: Mount the share file Command:
Step 4: Mount this share file when turn on the client Command: