# Data Networking/Fall 2014/YunweiJiang
## The Folks

Yunwei Jiang (Jiang.yun@husky.neu.edu)
Tianhe Wang (wang.tianh@husky.neu.edu)
Manish Reddy Bhimavarapu (bhimavarapu.m@husky.neu.edu)
Samuelraj Vibin Mohanraj Samuel (mohanrajsamuel.s@husky.neu.edu)

## Motivation

The purpose of project is to create a network includes a webserver with firewall, a DNS server, a DHCP server, a NFS server, a NIS server, a VPN server. And in order to test VPN, another network with only a webserver is also built.
In this project, when a new coming client joins the network, it can be assigned IP addresses(both IPv4 and IPv6) dynamically by the DHCP server, and the user can log in with his username and password which are registered in the NIS server. When the user try to access the webserver, the DNS server will translate the domain name the user input in the browser blank into a corresponing IP address so that the certain webpage can be shown in the client brower. Since the firewall only allow data traffic from port 80 which is the port for HTTP, the user cannot ping the webserver or telnet the webserver. When testing the VPN, what we should do first is to verificate that the client cannot get access to the webserver locating in another network. After that, we should make the client connect to VPN and then try to get access to the webserver. If it works, it means that the VPN works!

## Network Topology

The central network topology is Star Topology, all servers and clients are connected to the switch.
However, in the project, we use 4 physical PCs, and connected them to the switch. They may have a virtual network in the Host system if one run Virtual Machines. There are 2 type of virtual network. The one is vmNet0, auto bridged network, which bridged to Ethernet port, on link layer. Another is vmNet2, the Host-only network, which means it is a internal network between virtual machines and Host system. It not connected to any other network in any form.
Specially, the VPN server have two interfaces, one connected to the vmNet0, another connected to vmNet2. The Private Server have one interface and it connected to vmNet2. All other Virtual machines only have one interface and connected to the vmNet0.
* Logical topology
* Phsical topology

## DHCP Server
### Understanding the Protocol
#### Behavior of the protocol

Dynamic Host Configuration Protocol (DHCP) is a client/server protocol that automatically provides an Internet Protocol (IP) host with its IP address and other related configuration information such as the subnet mask and default gateway. This TCP/IP standard reduces the complexity and administrative overhead of managing network client IPv4 / IPv6 addresses and other configuration parameters.

#### Signaling

DHCP servers and DHCP clients communicate through a series of DHCP messages. To obtain a lease, the DHCP client initiates a conversation with a DHCP server using a series of these DHCP messages.
The common messages that can be sent between DHCP clients and servers are as follows:
DHCPDiscover Broadcast by a DHCP client when it first attempts to connect to the network. This message requests IP address information from a DHCP server.
DHCPOffer Broadcast by each DHCP server that receives the client DHCP Discover message and has an IP address configuration to offer to the client. The DHCPOffer message contains an unleased IP address and additional TCP/IP configuration information, such as the subnet mask and default gateway.
DHCPRequest Broadcast by a DHCP client after it selects a DHCPOffer. The DHCPRequest message contains the IP address from the DHCPOffer that it selected. If the client is renewing or rebinding to a previous lease, this packet might be unicast directly to the server.
DHCPAck Broadcast by a DHCP server to a DHCP client acknowledging the DHCPRequest message. Upon receipt of the DHCPAck, the client can use the leased IP address to participate in the TCP/IP network and complete its system startup. This message is typically broadcast, because the DHCP client does not officially have an IP address that it can use at this point.
DHCPNack, DHCPDecline, DHCPRelease and DHCPInform are the other common messages used by the server and client.

#### Flow Chat of DHCP

* DHCP Flow Chat

### The Requirements

1. A DHCP server that has installed isc-dhcp-server and isc-dhcp6-server (will manually create after)
2. A client.

### Steps to perform the installation and configuration
#### Edit the configuration file

Add these lines into it.

#### Configure inetd.conf

Add this line into it, insert it below "#BOOT:......" without any '#' as the beginning of the line.

#### Get PXE boot images

Get Ubuntu PXE boot environment file from internet, of course you can choose other PXE boot images.
You can get Ubuntu installer pxelinux from here:
http://archive.ubuntu.com/ubuntu/dists/utopic/main/installer-amd64/current/images/netboot/
You can also use FTP tool to get it. You should download all belongings from it and do not change the folder's order. Then, Copy it to /var/lib/tftpboot/
It likes the picture shows above. Then, change the access permissions of these files.

#### Restart the services.
### Testing

When testing DHCP server, what we need to do is just to see whether our client can get a IP address in a dynamical way.
We also can test the DHCP server and PXE boot at the same time.
Open a computer which support PXE boot. You may need press F12 button during the diagnose/POST screen, then entering the PXE boot.
It looks like following scenario.
* PXE boot start up screen
After it has been successfully allocated IP address from the DHCP server, the client will run the pxelinux.0, which is download from the TFTP server.
* Linux_tftpboot_start screen
When it loaded whole image from the TFTP server, it will be booted. Then, there is no different between regular computer booting.
* Linux_tftpboot_success screen

## DNS Server
### Understanding the Protocol

DNS is a protocol within the set of standards for how computers exchange data on the Internet and on many private networks, known as the TCP/IP protocol suite. Its basic job is to turn a user-friendly domain name into an Internet Protocol (IP) address like 70.42.251.42 that computers use to identify each other on the network. Whether you're accessing a Web site or sending e-mail, your computer uses a DNS server to look up the domain name you're trying to access. The proper term for this process is DNS name resolution, and you would say that the DNS server resolves the domain name to the IP address.

#### Signaling

DNS queries can be sent from a DNS client (resolver) to a DNS server, or between two DNS servers. A DNS query is merely a request for DNS resource records of a specified resource record type with a specified DNS name. For example, a DNS query can request all resource records of host with a specified DNS name. A recursive query forces a DNS server to respond to a request with either a failure or a successful response. DNS clients (resolvers) typically make recursive queries. With a recursive query, the DNS server must contact any other DNS servers it needs to resolve the request. When it receives a successful response from the other DNS server(s), it then sends a response to the DNS client. The recursive query is the typical query type used by a resolver querying a DNS server and by a DNS server querying its forwarder, which is another DNS server configured to handle requests forwarded to it. An iterative query is one in which the DNS server is expected to respond with the best local information it has, based on what the DNS server knows from local zone files or from caching. It may have to query a number of outside DNS servers in an attempt to resolve the name. The DNS Client service queries the DNS servers in the following order: • The DNS Client service sends the name query to the first DNS server on the preferred adapter’s list of DNS servers and waits one second for a response. • If the DNS Client service does not receive a response from the first DNS server within one second, it sends the name query to the first DNS servers on all adapters that are still under consideration and waits two seconds for a response. • If the DNS Client service does not receive a response from any DNS server within two seconds, the DNS Client service sends the query to all DNS servers on all adapters that are still under consideration and waits another two seconds for a response. • If the DNS Client service still does not receive a response from any DNS server, it sends the name query to all DNS servers on all adapters that are still under consideration and waits four seconds for a response. • If it the DNS Client service does not receive a response from any DNS server, the DNS client sends the query to all DNS servers on all adapters that are still under consideration and waits eight seconds for a response. • If the DNS Client service receives a positive response, it stops querying for the name, adds the response to the cache and returns the response to the client. • If the DNS Client service has not received a response from any server within eight seconds, the DNS Client service responds with a time-out. Also, if it has not received a response from any DNS server on a specified adapter, then for the next 30 seconds, the DNS Client service responds to all queries destined for servers on that adapter with a time-out and does not query those servers. Only computers running Windows 2000 or Windows Server 2003 return this time-out. • If at any point the DNS Client service receives a negative response from a server, it removes every server on that adapter from consideration during this search. For example, if in step 2, the first server on Alternate Adapter A gave a negative response, the DNS Client service would not send the query to any other server on the list for Alternate Adapter A.
The DNS Client service keeps track of which servers answer name queries more quickly, and it moves servers up or down on the list based on how quickly they reply to name queries.

#### Heirarchy

* DNS Server Hierarchy

#### Flow Chat

* DNS Flow Chat

### Steps to perform the setup / Installation

1. Update and Upgrade the packages
2. Choose a preferred editor to work on. gedit is pre-installed in most of the Ubuntu versions. Vi editor is also an option.
3. Install the service BIND9 (Berkeley Internet Name Domain)
4. Files that need to be configured inside /etc/bind:
5. Edit the file, add the following: This is our domain name and reverse area
5. Static DNS Record This means the DNS server is responsible for such domain names Edit the file. The file name needed to be in this order: db.yourdomain, for example gedit /etc/bind/db.physicsboy.org
put following record in it

### Testing

Try to use the command nslookup on the DNS server. Another choice is to use the client to get access to the webserver, and type a domain name, such as www.physicsboy.org. If you can get the webpage, it means that the DNS sever is done!

## NIS Server / Client
### Understanding the Protocol

NIS is the abbreviation of Network Information System which is a directory service protocol used to manage configuration files which are related to computer system management, such as account, passwords, hostname, group, etc. Usually, NIS can be called as "Yellow Page". The service was developed by SUN.

### The Requirements

1. Hardware: A configured NIS server and a configured NIS client.
2. Software: The server and the client should install NIS and portmap(in Ubuntu 14.04, portmap has been abolished and we should use rpcbind instead).
3. The NIS server should be turned on.

### Steps to perform the setup / installation
#### 1. Server Configuration

1) Install rpcbind:
In previous versions of Ubuntu, wheat should be installed is portmap service, however, in Ubuntu 14.04, we should choose rpcbind because portmap has stopped being used.
2) Update rpcbind defaults:
3) Install NIS:
When nis service is installed in your host for the first time, you will be asked to input a NIS domain, and usually, the NIS domain should be your organization's domain name.
4)Edit /etc/defaults/nis:
When editting the file, only 2 lines need to be updated, the default contents of the 2 lines are:
Here, we should update the 2 lines to
This modification is to make your host be the NIS server.
5) Edit /etc/ypserv.securenets: sudo vi /etc/ypserv.securenets
In this file, only 1 line need to be update,the original line is:
Here we should update the Network ID to your organization's ID, and the results in this project is:
This modification is to determine the subnet that NIS server works for.
6) Edit /var/yp/makefile:
Modify the line from
to
7) Restart the service:
8) Invoke /usr/lib/yp/ypinit -m:
9) Add users and group to be used by NIS clients throughout the network to the NIS server:
For example,
10) Set the passwords for all these new users: sudo passwd username. For example, sudo passwd user1.
11) Compile new uses, groups and passwords into the NIS database:

#### 2. Client Configuration

1) Install rpcbind:
2) Update rpcbind:
3) Install NIS:
4) Edit /etc/hosts:
Here we need to append our NIS server's IP address and hostname as well as the domain name we set for the NIS server before to the file.
5) Edit /etc/yp.conf:
Here we need to append our NIS server's domain name to the file.
6) Edit /etc/nsswitch.conf:
Update the content
to
7) Modify the permission of the default /home folder:
8) Reboot the client:

#### 3. NFS Configuration

After completing the configuration of NIS server and NIS client, we need to test whether the two hosts can work well. During the test, the users registered in the NIS server may not find their /Home directory. In order to solve the problem, we need to configure NFS on both the NIS server and NIS client. We will give more details about configuring the NFS service later.

### Testing

When the NIS is on, we can log in with the identification of user1/user2/user3, however, if the NIS server is off, none of these users can log in on the NIS client.

## Web Server
### Understanding the Protocol

A web server is a computer system that processes requests via HTTP, the basic network protocol used to distribute information on the World Wide Web. The primary function is to serve web pages or store information. Every web server has an IP address and a domain name if possible. Any computer can be turned into a Web server by installing server software and connecting the machine to the Internet. Apache Webserver is the most widely used webserver. And for secure consider, we can also implement SSL.

### The Requirements

The requirements for webserver is quite simple. 1. A webserver installing Apache2 and openssl; 2. A host which can get access to the webserver.
== Steps to perform the setup / installation ==
1. Install Apache2
2. Edit the configuration file of the server
3. Create web pages using HTML and save them using filename.html Web pages are saved at /var/www
4. To edit HTML web page give
To view the web page give localhost/filename.html or /var/www/filename.html in the web browser.
5. Web Server stop/restart
a) To stop the web server, enter
b) To restart the web server give
6. Enable SSL
7. Create a folder to save the key and certification
8. To generate the key and certification
After executing the command, you will see such words on your screen:
Usually, we can keep all lines but “Common Name” default, and we can set “Common Name” as our organization name or our IP address.
9. Set up the certificate by editing the file /etc/apache2/sites-available/default-ssl.conf.
10. Active the website created

### Testing

1. To test Apache, we need only open our browser and then type the IP address of the webserver to see whether the default test page of Apache will show. 2. To test SSL, we need to open our browser and then type "https://" and the IP address of the webserver to see whether the default test page of Apache will show.

## NFS Server
### Understanding the Protocol

NFS, or Network File System is one kind of file systems supported by FreeBSD. NFS allows a system share its directories and files on the network. Users and programs can access files residing in remote servers as directories and files locating in local host.
The advantages of NFS are obvious:
1. Local workstation can save hard-disk space because files can be saved on the NFS server and can be accessed through the network.
2. It's not necessary for users to have a home directory on each hosts because this directory can be placed in the NFS server which can be accessed through the network.
3. Devices like CDROM, floppy drive can be used by other hosts through the network, reducing the amount of removable devices.

### The Requirements

1. A NFS server and one or more NFS clients.
2. The NFS server should install nfs-kernel-server, rpcbind.
3. The NFS client should install nfs-common, rpcbind.

### Steps to perform the setup / installation
#### 1. Server Configuration

1) Install nfs-kernel-server on the NFS server:
2) Build the folder going to share:
3) Change the permission of the folder
4) Edit /etc/exports:
Here, we need to append the shared directory, /armnfs, and set the operating permission.
"*" means that all subnets can get access to the directory;
"rw" means that users can read and write the files;
"sync" means the file contents are written to RAM and ROM at the same time
Other details are no more listed here
5) Restart NFS service:

#### 2. Client Configuration

Here we select the webserver as the NFS client and most html files are located in the NFS server.
1) Install nfs-common and rpcbind
2) Build a new subfolder in the folder /var/www/:
After executing the command, open the browser of the webserver and type "localhost/armnfs/homepage.html" which is a html file locating in the NFS server in the browser blank, if you can get access to it, your NFS client configuration is done!

### Testing

1) Test the NFS server:
If it shows
It means that the NFS server has been configured successfully.
2. Test the client:
If you want stop the connection between the NFS client and the NFS server, use the below command:

## VPN Server / Client
### Understanding the Protocol

A VPN is a method of connecting to a private network by way of a public network. A Virtual Private Network, or VPN, creates an encrypted tunnel between computer (client) and the VPN (server). The VPN server must have IP addresses available in order to assign them to the VPN server's virtual interface and to VPN clients during the negotiation phase of the connection process. The IP address assigned to the VPN client is assigned to the virtual interface of the VPN client.

### The Requirements

1. A client which has installed openvpn service;
2. The client must have installed the certificate geneated by the VPN server;
3. A VPN server which has installed openvpn service.

### Steps to perform the setup / installation

1. Install openvpn and easy-rsa
2. Certificate Authority Setup:
3. Edit /etc/openvpn/easy-rsa/vars:
Modify the default configuration to what is shown above.
4. Generate the master Certificate Authority certificate and key:
5. Generate a certificate and private key for the server:
6. Generate client certificates and copy it to the client in a secure way and delete it in the server:
7. Copying and unpacking server.conf.gz to /etc/openvpn/server.conf:
8. Edit /etc/openvpn/server.conf to make sure the following lines are pointing to the certificates and keys created in the section above:
9. Start the openvpn service:
10. To check if OpenVPN created a tun0 interface:

### Testing

Shutting down the VPN service, we can find that the client cannot get access to the webserver locating in another network. Then we turn on the VPN service and try to make the client access to the webserver. If the client can get the webpage, it means that the VPN is done!
=Firewall=

### Understanding the protocol

A firewall is a network security system that controls the incoming and outgoing network traffic based on applied rule set. A firewall establishes a barrier between a trusted, secure internal network and another network (e.g., the Internet) that is assumed not to be secure and trusted. By configuring commands on a Linux terminal, an Ubuntu machine both at the (web server end and at the client end) a set of rules are applied so that it will drop certain packets but allows rest all packets.

### Steps to perform the setup / Installation

1. To show iptables configuration:
2. Allow established sessions to receive traffic:
3. Allow incoming traffic on specific ports, here we only allow traffic on port 80:
4. Blocking traffic:
5. Insert to allow lo traffic:

### Testing

Let's shut down the firewall first, and try to ping the webserver. We will find that the webserver will give icmp response to the client. Then start the firewall, since the firewall configured here only allows HTTP request, thus no icmp can get access to the webserver. We try to ping the server, and find that no response. Buy we can still get access to the webpage. This means that our configuration for firewall works.

## Testing

Because of the limited number of laptops, we have to run most of these servers on VMware. Here, we use A, B, C, D to denote different 4 laptops.
In laptop A, we install a VPN server and a webserver which belongs to network1;
In laptop B, we install a DHCP server and a DNS server;
In laptop C, we install a webserver including the firewall and SSL configuration, and s NIS server as well as a NFS server;
We take laptop D as the client, and in order to test NIS and VPN, we implement NIS client configuration and VPN client configuration on laptop D.
The test steps are simple:
1. Open all servers and client;
2. Log in with the identification registered in the NIS server, such as user1, user2, and user3.
3. Once the user log in successfully, meaning that the NIS server is configured correctly, open the browser of the client;
4. Check the IP addresses(IPv4 and IPv6) of the client;
5. Type a domain name or a IP address which can be find in the DNS server in the browser's blanket, here we can use www.physicsboy.org or 10.68.19.62.
6. Type a domain name or a IP address with a prefix "https://" which can help to prove SSL in the brower's blanket, here we can use https://www.physicsboy.org or https://10.68.19.62.
7. Visit a webpage which is not locate in the webserver but the NFS server.
8. If all above are done successfully, it means that the requirements for webserver, DNS server, DHCP server, NIS, NFS are all completed.
9. When testing the VPN part, we should first shut down the VPN service of the client, then try to get access to a webpage existing in the webserver locating in another network, and the browser will show us a error if everything is correct. Then open the VPN service of the client, and then try to access to the same webpage, if the browser displays the webpage correctly, VPN part is proved.

## Future Prospects

In this project, we implemented the webserver, the DHCP server, the DNS server, the NIS service, the NFS service, the VPN service. However, because of the limited time, we did not make our LAN get access to the internet, although it is not quite difficult to implement. If the future time, we may try to make our LAN get access to the Internet so that our project can work in the real life.