189 | | For this experiment we will run an !OpenFlow Firewall. |
190 | | |
191 | | [[Image(http://groups.geni.net/geni/raw-attachment/wiki/GENIExperimenter/Tutorials/OpenFlowNetworkDevices/Firewall/Firewall-2.png, 50%, nolink)]] |
192 | | |
193 | | {{{ |
194 | | #!html |
195 | | |
196 | | |
197 | | |
198 | | |
199 | | <table border="0"> |
200 | | <tr> |
201 | | <td > |
202 | | <ol type="a"> |
203 | | <li>Log into <tt>switch</tt> and run the following commands to download and run the firewall controller: |
204 | | <pre> |
205 | | sudo apt-get install python-pip python-dev libxml2-dev libxslt-dev zlib1g-dev |
206 | | sudo pip install oslo.config |
207 | | </pre> |
208 | | </li> |
209 | | <li> |
210 | | Run a simple learning switch controller: |
211 | | <pre> |
212 | | cd /tmp/ryu |
213 | | ./bin/ryu-manager --verbose ryu/app/simple_switch.py |
214 | | </pre> |
215 | | </li> |
216 | | <li> Verify simple connectivity by logging into <tt>right</tt> ping <tt>left</tt> |
217 | | <pre> |
218 | | ping left |
219 | | </pre> |
220 | | Notice the printouts of the ryu simple switch controller. |
221 | | </li> |
222 | | <li> |
223 | | Stop your controller by Ctrl-c and remove all your flows |
224 | | <pre> |
225 | | sudo ovs-ofctl del-flows br0 |
226 | | </pre> |
227 | | <li> Make your switch into a firewall by downloading and running the appropriate Ryu controller: |
228 | | <pre> |
229 | | wget http://www.gpolab.bbn.com/exp/OpenFlowExampleExperiment/ryu/gpo-ryu-firewall.tar.gz |
230 | | tar xvfz gpo-ryu-firewall.tar.gz |
231 | | cd gpo-ryu-firewall/ |
232 | | /tmp/ryu/bin/ryu-manager simple_firewall.py |
233 | | </pre> |
234 | | <b> WARNING </b> If at some point your controller prints an error, kill it (ctrc-c) and start it again. |
235 | | </li> |
236 | | <li>Log into <tt>right</tt> and run a <tt>nc</tt> server: |
237 | | <pre> |
238 | | nc -l 5001 |
239 | | </pre> |
240 | | </li> |
241 | | <li>Log into <tt>left</tt> and run a <tt>nc</tt> client: |
242 | | <pre> |
243 | | nc 10.10.11.1 5001 |
244 | | </pre></li> |
245 | | <li>Type some text in <tt>left</tt> and it should appear in <tt>right</tt> and vise versa.</li> |
246 | | <li>In the terminal for <tt>switch</tt> you should see messages about the flow being passed or not: |
247 | | <pre> |
248 | | Extracted rule {'sport': '57430', 'dport': '5001', 'sip': '10.10.10.1', 'dip': '10.10.11.1'} |
249 | | Allow Connection rule {'dport': '5001', 'dip': '10.10.11.1', 'sip': '10.10.10.1', 'sport': 'any'} |
250 | | </pre> |
251 | | </li> |
252 | | <li><tt>CTRL-C</tt> to kill <tt>nc</tt> in each terminal. </li> |
253 | | <li>Run a <tt>nc</tt> server on port 5002, then 5003. |
254 | | <ul> |
255 | | <li> Compare the observed behavior to the contents of <tt>~/gpo-ryu-firewall/fw.conf</tt>. <i>Does the behavior match the configuration file?</i> |
256 | | <li> Stop the Firewall controller and run a simple switch controller. Is there any traffic being blocked now? Don't forget to delete the flows after you stop the controller</li> |
257 | | <li> Feel free to modify the configuration file to allow more traffic.</li> |
258 | | </ul> |
259 | | |
260 | | </ol> |
261 | | }}} |
262 | | |
263 | | = [.. Return to the main page] = |