| | 1 | = OpenFlow Firewall = |
| | 2 | |
| | 3 | ''This exercise is based on as assignment by [http://groups.geni.net/geni/wiki/GENIEducation/SampleAssignments/OpenFlowFirewallAssignment Sonia Famy, Ethan Blanton and Sriharsha Gangam of Purdue University].'' |
| | 4 | |
| | 5 | For this experiment we will run an !OpenFlow Firewall. |
| | 6 | |
| | 7 | [[Image(http://groups.geni.net/geni/raw-attachment/wiki/GENIExperimenter/Tutorials/OpenFlowNetworkDevices/Firewall/Firewall-2.png, 50%, nolink)]] |
| | 8 | |
| | 9 | {{{ |
| | 10 | #!html |
| | 11 | |
| | 12 | |
| | 13 | |
| | 14 | |
| | 15 | <table border="0"> |
| | 16 | <tr> |
| | 17 | <td > |
| | 18 | <ol type="a"> |
| | 19 | <li>Log into <tt>switch</tt> and run the following commands to download and run the firewall controller: |
| | 20 | <pre> |
| | 21 | sudo apt-get install python-pip python-dev libxml2-dev libxslt-dev zlib1g-dev |
| | 22 | sudo pip install oslo.config |
| | 23 | </pre> |
| | 24 | </li> |
| | 25 | <li> |
| | 26 | Run a simple learning switch controller: |
| | 27 | <pre> |
| | 28 | cd /tmp/ryu |
| | 29 | ./bin/ryu-manager --verbose ryu/app/simple_switch.py |
| | 30 | </pre> |
| | 31 | </li> |
| | 32 | <li> Verify simple connectivity by logging into <tt>right</tt> ping <tt>left</tt> |
| | 33 | <pre> |
| | 34 | ping left |
| | 35 | </pre> |
| | 36 | Notice the printouts of the ryu simple switch controller. |
| | 37 | </li> |
| | 38 | <li> |
| | 39 | Stop your controller by Ctrl-c and remove all your flows |
| | 40 | <pre> |
| | 41 | sudo ovs-ofctl del-flows br0 |
| | 42 | </pre> |
| | 43 | <li> Make your switch into a firewall by downloading and running the appropriate Ryu controller: |
| | 44 | <pre> |
| | 45 | wget http://www.gpolab.bbn.com/exp/OpenFlowExampleExperiment/ryu/gpo-ryu-firewall.tar.gz |
| | 46 | tar xvfz gpo-ryu-firewall.tar.gz |
| | 47 | cd gpo-ryu-firewall/ |
| | 48 | /tmp/ryu/bin/ryu-manager simple_firewall.py |
| | 49 | </pre> |
| | 50 | <b> WARNING </b> If at some point your controller prints an error, kill it (ctrc-c) and start it again. |
| | 51 | </li> |
| | 52 | <li>Log into <tt>right</tt> and run a <tt>nc</tt> server: |
| | 53 | <pre> |
| | 54 | nc -l 5001 |
| | 55 | </pre> |
| | 56 | </li> |
| | 57 | <li>Log into <tt>left</tt> and run a <tt>nc</tt> client: |
| | 58 | <pre> |
| | 59 | nc 10.10.11.1 5001 |
| | 60 | </pre></li> |
| | 61 | <li>Type some text in <tt>left</tt> and it should appear in <tt>right</tt> and vise versa.</li> |
| | 62 | <li>In the terminal for <tt>switch</tt> you should see messages about the flow being passed or not: |
| | 63 | <pre> |
| | 64 | Extracted rule {'sport': '57430', 'dport': '5001', 'sip': '10.10.10.1', 'dip': '10.10.11.1'} |
| | 65 | Allow Connection rule {'dport': '5001', 'dip': '10.10.11.1', 'sip': '10.10.10.1', 'sport': 'any'} |
| | 66 | </pre> |
| | 67 | </li> |
| | 68 | <li><tt>CTRL-C</tt> to kill <tt>nc</tt> in each terminal. </li> |
| | 69 | <li>Run a <tt>nc</tt> server on port 5002, then 5003. |
| | 70 | <ul> |
| | 71 | <li> Compare the observed behavior to the contents of <tt>~/gpo-ryu-firewall/fw.conf</tt>. <i>Does the behavior match the configuration file?</i> |
| | 72 | <li> Stop the Firewall controller and run a simple switch controller. Is there any traffic being blocked now? Don't forget to delete the flows after you stop the controller</li> |
| | 73 | <li> Feel free to modify the configuration file to allow more traffic.</li> |
| | 74 | </ul> |
| | 75 | |
| | 76 | </ol> |
| | 77 | }}} |
| | 78 | |
| | 79 | = [.. Return to the main page] = |
