Introduction to Networking - II
Transient (In-Memory) Gateway-Node Network

Objective

  • Objective is to introduce steps and concepts involved in setting up a transient (temporary, in-memory) network between two hosts from the command line.


  • This network is available as long as both hosts are setup to do their roles (either as node or as gateway) and running, however, when either one or both are rebooted this transient network between the two hosts wont be available.

Two Host (CIDR/30) Gateway-Node Network

We will create a 2 host transient (in-memory) network with the following setup:

Description Value
Network Address (Fixed) 192.168.99.0/30
Host 1 (Gateway 2 NIC) 192.168.99.1/30
Host 2 (Node 1 NIC) 192.168.99.2/30
Broadcast Address (Fixed) 192.168.99.3/30

NOTES:

  1. This network is allowed to have two hosts only (see: CIDR/30 or glue network), so we configure one of them as a gateway and the other host as a node in order to understand the role and purpose of the node and the gateway in a typical network. In addition, we learn how to configure each host (gateway and node) on this transient (in memory and not boot-persistent) network from the command line.


  2. Unless the node is configured to look for a default gateway by adding a route to the gateway IP in the node's routing table, the node will not have Internet connectivity.


  3. Unless the gateway is configured to forward packets, it wont act as a gateway. This means the node which depends on the gateway to route node's network packets wont connect to the Internet even if the node was configured correctly. The gateway, however, will connect to the Internet whether configured correctly or not because the gateway gets a dynamic IP from VirtualBox (and so the gateway is able to route its packets) on the other NIC (network interface card).


  4. Since this network is transient, it only exists in memory of both the hosts when they are up and running, and configured to do their respective roles correctly. Upon rebooting any one of them, the network as described (in 2. and 3.) above no longer exists.


  5. The gateway is configured to packet forward (which means to pass network packets from one network segment to another network segment) and masquerade (see: How does IP Masquerade Work?) while the node is configured to add a default gateway. When both are configured, the gateway acts as the node's gateway of last resort.


This lab below shows how to, from the command line, add a (transient) route and how to forward packets coming in from one interface (representing one network segment) to another interface (representing the other network segment).


Both features: default gateway setup on the node and packet forwarding on the gateway are only available until either machine reboots. So, if any one of them reboots the network will no longer be active as described in this lab.

Step 1: Enable Node to ping Gateway

Do this step to ensure both Node and Gateway are on the same subnet.

Node

  • Check existing setup and verify Internet connectivity.
    ip -4 address show up | sed '/^1/,/forever/d'
    ip route
    getent ahosts debian.org
    
  • Stop NetworkManager and disable the DHCP (enp0s3) interface
    # in case of minimal desktop (no GUI) you can skip the next two steps
    systemctl stop NetworkManager
    systemctl disable NetworkManager
    
    # disable DHCP on enp0s3
    ip link set dev enp0s3 down
    dhclient -r enp0s3
    ip -4 address show up
    
  • Set enp0s8 to IP 192.168.99.2/30
    # if interface has an existing IP address, delete it (optional)
    ip address delete 192.168.99.19/24 dev enp0s8
    
    # using CIDR notation, assign IP and broadcast to the interface
    ip address add 192.168.99.2/30 broadcast 192.168.99.3 dev enp0s8
    
  • Verify enp0s8 has IP address assigned but no Internet.
    1. Verify Node is not connected to the Internet.
    2. Verify Node cannot reach Gateway (192.168.99.1/32) on the same subnet (since Gateway has not been setup yet).

Gateway

  • Check existing setup and verify Internet connectivity.

    Use the commands, shown in Node example above, to check existing Gateway IP address and route setup. Verify Internet connectivity works in the Gateway before you proceed further.

  • Set secondary interface to have IP 192.168.99.1/30
    # if interface has an existing IP address, delete it (optional)
    ip address delete 192.168.99.19/24 dev enp0s8
    
    # using CIDR notation, assign IP and broadcast to the interface
    ip address add 192.168.99.1/30 broadcast 192.168.99.3 dev enp0s8
    
  • Verify enp0s8 has assigned IP address.
    1. Verify Gateway continues to have Internet connectivity after setting Gateway IP.
    2. In addition, verify Node (192.168.99.2/30) can ping gateway (192.168.99.1/30) but Node cannot go outside the 192.168.99.0/30 subnet (Node should continue to have no Internet connectivity at this step).

Step 2: Enable Packet Forward and Masquerade on Gateway

Do this step to ensure packets originating from, and destined for, Node can hop across the two gateway network segments (enp0s3 on Gateway is connected to the Internet whereas enp0s8 on Gateway is connected to Node).

Gateway

iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
cat /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/ip_forward
cat /proc/sys/net/ipv4/ip_forward

Step 3: Add route rule on Node to use Gateway as default

Do this step to ensure Node always knows where to send its packets.

Node

ip route add default via 192.168.99.1 dev enp0s8

Step 4: Enable name resolution lookup on Node

Do this step to ensure Node knows which nameservers to contact when it needs to translate domain names (such as debian.org) to their IP values.

Node

  • Create (or edit) the domain name server lookup file and put these lines into /etc/resolv.conf
    cat /etc/resolv.conf
    
    nameserver 1.1.1.1
    nameserver 8.8.8.8
    
    # nameservers for Seneca VPN (FOR REFERENCE ONLY. DO NOT ADD)
    # nameserver 10.101.100.21
    # nameserver 10.101.100.22
    

Step 5: Verify Internet connectivity available on Node

getent ahosts debian.org

Reference Screen Capture

A working version of the 2-Host CIDR/30 192.168.99.0 network should be similar to this GW (gateway) and ND (node) setup.

Practice Questions

NOTE: Answers to the configuration questions are to be based on what you would enter on the command line only, i.e. without making any changes to any files in /etc irrespective of whether you are working on the node or on the gateway.


  1. What does the CIDR acronym mean? What problem does CIDR solve and how does CIDR solve that problem?


  2. What is the smallest multi-host network using the CIDR notation? How many additional hosts does this smallest multi-host CIDR network have in comparison to CIDR's glue network?


  3. What does the term network routing mean? In the lab above which of the two hosts was configured to route its packets to the other? Why?


  4. Using a one-line ip command, display the routing table. In the output, of the routing table, you get how would you identify the gateway IP?


  5. Examine the sample output, shown below, of ip route

    192.168.0.0/24 dev wlan0 proto kernel scope link src 192.168.0.221
    

    In the output shown, is there a gateway IP assigned? If so, what is its value? If no gateway IP was assigned, write an ip route command to assign a gateway IP (HINT: You may use any IP you want for the gateway provided its value is usable on the same subnet as the sample output).


  6. What two commands would you use to make host 192.168.99.1/30 a gateway.


  7. After you ran the two commands in question #6 above, what two different commands will you use to confirm that host 192.168.99.1/30 has become a gateway? Where would you run those commands (on the gateway or on the node)? Why? What commands will you use on the node to confirm that the gateway is setup correctly and running? What command will you use on the gateway to confirm that it is the gateway and forwarding packets?


  8. You are asked to configure a small ad hoc intranet 192.168.3.0/28 having one gateway with four nodes, briefly describe the steps you would take to create that network. What values will you use for the four nodes and the gateway and write the commands you would execute on each node and gateway.


  9. What does term packet forwarding mean? How will you confirm packet forwarding has been implemented? Why was it necessary to be done on the gateway and not the node? What would happen if packet forwarding was implemented on the node as well as the gateway - would the node still be able to connect to the Internet? Now what happens if packet forwarding was only done on the node, not the gateway, would the node be able to connect to the Internet?


  10. In the iptables command used above, what does POSTROUTING and MASQUERADE mean? Why was that step necessary to make 192.168.99.1/30 a gateway? What is the iptables command generally used for?
Last Updated: 2020-Oct-30 Fri 22:37