GSOC2012NetworkAddressTranslation - Revision history

Tomh: /* Project Contact */

2014-12-07T15:00:40Z

Project Contact

← Older revision		Revision as of 15:00, 7 December 2014
Line 5:		Line 5:
	* Abstract: Implementing a solid working NAT model for the NS3 framework taking into account the different behavior that NAT exhibits in a network equipping the node to act as a successful network edge device, also giving way for further security (firewall) implementations. This would include reusing Netfilter implementation on NS3 to facilitate NAT and then implement NAT itself. This would mimic the Linux NAT model and have added extensions.		* Abstract: Implementing a solid working NAT model for the NS3 framework taking into account the different behavior that NAT exhibits in a network equipping the node to act as a successful network edge device, also giving way for further security (firewall) implementations. This would include reusing Netfilter implementation on NS3 to facilitate NAT and then implement NAT itself. This would mimic the Linux NAT model and have added extensions.
	* Mid-Term: https://www.nsnam.org/wiki/index.php/GSOC2012NetworkAddressTranslationMidTermReview		* Mid-Term: https://www.nsnam.org/wiki/index.php/GSOC2012NetworkAddressTranslationMidTermReview
	*Code Repo : http://code.nsnam.org/vsindhuja/ns-3-gsoc-nat/		* Final Review code: https://codereview.appspot.com/6454146/
			* Code Repo : http://code.nsnam.org/vsindhuja/ns-3-gsoc-nat/

	==Introduction==		==Introduction==

Vsindhuja: /* Project Contact */

2012-10-24T05:15:06Z

Project Contact

← Older revision		Revision as of 05:15, 24 October 2012
Line 5:		Line 5:
	* Abstract: Implementing a solid working NAT model for the NS3 framework taking into account the different behavior that NAT exhibits in a network equipping the node to act as a successful network edge device, also giving way for further security (firewall) implementations. This would include reusing Netfilter implementation on NS3 to facilitate NAT and then implement NAT itself. This would mimic the Linux NAT model and have added extensions.		* Abstract: Implementing a solid working NAT model for the NS3 framework taking into account the different behavior that NAT exhibits in a network equipping the node to act as a successful network edge device, also giving way for further security (firewall) implementations. This would include reusing Netfilter implementation on NS3 to facilitate NAT and then implement NAT itself. This would mimic the Linux NAT model and have added extensions.
	* Mid-Term: https://www.nsnam.org/wiki/index.php/GSOC2012NetworkAddressTranslationMidTermReview		* Mid-Term: https://www.nsnam.org/wiki/index.php/GSOC2012NetworkAddressTranslationMidTermReview
			*Code Repo : http://code.nsnam.org/vsindhuja/ns-3-gsoc-nat/

	==Introduction==		==Introduction==

Vsindhuja: /* Testing */

2012-08-21T07:34:00Z

Testing

← Older revision		Revision as of 07:34, 21 August 2012
Line 66:		Line 66:

	- Appropriate routing of the packet		- Appropriate routing of the packet

	- Packet filtering in place		- Packet filtering in place

	- Header fields in the packet updated as per netfilter and nat rules		- Header fields in the packet updated as per netfilter and nat rules

	~~- Connection tracking maintained~~

	- Checksum computation accuracy		- Checksum computation accuracy

Vsindhuja at 07:33, 21 August 2012

2012-08-21T07:33:31Z

← Older revision		Revision as of 07:33, 21 August 2012
Line 128:		Line 128:

	The above would translate the ip addresses from the 192.168.1.0/24 network to the ip 192.168.1.5 with ports between 49153 and 49163.		The above would translate the ip addresses from the 192.168.1.0/24 network to the ip 192.168.1.5 with ports between 49153 and 49163.

			==Open Issue Tracker==
			* Adding port pool options to Dynamic nat rather than translating to a single ip and port address translation
			* Adding checksum checks to the static and Dynamic Nat.
			* Adding test suite for dynamic Nat.

Vsindhuja at 07:32, 21 August 2012

2012-08-21T07:32:02Z

← Older revision		Revision as of 07:32, 21 August 2012
Line 127:		Line 127:
	nat->AddDynamicRule (rule);		nat->AddDynamicRule (rule);

			The above would translate the ip addresses from the 192.168.1.0/24 network to the ip 192.168.1.5 with ports between 49153 and 49163.
	~~==Open Issue Tracker==~~

	* Need to consider what is the ~~proper way to generically handle different protocol types for which there is no conntrack helper (i~~.e. ~~not TCP or UDP)~~. ~~Presently, the code will NF_ACCEPT them.~~
	* Need to provide patches to code review without white space changes
	* NF_LOCAL_OUT wants an IP header to be attached to the ~~packet~~. ~~However, for unicast delivery, the function SendRealOut() is where the real header is appended~~. ~~As a result, if there is a mangle operation on the IP header, this header will not be saved~~. ~~this requires some refactoring of IPv4L3Protocol to allow the (mangled) header to be saved~~.

Vsindhuja at 07:29, 21 August 2012

2012-08-21T07:29:31Z

← Older revision		Revision as of 07:29, 21 August 2012
Line 108:		Line 108:

	The above rule would translate 192.168.2.3:80 in the private realm to 10.1.3.4:8080 in the public realm, for all protocols (last field is zero).		The above rule would translate 192.168.2.3:80 in the private realm to 10.1.3.4:8080 in the public realm, for all protocols (last field is zero).

			===Dynamic Nat Example===
			In order to configure the node to perform Dynamic Nat one would do the following:

			Follow the steps till setting the inside and outside interface as mentioned in the above example.

			The following code with set the address pool to which the dynamic nat translation would occur:

			nat->AddAddressPool (Ipv4Address ("192.168.1.5"), Ipv4Mask ("255.255.255.255"));

			The following code adds the port range to which the host would translate

			nat->AddPortPool (49153, 49163);

			The following rule would translate all the IP addresses in 192.168.1.0 network in a dynamic translation.

			Ipv4DynamicNatRule rule (Ipv4Address ("192.168.1.0"), Ipv4Mask ("255.255.255.0"));
			nat->AddDynamicRule (rule);


	==Open Issue Tracker==		==Open Issue Tracker==

Vsindhuja at 07:20, 21 August 2012

2012-08-21T07:20:21Z

← Older revision		Revision as of 07:20, 21 August 2012
Line 74:		Line 74:

	- Checksum computation accuracy		- Checksum computation accuracy

			==Usage==

			===Static Nat Example===
			NAT is a capability that is aggregated to a node that includes an IPv4 stack with Netfilter capability. From a user perspective, NAT is typically configured by creating the NAT object and adding rules to the table.

			The following are the steps of things to be done when converting a node to a NAT node:

			// obtain a node pointer "node"
			Ipv4NatHelper natHelper
			Ptr<Ipv4Nat> nat = natHelper.Install (node);

			Next, define the inside and the outside interfaces of the NAT. These are the interfaces between which the nat will be processed. The Ipv4Interface indices are used to refer to the NAT interfaces:

			nat->SetInside (1);
			nat->SetOutside (2);

			NAT is configured to block all traffic that does not match one of the configured rules. The user would configure rules next, such as follows:

			// specify local and global IP addresses
			Ipv4StaticNatRule rule (Ipv4Address ("192.168.1.1"), Ipv4Address ("203.82.48.100"));
			nat->AddStaticRule (rule);

			The following code will help printing the NAT rules to a file nat.rules from the stream:

			Ptr<OutputStreamWrapper> natStream = Create<OutputStreamWrapper> ("nat.rules", std::ios::out);
			nat->PrintTable (natStream);

			The above illustrates a typical example of a one to one static NAT. The other variant in the static nat rule for which the ports can be defined:

			Ipv4StaticNatRule rule2 (Ipv4Address ("192.168.2.3"), 80, Ipv4Address ("10.1.3.4"), 8080, 0);
			nat->AddStaticRule (rule2);

			The above rule would translate 192.168.2.3:80 in the private realm to 10.1.3.4:8080 in the public realm, for all protocols (last field is zero).

	==Open Issue Tracker==		==Open Issue Tracker==

Vsindhuja at 07:17, 21 August 2012

2012-08-21T07:17:05Z

← Older revision		Revision as of 07:17, 21 August 2012
Line 52:		Line 52:
	The design of NAT for ns-3 is basically divided into two main categories:		The design of NAT for ns-3 is basically divided into two main categories:

	- Static NAT: This type of NAT allows IP flows to be established in either direction. It is designed to perform host to host NAT and also has a variant to specify the nat for specific protocol and port. In practice,this type of NAT may be more often found in enterprise environments.		'''- Static NAT:''' This type of NAT allows IP flows to be established in either direction. It is designed to perform host to host NAT and also has a variant to specify the nat for specific protocol and port. In practice,this type of NAT may be more often found in enterprise environments.

	- Dynamic NAT: This type of NAT typically allows IP flows to be established only in one direction, from private address realm to public address realm. Often, multiple hosts may be multiplexed onto a single public IP address via port translation. The NAT state is dynamic and times out after a period of inactivity. In practice, this type of NAT may be more often found in home networks.		'''- Dynamic NAT:''' This type of NAT typically allows IP flows to be established only in one direction, from private address realm to public address realm. Often, multiple hosts may be multiplexed onto a single public IP address via port translation. The NAT state is dynamic and times out after a period of inactivity. In practice, this type of NAT may be more often found in home networks.

	===Testing===		===Testing===

Vsindhuja at 07:16, 21 August 2012

2012-08-21T07:16:12Z

← Older revision		Revision as of 07:16, 21 August 2012
Line 44:		Line 44:

	====Network Address Translation====		====Network Address Translation====
	Network address translation (NAT) is a process of altering the		Network address translation (NAT) is a process of altering the source/destination IP address of a packet in order to make it routable over a network. This is usually applied when packets are passed from a private address realm to a public network. Network address translation is also used in IP address hiding where hosts can be on the address behind the NAT device and cannot be directly reached from an external network. NAT also comes with a number of variants in terms of what fieldd of the packet is translated through the NAT (e.g.port numbers) or the directions of the NAT (e.g. unidirectional vs bidirectional).
	source/destination IP address of a packet in order to make it routable over
	a network. This is usually applied when packets are passed from a private
	address realm to a public network.
	Network address translation is also used in IP address hiding where hosts
	can be on the address behind the NAT device and cannot be directly
	reached from an external network. NAT also comes with a number of variants
	in terms of what fieldd of the packet is translated through the NAT (e.g.
	port numbers) or the directions of the NAT (e.g. unidirectional vs
	bidirectional).

	While NAT is mainly deployed for operational purposes (managing IP address		While NAT is mainly deployed for operational purposes (managing IP address space), the inclusion of simulation models of NAT may be helpful to developers of peer-to-peer applications for ns-3 who wish to evaluate the NAT traversal aspects of the application.
	space), the inclusion of simulation models of NAT may be helpful to developers
	of peer-to-peer applications for ns-3 who wish to evaluate the NAT traversal
	aspects of the application.

			The source code for this model lives in the directory src/internet/model.

			The design of NAT for ns-3 is basically divided into two main categories:

			- Static NAT: This type of NAT allows IP flows to be established in either direction. It is designed to perform host to host NAT and also has a variant to specify the nat for specific protocol and port. In practice,this type of NAT may be more often found in enterprise environments.

			- Dynamic NAT: This type of NAT typically allows IP flows to be established only in one direction, from private address realm to public address realm. Often, multiple hosts may be multiplexed onto a single public IP address via port translation. The NAT state is dynamic and times out after a period of inactivity. In practice, this type of NAT may be more often found in home networks.

	===Testing===		===Testing===

Vsindhuja at 07:12, 21 August 2012

2012-08-21T07:12:22Z

← Older revision		Revision as of 07:12, 21 August 2012
Line 24:		Line 24:
	The work will primarily be divided in two main parts:		The work will primarily be divided in two main parts:

	~~'''A.Building the~~ Netfilter Framework ~~'''~~		====Netfilter Framework====

	For the first part I am considering working off of the existing model that was proposed for performing a Netfilter and suiting it to the current ns3 version.		For the first part I am considering working off of the existing model that was proposed for performing a Netfilter and suiting it to the current ns3 version.