Install tcpdump and iptables packages on uml virtual machines

The UML vritual machines on fc1uml comes with minimum software packages (a bare bone machine). Since they installed with Slackware Linux system, additional softare packages can be downloaded from slackware site ftp://ftp.slackware.com/pub/slackware/slackware-9.1/slackware/n/
To debug the network connections and find out what a machine sends and whether a machine receiver certain packets, we need packet sniffer such as Ethereal or tcpdump. They are based on pcap (packet capture library) developed at LNL.
Since those UML virtual machines do not include X windows for GUI, we will install tcpdump which is text-based.
The tcpdump package version on slackware.com site for slackware 9.1 is tcpdump-3.7.2-i386-1.tgz
To setup firewall or DNAT/SNAT on a linux router, we can use the iptables packages from netfilter.org. http://www.netfilter.org/
The iptables packages for slackware 0.1 is iptables-1.2.8-i486-1.tgz
We will download and install these two packages on fc1uml virtual machines to help answer questions in part 1 of hw3
For security reason, the fc1uml only has local-only network connection, therefore we do not have direct network connection to transfer files from Internet.
Also accessing file share on local host was not supported for Linux virtual machines on VPC2004.
To copy these two packages to fc1uml, we need to

download these two packages to the c:/student/ file share on the XP host in EAS 138 from the above site, or from local site http://cs.uccs.edu/~cs522/hw/hwF2004/fc1uml/slackware/
start fc1uml. Make sure the eth0 is assigned with an ethernet address on the same "Local-Only" subnet as that of XPvm1. Use the following command:
ifconfig eth0 192.168.138.41
start XPvm1 which has file share support and can access those file in its S: drive which maps to c:/student/.
If the VPC2004 complains the memory is not enough to start XPvm1, change the ram_size tag value from 400 to 300 in the XPvm1.vmc configuration file in c:\Virtual Machines\cs301\XPvm1\. It should allow XPvm1 to start.
Use ipconfig to double check the IP address assigned to the local connection. It should indicate 192.168.138.1. If not, select Start | Control Pannel | Network and Internet Connections | Network Connections | Local Area Connection | Properties | Internet Protocol (TCP/IP) | Properties and then select "Use the following address" Enter 192.168.138.1 as IP address and 255.255.255.0 as subnet mask.
Start the Cygwin window by double click its icon on the desktop of XPvm1.
type "cd S:" to get the student file share directory. You should see the two packages already downloaded there.
type "scp *.tgz root@192.168.138.41:.". Enter the root password of fc1uml when asked.

To install the two packages on UML virtual machines,
- start the UML virtual machines on fc1uml.
- login to those UML virtual amchines.
- set password by typing "passwd" and enter then confirm the new password. Let us use the same root password.
- from fc1uml root directory, type the following command to copy the software package to lamb
  scp *.tgz root@172.31.0.169:.
- scp *.tgz root@172.31.0.159:.
  for bilbo
- scp *.tgz root@172.31.0.172:.
  for b2b
- scp *.tgz root@172.31.0.174:.
  for frodo
- In the root directory of each virtual machine, type the following two commands to install tcpdump and iptables:
  installpkg tcpdump-3.7.2-i386-1.tgz
  installpkg iptables-1.2.8-i486-1.tgz
- You should see the description of package when it is successfully installed.
- To monitor the packet flow on an ethernet interface say ethn, type "tcpdump -i ethn"
- It will print out the time, source IP, destination IP, protocol type and brief description of the packet payload
For Question c, you can use tcpdump -i eth1 on lamb and find out what packets were sent.
To setup and demonstrate DNAT using iptables, we will treat 10.0.1.0/24 as extranet, bilbo is external client. b2b is the firewall, 10.0.0.0/24 is DMZ LAN with lamb serve as a web server. For external clients, the 10.0.1.172:80 is the url for the web server for the site protected by b2b.

Type the following iptables command on b2b to set up the DNAT:

iptables -t nat -A PREROUTING -p TCP -i eth2 -d 10.0.1.172 --dport 80 -j DNAT --to-destination 10.0.0.169

The command specifies for any incoming packets at eth2 with destination IP=10.0.1.172 and TCP port 80 will be applied (j option for jump) with DNAT service and its destination IP address will be substituted with 10.0.0.169 and routed to lamb.

# The nat table can be displayed with the following command:

root@b2b:~# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- anywhere 10.0.1.172 tcp dpt:http to:10.0.0.169

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
We modify the default web page on each web server to contain "This is <machine name>" string for easy identification.
After you have setup the route as described in part 1 of hw3 and the above DNAT iptables command, you can enter "lyn 10.0.1.172" or "telnet 10.0.1.172 80" with "GET / HTTP/1.0 enter enter " as HTTP request to retrieve the default web page. It should indicate "This is lamb".
You can use tcpdump to verify that the destination IP address has been changed to 10.0.0.169 from 10.0.1.172 between eth2 and eth1 of b2b.