CloudLabBox
Try the free demo

Linux for network engineers lab 14 of 14

Capstone: a Linux edge with firewall, services and VPN

You build a whole site edge on Linux from a list of requirements: routing, DHCP and DNS, a default-deny firewall, NAT with a VPN exemption, a published server, and an IPsec tunnel to a branch written by hand with ip xfrm.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 3,584 MB in total. That fits the free demo too.

In your workspace: Shared, then Linux for network engineers guided labs, then 14 - Capstone - a Linux edge with firewall services and VPN

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 120 minutes
Nodes need
6 vCPU, 3,584 MB
Smallest plan
Lite

The scenario

Kestrel has bought a small rival and is moving its Lincoln site to Linux. You've done every part of this in earlier labs, and now it all goes on one box, EDGE, with a tunnel to the new branch router BR. The requirements below are all you get. The addresses are fixed, and the design is yours, though the solution shows one way that works.

Requirements

  • LAN PCs get addresses and DNS from EDGE. H1 always gets 10.14.10.99.
  • portal.kestrel.lab is SRV, branch.kestrel.lab is WS.
  • LAN PCs reach the Internet on TCP 80 and 443 and can ping, all through the one public address.
  • LAN PCs reach SRV on TCP 80.
  • Anyone on the Internet reaches SRV on TCP 80 at 203.0.113.2.
  • The LAN and the branch LAN talk freely over an encrypted tunnel.
  • The branch uses EDGE's DNS over the tunnel.
  • EDGE answers nothing from the Internet except ESP from BR.
  • Everything else is dropped, and drops through EDGE are logged.
DeviceInterfaceAddressRole
EDGEeth010.14.10.1/24head office LAN
EDGEeth110.14.20.1/24DMZ
EDGEeth2203.0.113.2/30public side, gateway .1
H1eth0DHCP, reserved 10.14.10.99LAN PC
SRVeth010.14.20.10/24web server, gateway .1
ISPGi0/0, Gi0/1, Lo0203.0.113.1/30, 198.51.100.1/30, 192.0.2.1/32the provider; 192.0.2.1 stands for the Internet
BReth0198.51.100.2/30public side, gateway .1
BReth110.14.30.1/24branch LAN
WSeth010.14.30.50/24branch workstation
DeviceRunsHow to log in
WSUbuntu 22.04 desktop containerIts console is a remote desktop: root / eve. Open a terminal there.
H1, SRVAlpine Linux 3.20root, no password.
ISPCisco IOSv 15.9The console opens at >; enable has no password.
EDGE, BRAlpine Linux 3.16 with iptables and iproute2Opens on a menu: press 5, then Enter, for a root shell.

What you’ll practise

  • Plan and build a Linux edge from a requirements list
  • Serve DHCP and DNS from the edge and protect them
  • Write a default-deny policy for the box and for traffic through it
  • Combine masquerade, DNAT and a NAT exemption
  • Build ESP tunnel mode with ip xfrm and read its state
  • Test what should fail as well as what should work

The tasks

  1. Start the Linux nodes
  2. Build the routers
  3. Run the head-office services
  4. Write the firewall policy
  5. Add NAT, with one exception
  6. Build the VPN
  7. Prove it and save it

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Capstone - a Linux edge with firewall services and VPN6 nodes, 5 links. Every link is listed as text below the diagram.WSH1SRVISPEDGEBReth1eth0Gi0/1eth0eth2Gi0/0eth1eth0eth0eth0
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • EDGE eth0 to H1 eth0
  • EDGE eth1 to SRV eth0
  • EDGE eth2 to ISP Gi0/0
  • ISP Gi0/1 to BR eth0
  • BR eth1 to WS eth0
Nodes in Capstone: a Linux edge with firewall, services and VPN, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
WSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
SRVAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
EDGEAlpine WAN emulatorclbalpinewanem-alpine-3-16-2-wanem1 vCPU, 512 MB
BRAlpine WAN emulatorclbalpinewanem-alpine-3-16-2-wanem1 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Linux for network engineers guided labs.

  3. Open 14 - Capstone - a Linux edge with firewall services and VPN and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Linux for network engineers labs

All Linux for network engineers labs

Related labs in other courses

CloudLabBox is independent of Cisco, CompTIA, the Linux Foundation and the Linux Professional Institute. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.