Private IP address

What is private IP address:

• A private IP address is an IP address that's reserved for internal use behind a router or other Network Address Translation (NAT) device, apart from the public.

Which IP Addresses Are Private?

• The Internet Assigned Numbers Authority (IANA) reserves the following IP address blocks for use as private IP addresses:
• 10.0.0.0 to 10.255.255.255     ==> 16 million addresses
• 172.16.0.0 to 172.31.255.255    ==> 1 million addresses
• 192.168.0.0 to 192.168.255.255   ==>  65,000
• Another range of private IP addresses is 169.254.0.0 to 169.254.255.255, but those addresses are for Automatic Private IP Addressing (APIPA) use only.
• In 2012, the IANA allocated 4 million addresses of 100.64.0.0/10 for use in carrier-grade NAT environments.

Why using Private IP address:

• IP address are limited, so private IP addresses provide an entirely separate set of addresses that still allow access on a network but without taking up a public IP address space.

Reserved IP Addresses

• Another set of IP addresses that are restricted even further are called reserved IP addresses.
• These are similar to private IP addresses in the sense that they can't be used for communicating on the greater internet, but they're even more restrictive than that.
• The most famous reserved IP is 127.0.0.1. This address is called the loopback address and is used to test the network adapter or integrated chip.  
• Technically, the entire range from 127.0.0.0 to 127.255.255.255 is reserved for loopback purposes but you'll almost never see anything but 127.0.0.1 used in the real world.
• Addresses in the range from 0.0.0.0 to 0.255.255.255 are also reserved but don't do anything at all. If you're even able to assign a device an IP address in this range, it will not function properly no matter where on the network it's installed.

Source:
     https://www.lifewire.com/what-is-a-private-ip-address-2625970

Kernel: kernel running process or module details, conntrack & iptables

• Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system.
• A module can be configured as built-in or loadable.
• To create a kernel moduld, you can read The Linux Kernel Module Programming Guide
• A module can be configured as built-in or loadable. 
•  For example,
• One type of module is the device driver, which allows the kernel to access hardware connected to the system.
• Without modules, we would have to build monolithic kernels and add new functionality directly into the kernel image.
• Besides having larger kernels, this has the disadvantage of requiring us to rebuild and reboot the kernel every time we want new functionality.

Example:

:~$ lsmod | grep conn
nf_conntrack_ipv4      16384  1
nf_defrag_ipv4         16384  1 nf_conntrack_ipv4
nf_conntrack          106496  3 nf_nat,nf_nat_ipv4,nf_conntrack_ipv4

:~$ lsmod | grep iptab
iptable_nat            16384  1
nf_nat_ipv4            16384  1 iptable_nat
iptable_filter         16384  0
ip_tables              28672  2 iptable_filter,iptable_nat
x_tables               36864  4 ip_tables,xt_tcpudp,iptable_filter,xt_REDIRECT

~$ lsmod | grep nat
nf_nat_redirect        16384  1 xt_REDIRECT
iptable_nat            16384  1
nf_nat_ipv4            16384  1 iptable_nat
nf_nat                 24576  2 nf_nat_redirect,nf_nat_ipv4
nf_conntrack          106496  3 nf_nat,nf_nat_ipv4,nf_conntrack_ipv4
ip_tables              28672  2 iptable_filter,iptable_nat

machine:~$ modinfo nf_conntrack
filename:       /lib/modules/3.19.0-25-generic/kernel/net/netfilter/nf_conntrack.ko
license:        GPL
srcversion:     87BEFE2F26ECB852F6EF9EC
depends:
intree:         Y
vermagic:       3.19.0-25-generic SMP mod_unload modversions
signer:         Magrathea: Glacier signing key
sig_key:        6A:AA:11:D1:8C:2D:3A:40:B1:B4:DB:E5:BF:8A:D6:56:DD:F5:18:38
sig_hashalgo:   sha512
parm:           tstamp:Enable connection tracking flow timestamping. (bool)
parm:           acct:Enable connection tracking flow accounting. (bool)
parm:           nf_conntrack_helper:Enable automatic conntrack helper assignment (default 1) (bool)
parm:           expect_hashsize:uint

:~$ modinfo ip_tables
filename:       /lib/modules/3.19.0-25-generic/kernel/net/ipv4/netfilter/ip_tables.ko
description:    IPv4 packet filter
author:         Netfilter Core Team <coreteam@netfilter.org>
license:        GPL
srcversion:     44A16130862F8CA2ECA59D9
depends:        x_tables
intree:         Y
vermagic:       3.19.0-25-generic SMP mod_unload modversions
signer:         Magrathea: Glacier signing key
sig_key:        6A:AA:11:D1:8C:2D:3A:40:B1:B4:DB:E5:BF:8A:D6:56:DD:F5:18:38
sig_hashalgo:   sha512

machine:~$ modinfo nf_nat
filename:       /lib/modules/3.19.0-25-generic/kernel/net/netfilter/nf_nat.ko
license:        GPL
srcversion:     A7C7F33E2B7EFD16A2534DF
depends:        nf_conntrack
intree:         Y
vermagic:       3.19.0-25-generic SMP mod_unload modversions
signer:         Magrathea: Glacier signing key
sig_key:        6A:AA:11:D1:8C:2D:3A:40:B1:B4:DB:E5:BF:8A:D6:56:DD:F5:18:38
sig_hashalgo:   sha512

ftp server on ubuntu (vsftpd)

FTP server on Ubuntu

FTP server:

To install:

sudo apt install vsftpd

Anonymous FTP Configuration:

• Go to this file sudo vi  /etc/vsftpd.conf  and change below

 anonymous_enable=Yes

File location:

cd /srv/ftp/

•  copy our file into above location.
• To restart the vsfpd server:

 sudo service vsftpd restart

 If we restart then only anonymous user will be take effect

From Client:

To connect:

ftp 172.31.141.47
username: anonymous
pwd   is just give enter(empty string)

------- snip ---------
Connected to 172.31.141.47.
220 (vsFTPd 3.0.2)
Name (172.31.141.47:labuser): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>
------------------ snip -------------

Command:

 ls -> to list remove server file
 !ls -> to list client VM file list.
 get file.txt  -> To download the file
 put file.txt  -> To upload the file to the server.

--------- snip of get ----------
ftp> get 210
local: 210 remote: 210
200 PORT command successful. Consider using PASV.
150 Opening BINARY mode data connection for 210 (45219860 bytes).
226 Transfer complete.
45219860 bytes received in 3.90 secs (11335.1 kB/s)
ftp>
--------- snip of get ----------

How firefox is working & know the DNS ?

How firefox is working & know the DNS ?

• How firefox know the DNS ?

• /etc/resolv.conf file is used to inform to firefox about the DNS server ip address.
• This file contain the list of DNS IP address, using this IP address firefox send the DNS request to get the IP for given web page(Eg: google.com)
• resolv.conf is the name of a computer file used in various operating systems to configure the system's Domain Name System (DNS) resolver.

• How firefox is working:

• While user give "google.com" and enter, first it will check the cache, if it cache contain this then load from cache.
• Suppose first time we are giving, then cache dont have this information.
• So it tries to resolve the "google.com" string into an IP address,
• To conver IP address, firefox uses the DNS protocol,
• As mentioned above it will get the DNS IP address and request DNS for google IP address.
• Once it get the google.com IP address, then it will start the session to that IP address using TCP syn,
• Google will reply back with Ack+syn,
• Again firefox replay the ACK, now 3 way handshake is over and it will get the page from google and will load.
• Usually google.com doesn't give only one flow, many flows (connnection) will be used to load the single google page.

How to list and delete IPtables

How to list and delete iptables

• To delete Input rules:
• iptables -L -n -v --line-number
• For example, if we want to delete the input rule that drops invalid packets, we can see that it's rule 3 of the INPUT chain. So we should run this command:
• iptables -D INPUT 3
• To delete POSTROUTING:
• iptables -t nat -L -n -v --line-number
• iptables -t nat -D POSTROUTING 2
• --------------- snip -----------
• • Chain POSTROUTING (policy ACCEPT 57 packets, 4044 bytes)
  • num   pkts bytes target     prot opt in     out     source               destination
  • 1      670 42596 SNAT       all  --  *      br2     0.0.0.0/0            0.0.0.0/0            to:172.30.13.90
  • 2        0     0 SNAT       tcp  --  *      *       0.0.0.0/0            192.168.1.254        tcp dpt:80 to:192.168.1.99
• ---------------snip ----------------
• The above place line 2 is deleted.

Command to list the IPtables:

• iptables -L -v
• iptables -L
• iptables -L -n  => For INPUT, FORWARD and OUTPUT-chains
• iptables -L -t nat
• iptables -t nat -L -n -v  -> to View nat rules
• 
  

How to specify particular source address & port in iptables

How to specify particular source address & port in iptables:

• Source ip (-s)
• -s, --source address[/mask][,...]
• Destination (-d)
• -d, --destination address[/mask][,...]
• Source Port:
• --source-port,--sport [!] port[:port]
• Destination port:
• --destination-port,--dport [!] port[:port]
• protocol
• -p <protocol name, tcp, udp, icmp> 

Example:

iptables -t nat -A PREROUTING -p tcp -s 192.168.1.99 --sport 58902 -d 173.223.52.123 --dport 80 -j DNAT --to-destination 192.168.1.254:80

what is tuples

What is tuples

• A `tuple' is a structure containing the information to uniquely identify a connection.
• ie. if two packets have the same tuple, they  are in the same connection; if not, they are not.
• A 5-tuple refers to a set of five different values that comprise a Transmission Control Protocol/Internet Protocol (TCP/IP) connection. It includes a source IP address/port number, destination IP address/port number and the protocol in use
• Protocol(tcp or  udp), src ip & port, dst ip & port.
• It used in the ip tables to identify the unique connections & can able to redirect that connection. 
• Eg: iptables -t nat -A PREROUTING -p tcp -s 192.168.1.99 --sport 58902 -d 173.223.52.123 --dport 80 -j DNAT --to-destination 192.168.1.254:80