Testing Firewalls and Web Proxies - Revision history

Tredmond: /* Dealing with a pesky apple */

2013-07-12T22:41:44Z

‎Dealing with a pesky apple

Tredmond: /* Dealing with a pesky apple */

2013-07-12T22:40:20Z

‎Dealing with a pesky apple

Tredmond: /* Dealing with a pesky apple */

2013-07-12T22:38:17Z

‎Dealing with a pesky apple

Tredmond: /* Configuring the firewall */

2013-07-12T21:50:03Z

‎Configuring the firewall

Tredmond: /* Testing firewalls and proxies by using a virtual network */

2013-07-12T21:45:14Z

‎Testing firewalls and proxies by using a virtual network

Tredmond: /* Testing firewalls and proxies by using a virtual network */

2013-07-12T21:44:46Z

‎Testing firewalls and proxies by using a virtual network

Tredmond: /* Dealing with a pesky apple */

2013-07-12T21:39:58Z

‎Dealing with a pesky apple

Tredmond: /* Dealing with a pesky apple */

2013-07-12T21:38:25Z

‎Dealing with a pesky apple

Tredmond: /* Dealing with a pesky apple */

2013-07-12T21:12:47Z

‎Dealing with a pesky apple

Tredmond: /* Dealing with a pesky apple */

2013-07-12T21:11:49Z

‎Dealing with a pesky apple

← Older revision		Revision as of 22:41, July 12, 2013
Line 32:		Line 32:
	== Dealing with a pesky apple ==		== Dealing with a pesky apple ==

−	''Note: it should be possible to simplify this example considerably. The entire setup should work on a single machine where the virtual firewall has a real network device as its red side and a virtual network device on the green side that is seen by the host machine. I was able to get it working this far but then the mac doesn't configure and use the green virtual network device.''	+	''Note: it should be possible to simplify this example considerably. The entire setup should work on a single machine where the virtual firewall has a real network device as its red side and a virtual network device on the green side that is seen by the host machine. I was able to get it working this far but then the mac doesn't configure and use the green virtual network device. Knowing the right command line calls to get the virtual network working and routing would probably get this proposal working.''

← Older revision		Revision as of 22:40, July 12, 2013
Line 32:		Line 32:
	== Dealing with a pesky apple ==		== Dealing with a pesky apple ==

−	''Note: it should be possible to simplify this example considerably. The entire setup should work on a single machine where the virtual firewall has a real network device as its red side and a virtual network device on the green side that is ~~how~~ the host machine ~~connects to the internet~~. I was able to get it working this far but then the mac doesn't configure and use the green virtual network device.''	+	''Note: it should be possible to simplify this example considerably. The entire setup should work on a single machine where the virtual firewall has a real network device as its red side and a virtual network device on the green side that is seen by the host machine. I was able to get it working this far but then the mac doesn't configure and use the green virtual network device.''

← Older revision		Revision as of 22:38, July 12, 2013
Line 31:		Line 31:

	== Dealing with a pesky apple ==		== Dealing with a pesky apple ==
		+
		+	''Note: it should be possible to simplify this example considerably. The entire setup should work on a single machine where the virtual firewall has a real network device as its red side and a virtual network device on the green side that is how the host machine connects to the internet. I was able to get it working this far but then the mac doesn't configure and use the green virtual network device.''
		+

	At one time I bought a copy of Mountain Lion explicitly so that I could create a virtual machine, as seemed to be allowed by the license, and use this virtual machine for testing the mac. But I had a great deal of difficulty in getting this virtual machine to work and there didn't seem to be much support. However, even without being able to run the mac in a virtual machine it is still possible to test the mac in this way. The key is the realization that it is possible for a virtual firewall to be the firewall for a real world machine. I had my doubts but it really does work and this is probably obvious to many people who are more sophisticated than I am. One caveat is that I have only done this with VirtualBox, so while I assume that more or less the same thing can be done with vmware I don't know this for a fact.		At one time I bought a copy of Mountain Lion explicitly so that I could create a virtual machine, as seemed to be allowed by the license, and use this virtual machine for testing the mac. But I had a great deal of difficulty in getting this virtual machine to work and there didn't seem to be much support. However, even without being able to run the mac in a virtual machine it is still possible to test the mac in this way. The key is the realization that it is possible for a virtual firewall to be the firewall for a real world machine. I had my doubts but it really does work and this is probably obvious to many people who are more sophisticated than I am. One caveat is that I have only done this with VirtualBox, so while I assume that more or less the same thing can be done with vmware I don't know this for a fact.

@@ Line 22: / Line 22: @@
 Now, for this particular test we want to configure the firewall to deny outgoing web requests but to provide a proxy for those web requests.  We can configure the firewall by using a very nice web interface to the firewall from any virtual machine on the green network.  When the endian firewall starts up, it displays a nice message telling us what web address to use to manage the firewall: ''Management URL: https://192.168.0.15:10443'' and this is the url that we use to connect to the firewall.  If you use my preconfigured virtual endian firewall then the username is admin and the password is vmproxynet.  Otherwise the user name and password are as you configured them when you set up the firewall.  I made the following changes:
-* I went to the firewall tab and then clicked "Outgoing traffic".  From there I disabled the two firewall rules that allowed outgoing http and https traffic.  As a result of this, machines on the green network are no longer able to access web pages and Protege will not be able to access many ontologies on the web including the proverbial pizza ontology.
+* I went to the firewall tab and then clicked "Outgoing traffic".  From there I disabled the two firewall rules that allowed outgoing http and https traffic.  As a result of this, machines on the green network are no longer able to access web pages from the internet and Protege will not be able to access many ontologies on the web including the proverbial pizza ontology.
 * I went to the Proxy tab and enabled a non-transparent http proxy on port 8080.
 At this point it should be possible to test the configuration with a web browser on the green network.  By default, the web browser should not be able to access web sites such as google.com because web access is being blocked by the browser.  However, if the browser is configured to use the proxy at 192.168.0.15:8080 then web access should resume working because the http proxy on the firewall is providing access to external web pages.

← Older revision		Revision as of 21:45, July 12, 2013
Line 3:		Line 3:


−	Occasionally we get questions from people who are behind a firewall. In the past, we have had no way to simulate and test how Protege behaves in their environment and so our answers on the mailing list have been somewhat limited. But with a virtualization software such as vmware or VirtualBox, it is not too difficult to simulate such a network configuration and test how Protege behaves. In this particular case, I think that it is even possible to work with Mac OS X, which can be difficult platform for developers to work with. The network that we are trying to create should look something like the diagram below:	+	Occasionally we get questions from people who are behind a firewall. In the past, we have had no way to simulate and test how Protege behaves in their environment and so our answers on the mailing list have been somewhat limited. But with a virtualization software such as vmware or VirtualBox, it is not too difficult to simulate such a network configuration and test how Protege behaves. In this particular case, I think that it is even possible to work with Mac OS X, which can be difficult platform for developers to work with. The virtual network that we are trying to create should look something like the diagram below:

	[[File:TestingFirewallsVirtualNetwork.png]]		[[File:TestingFirewallsVirtualNetwork.png]]

← Older revision		Revision as of 21:44, July 12, 2013
Line 3:		Line 3:


−	Occasionally we get questions from people who are behind a firewall. In the past, we have had no way to simulate and test how Protege behaves in their environment and so our answers on the mailing list have been somewhat limited. But with a virtualization software such as vmware or VirtualBox, it is not too difficult to simulate such a network configuration and test how Protege behaves. In this particular case, I think that it is even possible to work with Mac OS X, which ~~is a generally~~ difficult platform for developers to work with~~. In this case the problem is that os x does not run very well in virtual machine~~. The network that we are trying to create should look something like the diagram below:	+	Occasionally we get questions from people who are behind a firewall. In the past, we have had no way to simulate and test how Protege behaves in their environment and so our answers on the mailing list have been somewhat limited. But with a virtualization software such as vmware or VirtualBox, it is not too difficult to simulate such a network configuration and test how Protege behaves. In this particular case, I think that it is even possible to work with Mac OS X, which can be difficult platform for developers to work with. The network that we are trying to create should look something like the diagram below:

	[[File:TestingFirewallsVirtualNetwork.png]]		[[File:TestingFirewallsVirtualNetwork.png]]

@@ Line 39: / Line 39: @@
 * Virtualization software on the machine-b together with the endian firewall virtual machine.
 The configuration that we are trying to achieve looks something like this:
 [[File:TestingFirewallsVirtualOverReal.png]]

@@ Line 38: / Line 38: @@
 * Another computer (machine-b) with two network ports, one of which can be connected to machine-a (this means that you might need a cable also) and one which is connected to the internet.  In my experiment, machine-b was a laptop which connected to the internet through a wireless network and which would eventually connect to machine-a with a wired network.
 * Virtualization software on the machine-b together with the endian firewall virtual machine.
 I did the following steps (which hopefully work for you):
 # I connected machine-b to the internet.

@@ Line 39: / Line 39: @@
 * Virtualization software on the machine-b together with the endian firewall virtual machine.
 I did the following steps (which hopefully work for you):
-# I connectedmachine-b to the internet.
+# I connected machine-b to the internet.
-# I connected network cable between the machine-a and machine-b.
+# I connected a network cable between the machine-a and machine-b.
 # I made sure that the machine-b was not using the network device that was connected to the machine-a
 # I changed the VirtualBox settings of the virtual endian firewall on machine-b so that the green network was a bridged adapter to the network device that connects to the mac.

@@ Line 35: / Line 35: @@
 You will need the following things:
-* A mac running some version of OS X (hopefully the version that you want to test).
+* A mac (machine-a) running some version of OS X (hopefully the version that you want to test).
-* Another computer with two network ports, one of which can be connected to the mac (this means that you might need a cable also) and one which is connected to the internet.  In my experiment, this computer was a laptop which connected to the internet through a wireless network and which would eventually connect to the mac with a wired network.
+* Another computer (machine-b) with two network ports, one of which can be connected to machine-a (this means that you might need a cable also) and one which is connected to the internet.  In my experiment, machine-b was a laptop which connected to the internet through a wireless network and which would eventually connect to machine-a with a wired network.
 I did the following steps (which hopefully work for you):