-
Notifications
You must be signed in to change notification settings - Fork 0
Topic Ideas
This project would focus on connecting to the DN42 distributed VPN, which is a project used to learn advanced networking concepts like you might see at an ISP-level.
I have spent years learning and experimenting with networking, from basic routing to tunneling IPv6 traffic, and using complex VLAN topologies and software-defined networking to build up single-purpose networks and host services on them. But some concepts have been out of reach in my networks, including internetworking. One of the main purposes of DN42, which is already fairly mature including major peers supporting substantial throughput, is to provide a playground to learn and deploy complex interconnected networks using VPNs like Wireguard to simulate physical connections between peers, with BGP and supporting services running on top of it to, among other things, prevent BGP hijacking.
Besides the somewhat complicated administrative overhead of registering for address space and finding willing nearby peers with enough capacity, I would need to set up a router with VPN capabilities, connect it to said peers, and configure BGP route sharing. In addition, I would set up supporting services like an ROA signature validator to prevent BGP hijacking (accidental or otherwise). From there, I could deploy test services (like a BGP looking glass) and end devices to connect to other networks and allow connections to my own.
There is also some potential for this project to be continued by another student, or at least for my documentation to help with another new deployment. While connecting to DN42 has little practical use for production services since it's only available to other DN42 members, it can continue to be expanded upon with enhancements like automation, high availability, and new and innovative services available to the rest of the network.
This project would focus on creating a tool to automate management of firewall rulesets across vendors, much like DNSControl does for DNS.
As I've worked with fancier networking concepts like VLANs, it's become abundantly clear that firewall management becomes more and more difficult when traffic has to pass through multiple devices, especially those of different vendors. Updating rulesets to allow traffic to pass through several hops requires multiple manual steps using different syntax, often resulting in errors due to sheer difficulty understanding how traffic will flow, especially with multiple sources and destinations. As an example, while I used to whitelist which IPs could connect to management ports on my servers, as more devices were added I found myself consistently having to go back and deploy new rules on different platforms such as VyOS, different forms of iptables, and using features which were differently configured or not available such as ipsets. As a result, I no longer whitelist IPs, instead relying only on the underlying authentication capabilities of SSH.
My goal with this project is to simplify and centralize firewall rules into a single syntax designed not around what a single interface's ACL should be, but how traffic should flow throughout a network. This would also require custom modules using vendor APIs and SDKs to support deploying to various firewall hardware and software, taking into account varying levels of support for some features like groups of IP addresses. This would not be an easy challenge, with one of the most difficult parts being how to represent complex networks in a configuration file, and how to convert this format into rulesets for each individual device. This project would likely be written in either Go or Python, making use of existing vendor libraries where possible.