-
Notifications
You must be signed in to change notification settings - Fork 0
Topic Ideas
This project would focus on connecting to the DN42 distributed VPN, which is a project used to learn advanced networking concepts like you might see at an ISP-level.
I have spent years learning and experimenting with networking, from basic routing to tunneling IPv6 traffic, and using complex VLAN topologies and software-defined networking to build up single-purpose networks and host services on them. But some concepts have been out of reach in my networks, including internetworking. One of the main purposes of DN42, which is already fairly mature including major peers supporting substantial throughput, is to provide a playground to learn and deploy complex interconnected networks using VPNs like Wireguard to simulate physical connections between peers, with BGP and supporting services running on top of it to, among other things, prevent BGP hijacking.
Besides the somewhat complicated administrative overhead of registering for address space and finding willing nearby peers with enough capacity, I would need to set up a router with VPN capabilities, connect it to said peers, and configure BGP route sharing, as well as deploy supporting services like an ROA signature validator to prevent BGP hijacking (accidental or otherwise). From there, I could deploy test services (like a BGP looking glass) and end devices to connect to other networks and allow connections to my own.
There is also some potential for this project to be continued by another student, or at least for my documentation to help with another new deployment. While connecting to DN42 has little practical use like hosting production websites, it can continue to be expanded upon with enhancements like automation, high availability, and new and innovative services available to other DN42 members.
This project would focus on creating a tool to automate management of firewall rulesets across vendors, much like DNSControl does for DNS.
As I've worked with fancier networking concepts like VLANs, it's become abundantly clear that firewall management becomes more and more difficult when traffic has to pass through multiple devices, especially those of different vendors. Updating the rulesets to allow traffic to pass through several hops requires multiple manual steps using different syntax, often resulting in errors due to complexity, especially with multiple sources and destinations. As an example, while I used to whitelist which IPs could connect to management ports to administer a particular server, as more devices were added I found myself consistently having to deploy new rules on different platforms such as VyOS, iptables, and custom implementations that used features like ipset, where other implementations did not offer such a simple solution.
My goal with this project is to simplify and centralize the core concepts of firewall rules into a single syntax designed not around what a single interface's ACL should be, but how that ACL fits into the flow of traffic through it and other devices. This would also require custom modules to support deploying to various firewall hardware and software, taking into account varying levels of support for some features like groups of IP addresses. This would not be an easy challenge, with one of the most difficult parts being how to represent complex networks in a configuration file format, and how to convert this format into rulesets for each individual device. Beyond that, adding vendor support using various APIs and SDKs would be no simple challenge, either.