4. Network architecture

The honeypot environment is entirely IPv6-based, reflecting modern network standards and challenges. The IT infrastructure of The Boys features a robust and scalable architecture, designed to support both the production and distribution of digital content efficiently.

4.1 Network and Subnets

The network is divided into multiple Local Area Networks (LANs), each with a specific functional role. Below is an overview of the main LANs and their representation in the topological schema.

IPv6 addressing has been planned using the base prefix: 2a04::/56, which is then split into two main subnet groups through subnetting.

• The first macro subnet is dedicated to servers and hosts critical services such as DNS, web servers, and more. This subnet is further divided to allow for future scalability, yielding 16 subnets in total. Applied subnetting: 2a04:0:0:0::/60 → 2a04:0:0:f::/60 Currently, only three networks have been implemented:

  • LAN A: Internal corporate server network, providing secure access to critical internal resources.
  • LAN B: Internal corporate server network, supporting various operational functions within the organization.
  • LAN C: Public server network, accessible from the internet, hosting publicly reachable services.

• The second macro subnet is reserved for employee workstations. It is partitioned into a large number of subnets (up to 240 LANs) to support potential large-scale deployments. Applied subnetting: 2a04:0:0:10::/60 → 2a04:0:0:ff::/60 Currently active networks:

  • LAN S - System administrators' network, providing access to the two workstations of the administrators.
  • LAN D - Managers network, reserved for the executive team's workstations.
  • LAN O - General users network (others), accommodating other employees and their workstations.

• In addition to the above LANs, there are two management networks, which are simulated as VLANs to efficiently isolate and manage network traffic. System administrators can log in using SSH on these machines via their IPv6 link-local addresses as follows:

  • M1: Used for connecting servers. This network provides management access solely to devices within the server environment, allowing system administrators to perform maintenance and management tasks efficiently.

    Machine	IPv6 Link Local	Interface	LAN
    oldap	fe80::200:ff:fe00:a1	eth0	A
    syslog	fe80::200:ff:fe00:a2	eth0	A
    bind1	fe80::200:ff:fe00:a3	eth0	A
    wsa1	fe80::200:ff:fe00:b1	eth0	B
    mdb	fe80::200:ff:fe00:b2	eth0	B
    smb	fe80::200:ff:fe00:b3	eth0	B
    mxs	fe80::200:ff:fe00:b4	eth0	B
    wsa2	fe80::200:ff:fe00:c1	eth0	C
    wsn	fe80::200:ff:fe00:c2	eth0	C
    ovpn	fe80::200:ff:fe00:c3	eth0	C
    bind2	fe80::200:ff:fe00:c4	eth0	C

  • M2: Used for routers and switches. This network allows system administrators to connect for maintenance tasks. On these management networks, devices utilize only link-local IPv6 addresses. System administrators can connect via SSH for secure remote management.

    Machine	IPv6 Link Local	Interface	LAN
    fw	fe80::200:ff:fe00:X	eth0	-
    cisco	fe80::200:ff:fe00:X	eth0	A/B/C
    ciscos	fe80::200:ff:fe00:X	eth0	S
    ciscod	fe80::200:ff:fe00:X	eth0	D
    ciscoo	fe80::200:ff:fe00:X	eth0	O
    switcha	fe80::200:ff:fe00:X	eth0	A
    switchb	fe80::200:ff:fe00:X	eth0	B
    switchc	fe80::200:ff:fe00:X	eth0	C
    switchs	fe80::200:ff:fe00:X	eth0	S
    switchd	fe80::200:ff:fe00:X	eth0	D
    switcho	fe80::200:ff:fe00:X	eth0	O

  To test the connectivity of devices on the management network, you can use the following ping commands:

  # Classic ping using link-local IPv6 address
  ping <ipv6_link_local>%<interface>
  # Custom ping using hostname's machine defined in .bashrc
  pingsys <hostame.local>

  System administrators can log into machines via SSH using the following command format:

  ssh syserver@<ipv6_link_local>%<interface>

4.2 Backbone

The network backbone consisting of several routers, each configured to manage different networks. This project is designed as a mono-stack IPv6 environment, primarily operating using IPv6 addressing. It supports compatibility with IPv4 services through the implementation of NAT64 and DNS64.

• nat64 The NAT64 setup utilizes Tayga, a transparent NAT64 implementation.

  tun-device nat64               # Tun device for NAT64 tunneling
  ipv4-addr 172.17.0.2           # IPv4 address used for NAT64 translation
  prefix 2001:db8:64:ff9b::/96   # IPv6 prefix used for NAT64 translation
  dynamic-pool 172.17.0.128/25   # Dynamic pool for allocation of IPv4 addresses
  data-dir /var/db/tayga         # Directory for storing NAT64 data

  

• dns64 DNS64 is implemented to allow IPv6 clients to resolve domain names pointing to IPv4 addresses by synthesizing AAAA records (IPv6) from A records (IPv4). This ensures seamless access to IPv4-only resources for IPv6 clients.

• fw

  • Purpose/Function: Manages and secures traffic between multiple networks
  • Connected Networks: M2, I, E, W
  • Key Configurations: Startup script for managing firewall rules

• cisco

  • Purpose/Function: Manages routing for three networks (A, B, C)
  • Connected Networks: M2, I, A, B, C
  • Key Configurations: RAdvD configuration for IPv6 routing

• ciscos

  • Purpose/Function: Controls networks S, F1, F2
  • Connected Networks: M2, F1, F2, S, E
  • Key Configurations: RAdvD configuration for IPv6 routing

• ciscod

  • Purpose/Function: Manages networks D, F2, F3
  • Connected Networks: M2, F1, F3, D
  • Key Configurations: RAdvD configuration for IPv6 routing

• ciscoo

  • Purpose/Function: Controls O, F3, F1
  • Connected Networks: M2, F3, F2, O
  • Key Configurations: RAdvD configuration for IPv6 routing

4.3 Reachability

Custom routing tables are configured within the routers to manage traffic across the segmented network. These tables define the paths packets should follow to reach specific subnets, ensuring efficient communication between internal services and network zones.

This table serves as a reachability and communication matrix for the IT infrastructure. It defines and verifies the access rules between LAN segments, acting as a policy map that clearly indicates which networks can communicate freely (✔️) and which are completely isolated for security reasons (❌).

From/To	LAN A	LAN B	LAN C	LAN S	LAN D	LAN O	LAN M1	LAN M2	Internet
LAN A	✔️	✔️	✔️	✔️	✔️	✔️	✔️	✔️	✔️
LAN B	✔️	✔️	✔️	✔️	✔️	✔️	✔️	✔️	✔️
LAN C	✔️	✔️	✔️	✔️	✔️	✔️	✔️	✔️	✔️
LAN S	✔️	✔️	✔️	✔️	✔️	✔️	❓	❓	✔️
LAN D	✔️	✔️	✔️	✔️	✔️	❌	❌	❌	✔️
LAN O	✔️	✔️	✔️	✔️	❌	✔️	❌	❌	✔️
LAN M1	✔️	✔️	✔️	❓	❌	❌	✔️	❌	❌
LAN M2	✔️	✔️	✔️	❓	❌	❌	❌	✔️	❌
Internet	❌	❌	✔️	❌	❌	❌	❌	❌	✔️

4.4 DNS Namespaces

The DNS namespace is the hierarchical structure used by the Domain Name System (DNS) to organize and resolve domain names on the internet. In this project, the Top-Level Domain (TLD) is .it, the second-level domain is theboys, and the subdomains are illustrated in the figures.

4.4.1 Internal Namespace

• BIND1: Internal DNS for resolving local network hostnames.

4.4.2 External Namespace

• BIND2: External DNS serving Internet queries.