Perl and Regular Expressions

I have been drawn into an exciting area called "Perl scripting!". It is a great fun and until I started studying Perl I didn't know how much I was lost in system and network administration!
Currently, what I mostly need to do with Perl is text processing.
In my first project I needed to telnet into a Fortigate firewall, send a couple of commands, fetch the output, process and reorder the output which was the main purpose of the job and store it in a file and trigger an action if specific pattern observed in the output.
All these required complex text processing which could not have been accomplished without "Regular Expressions".
The following are the references I found very useful for me to get a grasp on "Regular Expressions" in Perl.

Regular expressions in Perl
Perl regular expressions tutorial
Steve Litt's Perls of Wisdom: Perl Regular Expression

Free Windows TFTP and Syslog server!

It might sound crazy but I got a Cisco PIX firewall at home (PIX 501) and my internet traffic is running through it with a PPPoE connection and I have configured it to accept remote VPN connections as well in case I need to access my data at home while at work.
I was looking for a free and light TFTP server to backup my PIX configuration regularly and I found exactly what I was looking for at http://tftpd32.jounin.net/. tftpd32 is not just a TFTP server but also a DHCP and Syslog server as well. The next question was running TFTP as a service which I found the answer here: HOW TO install Windows tftpd as service.

How to Implement Source Routing With Linux

As mentioned in my previous post I got an Internet gateway which is a Linux box and I have two Internet connections connected to that server. One is a 2Mbps Leased-Line and the other a 1Mbps wireless connection. I want hosts from specific subnets have their Internet traffic directed to the wireless Internet connection while others go through the Leased-Line link.

This is easily done with Linux and iproute2 suit which is installed by default on Fedora.

By default all routes are stored in a table called "main" and by issuing the following command the routes stored inside this table can be displayed:

• ip route list table main
  

The results are exactly that same as just running the "route" command.

Any queries coming to this server for routing decisions will be looked up in the "main" table unless mentioned otherwise. But how is this possible?

It is also possible to define a new routing tables and have different routing entries inside the new defined table and apply rules so that traffic from specific sources are directed to this new table for route look up!

First:

we need to create a new table which easily handled by adding the name at the end of /etc/iproute2/rt_table. It may look like this:

10 wireless-link

Second:

New routes should be added to this table:

• ip route add 192.168.120.0/24 via 192.168.10.1 table wireless-link
• ip route add default via 80.120.99.12 table wireless-link (This defines the default route for "wireless-link" routing table)
• ip route list table wireless-link (This will display routes added to wireless-link)

Third:

Route rules must define when requests must be looked up in the "wireless-link" table!

• ip rule add from 192.168.120.0/24 table wireless
• ip rule list (display ip rules)

From now on, every traffic coming from 192.168.120.0/24 will be leaded to wireless-link table so its default route will be 80.120.99.12 while traffic from other sources will be still lookup routes in the "main" table which has its own default route (Leased-Line).

To undo ip rules and routes the following syntax must be followed:

• ip rule del from 192.168.120.0/24 table wireless
• ip route del default via 80.120.99.12 table wireless-link

Route Policy With Linux

In one of our premises I have two firewalls; A Linux iptable and a Microsoft ISA Server.
I got two Internet connections, each connected to one firewall and the plan is to remove the ISA server and add the Internet connection (currently servicing ISA server users) to the Linux box which makes two internet connections on the same server. I got around 20 VLANs and I want to split Internet traffic between these two connections based on the source address. This can easily be done by iproute2 suite. I have not done this before but I am studying it and it seems easy and straightforward. I will post more on this later.

Linux Traffic Control, DNS ALG issue , and Service Monitoring

I am busy with a couple of interesting stuff that keeps me away from posting here.
First,
I am working on a linux box which is an internet gateway and controls traffic using iptable and at same time it acts as the inter VLAN router for around 10 VLANs using 802.1Q. I am trying to run some sort of QoS to put traffic control on every VLAN for their internet usage. And with Linux this will be easily done with a tool called TC.
I have expressed that before but it is worth to mention again that with linux we will get tons of outstanding networking features that gives us full control on our network and what is running behind the scene on the wires! I am really impressed!!!
Second,
My firewall is not handling DNS ALG as expected so it has brought us some disturbance. Everything is fine with outside to inside regular DNS queries but when a DNS query for PTR record comes in, DNS ALG does not translate the IP address in the response payload while it does so when it comes to Forward queries. According to RFC 2694 this should work unless our Firewall is not RFC compliant. I am documenting the issue regarding RFC to send it over to our Firewall Vendor.
Third,
I was studying available service monitoring tools to monitor our IDC services and servers and nearly reached to the conclusion to implement "ManageEngine Applications Monitror" and I already have a pilot server in place. I will post on it later.

The Challenges of a Firewall Administrator

A firewall administrator must have a good understanding of the applications and the way they work behind the scenes. Some protocols are unruly in their communication pattern and some put layer 3 and layer 4 addressing in payload which adds another twist to the problem. at last, sometimes the direction which the protocol is initiated is unclear!
When working with firewalls to provide access to services and applications the following must be considered carefully :

1. Some protocols are untruly in their communication (FTP)
   
2. Some put addressing in payload (FTP, SIP, PPTP)
   
3. Some confuse us about the direction of the communication (SNMP, SNMPTrap)

So anyone who is in complete charge of a firewall needs to know how the communication of protocols happens.
Do we need an inbound or outbound connection? (Where will the traffic be initiated?)
Is it TCP or UDP or do we need to put a protocol number?
Do we also need to handle address translation in payload?

All this brings up a great challenge to a firewall administrator which makes him to get to know applications and protocols well enough to tackle the problems.

Firewalling Windows Servers with IPFW

For some time I spent thinking of an IPTable like firewall for host protection on windows servers and I didn't know whether there is one available until I gave it a try and surprisingly found WIPFW. I find it very cool to have a unix based firewall on my windows boxes!
WIPFW is the Windows version of FreeBSD IPFW firewal and It can be used on any version of windows, starting with windows 2000.
It gives a lot of flexibility in the way rules can be applied to different sort of traffic and it can also keep track of the states of packets as well. There are a lot of great features that comes with it and it can be checked through its online documentation. Any IPTable administrator can figure it out quickly.

Some missing features in its current release(0.2.8) are as follow:

• Unable to change packet contents
• No traffic shaping capabilities
• Does not support SNAT and DNAT

Check here for documentation and product download:
WIPFW: Windows Operable Version of BSD IPFW

Check also here for more info on WIPFW:
Jameser's Tech Tips: Stateful Packet Filter for Windows

Learn more about the original IPFW:
ONLamp - BSD Firewalls: IPFW
IPFW How-To

D-Link DI-624 Router

I do not have a broadband Internet connection at home yet but once I get it I would put D-Link's DI-624 Router in my Must Have List! DI-624 is a "Basic Firewall", "Internet Sharing Server", "802.11g Access Point with Super G (108Mbps) support", "4-port Switch" and many other great features like "MAC Filtering, URL and Domain Blocking, Scheduling, IP Filtering for more internet access control" that makes it a great residential gateway for home and small office users.

Windows 2003 RRAS & VPN

I have set up my first VPN server on a windows 2003 RRAS today and it works fine as now. A great improvement to RRAS in Windows 2003 is its built-in basic firewall which blocks every traffic coming from the WAN connection including ICMP requests and exclusions can be defined easily on ICMP traffic, applications and services to let the traffic pass the firewall. Once a client is connected to the VPN server over internet it acts as if it has locally connected to the LAN drop and all resources are accessible normally. Outlook 2003 will download headers on slow connection to retrieve data from Microsoft Exchange on requests. I tried to connect to our servers from the Remote Desktops console and this also worked fine. The PPTP VPN connection is the only concern regarding security so I will work on it to make L2TP work for us.