Exercise: Tunnelling and TCPMon

1. Set up tunneling. Depending on the operating system of "myhomepc" use either Putty or ssh to set up tunnel from "myhomepc" to the VMWare instance "myserver". In the case of PuTTY, you can open "Session" in the left navigation bar; type in the IP address of your VMWare, and leave the default port number (22). Then open Connection->SSH->Tunnels and pick source port "8808" and destination www.google.com:80

Unknown macro: picture. Click on this message for details.
The [picture] macro is not in the list of registered macros. Verify the spelling or contact your administrator.

Figure: How to configure tunneling for PuTTY

1. In case your desktop computer is Linux, set up the tunneling as described in SSH Tunneling Guide.
2. On VMWare "myserver" run the tcpdump program: 

 Open browser session, type in the address http://localhost:8808 . The tcpdump should print IP packets arriving to the interface eth1, port 80 corresponding to this request. Browser should display Google search page. 

TcpMon for Web traffic observation

1. Exit the tunnel you set up in the previous exercise. 
2. Download the tcpmon.jar from https://tcpmon.dev.java.net/servlets/ProjectDocumentList?folderID=0. 
3. Run the JAR - either double-click it or run the command-line 

1. Pick local port equal to 8808, server name - either www.google.com or your VMWare machine's IP address and the server port 80. Press button Add Monitor. 
2. Again connect to http://localhost:8808. Notice that you can see all the HTTP traffic in the monitor screen. 
3. Press the refresh button. See that there is a new "Cache-Control:max-age=0" header, and that Google responds with "304: Not Modified". 
4. Change your browser's language settings - Tools -> Options -> Advanced, and press *Choose button in the section "Languages". How are the HTTP headers affected?

Transparent Proxy (do not do this)

Unknown macro: picture. Click on this message for details.
The [picture] macro is not in the list of registered macros. Verify the spelling or contact your administrator.

Figure: Typical data flow for a transparent proxy

Spoofing attacks explained:

Unknown macro: picture. Click on this message for details.
The [picture] macro is not in the list of registered macros. Verify the spelling or contact your administrator.

Figure: Difficulty distinguishing Transparent proxies from IP spoofing

1. If Squid is used as an interceptor, it returns packets with spoofed IP addresses itself. I.e. it is breaking "lan0" filtering rule.
2. To use transparent proxy router has to disable such "lan0 deny" filtering rule - i.e. lan0 may now become a source for DOS attacks.

Here is how to set up transparent proxying:

1. Enable IP packet forwarding on VMWare "myserver" (Figure 3): edit /etc/sysctl.conf: uncomment line: 

1. Add the following rule to the iptables: 

1. Save iptables: iptables-save
2. Configure Squid on VMWare "myserver": 

1. Restart Squid: /etc/init.d/squid restart
2. In the Virtual Machine open the squid's logfile: 

 Repeat the same request as before. You should see the intercepted HTTP requests being logged TODO: This currently does not happen, possibly the error is in iptables configuration.