Forwarding packets in a single Open vSwitch bridge
I am trying to emulate a L3-switch where multiple machines are connected (in no VLANs or a single VLAN.) Then I would like to configure the switch to forward packets as I want, which I had no luck.
My system configuration:
- Host machine OS: Ubuntu 18.04.
- Open vSwitch 2.9.0
- Client machines: UBuntu 18.04 clients in VirtualBox 5.2.20
What I want to do
(basically emulating a man-in-the-middle attack.)
- VM1, VM2 and VM3 are connected to a virtual switch or bridge (BR0).
- VM1 sends a packet (e.g., HTTP GET request) to VM3.
- BR0 intercepts it and forward it to VM2.
- VM2 sends the response to VM1.
- BR0 forwards it to VM1 like VM3 responding.
What I did:
ovs-vsctl add-br br0: Create a bridge (BR0)- Create VM1,2,3 that use br0 as a network bridge.
- Run different webservers inside VM2 and VM3 (e.g., VM2 returns "hello" at the root wheras VM3 returns "HELLO".)
- Configure IP addresses inside each machine to, say,
- VM1: 192.168.0.2
- VM2: 192.168.0.3
- VM3: 192.168.0.4
ovs-ofctl --strict add-flow br0 priority=1,tcp,nw_dst=192.168.0.4,actions=mod_nw_dst=192.168.0.3: Add a flow modifying the destintion IP. Catching packges going to VM3 and forwarding them to VM2 (I hope.)
ovs-ofctl --strict add-flow br0 priority=1,tcp,nw_src=192.168.0.3,actions=mod_nw_src=192.168.0.4: Add a flow modifying the source IP. To make the response come from VM3.
What I saw:
However, obviously, it was not successful.
- I can
pingfrom one to another. - I can
cURLfrom one to another. - However, the
mod_nw_dstcommand was not effective. From VM1, I only can see the original response from VM3, which I wanted to forward to VM2.
I googled this a lot and found many articles about forwarding across VLANs, but not like this in a single bridge. Is my implementation incorrect? Otherwise, is it not an intended feature? In that case, what would be the best approach to emulate such things?
Thanks in advance!
EDIT: The result of ovs-ofctl dump-flows br0 is just the above command.
cookie=0x0, duration=157469.378s, table=0, n_packets=0, n_bytes=0, priority=1,tcp,nw_src=192.168.0.3 actions=mod_nw_src:192.168.0.4
cookie=0x0, duration=157462.433s, table=0, n_packets=0, n_bytes=0, priority=1,tcp,nw_dst=192.168.0.4 actions=mod_nw_dst:192.168.0.3
cookie=0x0, duration=157534.866s, table=0, n_packets=0, n_bytes=0, priority=0 actions=NORMAL
forwarding openflow switching openvswitch
asked Nov 21 '18 at 5:44
randusrrandusr
215
|
show 2 more comments
I am trying to emulate a L3-switch where multiple machines are connected (in no VLANs or a single VLAN.) Then I would like to configure the switch to forward packets as I want, which I had no luck.
My system configuration:
- Host machine OS: Ubuntu 18.04.
- Open vSwitch 2.9.0
- Client machines: UBuntu 18.04 clients in VirtualBox 5.2.20
What I want to do
(basically emulating a man-in-the-middle attack.)
- VM1, VM2 and VM3 are connected to a virtual switch or bridge (BR0).
- VM1 sends a packet (e.g., HTTP GET request) to VM3.
- BR0 intercepts it and forward it to VM2.
- VM2 sends the response to VM1.
- BR0 forwards it to VM1 like VM3 responding.
What I did:
ovs-vsctl add-br br0: Create a bridge (BR0)- Create VM1,2,3 that use br0 as a network bridge.
- Run different webservers inside VM2 and VM3 (e.g., VM2 returns "hello" at the root wheras VM3 returns "HELLO".)
- Configure IP addresses inside each machine to, say,
- VM1: 192.168.0.2
- VM2: 192.168.0.3
- VM3: 192.168.0.4
ovs-ofctl --strict add-flow br0 priority=1,tcp,nw_dst=192.168.0.4,actions=mod_nw_dst=192.168.0.3: Add a flow modifying the destintion IP. Catching packges going to VM3 and forwarding them to VM2 (I hope.)
ovs-ofctl --strict add-flow br0 priority=1,tcp,nw_src=192.168.0.3,actions=mod_nw_src=192.168.0.4: Add a flow modifying the source IP. To make the response come from VM3.
What I saw:
However, obviously, it was not successful.
- I can
pingfrom one to another. - I can
cURLfrom one to another. - However, the
mod_nw_dstcommand was not effective. From VM1, I only can see the original response from VM3, which I wanted to forward to VM2.
I googled this a lot and found many articles about forwarding across VLANs, but not like this in a single bridge. Is my implementation incorrect? Otherwise, is it not an intended feature? In that case, what would be the best approach to emulate such things?
Thanks in advance!
EDIT: The result of ovs-ofctl dump-flows br0 is just the above command.
cookie=0x0, duration=157469.378s, table=0, n_packets=0, n_bytes=0, priority=1,tcp,nw_src=192.168.0.3 actions=mod_nw_src:192.168.0.4
cookie=0x0, duration=157462.433s, table=0, n_packets=0, n_bytes=0, priority=1,tcp,nw_dst=192.168.0.4 actions=mod_nw_dst:192.168.0.3
cookie=0x0, duration=157534.866s, table=0, n_packets=0, n_bytes=0, priority=0 actions=NORMAL
forwarding openflow switching openvswitch
asked Nov 21 '18 at 5:44
randusrrandusr
215
1
What's the full content of your OpenFlow tables (ovs-ofctl dump-flows br0)?
– pchaigno
Nov 21 '18 at 10:08
@pchaigno Hi, I just added the table in the text. Thanks!
– randusr
Nov 21 '18 at 19:39
1
It looks like your secondovs-ofctl add-flowcommand wasn't taken into account. Did you get any error message when you ran that command?
– pchaigno
Nov 21 '18 at 20:12
@pchaigno Sorry, that I forgot to add that. I was playing with various configurations and the second command was redacted in the current setup. It didn't give me an error and showed the same result. I updated the table result above.
– randusr
Nov 21 '18 at 20:19
1
Did you empty the table before running these commands? There should be a default forwarding rule with aNORMALaction.
– pchaigno
Nov 21 '18 at 20:39
|
show 2 more comments
I am trying to emulate a L3-switch where multiple machines are connected (in no VLANs or a single VLAN.) Then I would like to configure the switch to forward packets as I want, which I had no luck.
My system configuration:
- Host machine OS: Ubuntu 18.04.
- Open vSwitch 2.9.0
- Client machines: UBuntu 18.04 clients in VirtualBox 5.2.20
What I want to do
(basically emulating a man-in-the-middle attack.)
- VM1, VM2 and VM3 are connected to a virtual switch or bridge (BR0).
- VM1 sends a packet (e.g., HTTP GET request) to VM3.
- BR0 intercepts it and forward it to VM2.
- VM2 sends the response to VM1.
- BR0 forwards it to VM1 like VM3 responding.
What I did:
ovs-vsctl add-br br0: Create a bridge (BR0)- Create VM1,2,3 that use br0 as a network bridge.
- Run different webservers inside VM2 and VM3 (e.g., VM2 returns "hello" at the root wheras VM3 returns "HELLO".)
- Configure IP addresses inside each machine to, say,
- VM1: 192.168.0.2
- VM2: 192.168.0.3
- VM3: 192.168.0.4
ovs-ofctl --strict add-flow br0 priority=1,tcp,nw_dst=192.168.0.4,actions=mod_nw_dst=192.168.0.3: Add a flow modifying the destintion IP. Catching packges going to VM3 and forwarding them to VM2 (I hope.)
ovs-ofctl --strict add-flow br0 priority=1,tcp,nw_src=192.168.0.3,actions=mod_nw_src=192.168.0.4: Add a flow modifying the source IP. To make the response come from VM3.
What I saw:
However, obviously, it was not successful.
- I can
pingfrom one to another. - I can
cURLfrom one to another. - However, the
mod_nw_dstcommand was not effective. From VM1, I only can see the original response from VM3, which I wanted to forward to VM2.
I googled this a lot and found many articles about forwarding across VLANs, but not like this in a single bridge. Is my implementation incorrect? Otherwise, is it not an intended feature? In that case, what would be the best approach to emulate such things?
Thanks in advance!
EDIT: The result of ovs-ofctl dump-flows br0 is just the above command.
cookie=0x0, duration=157469.378s, table=0, n_packets=0, n_bytes=0, priority=1,tcp,nw_src=192.168.0.3 actions=mod_nw_src:192.168.0.4
cookie=0x0, duration=157462.433s, table=0, n_packets=0, n_bytes=0, priority=1,tcp,nw_dst=192.168.0.4 actions=mod_nw_dst:192.168.0.3
cookie=0x0, duration=157534.866s, table=0, n_packets=0, n_bytes=0, priority=0 actions=NORMAL
forwarding openflow switching openvswitch
asked Nov 21 '18 at 5:44
randusrrandusr
215
I am trying to emulate a L3-switch where multiple machines are connected (in no VLANs or a single VLAN.) Then I would like to configure the switch to forward packets as I want, which I had no luck.
My system configuration:
- Host machine OS: Ubuntu 18.04.
- Open vSwitch 2.9.0
- Client machines: UBuntu 18.04 clients in VirtualBox 5.2.20
What I want to do
(basically emulating a man-in-the-middle attack.)
- VM1, VM2 and VM3 are connected to a virtual switch or bridge (BR0).
- VM1 sends a packet (e.g., HTTP GET request) to VM3.
- BR0 intercepts it and forward it to VM2.
- VM2 sends the response to VM1.
- BR0 forwards it to VM1 like VM3 responding.
What I did:
ovs-vsctl add-br br0: Create a bridge (BR0)- Create VM1,2,3 that use br0 as a network bridge.
- Run different webservers inside VM2 and VM3 (e.g., VM2 returns "hello" at the root wheras VM3 returns "HELLO".)
- Configure IP addresses inside each machine to, say,
- VM1: 192.168.0.2
- VM2: 192.168.0.3
- VM3: 192.168.0.4
ovs-ofctl --strict add-flow br0 priority=1,tcp,nw_dst=192.168.0.4,actions=mod_nw_dst=192.168.0.3: Add a flow modifying the destintion IP. Catching packges going to VM3 and forwarding them to VM2 (I hope.)
ovs-ofctl --strict add-flow br0 priority=1,tcp,nw_src=192.168.0.3,actions=mod_nw_src=192.168.0.4: Add a flow modifying the source IP. To make the response come from VM3.
What I saw:
However, obviously, it was not successful.
- I can
pingfrom one to another. - I can
cURLfrom one to another. - However, the
mod_nw_dstcommand was not effective. From VM1, I only can see the original response from VM3, which I wanted to forward to VM2.
I googled this a lot and found many articles about forwarding across VLANs, but not like this in a single bridge. Is my implementation incorrect? Otherwise, is it not an intended feature? In that case, what would be the best approach to emulate such things?
Thanks in advance!
EDIT: The result of ovs-ofctl dump-flows br0 is just the above command.
cookie=0x0, duration=157469.378s, table=0, n_packets=0, n_bytes=0, priority=1,tcp,nw_src=192.168.0.3 actions=mod_nw_src:192.168.0.4
cookie=0x0, duration=157462.433s, table=0, n_packets=0, n_bytes=0, priority=1,tcp,nw_dst=192.168.0.4 actions=mod_nw_dst:192.168.0.3
cookie=0x0, duration=157534.866s, table=0, n_packets=0, n_bytes=0, priority=0 actions=NORMAL
forwarding openflow switching openvswitch
forwarding openflow switching openvswitch
asked Nov 21 '18 at 5:44
randusrrandusr
215
asked Nov 21 '18 at 5:44
randusrrandusr
215
edited Nov 24 '18 at 22:29
randusr
asked Nov 21 '18 at 5:44
randusrrandusr
215
asked Nov 21 '18 at 5:44
randusrrandusr
215
asked Nov 21 '18 at 5:44
randusrrandusr
215
215
1
What's the full content of your OpenFlow tables (ovs-ofctl dump-flows br0)?
– pchaigno
Nov 21 '18 at 10:08
@pchaigno Hi, I just added the table in the text. Thanks!
– randusr
Nov 21 '18 at 19:39
1
It looks like your secondovs-ofctl add-flowcommand wasn't taken into account. Did you get any error message when you ran that command?
– pchaigno
Nov 21 '18 at 20:12
@pchaigno Sorry, that I forgot to add that. I was playing with various configurations and the second command was redacted in the current setup. It didn't give me an error and showed the same result. I updated the table result above.
– randusr
Nov 21 '18 at 20:19
1
Did you empty the table before running these commands? There should be a default forwarding rule with aNORMALaction.
– pchaigno
Nov 21 '18 at 20:39
|
show 2 more comments
1
What's the full content of your OpenFlow tables (ovs-ofctl dump-flows br0)?
– pchaigno
Nov 21 '18 at 10:08
@pchaigno Hi, I just added the table in the text. Thanks!
– randusr
Nov 21 '18 at 19:39
1
It looks like your secondovs-ofctl add-flowcommand wasn't taken into account. Did you get any error message when you ran that command?
– pchaigno
Nov 21 '18 at 20:12
@pchaigno Sorry, that I forgot to add that. I was playing with various configurations and the second command was redacted in the current setup. It didn't give me an error and showed the same result. I updated the table result above.
– randusr
Nov 21 '18 at 20:19
1
Did you empty the table before running these commands? There should be a default forwarding rule with aNORMALaction.
– pchaigno
Nov 21 '18 at 20:39
1
1
What's the full content of your OpenFlow tables (
ovs-ofctl dump-flows br0)?– pchaigno
Nov 21 '18 at 10:08
What's the full content of your OpenFlow tables (
ovs-ofctl dump-flows br0)?– pchaigno
Nov 21 '18 at 10:08
@pchaigno Hi, I just added the table in the text. Thanks!
– randusr
Nov 21 '18 at 19:39
@pchaigno Hi, I just added the table in the text. Thanks!
– randusr
Nov 21 '18 at 19:39
1
1
It looks like your second
ovs-ofctl add-flow command wasn't taken into account. Did you get any error message when you ran that command?– pchaigno
Nov 21 '18 at 20:12
It looks like your second
ovs-ofctl add-flow command wasn't taken into account. Did you get any error message when you ran that command?– pchaigno
Nov 21 '18 at 20:12
@pchaigno Sorry, that I forgot to add that. I was playing with various configurations and the second command was redacted in the current setup. It didn't give me an error and showed the same result. I updated the table result above.
– randusr
Nov 21 '18 at 20:19
@pchaigno Sorry, that I forgot to add that. I was playing with various configurations and the second command was redacted in the current setup. It didn't give me an error and showed the same result. I updated the table result above.
– randusr
Nov 21 '18 at 20:19
1
1
Did you empty the table before running these commands? There should be a default forwarding rule with a
NORMAL action.– pchaigno
Nov 21 '18 at 20:39
Did you empty the table before running these commands? There should be a default forwarding rule with a
NORMAL action.– pchaigno
Nov 21 '18 at 20:39
|
show 2 more comments
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53405907%2fforwarding-packets-in-a-single-open-vswitch-bridge%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53405907%2fforwarding-packets-in-a-single-open-vswitch-bridge%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
What's the full content of your OpenFlow tables (
ovs-ofctl dump-flows br0)?– pchaigno
Nov 21 '18 at 10:08
@pchaigno Hi, I just added the table in the text. Thanks!
– randusr
Nov 21 '18 at 19:39
1
It looks like your second
ovs-ofctl add-flowcommand wasn't taken into account. Did you get any error message when you ran that command?– pchaigno
Nov 21 '18 at 20:12
@pchaigno Sorry, that I forgot to add that. I was playing with various configurations and the second command was redacted in the current setup. It didn't give me an error and showed the same result. I updated the table result above.
– randusr
Nov 21 '18 at 20:19
1
Did you empty the table before running these commands? There should be a default forwarding rule with a
NORMALaction.– pchaigno
Nov 21 '18 at 20:39