Software-Defined Network-Based Firewall

This project aims to use software-defined networking (SDN) to create an externally configurable blacklist firewall using the SDN platform Pyretic and the POX OpenFlow Controller.

The firewall rules are in the configuration file firewall-config.pol. The firewall policy is implemented in firewall_policy.py. The following rules are implemented:

Block PPTP, prohibiting all hosts from sending traffic to a PPTP server running on server2.
Prohibit all hosts from sending traffic to an SSH server on hosts e1, e2, and e3.
Protect the DNS and NTP services on server1 and server2 from receiving traffic from all hosts.
Disallow hosts w1 and w2 from pinging client1.
Disallow host e1 from sending traffic destined to TCP ports 9950-9952 on host e3.
Restrict host client1 from sending traffic to hosts e1, e2, and e3.
Prohibit all hosts from sending traffic to a L2TP/IPSEC server running on server3.

firewall.py sets up the Pyretic application and reads the firewall config into a data object. firewall-topo.py is a Mininet program that starts a topology consisting of one switch and two groups of hosts. The learning switch is implemented in pyretic_switch.py. run-firewall.sh is used to run the firewall; it also allows for different config files to be used by providing a filename via the command line.

For TCP testing: test-tcp-client.py acts as a TCP client - it opens a connection, sends a string, then waits to hear it echoed back. test-tcp-server.py acts as a TCP server - it listens on a specified port and echoes back whatever it hears.

For UDP testing: test-udp-client.py acts as a UDP client. test-udp-server.py acts as a UDP server that echoes back whatever it hears.

susuomlu/sdnfirewall

Software-Defined Network-Based Firewall