Introduction

NETinVM is a virtual machine image that provides the user with a complete computer network. For this reason, NETinVM can be used for learning about operating systems, computer networks and system and network security.

In addition, it can be used for demonstrations (i.e. in classrooms) that can be reproduced by students either in a laboratory or on their own laptop and thus, at home, at the library... For these reasons we present NETinVM as an educational tool.

Description of NETinVM

NETinVM is a virtual machine image that contains, ready to run, a series of Kernel Virtual Machine (KVM) virtual machines. When started, the KVM virtual machines create a whole computer network; hence the name NETinVM, an acronym for NETwork in Virtual Machine. This virtual network has been called 'example.net' and has fully qualified domain names defined for the systems: 'base.example.net', 'fw.example.net', etc.

Since NETinVM is a virtual machine and it contains other virtual machines, there are 2 virtualization levels. For this reason, the NETinVM virtual machine is called L1VM (level 1 virtual machine) and the internal KVM machines are called L2VM or KVM2 (for historical reasons).

All of the virtual machines use the Linux operating system. The L1VM is called 'base' and it runs Debian 12. KVM2 machines (L2VM) also use Debian 12 and they have different names depending on their network location, because they are grouped into three different subnets: corporate, perimeter and external. The subnetworks are named 'int' (for internal network), 'dmz' (for DMZ or demilitarized zone, usually used as a synonym for perimeter network) and 'ext' (for external network).

One of the KVMvirtual machine 2 machines, 'fw', interconnects the three networks ('int, 'dmz' and 'ext'), allowing for communication and packet filtering. The rest of the KVM2 machines have only one network interface, connected to the network they are named after:

int<X>

KVM2s connected to the internal network. <X> can take values from 'a' to 'f', both inclusive. These machines only offer SSH service by default.

dmz<X>

KVM2s connected to the perimeter network (DMZ). They are supposed to be bastion nodes. Two preconfigured bastion nodes are provided, each one with its appropriate alias:

• 'dmza' is aliased as 'www.example.net' and it offers HTTP and HTTPS services.
• 'dmzb' is aliased as 'ftp.example.net' and it offers FTP.

ext<X>

KVM2s connected to the external network (ie: Internet).

Because a picture paints a thousand words, or so they say, the following figure shows NETinVM with all of the virtual machines running inside.

All of the elements referenced before are shown in the image with their IP and ethernet addresses. The following rules have been used for assigning addresses:

• IP addresses are of the form 10.5.<NET>.<MACHINE>, where <NET> is either 0 ('ext'), 1 ('dmz') or 2 ('int'), and <MACHINE> is either 10 for 'exta', 'dmza' or 'inta', 11 for 'b' and so on up to 15 for 'f'.
• Network masks are 24 bits (255.255.255.0).
• Ethernet addresses are CA:FE:00:00:0<NET>:0<MACHINE>, where <NET> is either 0, 1 or 2 (following the same domain rule as IP addressing) and <MACHINE> is either a, b, c, d, e or f.
• The interfaces of 'fw' use 254 for IP and FE for ethernet.
• The interfaces of 'base' use 1 for IP and 01 for ethernet.

In addition to the computers and networks already described, the figure also shows the real computer where NETinVM runs ('REAL COMPUTER') and VMware Workstations's typical network interface ('vmnet8'), which optionally interconnects NETinVM's networks with the external word.

When they boot, all KVM virtual machines get their network configuration from 'base', which provides DHCP and DNS services to the three NETinVM networks through its interfaces 'virbr-ext', 'virbr-dmz' and 'virbr-int'.

Routing works as follows:

• The default gateway for the internal and perimeter networks (machines 'int<X>' and 'dmz<X>') is 'fw' (more specifically, the IP address of 'fw' in the corresponding internal or perimeter subnet).
• The default gateway for 'fw' is 'base' (its external network address).
• 'base' (its external network address) is also the default gateway for machines in the external network ('ext<X>'), but they are configured to use 'fw' (external network address) as the gateway for accessing machines in the perimeter and internal networks.

Thus, IP traffic exchanged among the three networks goes through 'fw', while traffic going out from NETinVM to the external world goes through 'fw' if (and only if) it comes from the internal or perimeter networks. All traffic going to the real world (outside NETinVM) exits through 'base' which, applies IP forwarding and NAT to this outgoing traffic, and routes it back through the external network using the routing table 'netinvm'.

Communication between 'base' and any KVM2 machine, in both directions, is direct, without going through 'fw'. (When the communication is started from a KVM2 machine, the IP address of the interface of 'base' in the corresponding network must be used.) This configuration permits access from 'base' to all KVM2 machines using SSH independently of the packet filtering configuration at 'fw'.

Working with NETinVM

Sample Exercises

The following documents describe some sample exercises that can be carried out using NETinVM.

Download information

NETinVM can be downloaded directly from its main page: index.html