Kathara External in a Linux Azure VM

[afmurillo]

Hello,

First of all, Kudos to the Kathará team, amazing and powerful tool.

I am trying to recreate the lab shown here. Nevertheless, I am unable to ping the physical interface of the azure VM instance.

So far this is how my environment looks:

and inside pc1:

Nevertheless, I am unable to ping the VM physical interface. What I am trying to achieve is allow Kathará hosts to access the VM physical interface in order to connect the virtual network built with Kathará to external tools or other Azure VM instances in the same azure virtual network.

For reference, when using docker (docker alone and not Kathará), I have been able to have a similar scenario working, by launching the container with the "--network host" flag enabled.

Has this type of scenario tried before? Thank you very much.

[tcaiazzi]

Dear @afmurillo,

Sorry for the late reply, and thanks for your kind words.

We always used the external feature to attach a Kathará device to an external physical device through a cable. However, theoretically, it should be work also to communicate with the host or with a VM on the host.

Nevertheless, it isn't working, so I'm searching for a solution for your interesting use case.

A strange behavior is that dumping the host interface, you can see the packets from the container. However, these packets are not answered and not routed anywhere.

In the picture, the container has the IP 172.21.181.10 while eth0 on the host has the IP 172.21.181.146

I'm trying to figure out what is happening, I'll come back when I find a solution. 😇

[afmurillo]

Thank you for looking into it. Yes, I found the same behaviour, with the ARP table marked as incomplete in both the host and the kathara node.

[tcaiazzi]

I tried on a physical Linux host and it works!

The steps to reproduce:

1. Attach a container to the physical interface of the host (host has IP 192.168.127.100/24)
2. Set an IP to the container with the same prefix as the host (container has IP 192.168.127.10/24).
3. Activate the promisc mode on the host interface.
4. Ping the docker interface docker0 on the host from the container.

However, I'm still not able to ping the host interface on which the container is attached.

Moreover, there is something different from the VM and the physical host settings, since this case does not work on the VM.

As I find something else, I will update you.

[tcaiazzi]

Dear @afmurillo,

Sorry for the delay, but I finally found a solution!

I managed to connect two different network scenarios (or a network scenario to a host interface) by passing through a bridge on the host machine. The same procedure can also be repeated to connect a network scenario to a VM on the host.

In the following, I show how to connect two scenarios and also how to connect a Kathará device to a host interface.

Example: connecting two labs

Basically, I created two network scenarios with only one device (as the one in the basic tutorial of Kathará external).
Then, I created a bridge on the host and two pairs of veth interfaces. For each pair, one end is attached to one lab (i.e., to an interface of the device in that lab), while the other end is attached to the bridge.

In this way, the two network scenarios can communicate through the bridge. However, to prevent that the bridge filters the packets, we need to add an iptables rule to permit all the packets switched by the bridge.

Supposing that the bridge's name is br0, we have:

iptables -A FORWARD -i br0 -o br0 -j ACCEPT

I attached a working example here: connecting-two-labs.zip.

It contains:

1. The two network scenarios (lab1 and lab2)
2. The script to create the bridge, the veth pairs, and to connect them.
3. The script to delete the created interfaces.

Steps to perform the experiment:

1. Before running the network scenarios, run the create_veth.sh script with root privileges:

sudo ./create_veth.sh

This will:

• Create one bridge called br0;
• Create two pairs of veth (veth0-veth1 and veth2-veth3)
• Connect veth1 and veth3 to br0
• Add the iptables rule

2. Run the two network scenarios:

• pc1 (10.0.0.1/24) of lab1 is connected through Kathará external to veth0
• pc2 (10.0.0.2/24) of lab2 is connected through Kathará external to veth2

At this point, you should have the following virtual topology:

3. Ping pc2 from pc1:
   

Example: connecting a Kathará device to a host interface
If you want to communicate from a Kathará device to a host interface, you only need to attach the interface of the host to the bridge br0.

Suppose we want to ping eth0 on the host from pc1 in lab1.

After attaching the container to veth0 (veth1 is still connected to the bridge as in the previous example), you only need to attach eth0 to the bridge.

sudo ip link set eth0 master br0

At this point, you should have a topology similar to the following:

We have to add a proper route to allow the host to communicate with the container through the bridge:

sudo ip route add 10.0.0.0/24 dev br0

Finally, we have to add a default route to the container (pc1 of lab1). For example:

ip route add default dev eth0

My host has IP 172.30.16.107/20 on eth0. At this point, I'm able to ping the host interface from the container:

Please let me know if this helps and if the solution is good for your use case!

[afmurillo]

Dear @tcaiazzi,

Thank you very much for your reply and sorry for my delayed answer. I confirm that I was able to reproduce the results you presented here, I think for now this solution seems ok. Nevertheless, would it be possible to have a similar setup without having to connect another Kathara lab? Something like

pc1:eth0 - veth0 -br0- host:eth0?

[tcaiazzi]

Dear @afmurillo,

Sure, there is no need to connect the other lab. You can connect directly pc1 to eth0, as you said.

I'm working on a tutorial explaining it: https://github.com/KatharaFramework/Kathara-Labs/tree/develop/tutorials/kathara-external/communicating-with-the-host

It will be published soon.

Please let me know if I can help further, and thanks for pointing out this interesting use case 🚀

[tcaiazzi]

The tutorial is published: https://github.com/KatharaFramework/Kathara-Labs/tree/main/tutorials/kathara-external/communicating-with-the-host