How to Calculate Network Demilitarized Zone in omnet++
To calculate and evaluating a Network Demilitarized Zone (DMZ) in OMNeT++ encompasses mimicking the architecture and performance of a DMZ, which is a physical or logical sub network that splits an internal local area network (LAN) from untrusted external networks, like the internet. It is constructed to insert an extra layer of security to the internal network by showing services to the external network while protecting the internal network.
Step-by-Step Implementations:
- Understand the Role of a DMZ
A DMZ normally:
- Hosts Public Services: Web servers, email servers, and DNS servers that want to be available from the internet are placed in the DMZ.
- Isolates Internal Networks: Stops direct access to internal networks by filtering traffic through the DMZ.
- Implements Firewalls: To manage and observe traffic among the DMZ, internal network, and external network by using firewalls.
- Set up a Network with a DMZ
Generate a network topology where a DMZ is placed among the external network like the internet and the internal network such as a corporate LAN in OMNeT++. The DMZ will usually be divided from both networks by firewalls.
Example: Define a Network with a DMZ in NED
network DMZNetwork {
submodules:
externalNetwork: ExternalNetwork; // Represents the internet or external network
dmz: DMZ; // The DMZ containing public servers
internalNetwork: InternalNetwork; // The internal network to be protected
firewall1: Firewall; // Firewall between external network and DMZ
firewall2: Firewall; // Firewall between DMZ and internal network
connections:
externalNetwork.out++ –> firewall1.in++;
firewall1.out++ –> dmz.in++;
dmz.out++ –> firewall2.in++;
firewall2.out++ –> internalNetwork.in++;
}
- Implement the DMZ Logic
In the DMZ, we can place public-facing servers like web servers that want to be available from the external network. The firewalls control and filter traffic among the external network, DMZ, and internal network.
Example: Implementing a Simple DMZ
#include <omnetpp.h>
using namespace omnetpp;
class DMZServer : public cSimpleModule {
private:
int requestsHandled = 0;
protected:
virtual void handleMessage(cMessage *msg) override {
// Handle incoming requests
requestsHandled++;
EV << “Request handled by DMZ server.” << endl;
// Simulate processing delay
simtime_t processingTime = par(“processingDelay”).doubleValue();
scheduleAt(simTime() + processingTime, msg);
}
virtual void finish() override {
recordScalar(“Requests Handled”, requestsHandled);
}
};
Define_Module(DMZServer);
- Simulate Traffic through the DMZ
Make traffic from the external network that targets services presented in the DMZ. The firewall would permit only specific kinds of traffic like HTTP, HTTPS to reach the DMZ servers, while blocking others.
Example: Traffic Simulation in the External Network
class ExternalNetworkNode : public cSimpleModule {
protected:
virtual void initialize() override {
// Start generating requests after a delay
scheduleAt(simTime() + par(“sendInterval”).doubleValue(), new cMessage(“httpRequest”));
}
virtual void handleMessage(cMessage *msg) override {
// Send the request to the DMZ server via the firewall
send(msg, “out”);
}
};
- Implement Firewall Filtering Rules
The firewalls should perform rules to filter traffic based on protocols, ports, or source/destination addresses. For example, a firewall might permit HTTP and HTTPS traffic but block all other kinds.
Example: Implementing Firewall Rules
class Firewall : public cSimpleModule {
private:
int packetsAllowed = 0;
int packetsBlocked = 0;
protected:
virtual void handleMessage(cMessage *msg) override {
// Apply filtering rules
if (isAllowed(msg)) {
packetsAllowed++;
send(msg, “out”);
} else {
packetsBlocked++;
EV << “Packet blocked by firewall.” << endl;
delete msg; // Block the packet
}
}
bool isAllowed(cMessage *msg) {
// Implement your filtering rules here
// Example: Allow only HTTP/HTTPS traffic
return strcmp(msg->getName(), “httpRequest”) == 0;
}
virtual void finish() override {
// Record firewall performance metrics
recordScalar(“Packets Allowed”, packetsAllowed);
recordScalar(“Packets Blocked”, packetsBlocked);
}
};
Define_Module(Firewall);
- Monitor DMZ and Firewall Performance
We can watch several aspects of the DMZ and firewall performance, like:
- Requests Handled by DMZ Servers: The number of legitimate requests that were managed by the servers in the DMZ.
- Packets Allowed/Blocked by Firewalls: The efficiency of the firewall in filtering traffic.
- Processing Delay: The time taken by the DMZ servers and firewalls to process requests.
Example: Monitoring DMZ and Firewall Metrics
class DMZServer : public cSimpleModule {
private:
int requestsHandled = 0;
simsignal_t processingDelaySignal;
protected:
virtual void initialize() override {
processingDelaySignal = registerSignal(“processingDelay”);
}
virtual void handleMessage(cMessage *msg) override {
requestsHandled++;
simtime_t startProcessing = simTime();
// Simulate processing delay
simtime_t processingTime = par(“processingDelay”).doubleValue();
scheduleAt(simTime() + processingTime, msg);
simtime_t endProcessing = simTime();
emit(processingDelaySignal, endProcessing – startProcessing);
}
virtual void finish() override {
recordScalar(“Requests Handled”, requestsHandled);
}
};
- Analyse the Effectiveness of the DMZ
Examine the effectiveness of the DMZ setup after running the simulation:
- Security: Did the firewalls effectively block unauthorized access attempts to the internal network?
- Efficiency: How well did the DMZ servers manage the incoming requests?
- Traffic Management: Was legitimate traffic correctly routed to the DMZ, and was needless traffic blocked?
- Example Scenario
In the below example, the DMZ module encompasses public-facing servers that manage requests from the external network, while firewalls control traffic among the external network, DMZ, and internal network. The performance of the DMZ and firewalls is monitored through metrics like processing delay, packets blocked and packets allowed.
network DMZExample {
submodules:
externalNetwork: ExternalNetworkNode;
firewall1: Firewall;
dmzServer: DMZServer;
firewall2: Firewall;
internalNetwork: cModule;
connections:
externalNetwork.out++ –> firewall1.in++;
firewall1.out++ –> dmzServer.in++;
dmzServer.out++ –> firewall2.in++;
firewall2.out++ –> internalNetwork.in++;
}
- Post-Simulation Analysis
To observe the recorded metrics, like the number of packets allowed and blocked by the firewalls, requests managed by the DMZ servers, and the processing delay by using OMNeT++’s built-in analysis tools. This analysis will help to know how well the DMZ architecture is performing in terms of security and effectiveness.
In this setup, we are known and develop knowledge about how to implement Network Demilitarized zone using OMNeT++. We will offer further informations about this topic based on your requests.
We will help you with the Network Demilitarized Zone in the omnet++ tool for your project so drop us with your parameter details. We carry on network project performance based on your specifications.