Ask HN: Isolated virtualized networking learning env?

In order to do some detailed hands-on learning of networking, I'm considering putting together the following type of environment. I'm seeking feedback about whether such things exist, whether this is a good idea, or perhaps if others know betters ways about this. I'd also appreciate pointers about how to do it - like maybe websites that explain which software runs at every step, what the common choices are, etc.

Specifically: the goal would be to model a small "internet" that would fit in as many isolated small VMs as could fit on a single 64GB ubuntu box (say, 30-ish hosts maybe at <2GB/host). The model would start with a single machine running a browser + mail-client on a small home network, the border router, the link to the ISP, the backbone, and all the way to a cloud operator running a web server. If space permits, model another home network, to see what one would ordinarily observe when VPN-ing home from another site. Include all the major server types (dhcp at home, firewalls, dns, ntp, vpn, mail, web/socks proxies, load balancers, etc). The idea would be to have a "god view" of this little internet and be able to observe packet flow and understand where traffic originates, where it goes, what paths it follows, where it's blocked, how it's routed, etc. The learning objective would be to understand all the basic tools like tcpdump, wireshark, nmap, traceroute, kernel networking settings, kernel networking-related modules, etc without the accidental complexities and access limitations of a real network.

I would build this up incrementally, starting from one host talking to its local dhcp, and adding hosts little by little. I imagine this can be done in a reasonably straightforward way with a bunch of qemu command-lines, apt installs and configuration of the various servers in the path.

PS: I can see that there are systems like mininet and gns3 out there, but it seems like they introduce a layer above all the actual systems beneath. Maybe that's worthwhile, it's hard for me to tell.

8 points | by dbglog 91 days ago

5 comments

  • fefferkorn 91 days ago
    I think a simple linux box with docker/kvm/proxmox would be quite sufficient to start with. You can just add bridges between VMs / Containers,... advance to SDN, setup your own Firewalls and LoadBalancing VMs... and for watching network traffic you can use wireshark/tcpdump.or whatever, you csn even plug in monitoring or tracing proxies in between. When using LXC containers with proxmox the system should be quite sleek.

    I would recommend to stay as open source as you can. (using pfsense, nginx... not commercial firewalls), play around with wireguard,... also use a IaC configuration tool like ansible or pyinfra do configure your stuff from.the beginning (so you can easily reconfigure stuff and make changes in scale)

    Have fun!

    • dbglog 91 days ago
      thanks! yes all OSS is the goal so that I can ideally hack/re-build any component in the path.
  • rohitpaulk 91 days ago
    Not exactly what you described, but https://labs.iximiuz.com/ is similar
    • dbglog 91 days ago
      thanks! I'll check it out
    • fefferkorn 91 days ago
      interessting, thanks!
  • wmf 91 days ago
  • oh_fiddlesticks 90 days ago
    GNS3