Can private networks be created?

[MarcoBorrini99]

Is it possible to create a topolgy where nodes (including host itself) can only comunicate with each other without the ability to contact external resources (let's say 8.8.8.8 or, worse, a bgb neighbour in a production env if office vpn is active)?

BR

[steiler]

Hi @MarcoBorrini99,
yes that is perfectly possible.
This should cover the requested https://containerlab.dev/manual/network/#external-access

[MarcoBorrini99]

Hi @MarcoBorrini99, yes that is perfectly possible. This should cover the requested https://containerlab.dev/manual/network/#external-access

Thanks for the answers but no, I'm trying to achieve the exact opposite :-)

I'll try to explain better...

On my Archlinux notebook and vpn active I can reach our Arista nodes in our IX infrastrucure and on the same Arch box I'm trying to use containerlab to setup a topology where configurations match the real ones as much as possible.

Said that, I've started with something simple:

name: ceosix

mgmt:
  external-access: false

topology:
  nodes:
    nodeA:
      kind: ceos
      image: ceos:4.25.10M
    nodeB:
      kind: ceos
      image: ceos:4.25.10M
    nodeC:
      kind: ceos
      image: ceos:4.25.10M
    nodeD:
      kind: ceos
      image: ceos:4.25.10M

  links:
    - endpoints: ["nodeA:et49", "nodeC:et49"]
    - endpoints: ["nodeA:et50", "nodeB:et49"]
    - endpoints: ["nodeC:et51", "nodeD:et50"]
    - endpoints: ["nodeB:et50", "nodeD:et54"]

Now with

docker exec -it clab-ceosix-nodeA Cli

I can access the node and start to do something as:

nodeA#show running-config 
! Command: show running-config
! device: nodeA (cEOSLab, EOS-4.25.10M-29053933.42510M (engineering build))
!
no aaa root
!
username admin privilege 15 role network-admin secret sha512 $6$MAk6wWxLUdCIJsfL$sU4Buh4kXRUkaOrmrJOL3LLHq4LbI2a70I9tUslMvAw4bb25RfwWjMnPA27Mr0HZejGtcC/lxBce3uOvAC1m40
!
transceiver qsfp default-mode 4x10G
!
service routing protocols model multi-agent
!
hostname nodeA
!
spanning-tree mode mstp
!
interface Management0
   ip address 172.20.20.4/24
   ipv6 address 2001:172:20:20::4/64
!
no ip routing
!
ip route 0.0.0.0/0 172.20.20.1
!
ipv6 route ::/0 2001:172:20:20::1
!
management api http-commands
   no shutdown
!
management api gnmi
   transport grpc default
!
management api netconf
   transport ssh default
!
end

nodeA#ping 10.0.0.4
PING 10.0.0.4 (10.0.0.4) 72(100) bytes of data.
From 198.51.100.129 icmp_seq=1 Destination Net Unreachable
From 198.51.100.129 icmp_seq=2 Destination Net Unreachable
From 198.51.100.129 icmp_seq=3 Destination Net Unreachable
From 198.51.100.129 icmp_seq=4 Destination Net Unreachable
From 198.51.100.129 icmp_seq=5 Destination Net Unreachable

--- 10.0.0.4 ping statistics ---
5 packets transmitted, 0 received, +5 errors, 100% packet loss, time 31ms

ping fails but at least it's attempted:

sudo tshark -n -i any icmp 
Running as user "root" and group "root". This could be dangerous.
Capturing on 'any'
 ** (tshark:47512) 09:27:02.480341 [Main MESSAGE] -- Capture started.
 ** (tshark:47512) 09:27:02.480413 [Main MESSAGE] -- File: "/tmp/wireshark_anyB0IY01.pcapng"
    1 0.000000000  172.20.20.4 → 10.0.0.4     ICMP 116 Echo (ping) request  id=0x000b, seq=1/256, ttl=64
    2 0.000000000  172.20.20.4 → 10.0.0.4     ICMP 116 Echo (ping) request  id=0x000b, seq=1/256, ttl=64
    3 0.000044610   10.8.1.118 → 10.0.0.4     ICMP 116 Echo (ping) request  id=0x000b, seq=1/256, ttl=63
    4 0.007700704 198.51.100.129 → 10.8.1.118   ICMP 72 Destination unreachable (Network unreachable)

This is "dangerous", the packet exits the topology and goes through 10.8.1.118 that's the ip assigned by vpn to my notebook

Let's try with google:

nodeA#ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 72(100) bytes of data.
76 bytes from 8.8.8.8: icmp_seq=1 ttl=117 (truncated)
76 bytes from 8.8.8.8: icmp_seq=2 ttl=117 (truncated)
76 bytes from 8.8.8.8: icmp_seq=3 ttl=117 (truncated)
76 bytes from 8.8.8.8: icmp_seq=4 ttl=117 (truncated)
76 bytes from 8.8.8.8: icmp_seq=5 ttl=117 (truncated)

--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 32ms
rtt min/avg/max/mdev = 7.355/7.833/8.033/0.272 ms, ipg/ewma 8.043/7.931 ms

sudo tshark -n -i any icmp 
[sudo] password di marco: 
Running as user "root" and group "root". This could be dangerous.
Capturing on 'any'
 ** (tshark:49512) 09:32:50.300168 [Main MESSAGE] -- Capture started.
 ** (tshark:49512) 09:32:50.300241 [Main MESSAGE] -- File: "/tmp/wireshark_anyYZ3V01.pcapng"
    1 0.000000000  172.20.20.4 → 8.8.8.8      ICMP 116 Echo (ping) request  id=0x000e, seq=1/256, ttl=64
    2 0.000000000  172.20.20.4 → 8.8.8.8      ICMP 116 Echo (ping) request  id=0x000e, seq=1/256, ttl=64
    3 0.000025948   10.44.1.11 → 8.8.8.8      ICMP 116 Echo (ping) request  id=0x000e, seq=1/256, ttl=63
    4 0.008159483      8.8.8.8 → 10.44.1.11   ICMP 112 Echo (ping) reply    id=0x000e, seq=1/256, ttl=118
    5 0.008171062      8.8.8.8 → 172.20.20.4  ICMP 112 Echo (ping) reply    id=0x000e, seq=1/256, ttl=117
    6 0.008174474      8.8.8.8 → 172.20.20.4  ICMP 112 Echo (ping) reply    id=0x000e, seq=1/256, ttl=117
    7 0.008299757  172.20.20.4 → 8.8.8.8      ICMP 116 Echo (ping) request  id=0x000e, seq=2/512, ttl=64
    8 0.008299757  172.20.20.4 → 8.8.8.8      ICMP 116 Echo (ping) request  id=0x000e, seq=2/512, ttl=64
    9 0.008314141   10.44.1.11 → 8.8.8.8      ICMP 116 Echo (ping) request  id=0x000e, seq=2/512, ttl=63

Concluding, "external-access: false" is not what I need but maybe I'm missing something obviuos

[steiler]

Yes, you are right, now I also noticed that the knob is about the reverse direction.

So one thing you can do is to create iptables rules by hand that drop the traffic that you don't want.

Another option is to create a seperate isolated bridge. https://containerlab.dev/manual/network/#bridge-name