How to Calculate Network Firewalls in ns3

To calculate the Network Firewalls in ns3 that contains to setup the network where traffic is filtered by a firewall. We can trace various performance metrics like throughput, latency, and packet loss to estimate the firewall’s impact.

Here are the procedures on how to achieve this in ns3:

Steps to Calculate Network Firewalls in ns3

1. Set Up the ns3 Environment:
   • Make sure ns3 is installed in the computer.
2. Define the Network Topology:
   • Create a network topology that includes a firewall node to filter traffic.
3. Configure the Firewall:
   • Implement firewall rules to filter traffic based on certain criteria.
4. Install Applications:
   • Install traffic-generating applications on the nodes to simulate network traffic.
5. Monitor Performance Metrics:
   • Use trace sources or callbacks to monitor performance metrics such as throughput, latency, and packet loss.
6. Analyze Firewall Performance:
   • Calculate and log the performance metrics to evaluate the network firewall’s effectiveness.

Example Code

Here, the given below is the sample on how to setup the basic ns3 simulation to evaluate the performance of a network firewall. This is the sample uses of basic packet filtering on a node to simulate firewall behaviour.

#include “ns3/core-module.h”

#include “ns3/network-module.h”

#include “ns3/internet-module.h”

#include “ns3/point-to-point-module.h”

#include “ns3/applications-module.h”

#include “ns3/flow-monitor-module.h”

using namespace ns3;

NS_LOG_COMPONENT_DEFINE (“NetworkFirewallExample”);

void PacketFilter(Ptr<const Packet> packet, Ptr<Ipv4> ipv4, uint32_t interface)

{

Ipv4Header ipv4Header;

packet->PeekHeader(ipv4Header);

Ipv4Address srcAddr = ipv4Header.GetSource();

Ipv4Address dstAddr = ipv4Header.GetDestination();

// Example firewall rule: Drop packets from a specific IP address

if (srcAddr == Ipv4Address(“10.1.1.1”))

{

NS_LOG_UNCOND(“Packet from ” << srcAddr << ” to ” << dstAddr << ” dropped by firewall”);

ipv4->Drop(packet, Ipv4L3Protocol::DROP_FIREWALL);

}

}

void CalculateFirewallPerformance(Ptr<FlowMonitor> flowMonitor, FlowMonitorHelper &flowHelper)

{

Ptr<Ipv4FlowClassifier>classifier=DynamicCast<Ipv4FlowClassifier>(flowHelper.GetClassifier());

std::map<FlowId, FlowMonitor::FlowStats> stats = flowMonitor->GetFlowStats();

double totalThroughput = 0.0;

double totalLatency = 0.0;

uint32_t totalPackets = 0;

uint32_t lostPackets = 0;

for (auto it = stats.begin(); it != stats.end(); ++it)

{

Ipv4FlowClassifier::FiveTuple t = classifier->FindFlow(it->first);

double throughput = it->second.rxBytes * 8.0 / (it->second.timeLastRxPacket.GetSeconds() – it->second.timeFirstTxPacket.GetSeconds()) / 1024; // kbps

double latency = it->second.delaySum.GetSeconds() / it->second.rxPackets * 1000; // ms

uint32_t packets = it->second.rxPackets + it->second.lostPackets;

totalThroughput += throughput;

totalLatency += latency;

totalPackets += packets;

lostPackets += it->second.lostPackets;

}

double averageLatency = totalPackets > 0 ? totalLatency / stats.size() : 0;

double packetLoss = totalPackets > 0 ? (static_cast<double>(lostPackets) / totalPackets) * 100 : 0;

NS_LOG_UNCOND(“Total Throughput: ” << totalThroughput << ” kbps”);

NS_LOG_UNCOND(“Average Latency: ” << averageLatency << ” ms”);

NS_LOG_UNCOND(“Packet Loss: ” << packetLoss << ” %”);

}

int main(int argc, char *argv[])

{

CommandLine cmd;

cmd.Parse(argc, argv);

Time::SetResolution(Time::NS);

// Create nodes

NodeContainer nodes;

nodes.Create(3); // Client, Firewall, Server

// Create point-to-point links

PointToPointHelper pointToPoint;

pointToPoint.SetDeviceAttribute(“DataRate”, StringValue(“10Mbps”));

pointToPoint.SetChannelAttribute(“Delay”, StringValue(“2ms”));

NetDeviceContainer devices1 = pointToPoint.Install(NodeContainer(nodes.Get(0), nodes.Get(1)));

NetDeviceContainer devices2 = pointToPoint.Install(NodeContainer(nodes.Get(1), nodes.Get(2)));

// Install the internet stack on nodes

InternetStackHelper stack;

stack.Install(nodes);

// Assign IP addresses to the devices

Ipv4AddressHelper address;

address.SetBase(“10.1.1.0”, “255.255.255.0”);

Ipv4InterfaceContainer interfaces1 = address.Assign(devices1);

address.SetBase(“10.1.2.0”, “255.255.255.0”);

Ipv4InterfaceContainer interfaces2 = address.Assign(devices2);

// Enable routing

Ipv4GlobalRoutingHelper::PopulateRoutingTables();

// Create UDP server on node 2 (Server)

UdpServerHelper server(9);

ApplicationContainer serverApp = server.Install(nodes.Get(2));

serverApp.Start(Seconds(1.0));

serverApp.Stop(Seconds(10.0));

// Create UDP client on node 0 (Client)

UdpClientHelper client(interfaces2.GetAddress(1), 9);

client.SetAttribute(“MaxPackets”, UintegerValue(320));

client.SetAttribute(“Interval”, TimeValue(MilliSeconds(10)));

client.SetAttribute(“PacketSize”, UintegerValue(1024));

ApplicationContainer clientApp = client.Install(nodes.Get(0));

clientApp.Start(Seconds(2.0));

clientApp.Stop(Seconds(10.0));

// Configure packet filter on the firewall node (node 1)

Ptr<Ipv4> ipv4 = nodes.Get(1)->GetObject<Ipv4>();

ipv4->TraceConnectWithoutContext(“Rx”, MakeCallback(&PacketFilter));

// Install flow monitor to capture performance metrics

FlowMonitorHelper flowHelper;

Ptr<FlowMonitor> flowMonitor = flowHelper.InstallAll();

Simulator::Stop(Seconds(11.0));

Simulator::Run();

CalculateFirewallPerformance(flowMonitor, flowHelper);

Simulator::Destroy();

return 0;

}

Explanation

1. Setup: The code sets up a simple network topology with three nodes: a client, a firewall, and a server, connected by point-to-point links.
2. Internet Stack and Routing: The internet stack is installed on all nodes, and routing is enabled.
3. Applications: A UDP server is installed on the server node (node 2), and a UDP client is installed on the client node (node 0) to generate traffic.
4. Firewall Configuration: A packet filter is configured on the firewall node (node 1) to drop packets from a specific IP address.
5. Flow Monitor: The FlowMonitor is used to gather performance metrics like throughput, latency, and packet loss.
6. CalculateFirewallPerformance Function: This function calculates the total throughput, average latency, and packet loss, and logs these metrics to evaluate the performance of the network firewall.

Running the Simulation

Compile and run the simulation using the following commands in your ns3 environment:

./waf configure

./waf build

./waf –run your-script-name

Replace your-script-name with the actual name of your script file.

Here, we demonstrate how the run the simulation to calculate the network firewall in the traffic that is implemented by ns3 framework. We give elaborate information about how the network firewall performs in other tool. Kindly share all the relevant parameters of your network firewalls with ns3simulation.com to receive unique results. For expert advice on comparing performance, feel free to reach out to our team of specialists.