What you will do
Machines on a private network, such as 10.0.0.0/24, have addresses the internet does not know how to reach back. NAT, network address translation, is what lets a gateway speak for them. You will look at a small network, send a request that cannot get an answer, and find out why. You will not fix it: that is the lab's own task.
Before you start
Note
Press Start the lab on the bar at the top of this lesson. This lab is a whole Ubuntu machine of your own, with three small machines built inside it, so it takes a little longer to come up than a container. Each Run button below types its command into the machine's terminal, one after another. If one says the machine is still starting, wait a few seconds and press it again. To watch them, or to type your own, press Open terminal on the bar.
1. Meet the machines
Each machine is a separate network namespace with its own addresses. lan is the private machine, srv is a server on the outside, and gw is the gateway with a cable to each: 10.0.0.1 towards the LAN and 203.0.113.1 towards the outside. The last three lines say which machine serves a web page.
netlab statusShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
2. Ask the outside server for its page
sudo ip netns exec lan runs the command that follows inside lan. curl asks the outside server for its page, and gives up after three seconds: Connection timed out. The request left lan and nothing came back. --noproxy '*' keeps curl off the web proxy the VM itself uses, which these machines cannot reach.
sudo ip netns exec lan curl --noproxy '*' -sS -m 3 http://203.0.113.2:8000/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
3. Ask the outside what it knows
A route is a line in a table: "to reach this network, go this way". The outside server has one line, for its own cable, 203.0.113.0/24. It has none for 10.0.0.0/24, so even if the request got there, the answer has no way back to a private address.
sudo ip netns exec srv ip routeShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
4. Ask the gateway what it does
The gateway's rules are nftables. This is all of them: one chain that lets the LAN start connections and drops the rest, and nothing that translates an address. That is what is missing.
sudo ip netns exec gw nft list rulesetShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Now do the lab
Tip
You have found why the request gets no answer. Making it work is the task of this lab: open README.md in your home folder with cat README.md in the terminal. It says what to do and gives none of the answers.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. This lesson is worked in a VM lab: each student has an Ubuntu machine of their own with the network inside it, and a Run types into its terminal and shows what it printed. The lab itself has a check that marks the finished gateway by what the network then does. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.