Using ntopng Inline
-------------------
Traditionally ntopng has been used to passively monitor traffic. However
ntopng can be used inline to block/shape traffic according to various
criteria such as host and application protocol.

In README.netfilter you can read how to do this with netfilter that
is mostly used when using it on network routers. Instead you can use ntopng
on a totally passive way (transparent bridge) so that you can enforce
network policies without having to change IP address or any other
network setup such as the DNS address or the gateway IP address.

When used inline ntopng bridges the traffic of two network interfaces.
There are two possible setups for using ntopng inline on a transparent
fashion, when operating on an existing network.

Supposing to have this network

	  +------------------+        +-----------+
	  | Internet Gateway |  <---> |   Switch  |
	  +------------------+        +-----------+
	                                |       |
					V       V
				       PC1     PC2

where we want to use ntopng to enforce Internet traffic policies.


 +------------------+       +-----------+       +-----------+
 | Internet Gateway | <---> |  ntopng   | <---> |   Switch  |
 +------------------+       +-----------+       +-----------+
  	                                          |       |
 					          V       V
				                 PC1     PC2


You can use a box with 1+1 interfaces (one for reaching the box and
one for connecting to the Internet) or with 2+1 (two for connecting the
switch to the Internet and one for reaching the box).

Netfilter (Linux-only) traffic policy is available in all ntopng
versions, whereas interface bridging needs at least the Pro version.
Packages are available at http://packages.ntop.org/


Using ntopng bridging in 2+1 mode
----------------------------------
In this setup the management interface is used to access the box, and
two additional interfaces are use for bridging traffic.

0. Suppose you want to bridge zc:eth3 with zc:eth4. If the 
   interface names are different please adapt tools/load_hugepages.sh
   In case you are using non-ZC interfaces there is no need to
   run load_hugepages.sh

1. We suppose that you have PF_RING compiled with this layout
   - PF_RING
   - ntopng

   if not modify tools/load_hugepages.sh

3. Make sure you have executed once ../tools/load_hugepages.sh

3. Start ntopng as follows
   ntopng -i "bridge:zc:eth3,zc:eth4"


Using ntopng bridging in 1+1 mode
----------------------------------
You can implement this setup very easily using for instance a Raspberry PI3
that is equipped with a ethernet interface (eth0) that connect the box
to the Internet, and a WiFi interface (wlan0) to which network clients
can attach.

In this setup you need to configure the interfaces as described below.


Using ntopng in routing mode
----------------------------

Supposing to have this network configuration

	       eth0    +-----------+  eth1
    Internet  <---->   |   ntopng  | <----> Local network
                       +-----------+

- eth0 connects to the Internet
- eth1 connects your clients
- you want the ntopng box to NAT your clients and assign them an IP
  address with DHCP. The private network used for NAT
  will be 172.16.0.0/24 , and your ntopng box will act
  as gateway at IP 172.16.0.1 (just as example).

PRIOR TO START NTOPNG, you need to do once:
1. Setup a tap interface on your box
   # tunctl -t tap0  (On Centos: # ip tuntap add tap0 mode tap)
   # ifconfig tap0 172.16.0.1 netmask 255.255.255.0
   # ifconfig tap0 up

2. Setup NAT
   # iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
   # iptables --append FORWARD --in-interface tap0 -j ACCEPT
   # echo 1 > /proc/sys/net/ipv4/ip_forward

3. Setup your DHCP server serving addresses on tap0 from
   network 172.16.0.0/24 (of course except 172.16.0.1 that is
   used by ntopng)

Then you can start ntopng as:
   # ntopng -i bridge:tap0,eth1 -m "172.16.0.0/24" -w 80,3000 


* Debian-based distributions
----------------------------
For Debian-based distributions such as Raspbian the configuration is as follows.

$ cat /etc/network/interfaces
...
auto eth0
iface eth0 inet manual
up ifconfig eth0 up


# https://help.ubuntu.com/community/Network%20Bridge%20with%20a%20Tap!
auto br0
iface br0 inet dhcp
   bridge_ports eth0
   bridge stp off
   bridge_maxwait 0
   bridge_fd 0

allow-hotplug wlan0
iface wlan0 inet manual
   wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
...

Done this and installed ntopng from the ntop repository you can start
ntopng as follows:

# ntopng -i bridge:br0,wlan0 -w 80,3000

Note for Raspbian linux: The new dhcp client ignores what the
interfaces files does and doing its own things. This may cause
innterfaces configured with 'inet manual' to get an ip address via
dhcp. To prevent this behavior, /etc/dhcpcd.conf should be edited to
to tell the DHCP daemon to completely ignore the physical interfaces:

denyinterfaces eth0
denyinterfaces wlan0

Ref: https://www.raspberrypi.org/forums/viewtopic.php?p=798866#p798866

* Centos 7
----------

In order to setup the linux bridge on Centos 7, it is required to edit
files under /etc/sysconfig/network-scripts/

For example, assuming we want to create a linux bridge br0 attached
to physical NIC eno1, we can configure NIC configuration files as
follows

[mainardi@develv5 ~]$ cat /etc/sysconfig/network-scripts/ifcfg-br0
DEVICE=br0
TYPE=Bridge
BOOTPROTO=dhcp
STP=no
NAME=br0
ONBOOT=yes

[mainardi@develv5 ~]$ cat /etc/sysconfig/network-scripts/ifcfg-eno1
DEVICE=eno1
HWADDR=
ONBOOT=yes
NETMASK=
GATEWAY=
TYPE=Ethernet

# Bridge
BRIDGE=br0

Having set up network interfaces as above, and assuming the interface
that faces clients is enp7s0f1, then ntopng can be started
as follows:

# ntopng -i bridge:br0,enp7s0f1 -w 80,3000

It may be necessary to manually bring interface enp7s0f1 up with

# ifconfing enp7s0f1 up

Enabling Captive Portal
-----------------------
Captive portal is used to authenticate legitimate users and bind them to the
correct host pool. In order to enable this feature
- you need the enterprise version of ntopng
- the captive portal option must be enabled in the ntopng preferences menu
- ntopng must be active on port 80 (and port a different port) for authenticating users (-w 80,3000)
- ntopng can be activated also on port 443 (-W 443) for authenticating users over SSL (e.g., when they require a page over HTTPS)
- you can optionally start ntopng also in SSL (port 443) but you must have port 80 active

When the captive portal is used, port 80 is used only for that purpose (i.e. it cannot be
used to connect to the ntop GUI), whereas ntopng users can connect to port 3000. Please
refer to README.captive_portal for more information about this topic.

