This two-phase practical assignment guided students from building a low-level tunneling and VPN core to developing a managed network service with authentication, traffic monitoring, quota control, a web dashboard, and firewall rules.
| Item | Details |
|---|---|
| Course | Computer Networks |
| University | Isfahan University of Technology |
| Semester | Spring 2026 / 1405 |
| Instructor | Dr. Ali Fanian |
| Head Teaching Assistant | Mohammad Bazazzadeh |
| Teaching Assistants | Reyhaneh Afsharzadeh, Mohammadhossein Payafar, Yalda Jafari, Ali Tahvilian |
The course organization used template repositories for this project. Each student team was expected to create a private repository from the template and continue development there.
This made it possible to:
- monitor progress throughout the semester;
- review commit history and development discipline;
- evaluate implementation decisions gradually instead of only checking the final submission;
- keep each team's code private while preserving a shared project structure;
- provide a public showcase of the assignment design for future semesters.
The assignment asked students to build a simplified VPN-like system from scratch. Instead of using ready-made VPN tools such as OpenVPN, WireGuard, or IPsec, students had to implement the core behavior themselves using direct TCP socket programming, TUN interfaces, encryption, packet handling, and server-side traffic forwarding.
The project was intentionally split into two phases:
- Phase 1: implement the low-level data plane.
- Phase 2: add the control plane, service management, monitoring, and user-facing features.
Phase 1 focused on the networking core of the system.
Students implemented a client-server architecture in which the client captured operating-system IP traffic through a virtual TUN interface, encapsulated and encrypted packets, and sent them to the server over a TCP tunnel. The server decrypted the packets, forwarded them to the destination network using NAT or masquerading, then returned responses through the same tunnel.
Main requirements included:
- creating and managing a virtual TUN network interface;
- capturing Layer 3 IP packets from the operating system;
- building a custom message format over TCP;
- preserving packet boundaries over TCP's byte stream;
- encrypting all tunnel traffic before transmission;
- forwarding traffic through the server using NAT;
- proving that traffic passed through the TUN interface rather than through a normal software proxy;
- testing behavior when direct access from the client to a destination was blocked.
By completing this phase, students gained hands-on experience with transport-layer programming, virtual network interfaces, packet encapsulation, TCP stream handling, encryption, routing, and NAT.
Phase 2 extended the raw tunneling core into a manageable network service.
In this phase, students added authentication, authorization, accounting, traffic monitoring, user quota management, an admin web dashboard, a client portal, and user-space firewall rules. The goal was to show that a real network service needs more than packet forwarding: it also needs identity, policy enforcement, observability, and operational control.
Main requirements included:
- implementing AAA using a centralized database such as SQLite;
- authenticating clients before allowing tunnel traffic;
- rejecting inactive, banned, or quota-exhausted users;
- tracking active sessions, connection time, upload, and download usage;
- applying bandwidth rate limits in user space;
- enforcing total traffic quotas per user;
- building a web admin dashboard for monitoring users and traffic;
- recording destination IP addresses, ports, timestamps, and domain names where possible;
- allowing admins to disconnect active users;
- creating a user portal for account status and quota extension;
- managing login sessions with secure token-based authentication;
- implementing firewall rules based on destination IP, port, and client scope.
By completing this phase, students practiced combining systems programming with web development, database-backed service management, access control, traffic accounting, and network security policy enforcement.
The project also included optional bonus features for teams that wanted to go beyond the baseline requirements:
- maintaining a clean and meaningful GitHub workflow;
- multiplexing multiple logical tunnels over a single TCP connection;
- adding heartbeat and keep-alive messages;
- implementing packet fragmentation and reassembly in user space;
- adding load balancing between multiple servers;
- demonstrating a Man-in-the-Middle attack against unencrypted HTTP traffic;
- supporting advanced firewall rules such as domain filtering or application-layer protocol filtering.
After completing both phases, students were expected to understand:
- how VPN-like tunnels move packets between user space and the network;
- how TCP sockets behave as byte streams and why framing is necessary;
- how virtual TUN interfaces expose Layer 3 packets to applications;
- how encryption fits into a custom transport protocol;
- how NAT changes traffic visibility at the destination;
- how authentication and authorization protect network services;
- how traffic accounting and quotas are implemented;
- how admin dashboards and client portals interact with a network service core;
- how firewall rules can be enforced in user space;
- how Git history reflects real engineering progress.
This repository can be used as a reference for designing future course projects around practical networking. The assignment works best when students are required to develop incrementally in private repositories, document their design decisions, and demonstrate the behavior of their system in a controlled network environment.