The peer, at 10.99.0.2 (name peer), stands in for the other VM, on this VM's second network, 10.99.0.0/24 (this VM is 10.99.0.1 there, on interface le-host). It plays the RADIUS client (the access point) and the victim of your rogue router. Get a shell there with sudo ip netns exec lepeer bash; it shares this VM's files and programs.

Somebody has also put a rogue DHCP server on that network. Write answers to the files in /root/lab-answers/. The firewall, if it's running, is yours to open. The wireless parts of the chapter need real Wi-Fi hardware and aren't part of this lab.

Tasks

Install FreeRADIUS and its client tools (freeradius-utils). Let the server accept requests from 10.99.0.0/24 with the secret lab-radius-secret, add the user alice with the password alice-lab-pass and the reply message Hello, alice (from the user name), and run it, enabled at boot. From the peer, radtest with the right password must be accepted (with PAP and with MS-CHAP), and with a wrong one rejected. Open the firewall for RADIUS if it's running.
Capture the RADIUS traffic on le-host with tshark while you send an accepted and a rejected request from the peer, into /root/radius.pcapng, and read it with display filters and statistics.
Play a rogue router: advertise the prefix fd00:bad:30::/64 on le-host with radvd. In the peer, see the new address and default route, and find the MAC address the advertisements come from with tcpdump; write it to /root/lab-answers/3. Then stop the rogue router so that the peer drops the route, and turn forwarding on le-host off again.
Find the rogue DHCP server from this VM by asking on le-host (nmap's broadcast-dhcp-discover script), and write the router address it offers to /root/lab-answers/4.

Hints

RHEL family: /etc/raddb, service radiusd; run /etc/raddb/certs/bootstrap (in that directory) once, or the EAP module won't load. Ubuntu: /etc/freeradius/3.0, service freeradius. A client NAME { ipaddr = ...; secret = ... } block in clients.conf; mods-config/files/authorize: alice Cleartext-Password := "...", then an indented Reply-Message := "Hello, %{User-Name}". radiusd -XC or freeradius -XC. In the peer, radtest [-t mschap] USER PASS 10.99.0.1 0 SECRET 0 10.99.0.2: the last two are a PPP hint and the client's own address, which radtest otherwise looks up by host name, and the peer has no DNS.
tshark -i le-host -f "udp port 1812" -a duration:20 -w FILE in the background; tshark -r FILE -Y 'radius.code == 3', -q -z io,phs, -q -z conv,udp. Code 1 is Access-Request, 2 Access-Accept, 3 Access-Reject.
/etc/radvd.conf: interface le-host { AdvSendAdvert on; ... prefix fd00:bad:30::/64 { }; };; sysctl -w net.ipv6.conf.le-host.forwarding=1. In the peer: ip -6 addr, ip -6 route, tcpdump -i le-peer -nn -e 'icmp6 and ip6[40] == 134'.
nmap --script broadcast-dhcp-discover -e le-host.