Linux Network Configuration and Troubleshooting

# Linux Network Configuration and Troubleshooting

Introduction

Network configuration and troubleshooting are essential Linux system administration skills. From setting IP addresses and routing to diagnosing connectivity issues, Linux administrators must be proficient with both traditional and modern networking tools.

This tutorial covers Linux network configuration using iproute2, Netplan, and NetworkManager, DNS configuration, static and dynamic IP addressing, routing, firewall configuration with nftables and iptables, and network troubleshooting using ping, traceroute, ss, tcpdump, and other tools.

By the end of this guide, you will be able to configure and troubleshoot Linux networking in production environments.

Technical Background

Linux Network Stack

Application Layer (HTTP, SSH, DNS)
      ↓
Transport Layer (TCP, UDP)
      ↓
Network Layer (IP, ICMP, routing)
      ↓
Data Link Layer (Ethernet, ARP)
      ↓
Physical Layer (NIC, cable, wireless)

Network Configuration Tools

| Tool | Description | Best For | |------|-------------|----------| | ip (iproute2) | Modern Linux network configuration | Most Linux distributions | | netplan | YAML-based network configuration | Ubuntu Server | | NetworkManager | Desktop/server network management | RHEL, Fedora, Ubuntu Desktop | | ifconfig | Legacy network configuration | Older systems (deprecated) | | route | Legacy routing table management | Older systems (deprecated) |

Network Interfaces

| Interface Type | Description | |----------------|-------------| | eth0 | First Ethernet interface | | enp3s0 | Predictable network interface name (PCI bus) | | wlan0 | Wireless interface | | lo | Loopback interface | | bond0 | Bonded/aggregated interface | | br0 | Network bridge | | virbr0 | Virtual bridge (libvirt) |

Prerequisites

• Linux system with root or sudo access
• Network connectivity to test
• Understanding of TCP/IP networking (IP addresses, subnet masks, gateways, DNS)

Architecture

Network Configuration Flow

Physical NIC
      ↓
Kernel Network Driver
      ↓
Network Interface (eth0/enp3s0)
      ↓
IP Address Configuration
      ↓
Routing Table
      ↓
DNS Resolution
      ↓
External Network Access

Routing Table Example

default via 192.168.1.1 dev eth0 proto dhcp metric 100
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.50 metric 100
10.0.0.0/24 via 192.168.1.1 dev eth0 proto static metric 100

Step-by-Step Implementation

Step 1: Identify Network Interfaces

**Purpose**: List all network interfaces and their current state.

**Commands**:

# List all network interfaces
ip link show

# Show brief interface summary
ip -brief link show

# Show detailed interface information
ip addr show

# Show only IPv4 addresses
ip -4 addr show

# Show interface statistics
ip -s link show eth0

**Expected output**: List of interfaces with names, states, MAC addresses, and IP addresses.

**Verification**:

ip link show
# Shows interfaces with state (UP, DOWN, UNKNOWN)

Step 2: Configure IP Address (Temporary)

**Purpose**: Assign an IP address to an interface (temporary, lost on reboot).

**Commands**:

# Assign IP address and subnet mask
sudo ip addr add 192.168.1.50/24 dev eth0

# Bring interface up
sudo ip link set eth0 up

# Add default gateway
sudo ip route add default via 192.168.1.1

# Verify configuration
ip addr show eth0
ip route show

**Explanation**: Temporary configuration is useful for testing but does not persist across reboots. Use Netplan or NetworkManager for persistent configuration.

**Expected output**: Interface has IP address and default route.

**Verification**:

ping 192.168.1.1
# Should succeed if gateway is reachable

Step 3: Configure Persistent Networking with Netplan (Ubuntu)

**Purpose**: Configure persistent network settings using Netplan YAML configuration.

**Commands**:

# List Netplan configuration files
ls /etc/netplan/

# Edit Netplan configuration
sudo nano /etc/netplan/00-installer-config.yaml

**Example Netplan Configuration (DHCP)**:

network:
  version: 2
  ethernets:
    eth0:
      dhcp4: true

**Example Netplan Configuration (Static IP)**:

network:
  version: 2
  ethernets:
    eth0:
      addresses:
        - 192.168.1.50/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses:
          - 8.8.8.8
          - 1.1.1.1

**Apply Netplan configuration**:

# Test configuration (reverts on error)
sudo netplan try

# Apply configuration
sudo netplan apply

# Verify
ip addr show eth0
ip route show

**Expected output**: Network configuration persists across reboots.

**Verification**:

# Reboot and verify
sudo reboot
# After reboot, IP address should still be configured

Step 4: Configure Networking with NetworkManager (RHEL/Fedora)

**Purpose**: Configure network using NetworkManager CLI (nmcli).

**Commands**:

# Show network connections
nmcli connection show

# Show device status
nmcli device status

# Create static IP connection
sudo nmcli connection add type ethernet con-name eth0-static ifname eth0 \
  ipv4.addresses 192.168.1.50/24 \
  ipv4.gateway 192.168.1.1 \
  ipv4.dns "8.8.8.8 1.1.1.1" \
  ipv4.method manual

# Activate connection
sudo nmcli connection up eth0-static

# Verify
nmcli device show eth0

**Expected output**: NetworkManager manages interface with static IP.

**Verification**:

nmcli connection show eth0-static
# Shows connection details

Step 5: Configure DNS

**Purpose**: Configure DNS resolution for hostname lookup.

**Commands**:

# View current DNS configuration
cat /etc/resolv.conf

# View systemd-resolved status
systemd-resolve --status

# Or with resolvectl
resolvectl status

# Add DNS servers temporarily
sudo resolvectl dns eth0 8.8.8.8 1.1.1.1

# Add DNS search domain
sudo resolvectl domain eth0 ~ityantra.lab

**Example /etc/resolv.conf**:

nameserver 8.8.8.8
nameserver 1.1.1.1
search ityantra.lab
options timeout:2 attempts:3

**Expected output**: DNS resolution works for hostnames.

**Verification**:

nslookup google.com
dig google.com +short
getent hosts google.com

Step 6: Configure Static Routes

**Purpose**: Add custom routing table entries for specific networks.

**Commands**:

# Add temporary static route
sudo ip route add 10.0.0.0/24 via 192.168.1.1 dev eth0

# View routing table
ip route show

# Delete route
sudo ip route delete 10.0.0.0/24

**Expected output**: Route added; traffic for 10.0.0.0/24 goes through specified gateway.

**Verification**:

ip route get 10.0.0.50
# Shows route to 10.0.0.50 via 192.168.1.1

Step 7: Configure Firewall with nftables

**Purpose**: Configure host-based firewall rules.

**Commands** (nftables - modern replacement for iptables):

# List current rules
sudo nft list ruleset

# Allow SSH
sudo nft add rule inet filter input tcp dport 22 accept

# Allow HTTP/HTTPS
sudo nft add rule inet filter input tcp dport { 80, 443 } accept

# Allow established connections
sudo nft add rule inet filter input ct state established,related accept

# Allow loopback
sudo nft add rule inet filter input iif lo accept

# Drop all other inbound traffic
sudo nft add rule inet filter input drop

# Save rules (Debian/Ubuntu)
sudo netfilter-persistent save

**Example nftables configuration file** (`/etc/nftables.conf`):

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        iif lo accept
        ct state established,related accept
        ip protocol icmp accept
        tcp dport 22 accept
        tcp dport { 80, 443 } accept
    }
    chain forward {
        type filter hook forward priority 0; policy drop;
    }
    chain output {
        type filter hook output priority 0; policy accept;
    }
}

**Expected output**: Firewall rules active; only allowed traffic passes.

**Verification**:

sudo nft list ruleset
# Shows active firewall rules

Step 8: Network Troubleshooting Tools

**Purpose**: Diagnose network connectivity issues.

**Commands**:

# Test basic connectivity
ping -c 4 8.8.8.8
ping -c 4 google.com

# Trace network path
traceroute 8.8.8.8
mtr -rwc 10 8.8.8.8

# Check listening ports
ss -tlnp
ss -ulnp

# Check all connections
ss -tanp

# Check specific port
ss -tlnp | grep 22

# Capture packets
sudo tcpdump -i eth0 -c 10

# Capture specific host
sudo tcpdump -i eth0 host 192.168.1.50

# DNS troubleshooting
dig google.com
nslookup google.com
host google.com

# Check ARP table
ip neigh show

# Check interface statistics
ip -s link show eth0

# Check for dropped packets
ip -s link show eth0 | grep -A 5 RX

**Expected output**: Diagnostic information to identify network issues.

**Verification**:

# All tools return expected output for diagnosis

Configuration Examples

Complete Netplan Configuration with Bonding

network:
  version: 2
  ethernets:
    enp3s0:
      dhcp4: false
    enp4s0:
      dhcp4: false
  bonds:
    bond0:
      dhcp4: true
      interfaces:
        - enp3s0
        - enp4s0
      parameters:
        mode: active-backup
        primary: enp3s0

iptables Rules (Legacy)

# Allow SSH
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow loopback
sudo iptables -A INPUT -i lo -j ACCEPT

# Drop all other input
sudo iptables -A INPUT -j DROP

# Save rules
sudo iptables-save > /etc/iptables/rules.v4

/etc/hosts File

127.0.0.1   localhost
192.168.1.10  server01.ityantra.lab  server01
192.168.1.11  server02.ityantra.lab  server02

/etc/nsswitch.conf (Name Service Switch)

hosts:          files mdns4_minimal [NOTFOUND=return] dns myhostname

Verification

Network Verification Commands

ip addr show              -- Interface IP addresses
ip route show             -- Routing table
ip neigh show             -- ARP neighbor table
ss -tlnp                  -- Listening TCP ports
ss -ulnp                  -- Listening UDP ports
resolvectl status         -- DNS configuration (systemd-resolved)
cat /etc/resolv.conf      -- DNS configuration (traditional)
ping -c 4 <host>          -- Basic connectivity
traceroute <host>         -- Path to host

Expected Results

• Interfaces have correct IP addresses
• Default route points to correct gateway
• DNS resolves hostnames correctly
• Expected ports are listening
• Ping to gateway and external hosts succeeds
• Firewall rules block unwanted traffic

Troubleshooting

| Symptom | Possible Cause | Diagnostic Command | Corrective Action | Verification | |---------|---------------|-------------------|-------------------|--------------| | No IP address | DHCP failed or interface down | `ip addr show eth0` | Renew DHCP or set static IP | IP assigned | | Cannot reach gateway | Wrong subnet or cable issue | `ip neigh show` | Check cabling; verify subnet | Gateway reachable | | Cannot reach external | Missing default route or DNS | `ip route show default` | Add default route; check DNS | External ping works | | Cannot resolve hostname | DNS misconfiguration | `cat /etc/resolv.conf`; `dig` | Fix DNS servers | Hostname resolves | | Port not listening | Service not running | `ss -tlnp | grep <port>` | Start service | Port shows LISTEN | | Connection refused | Firewall blocking | `sudo nft list ruleset` | Add firewall rule | Connection succeeds | | High latency | Network congestion | `mtr <host>` | Contact ISP; optimize routing | Latency improves | | Packet loss | Bad cable or interface errors | `ip -s link show` | Replace cable; check interface | Loss drops to 0% | | DNS slow | Remote DNS slow | `dig @8.8.8.8 google.com` | Use local or faster DNS | DNS faster | | Interface down | Cable unplugged or admin down | `ip link show eth0` | Connect cable; `ip link set eth0 up` | Interface UP |

Best Practices

1. **Use persistent configuration**: Netplan or NetworkManager for settings that survive reboots. 2. **Use predictable interface names**: Modern Linux uses bus-based names (enp3s0) instead of eth0. 3. **Test with ip route get**: Verify routing to specific destinations. 4. **Use ss instead of netstat**: ss is faster and provides more information. 5. **Document network configuration**: Record IP addresses, gateways, DNS, and VLANs. 6. **Use firewall default deny**: Block all traffic by default; explicitly allow required services. 7. **Configure DNS search domains**: Simplifies hostname resolution in local domains. 8. **Monitor interface errors**: Track dropped packets and interface resets. 9. **Use bonding for critical servers**: NIC teaming provides redundancy. 10. **Keep /etc/resolv.conf managed**: Let systemd-resolved or NetworkManager manage it.

Conclusion

Linux network configuration and troubleshooting require proficiency with iproute2 tools, persistent configuration managers (Netplan, NetworkManager), DNS configuration, firewalls, and diagnostic utilities. Understanding the network stack from physical interfaces through routing and DNS enables systematic diagnosis of connectivity issues. Combined with firewall best practices and regular monitoring, these skills form the foundation of reliable Linux network administration.

References

• iproute2 Documentation (https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt)
• Netplan Documentation (https://netplan.io/)
• NetworkManager Documentation (https://networkmanager.dev/)
• nftables Wiki (https://wiki.nftables.org/)
• tcpdump Documentation (https://www.tcpdump.org/)
• Linux Networking Overview (https://www.kernel.org/doc/Documentation/networking/)