Introduction

This is the first release of the GOLEM Network Howto, this document aims to be a sort of unofficial update of the Linux Networking Howto.

General Information about Networking

Sources of non-linux-specific network information

If you are looking for general TCP/IP networking information, here you can find some resources:

IBM TCP/IP Tutorial and Technical Overview

IPv4 Addresses

Internet Protocol v4 Addresses are composed of 4 bytes (32 bit), each byte is converted to a decimal number (0-255) and bytes are separated by a . (dot), for this reason IPv4 addresses are limits to near 4 billions (2³²). Usually every network interface has its own IP address in a format like this: 192.168.0.5

Subnetting

Addresses in a network have some digits in common, that part is called the network portion of the address, the remaining numbers are called the host portion.

For example:

           -----------------  ---------------
           Host Address       192.168.0.23
           Network Portion    192.168.0.
           Host portion                .23
           -----------------  ---------------
           Network Address    192.168.0.0
           Broadcast Address  192.168.0.255
           -----------------  ---------------

Subnetting is a way to subdivide an TCP/IP network. The Classless Inter-Domain Routing (CIDR) is the current method for defining subnet, the IP address is followed by a prefix number between 0 and 32 that shows how many bits represent the network.

192.168.0.23/24 => network 192.168.0.0 - 192.168.0.255
192.168.0.23/16 => network 192.168.0.0 - 192.168.255.255

This method replace the obsolete classful network addressing architecture.

The maximum number of addresses of a network may be calculated as 2^{32 − prefix number}

CIDR	Classful network mask	Number of Hosts	Typical use
/8	255.0.0.0	16777214 = 2²⁴ - 2	Largest IANA block allocation
/9	255.128.0.0	8388608 = 2²³
/10	255.192.0.0	4194304 = 2²²
/11	255.224.0.0	2097152 = 2²¹
/12	255.240.0.0	1048576 = 2²⁰
/13	255.248.0.0	524288 = 2¹⁹
/14	255.252.0.0	262144 = 2¹⁸
/15	255.254.0.0	131072 = 2¹⁷
/16	255.255.0.0	65536 = 2¹⁶
/17	255.255.128.0	32768 = 2¹⁵	ISP / large business
/18	255.255.192.0	16384 = 2¹⁴	ISP / large business
/19	255.255.224.0	8192 = 2¹³	ISP / large business
/20	255.255.240.0	4096 = 2¹²	Small ISP / large business
/21	255.255.248.0	2048 = 2¹¹	Small ISP / large business
/22	255.255.252.0	1024 = 2¹⁰
/23	255.255.254.0	512 = 2⁹
/24	255.255.255.0	256 = 2⁸	Large LAN
/25	255.255.255.128	128 = 2⁷	Large LAN
/26	255.255.255.192	64 = 2⁶	Small LAN
/27	255.255.255.224	32 = 2⁵	Small LAN
/28	255.255.255.240	16 = 2⁴	Small LAN
/29	255.255.255.248	8 = 2³	The smallest multi-host network
/30	255.255.255.252	4 = 2²	Point-to-point links (glue network)
/31	255.255.255.254	2 = 2¹	Point-to-point network (RFC 3021)
/32	255.255.255.255	1 = 2⁰	Single host

Traffic between subnets is guaranteed by routers.

IPv6 Addresses

IPv6

Network Configuration

Driver

Modern Linux distributions already include driver for most of LAN and WiFi devices. Otherwise try to upgrade your OS or compile and install a newer kernel.

Network tools

iproute2: IP Routing Utilities

nftables: Linux kernel packet control tool (firewall)

iputils: arping, clockdiff, ping, tracepath

Legacy tools

net-tools: configuration tools for Linux networking (arp, ifconfig, ipmaddr, iptunnel, mii-tool, nameif, netstat, plipconfig, rarp, route, slattach)

iptables: Linux kernel packet control tool (firewall)

Network Application Programs

Most common network applications, derived from the 4.4BSDLite2 distribution, are collected in the inetutils package: dnsdomainname, ftp, ftpd, hostname, ifconfig, ping, rcp, rlogin, rlogind, rsh, rshd, talk, talkd, telnet, telnetd, whois

Setup LAN Interfaces

Predictable Network Interface Names

Starting with v197 systemd assign fixed and predictable network interface names for all local network devices instead of the traditional eth0, eth1, wlan0 which may change after a reboot post kernel update. This feature simplify the system management and fix potential security implications e.g., changing firewall rules.

These names are based on hardware firmware/topology/location information and they stay fixed even if hardware is added or removed.

Prefix	Description
en	Ethernet
ib	InfiniBand
sl	Serial line IP (slip)
wl	Wireless local area network (WLAN)
ww	Wireless wide area network (WWAN)

eth0 could be renamed enp6s0: en (ethernet) + p6 (bus 6) + s0 (slot 0)

Manual managing

The following commands activates the enp6s0 interface with the IP 192.168.0.2, for the subnet 192.168.0.1-255, using the router-gateway 192.168.0.1

# ip addr add 192.168.0.2/24 dev enp6s0
# ip route add default via 192.168.0.1

Edit the /etc/resolv.conf file adding a list of DNS IP addresses for enabling the address resolution

nameserver 8.8.8.8
nameserver 1.1.1.1

For a non fixed IP address in a LAN with a DHCP server just run

# dhcpcd enp6s0

Useful commands

Show devices IP addresses

# ip addr

Show information of a specific interface

# ip addr show enp6s0

Add IP addresses on a device

# ip addr add 192.0.2.10/24 dev enp6s0

Delete a device IP

# ip addr delete 192.0.2.10/24 dev enp6s0

Enabling the interface enp6s0 without specifying an IP

# ip link set dev enp6s0 up

Disabling the interface enp6s0

# ip link set dev enp6s0 down

Set 192.168.0.2 as default gateway for the host

# ip route add default via 192.0.2.1

Add the gateway 192.168.0.1 route for the interfaces enp2s0 10.0.2.0

# ip route add 10.0.2.1/24 via 192.168.0.1 dev enp2s0

Remove the gateway 192.168.0.1 route for the interfaces enp2s0 10.0.2.0

# ip route del 10.0.2.0/24 via 192.168.0.1 dev enp2s0

Show the routing table

# ip route show

Configuration Files

systemd-networkd is a system service, part of systemd, for the network configuration management.

Enable the systemd-networkd daemon

# systemctl enable --now systemd-networkd.service

Enable and set the DNS

# systemctl enable --now systemd-resolved.service
# ln -rsf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

DHCP

/etc/systemd/network/20-wired.network

[Match]
Name=enp1s0
[Network]
DHCP=yes

IP statico

/etc/systemd/network/20-wired.network

[Match]
Name=enp1s0
[Network]
Address=10.1.10.9/24
Gateway=10.1.10.1
DNS=10.1.10.1

Setup WLAN Interfaces

Rename a network interface

Create and edit a .link file

/etc/systemd/network/10-ethusb0.link

[Match]
MACAddress=12:34:56:78:90:ab
[Link]
Description=USB to Ethernet Adapter
Name=ethusb0

Sharing Internet connection

Abilitazione del forwarding dei pacchetti

$ sudo echo 1 > /proc/sys/net/ipv4/ip_forward

Per rendere il forwarding definitivo editare il file /etc/sysctl.conf modificando come segue il parametro net.ipv4.ip_forward:

net.ipv4.ip_forward = 1

Mascheramento dei pacchetti

$ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

eth0 non è un parametro fisso, identifica l'interfaccia con la quale il PC si connette ad Internet

Per applicare automaticamente tale regola ad ogni riavvio

# iptables-save > /etc/iptables.ipv4.nat
# iptables-restore < /etc/iptables.ipv4.nat

Assicurarsi che siano caricati i seguenti moduli del kernel:

# modprobe ip_tables
# modprobe ip_conntrack
# modprobe iptable_nat
# modprobe ipt_MASQUERADE

Condivisione tramite rete ethernet

Assegnare un IP statico alla scheda ethernet con la quale si vuol condividere la connessione.

# ifconfig eth1 192.168.5.1 netmask 255.255.255.0 up

Per rendere tale configurazione permanente sarà necessario editare il file /etc/network/interfaces ed aggiungere la seguente configurazione

auto eth1
iface eth1 inet static
address 192.168.5.1
netmask 255.255.255.0

Condivisione tramite rete WI-FI

Configurazione scheda wireless

Se non si desidera cifrare la rete e proteggerla con una password sarà sufficiente eseguire questi comandi.

# iwconfig wlan0 mode Master
# iwconfig wlan0 ESSID ReteGOLEM
# iwconfig wlan0 enc off
# ifconfig wlan0 192.168.5.1 netmask 255.255.255.0 up

Proteggere la connessione WI-FI

Installare il programma hostapd

Configurare hostapd modificando /etc/hostapd/hostapd.conf

# Interfaccia di rete
interface=wlan0
# Driver della scheda wifi usata (non tutte le schede sono supportate)
driver=nl80211
# Nome della rete (SSID)
ssid=ReteGOLEM
hw_mode=g
# Canale di trasmissione
channel=6
macaddr_acl=0
# Righe per la protezione
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
# Password del wifi
wpa_passphrase=password
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

Editare il file /etc/default/hostapd per impostare hostapd.conf come file di configurazione predefinito, modificando la riga DAEMON_CONF="":

DAEMON_CONF="/etc/hostapd/hostapd.conf"

Assegnazione automatica degli IP ai client

Install dhcp

Editare /etc/dhcpd.conf aggiungendo la configurazione per la rete interna (es.: eth1 o wlan0):

subnet 192.168.5.0 netmask 255.255.255.0 {
range 192.168.5.100  192.168.5.200;
option domain-name-servers 8.8.8.8;
}

Riavviare il servizio

# systemctl restart dhcpd

https://wiki.golem.linux.it/Appunti_Arch_Linux#Networking

Firewall

Block ports, transparent proxy...

https://wiki.archlinux.org/title/Nftables

https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking#assembly_creating-and-managing-nftables-tables-chains-and-rules_getting-started-with-nftables

https://guide.debianizzati.org/index.php/Nftables

https://home.regit.org/netfilter-en/nftables-quick-howto/

https://wiki.nftables.org/wiki-nftables/index.php/Main_Page

Routing Protocol

Bird Internet Routing Daemon

Bibliography

Linux Networking HOWTO

Net-HOWTO

Indice