Chapter 5. network setup
Let’s review the basic network infrastructure on the modern Debian system.
Table 5.1. List of network configuration tools
| packages | popcon | size | type | description |
|---|---|---|---|---|
ifupdown | V:587, I:991 | 217 | config::ifupdown | standardized tool to bring up and down the network (Debian specific) |
ifplugd | V:3, I:18 | 217 | , , | manage the wired network automatically |
ifupdown-extra | V:0, I:1 | 106 | , , | network testing script to enhance “ifupdown” package |
ifmetric | V:0, I:1 | 37 | , , | set routing metrics for a network interface |
guessnet | V:0, I:0 | 422 | , , | mapping script to enhance “ifupdown” package via “/etc/network/interfaces” file |
ifscheme | V:0, I:0 | 59 | , , | mapping scripts to enhance “ifupdown” package |
network-manager | V:358, I:440 | 14957 | config::NM | NetworkManager (daemon): manage the network automatically |
network-manager-gnome | V:132, I:372 | 5540 | , , | NetworkManager (GNOME frontend) |
wicd | I:24 | 36(*) | config::wicd | wired and wireless network manager (metapackage) |
wicd-cli | V:0, I:1 | 60(*) | , , | wired and wireless network manager (command-line client) |
wicd-curses | V:0, I:3 | 176(*) | , , | wired and wireless network manager (Curses client) |
wicd-daemon | V:19, I:26 | 992(*) | , , | wired and wireless network manager (daemon) |
wicd-gtk | V:15, I:25 | 576(*) | , , | wired and wireless network manager (GTK client) |
iptables | V:300, I:993 | 2520 | config::Netfilter | administration tools for packet filtering and NAT (Netfilter) |
iproute2 | V:672, I:926 | 2867 | config::iproute2 | iproute2, IPv6 and other advanced network configuration: ip(8), tc(8), etc |
ifrename | V:0, I:3 | 125 | , , | rename network interfaces based on various static criteria: ifrename(8) |
ethtool | V:102, I:261 | 597 | , , | display or change Ethernet device settings |
iputils-ping | V:234, I:997 | 113 | test::iproute2 | test network reachability of a remote host by hostname or IP address (iproute2) |
iputils-arping | V:8, I:127 | 55 | , , | test network reachability of a remote host specified by the ARP address |
iputils-tracepath | V:4, I:60 | 72 | , , | trace the network path to a remote host |
net-tools | V:234, I:634 | 991 | config::net-tools | NET-3 networking toolkit (net-tools, IPv4 network configuration): ifconfig(8) etc. |
inetutils-ping | V:0, I:1 | 359 | test::net-tools | test network reachability of a remote host by hostname or IP address (legacy, GNU) |
arping | V:2, I:29 | 77 | , , | test network reachability of a remote host specified by the ARP address (legacy) |
traceroute | V:63, I:936 | 159 | , , | trace the network path to a remote host (legacy, console) |
isc-dhcp-client | V:231, I:979 | 686 | config::low-level | DHCP client |
wpasupplicant | V:332, I:507 | 3436 | , , | client support for WPA and WPA2 (IEEE 802.11i) |
wpagui | V:0, I:2 | 781 | , , | Qt GUI client for wpa_supplicant |
wireless-tools | V:188, I:254 | 297 | , , | tools for manipulating Linux Wireless Extensions |
ppp | V:206, I:474 | 1054 | , , | PPP/PPPoE connection with chat |
pppoeconf | V:0, I:8 | 192 | config::helper | configuration helper for PPPoE connection |
pppconfig | V:1, I:2 | 801 | , , | configuration helper for PPP connection with chat |
wvdial | V:0, I:5 | 249 | , , | configuration helper for PPP connection with wvdial and ppp |
mtr-tiny | V:6, I:54 | 161 | test::low-level | trace the network path to a remote host (curses) |
mtr | V:4, I:43 | 214 | , , | trace the network path to a remote host (curses and GTK ) |
gnome-nettool | V:2, I:45 | 2105 | , , | tools for common network information operations (GNOME) |
nmap | V:31, I:253 | 4452 | , , | network mapper / port scanner (Nmap, console) |
zenmap | V:2, I:9 | 2939 | , , | network mapper / port scanner (GTK ) |
tcpdump | V:19, I:204 | 1329 | , , | network traffic analyzer (Tcpdump, console) |
wireshark | I:55 | 64 | , , | network traffic analyzer (Wireshark, GTK ) |
tshark | V:3, I:34 | 407 | , , | network traffic analyzer (console) |
tcptrace | V:0, I:3 | 401 | , , | produce a summarization of the connections from tcpdump output |
snort | V:0, I:1 | 2206 | , , | flexible network intrusion detection system (Snort) |
ntopng | V:1, I:2 | 969 | , , | display network usage in web browser |
dnsutils | V:64, I:517 | 256 | , , | network clients provided with BIND: nslookup(8), nsupdate(8), dig(8) |
dlint | V:0, I:7 | 53 | , , | check DNS zone information using nameserver lookups |
dnstracer | V:0, I:2 | 61 | , , | trace a chain of DNS servers to the source |
The hostname resolution is currently supported by the NSS (Name Service Switch) mechanism too. The flow of this resolution is the following.
The “
/etc/nsswitch.conf” file with stanza like “hosts: files dns” dictates the hostname resolution order. (This replaces the old functionality of the “order” stanza in “/etc/host.conf“.)The
filesmethod is invoked first. If the hostname is found in the “/etc/hosts” file, it returns all valid addresses for it and exits. (The “/etc/host.conf” file contains “multi on“.)The
dnsmethod is invoked. If the hostname is found by the query to the Internet Domain Name System (DNS) identified by the “/etc/resolv.conf” file, it returns all valid addresses for it and exits.
For example, “/etc/hosts” looks like the following.
127.0.0.1 localhost 127.0.1.1 <host_name> # The following lines are desirable for IPv6 capable hosts ::1 ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters ff02::3 ip6-allhosts
Each line starts with a IP address and it is followed by the associated hostname.
The IP address 127.0.1.1 in the second line of this example may not be found on some other Unix-like systems. The Debian Installer creates this entry for a system without a permanent IP address as a workaround for some software (e.g., GNOME) as documented in the bug #719621.
The <host_name> matches the hostname defined in the “/etc/hostname“.
For a system with a permanent IP address, that permanent IP address should be used here instead of 127.0.1.1.
For a system with a permanent IP address and a fully qualified domain name (FQDN) provided by the Domain Name System (DNS), that canonical <host_name>.<domain_name> should be used instead of just <host_name>.
The “/etc/resolv.conf” is a static file if the resolvconf package is not installed. If installed, it is a symbolic link. Either way, it contains information that initialize the resolver routines. If the DNS is found at IP=”192.168.11.1“, it contains the following.
nameserver 192.168.11.1
The resolvconf package makes this “/etc/resolv.conf” into a symbolic link and manages its contents by the hook scripts automatically.
For the PC workstation on the typical adhoc LAN environment, the hostname can be resolved via Multicast DNS (mDNS, Zeroconf) in addition to the basic files and dns methods.
The hostname resolution via deprecated NETBios over TCP/IP used by the older Windows system can be provided by installing the winbind package. The “/etc/nsswitch.conf” file should have stanza like “hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4 wins” to enable this functionality. (Modern Windows system usually use the dns method for the hostname resolution.)
The network interface name, e.g. eth0, is assigned to each hardware in the Linux kernel through the user space configuration mechanism, udev (see Section 3.3, “The udev system”), as it is found. The network interface name is referred as physical interface in ifup(8) and interfaces(5).
In order to ensure each network interface to be named persistently for each reboot using MAC address etc., there is a rules file “/etc/udev/rules.d/70-persistent-net.rules“. This file is automatically generated by the “/lib/udev/write_net_rules” program, probably run by the “persistent-net-generator.rules” rules file. You can modify it to change naming rule.
Let us be reminded of the IPv4 32 bit address ranges in each class reserved for use on the local area networks (LANs) by rfc1918. These addresses are guaranteed not to conflict with any addresses on the Internet proper.
Network interfaces are typically initialized in “networking.service” for the lo interface and “NetworkManager.service” for other interfaces on modern Debian desktop system under systemd.
Debian squeeze and newer can manage the network connection via management daemon software such as NetworkManager (NM) (network-manager and associated packages) or Wicd (wicd and associated packages).
These modern network configuration tools need to be configured properly to avoid conflicting with the legacy ifupdown package and its configuration file “/etc/network/interfaces“.
Official documentations for NM and Wicd on Debian are provided in “/usr/share/doc/network-manager/README.Debian” and “/usr/share/doc/wicd/README.Debian“, respectively.
Essentially, the network configuration for desktop is done as follows.
Make desktop user, e.g.
foo, belong to group “netdev” by the following (Alternatively, do it automatically via D-bus under modern desktop environments such as GNOME and KDE).$ sudo adduser foo netdev
Keep configuration of “
/etc/network/interfaces” as simple as in the following.auto lo iface lo inet loopback
Restart NM or Wicd by the following.
$ sudo /etc/init.d/network-manager restart
$ sudo /etc/init.d/wicd restart
Configure your network via GUI.
Under systemd, the network may be configured in /etc/systemd/network/ instead. See systemd-resolved(8), resolved.conf(5), and systemd-networkd(8).
This allows the modern network configuration without GUI.
A DHCP client configuration can be set up by creating “/etc/systemd/network/dhcp.network“. E.g.:
[Match] Name=en* [Network] DHCP=yes
A static network configuration can be set up by creating “/etc/systemd/network/static.network“. E.g.:
[Match] Name=en* [Network] Address=192.168.0.15/24 Gateway=192.168.0.1
When the method described in Section 5.2, “The modern network configuration for desktop” does not suffice your needs, you should use the legacy network connection and configuration method which combines many simpler tools.
The legacy network connection is specific for each method (see Section 5.5, “The network connection method (legacy)”).
There are 2 types of programs for the low level network configuration on Linux (see Section 5.8.1, “Iproute2 commands”).
Although these low level networking programs are powerful, they are cumbersome to use. So high level network configuration systems have been created.
The ifupdown package is the de facto standard for such high level network configuration system on Debian. It enables you to bring up network simply by doing , e.g., “ifup eth0“. Its configuration file is the “/etc/network/interfaces” file and its typical contents are the following.
auto lo iface lo inet loopback auto eth0 iface eth0 inet dhcp
The resolvconf package was created to supplement ifupdown system to support smooth reconfiguration of network address resolution by automating rewrite of resolver configuration file “/etc/resolv.conf“. Now, most Debian network configuration packages are modified to use resolvconf package (see “/usr/share/doc/resolvconf/README.Debian“).
Helper scripts to the ifupdown package such as ifplugd, guessnet, ifscheme, etc. are created to automate dynamic configuration of network environment such as one for mobile PC on wired LAN. These are relatively difficult to use but play well with existing ifupdown system.
These are explained in detail with examples (see Section 5.6, “The basic network configuration with ifupdown (legacy)” and Section 5.7, “The advanced network configuration with ifupdown (legacy)”).
The typical network connection method and connection path for a PC can be summarized as the following.
Here is the summary of configuration scripts for each connection method.
The network connection acronyms mean the following.
The typical modern home and small business network, i.e. LAN, are connected to the WAN (Internet) using some consumer grade broadband router. The LAN behind this router is usually served by the dynamic host configuration protocol (DHCP) server running on the router.
Just install the isc-dhcp-client package for the Ethernet served by the dynamic host configuration protocol (DHCP).
See dhclient.conf(5).
The configuration script pppconfig configures the PPP connection interactively just by selecting the following.
Table 5.6. List of configuration files for the PPP connection with pppconfig
You can test configuration using low level network configuration tools as the following.
$ sudo pon <isp_name> ... $ sudo poff <isp_name>
See “/usr/share/doc/ppp/README.Debian.gz“.
The traditional TCP/IP network setup on the Debian system uses ifupdown package as a high level tool. There are 2 typical cases.
These traditional setup methods are quite useful if you wish to set up advanced configuration; find details in the following.
The ifupdown package provides the standardized framework for the high level network configuration in the Debian system. In this section, we learn the basic network configuration with ifupdown with simplified introduction and many typical examples.
The wireless LAN (WLAN for short) provides the fast wireless connectivity through the spread-spectrum communication of unlicensed radio bands based on the set of standards called IEEE 802.11.
The WLAN interfaces are almost like normal Ethernet interfaces but require some network ID and encryption key data to be provided when they are initialized. Their high level network tools are exactly the same as that of Ethernet interfaces except interface names are a bit different like eth1, wlan0, ath0, wifi0, … depending on the kernel drivers used.
Here are some keywords to remember for the WLAN.
The actual choice of protocol is usually limited by the wireless router you deploy.
You need to install the wpasupplicant package to support the WLAN with the new WPA/WPA2.
In case of the DHCP served IP on WLAN connection, the “/etc/network/interfaces” file entry should be as the following.
allow-hotplug ath0 iface ath0 inet dhcp wpa-ssid homezone # hexadecimal psk is encoded from a plaintext passphrase wpa-psk 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
See “/usr/share/doc/wpasupplicant/README.modes.gz“.
You need to install the wireless-tools package to support the WLAN with the old WEP. (Your consumer grade router may still be using this insecure infrastructure but this is better than nothing.)
In case of the DHCP served IP on WLAN connection, the “/etc/network/interfaces” file entry should be as the following.
allow-hotplug eth0 iface eth0 inet dhcp wireless-essid Home wireless-key1 0123-4567-89ab-cdef wireless-key2 12345678 wireless-key3 s:password wireless-defaultkey 2 wireless-keymode open
See “/usr/share/doc/wireless-tools/README.Debian“.
The “/etc/network/run/ifstate” file stores the intended network configuration states for all the currently active network interfaces managed by the ifupdown package. Unfortunately, even if the ifupdown system fails to bring up the interface as intended, the “/etc/network/run/ifstate” file lists it active.
Unless the output of the ifconfig(8) command for an interface does not have a line like following example, it can not be used as a part of IPV4 network.
inet addr:192.168.11.2 Bcast:192.168.11.255 Mask:255.255.255.0
The functionality of the ifupdown package can be improved beyond what was described in Section 5.6, “The basic network configuration with ifupdown (legacy)” with the advanced knowledge.
The functionalities described here are completely optional. I, being lazy and minimalist, rarely bother to use these.
The ifplugd package is an older automatic network configuration tool which can manage only Ethernet connections. This solves unplugged/replugged Ethernet cable issues for mobile PC etc. If you have NetworkManager or Wicd (see Section 5.2, “The modern network configuration for desktop”) installed, you do not need this package.
This package runs a daemon and replaces auto or allow-hotplug functionalities (see Table 5.10, “List of stanzas in “/etc/network/interfaces“”) and starts interfaces upon their connection to the network.
Here is how to use the ifplugd package for the internal Ethernet port, e.g. eth0.
Now, the network reconfiguration works as you desire.
The ifupdown system automatically runs scripts installed in “/etc/network/*/” while exporting environment variables to scripts.
Here, each environment variable, “$IF_<OPTION>“, is created from the name for the corresponding option such as <option1> and <option2> by prepending “$IF_“, converting the case to the upper case, replacing hyphens to underscores, and discarding non-alphanumeric characters.
The ifupdown-extra package (see Section 5.6.14, “The ifupdown-extra package”) uses these environment variables to extend the functionality of the ifupdown package. The ifmetric package (see Section 5.7.2, “The ifmetric package”) installs the “/etc/network/if-up.d/ifmetric” script which sets the metric via the “$IF_METRIC” variable. The guessnet package (see Section 5.7.8, “Mapping with guessnet”), which provides simple and powerful framework for the auto-selection of the network configuration via the mapping mechanism, also uses these.
Generic network optimization is beyond the scope of this documentation. I touch only subjects pertinent to the consumer grade connection.
Table 5.17. List of network optimization tools
| packages | popcon | size | description |
|---|---|---|---|
iftop | V:7, I:115 | 97 | display bandwidth usage information on an network interface |
iperf | V:4, I:55 | 263 | Internet Protocol bandwidth measuring tool |
ifstat | V:0, I:8 | 60 | InterFace STATistics Monitoring |
bmon | V:1, I:17 | 146 | portable bandwidth monitor and rate estimator |
ethstatus | V:0, I:5 | 40 | script that quickly measures network device throughput |
bing | V:0, I:1 | 80 | empirical stochastic bandwidth tester |
bwm-ng | V:2, I:17 | 90 | small and simple console-based bandwidth monitor |
ethstats | V:0, I:0 | 23 | console-based Ethernet statistics monitor |
ipfm | V:0, I:0 | 78 | bandwidth analysis tool |
The Maximum Transmission Unit (MTU) value can be determined experimentally with ping(8) with “-M do” option which sends ICMP packets with data size starting from 1500 (with offset of 28 bytes for the IP ICMP header) and finding the largest size without IP fragmentation.
For example, try the following
$ ping -c 1 -s $((1500-28)) -M do www.debian.org PING www.debian.org (194.109.137.218) 1472(1500) bytes of data. From 192.168.11.2 icmp_seq=1 Frag needed and DF set (mtu = 1454) --- www.debian.org ping statistics --- 0 packets transmitted, 0 received, 1 errors
Try 1454 instead of 1500
You see ping(8) succeed with 1454.
This process is Path MTU (PMTU) discovery (RFC1191) and the tracepath(8) command can automate this.
In addtion to these basic guide lines, you should know the following.
Here are examples for setting the MTU value from its default 1500 to 1454.
For the DHCP (see Section 5.6.4, “The network interface served by the DHCP”), you can replace pertinent iface stanza lines in the “/etc/network/interfaces” with the following.
iface eth0 inet dhcp pre-up /sbin/ifconfig $IFACE mtu 1454
For the static IP (see Section 5.6.5, “The network interface with the static IP”), you can replace pertinent iface stanza lines in the “/etc/network/interfaces” with the following.
iface eth0 inet static address 192.168.11.100 netmask 255.255.255.0 gateway 192.168.11.1 mtu 1454 dns-domain example.com dns-nameservers 192.168.11.1
For the direct PPPoE (see Section 5.5.5, “The PPPoE connection with pppoeconf”), you can replace pertinent “mtu” line in the “/etc/ppp/peers/dsl-provider” with the following.
mtu 1454
The maximum segment size (MSS) is used as an alternative measure of packet size. The relationship between MSS and MTU are the following.
The TCP throughput can be maximized by adjusting TCP buffer size parameters as described in “TCP Tuning Guide” and “TCP tuning” for the modern high-bandwidth and high-latency WAN. So far, the current Debian default settings serve well even for my LAN connected by the fast 1G bps FTTP service.
Netfilter provides infrastructure for stateful firewall and network address translation (NAT) with Linux kernel modules (see Section 3.3.1, “The kernel module initialization”).
Table 5.19. List of firewall tools
| packages | popcon | size | description |
|---|---|---|---|
iptables | V:300, I:993 | 2520 | administration tools for netfilter (iptables(8) for IPv4, ip6tables(8) for IPv6) |
arptables | V:0, I:2 | 96 | administration tools for netfilter (arptables(8) for ARP) |
ebtables | V:15, I:39 | 265 | administration tools for netfilter (ebtables(8) for Ethernet bridging) |
iptstate | V:0, I:3 | 116 | continuously monitor netfilter state (similar to top(1)) |
shorewall-init | V:0, I:0 | 68 | Shoreline Firewall initialization |
shorewall | V:5, I:13 | 2458 | Shoreline Firewall, netfilter configuration file generator |
shorewall-lite | V:0, I:0 | 65 | Shoreline Firewall, netfilter configuration file generator (light version) |
shorewall6 | V:1, I:2 | 779 | Shoreline Firewall, netfilter configuration file generator (IPv6 version) |
shorewall6-lite | V:0, I:0 | 64 | Shoreline Firewall, netfilter configuration file generator (IPv6, light version) |
Main user space program of netfilter is iptables(8). You can manually configure netfilter interactively from shell, save its state with iptables-save(8), and restore it via init script with iptables-restore(8) upon system reboot.
Configuration helper scripts such as shorewall ease this process.
See documentations at http://www.netfilter.org/documentation/ (or in “/usr/share/doc/iptables/html/“).
Ещё статьи о debian
Рассмотрим более сложную конфигурацию ftp сервера: анонимные пользователи всё так же имеют доступ только на чтение. Локальные пользователи не используются. Вместо них используются виртуальные пользователи, учётные записи которых хранятся…
Ниже я привожу список этих опций сгруппированных по типу — не так как в man – странице. Формат конфигурационного файла vsftpd.conf не сложный. Строки начинающиеся с символа # являются комментариями. Все остальные строки это директивы,…
Вот чем мне нравится Debian, так тем что можно обновить установленную систему на ходу, без какой либо переустановки. На момент написания этой статьи произошла смена стабильного дистрибутива Debian. Вместо Debian 4 Etch, ставшей теперь…
Довольно часто, администрирование сервера на базе Linux происходит посредством удалённого доступа. А основным способом удалённого администрирования является администрирование с помощью SSH. Об этом и пойдёт речь в этой статье. Данная…
Эта статья является часть цикла статей о Debian/GNU Linux и является дополнением к статье «Установка Debian на сервер». В этой статье я расскажу, как произвести разметку диска используя LVM.LVM – это аббревиатура от Logical Volume Manager, что переводится как менеджер…
Изучать операционную систему и применять полученные знания на практике, не заглядывая в документацию, невозможно. Операционные системы Linux/Unix отлично документированы. Можно найти ответ на любой вопрос; нужно только знать где искать:…
Конфигурирование
В качестве примера переключения рассмотрим перенос конфигурации сети по умолчанию в CentOS (/etc/rc.d/init.d/network initscript) на systemd-networkd.
Полностью аналогичо переезд можно осуществить для Fedora и, с небольшими изменениями, для других дистрибутивов. Конфигурационные файлы systemd-networkd находятся в директории /etc/systemd/network. Доступны следующие типы:
- .link – описывают физические параметры каждого интерфейс: имя, MAC, MTU и другие
- .network – описывают параметры сети: IP, маршруты, DNS и другие
- .netdev – описывают виртуальные интерфейсы, мосты
Конфигурация для примера: два интерфейса со статическим IP в LAN и WAN.
$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 04:01:40:23:1f:01 brd ff:ff:ff:ff:ff:ff
inet 188.166.46.238/18 brd 188.166.63.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 2a03:b0c0:2:d0::69:7001/64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::601:40ff:fe23:1f01/64 scope link
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 04:01:40:23:1f:02 brd ff:ff:ff:ff:ff:ff
inet 10.133.248.54/16 brd 10.133.255.255 scope global eth1
valid_lft forever preferred_lft forever
inet6 fe80::601:40ff:fe23:1f02/64 scope link
valid_lft forever preferred_lft forever
Конфигурационные файлы для CentOS (или Fedora) можно найти в директории /etc/sysconfig/network-scripts
$ cat /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE='eth0'
TYPE=Ethernet
BOOTPROTO=none
ONBOOT='yes'
HWADDR=04:01:40:23:1f:01
IPADDR=188.166.46.238
NETMASK=255.255.192.0
GATEWAY=188.166.0.1
NM_CONTROLLED='yes'
IPV6INIT=yes
IPV6ADDR=2A03:B0C0:0002:00D0:0000:0000:0069:7001/64
IPV6_DEFAULTGW=2A03:B0C0:0002:00D0:0000:0000:0000:0001
IPV6_AUTOCONF=no
DNS1=2001:4860:4860::8844
DNS2=2001:4860:4860::8888
DNS3=8.8.8.8Необходимо создать 4 файла в директории /etc/systemd/network/
$ cat /etc/systemd/network/90-external.link
[Match]
MACAddress=04:01:40:23:1f:01
[Link]
Name=eth-outer
$ cat /etc/systemd/network/90-internal.link
[Match]
MACAddress=04:01:40:23:1f:02
[Link]
Name=eth-inner
$ cat eth-external.network
[Match]
Name= eth-outer
[Network]
DHCP=no
Adress=188.166.46.238/18
Adress=2A03:B0C0:0002:00D0:0000:0000:0000:0069:7001/64
Gateway=188.166.0.1
Gateway= 2A03:B0C0:0002:00D0:0000:0000:0000:0000:0001
DNS=2001:4860:4860:8844
DNS=2001:4860:4860:8888
DNS=8.8.8.8
$ cat eth-internal.network
[Match]
Name=eth-inner
[Network]
Address=10.133.248.54/16Вот и всё: конфигурация сети завершена. Теперь можно перезапустить сервис:
systemctl restart systemd-networkd
$ networkctl
IDX LINK TYPE OPERATIONAL SETUP
1 lo loopback n/a n/a
2 eth-outer ether routable configured
3 eth-inner ether routable configured
Другие типы сетей:
DHCP
В данном примере сконфигурируем DHCP IPv4 и IPv6; IPv6 если не нужен, можно исключить.
$ cat /etc/systemd/network/wired-dhcp.network
[Match]
Name=eth*
[Network]
DHCP=ipv4
DHCP=ipv6Подключение типа «Мост»
Сначала создает конфигурацию виртуального интерфейса:
$ cat /etc/systemd/network/bridge.netdev
[NetDev]
Name=br0
Kind=bridge
$ cat /etc/systemd/network/bridge.network
[Match]
Name=br0
[Network]
DHCP=ipv4
И настраиваем интерфейс для подключения:
$ cat /etc/systemd/network/wired.network
[Match]
Name=eth*
[Network]
Bridge=br0Настройка динамического ip-адреса
В некоторых случаях сервер может получать динамический IP-адрес. Чаще всего это зарезервированный адрес или псевдодинамический. Т. е. на DHCP-сервере производится привязка определённого mac-адреса к определённому ip-адресу (об этом читайте в статье «Настройка DHCP в Debian»).
# This file describes the network interfaces available on your system# and how to activate them. For more information, see interfaces(5)
# The loopback network interfaceauto loiface lo inet loopback
# The primary network interfaceallow-hotplug eth0iface eth0 inet dhcp
Вот и всё!В следующей статье мы рассмотрим настройку беспроводной карты в Debian
Ещё статьи о debian
- Рассмотрим более сложную конфигурацию ftp сервера: анонимные пользователи всё так же имеют доступ только на чтение. Локальные пользователи не используются. Вместо них используются виртуальные пользователи, учётные записи которых хранятся…
- Ниже я привожу список этих опций сгруппированных по типу — не так как в man – странице. Формат конфигурационного файла vsftpd.conf не сложный. Строки начинающиеся с символа # являются комментариями. Все остальные строки это директивы,…
- Вот чем мне нравится Debian, так тем что можно обновить установленную систему на ходу, без какой либо переустановки. На момент написания этой статьи произошла смена стабильного дистрибутива Debian. Вместо Debian 4 Etch, ставшей теперь…
- Довольно часто, администрирование сервера на базе Linux происходит посредством удалённого доступа. А основным способом удалённого администрирования является администрирование с помощью SSH. Об этом и пойдёт речь в этой статье. Данная…
- Эта статья является часть цикла статей о Debian/GNU Linux и является дополнением к статье «Установка Debian на сервер». В этой статье я расскажу, как произвести разметку диска используя LVM.LVM – это аббревиатура от Logical Volume Manager, что переводится как менеджер…
- Изучать операционную систему и применять полученные знания на практике, не заглядывая в документацию, невозможно. Операционные системы Linux/Unix отлично документированы. Можно найти ответ на любой вопрос; нужно только знать где искать:…
Настройка статического ip-адреса
И так, наше оборудование функционирует нормально. Нам нужно настроить статический IP-адрес со следующими параметрами: IP-адрес 192.168.123.254, маска подсети 255.255.255.0, основной шлюз 192.168.123.1.Сначала посмотрим вывод команды ifconfig:
# ifconfig
или
$ sudo ifconfig
Второй вариант команды я написал для тех, кто при установке запретил вход суперпользователя. Далее в статье я не буду дублировать команды, просто запомните: если в начале кода есть значок #, значит команда выполняется от имени суперпользователя. Те, кто запретил вход суперпользователя в систему выполняют её с помощью sudo.Если всё было настроено правильно ещё при установке системы, мы увидим следующее:
В первой строке мы видим тип подключения и mac-адрес (по другому — физический адрес). Во второй строке ip-адрес, широковещательный адрес и маску подсети. Третья строка относится к шестой версии стека протоколов TCP/IP, но об этом разговор пойдёт в одной из следующих статей.
А то и не увидим никакой информации. В общих случаях, для проверки или устранения неисправностей можно настроить сетевые интерфейсы с помощью команд ifconfig и route. Об этом будет написано ниже в этой же статье. А пока приступим редактированию файлов конфигураций.
# ifdown eth0
Но в нашем случае интерфейс eth0 ещё не сконфигурирован и мы получим сообщение об ошибке:
interface eth0 not configured
Тогда, для начала, проверяем существование файла /etc/network/interfaces. Если он не существует, то создаём его, если существует, то редактируем текстовым редактором:
# vim /etc/network/interfaces
Для сервера с одним сетевым интерфейсом у нас должно получиться следующее:
# This file describes the network interfaces available on your system# and how to activate them. For more information, see interfaces(5).
# The loopback network interfaceauto loiface lo inet loopback
# The primary network interfaceallow-hotplug eth0iface eth0 inet staticaddress 192.168.123.254netmask 255.255.255.0network 192.168.123.0broadcast 192.168.123.255gateway 192.168.123.1# dns-* options are implemented by the resolvconf package, if installeddns-nameservers 213.177.96.1 213.177.97.1dns-search aitishnik
auto eth0
В комментариях к файлу написано, что этот файл описывает доступные системе сетевые интерфейсы и как их активировать. Для получения большей информации следует посмотреть руководство interfaces(5). В предпоследней строке идёт перечисление через пробел dns-серверов, у вас там, естественно должны быть адреса dns-серверов вашего провайдера или вашей сети.
search aitishniknameserver 213.177.96.1nameserver 213.177.97.1
В первой строке указываем название своей рабочей группы или домена после слова search. Во второй и третьей строках после слов nameserver пишем ip-адреса DNS-серверов вашей сети или вашего провайдера в зависимости от конфигурации вашей сети. Если DNS-сервер один, то третью строку не пишем.
search aitishniknameserver 192.168.123.1
Теперь нужно активировать сетевой интерфейс:
# ifup eth0
И перезапустить сетевые службы:
# /etc/init.d/networking restart
Проверяем что у нас получилось:
# ifconfig
Проверяем работу сети. Сначала проверяем локальный интерфейс (параметр -с 4 подразумевает отправку четырех пакетов):
$ ping 127.0.0.1 -с 4
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.245 ms64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.501 ms64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.140 ms64 bytes from 127.0.0.1: icmp_seq=4 ttl=64 time=0.041 ms
— 127.0.0.1 ping statistics —4 packets transmitted, 4 received, 0% packet loss, time 3007msrtt min/avg/max/mdev = 0.041/0.231/0.501/0.172 ms
Затем проверяем сетевой интерфейс («пингуем» сами себя):
$ ping 192.168.123.254 -с 4
PING 192.168.123.254 (192.168.123.254) 56(84) bytes of data64 bytes from 192.168.123.254: icmp_seq=1 ttl=64 time=0.135 ms64 bytes from 192.168.123.254: icmp_seq=2 ttl=64 time=0.319 ms64 bytes from 192.168.123.254: icmp_seq=3 ttl=64 time=0.170 ms64 bytes from 192.168.123.254: icmp_seq=4 ttl=64 time=0.323 ms
— 192.168.123.254 ping statistics —4 packets transmitted, 4 received, 0% packet loss, time 2999msrtt min/avg/max/mdev = 0.135/0.236/0.323/0.087 ms
Теперь основной шлюз:
$ ping 192.168.123.1 -с 4
PING 192.168.123.1 (192.168.123.1) 56(84) bytes of data64 bytes from 192.168.123.1: icmp_seq=1 ttl=255 time=1.85 ms64 bytes from 192.168.123.1: icmp_seq=2 ttl=255 time=2.02 ms64 bytes from 192.168.123.1: icmp_seq=3 ttl=255 time=1.51 ms64 bytes from 192.168.123.1: icmp_seq=4 ttl=255 time=3.12 ms
— 192.168.123.1 ping statistics —4 packets transmitted, 4 received, 0% packet loss, time 3016msrtt min/avg/max/mdev = 1.514/2.128/3.123/0.605 ms
И какой-нибудь удалённый хост по имени:
