// Connect. Route. Secure.
NETWORKING IS THE LIFEBLOOD OF SERVERS.
Every service runs on a network port. Every server needs an IP. Understanding how data flows through your system is fundamental to being a competent Linux administrator.
FIREWALLS PROTECT WHAT YOU OWN.
iptables isn't just a tool—it's your first line of defense. Learn to block threats, forward ports, and shape traffic. The internet is hostile. Your firewall is your shield.
MASTER THE STACK.
From IP addresses to SSH tunnels, from DNS resolution to packet filtering. This guide takes you from "it works" to "I understand exactly what's happening."
12 lessons. Full network control.
Understand networking fundamentals on Linux systems
BeginnerConfigure IPs, subnets, and interfaces
BeginnerMaster network routing and gateway configuration
IntermediateSet up and troubleshoot DNS resolution
BeginnerBuild basic firewall rules with iptables
IntermediateConfigure network address translation
IntermediateUse ping, traceroute, tcpdump, and netstat
IntermediateSecure remote access and tunneling techniques
AdvancedMonitor bandwidth, latency, and packet loss
AdvancedConfigure OpenVPN and WireGuard VPN servers
AdvancedLoad balancing, high availability, and network automation
AdvancedLinux powers the vast majority of servers on the internet. Understanding networking on Linux means you can:
Every network service, every web application, every container—everything depends on networking. Master this, and you can build anything.
The internet runs on Linux. Now you'll know how.
Linux has a powerful networking stack built into the kernel. Every packet that enters or leaves your system goes through this stack, and you can configure every aspect of it.
Understanding networking requires knowing the OSI model layers:
$ ip addr show # Show all network interfaces and IPs $ ip route show # Show routing table $ cat /etc/resolv.conf # Show DNS servers $ hostname -I # Show all IP addresses
What layer of the OSI model handles IP addresses?
What model has 7 layers for networking?
What protocol provides reliable, ordered delivery?
What protocol is faster but unreliable?
What command shows network interfaces?
What command shows the routing table?
What address identifies a network card?
What determines network vs host portion of IP?
In Linux, network interfaces are represented as files in /sys/class/net/. Common interface names:
$ ip link show # Show all interfaces $ ip addr show eth0 # Show specific interface details $ ip -s link # Show interface statistics $ ethtool eth0 # Show hardware info (if installed)
Temporary Configuration (lost on reboot):
$ sudo ip addr add 192.168.1.100/24 dev eth0 # Add an IP $ sudo ip addr del 192.168.1.100/24 dev eth0 # Remove an IP $ sudo ip link set eth0 up # Bring interface up $ sudo ip link set eth0 down # Bring interface down
Debian/Ubuntu (/etc/network/interfaces):
auto eth0 iface eth0 inet static address 192.168.1.100 netmask 255.255.255.0 gateway 192.168.1.1 dns-nameservers 8.8.8.8 8.8.4.4
RHEL/CentOS (/etc/sysconfig/network-scripts/ifcfg-eth0):
TYPE=Ethernet DEVICE=eth0 ONBOOT=yes IPADDR=192.168.1.100 NETMASK=255.255.255.0 GATEWAY=192.168.1.1 DNS1=8.8.8.8
Which command brings a network interface down?
What is the traditional name for first Ethernet interface?
What is the loopback interface name?
What command assigns an IP address?
What is the loopback IP address?
What protocol automatically assigns IPs?
What setting controls maximum packet size?
What command shows interface hardware info?
Routing is the process of deciding where to send a packet. The routing table contains rules that determine the path packets take.
$ ip route show default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.100 metric 100 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100 192.168.2.0/24 via 192.168.1.254 dev eth0
$ sudo ip route add 10.0.0.0/8 via 192.168.1.1 dev eth0 # Add route to private network $ sudo ip route add 172.16.0.0/12 via 192.168.1.1 # Another private network $ sudo ip route add default via 192.168.1.1 # Default gateway $ sudo ip route del 10.0.0.0/8 # Remove a route
Linux supports advanced routing with multiple tables:
$ ip route show table all # Show all tables $ cat /etc/iproute2/rt_tables # View routing tables $ sudo ip rule add from 192.168.1.100 table internal # Add routing rule
What does "default" in the routing table represent?
What device connects your network to internet?
What command adds a static route?
What determines route priority?
What keyword specifies next hop in route?
What limits route to local network?
What file defines custom routing tables?
What command manages routing policy?
Linux uses a system called NSS (Name Service Switch) and /etc/nsswitch.conf to determine how to resolve hostnames:
$ cat /etc/nsswitch.conf | grep hosts hosts: files dns myhostname
This means Linux looks in:
$ cat /etc/hosts 127.0.0.1 localhost 127.0.1.1 myserver 192.168.1.10 dbserver.internal 192.168.1.11 webserver.internal
$ cat /etc/resolv.conf nameserver 8.8.8.8 nameserver 8.8.4.4 search internal.local
$ class="command"># Basic DNS lookup (deprecated) $ dig google.com # Detailed DNS query $ dig +short google.com # Just get the IP $ host google.com # Simple lookup $ getent hosts google.com # Use NSS resolver
Modern systems use systemd-resolved which manages /etc/resolv.conf:
$ resolvectl status # Show DNS servers $ resolvectl query google.com # Query DNS
In /etc/nsswitch.conf, what does "files" refer to for host resolution?
What file contains DNS server addresses?
What command queries DNS servers?
What command provides detailed DNS info?
What service manages DNS on modern Linux?
iptables is the Linux firewall that filters packets based on rules. It uses "chains" that packets pass through:
$ sudo iptables -L -v -n # List all rules with details $ sudo iptables -L INPUT -n # List INPUT chain $ sudo iptables -t nat -L -v # View NAT table
$ sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT # Allow SSH $ sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT # Allow HTTP $ sudo iptables -A INPUT -j DROP # Drop everything else
# Allow established connections (important!) $ sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow SSH on custom port $ sudo iptables -A INPUT -p tcp --dport 2222 -j ACCEPT # Allow HTTP and HTTPS $ sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT $ sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT # Allow ping $ sudo iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT # Drop everything else $ sudo iptables -A INPUT -j DROP
Which chain handles packets destined for a local service?
Which chain handles locally generated packets?
Which chain handles routed packets?
What target allows traffic?
What target blocks traffic silently?
Network Address Translation (NAT) allows multiple devices to share a single public IP address. The NAT table has two main purposes:
# Masquerade (hide private network behind public IP) $ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # Port forward (external port 8080 to internal 192.168.1.100:80) $ sudo iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.100:80 # Forward to internal host $ sudo iptables -t nat -A PREROUTING -p tcp --dport 2222 -j DNAT --to-destination 192.168.1.50:22
# Temporarily enable (for routing) $ sudo sysctl -w net.ipv4.ip_forward=1 # Permanently (add to /etc/sysctl.conf) $ echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-ip-forward.conf $ sudo sysctl -p /etc/sysctl.d/99-ip-forward.conf
iptables rules are lost on reboot. Save them:
# Debian/Ubuntu $ sudo iptables-save | sudo tee /etc/iptables/rules.v4 # RHEL/CentOS $ sudo service iptables save # Restore on boot (add to startup) $ sudo iptables-restore < /etc/iptables/rules.v4
Which iptables table is used for NAT?
What changes source IP for outgoing traffic?
What changes destination IP for incoming traffic?
What is dynamic SNAT called?
What redirects traffic to different port?
When network issues arise, these tools are your best friends:
$ ping google.com # Continuous ping $ ping -c 4 google.com # Ping 4 times $ ping -i 0.2 google.com # Faster interval $ ping -I eth0 google.com # Specific interface
$ traceroute google.com # Trace route $ traceroute -I google.com # ICMP traceroute $ traceroute -T google.com # TCP traceroute $ mtr google.com # Continuous traceroute
$ ss -tuln # Listening TCP/UDP ports $ ss -tn # Active connections $ ss -tp # Show process using socket $ ss -s# Socket summary
$ sudo tcpdump -i eth0 # Capture all traffic $ sudo tcpdump -i eth0 port 80 # HTTP traffic only $ sudo tcpdump -i eth0 host 8.8.8.8 # Specific host $ sudo tcpdump -i eth0 -w capture.pcap # Save to file $ tcpdump -r capture.pcap # Read from file
$ ip neighbor show # ARP table $ netstat -i # Interface statistics $ dig +trace google.com # Full DNS resolution $ curl -v google.com # HTTP request with details $ nc -zv host 80 # Check if port is open
Which tool shows which process is using a network port?
What is the older alternative to ss?
What captures network packets?
What tests connectivity to a host?
What shows the path packets take?
SSH tunnels encrypt your traffic and can bypass firewalls. They're essential for:
Forward a local port to a remote destination:
# Access remote MySQL through SSH tunnel $ ssh -L 3306:localhost:3306 user@remote-server # Access internal web server $ ssh -L 8080:internal-web:80 user@gateway # Background tunnel with key $ ssh -f -N -L 8080:internal-web:80 user@gateway
Allow remote host to access local services:
# Expose local web server to remote $ ssh -R 8080:localhost:80 user@remote-server # Share local port with internet (requires GatewayPorts) $ ssh -R 0.0.0.0:8080:localhost:80 user@remote-server
Create a SOCKS proxy for dynamic forwarding:
# Create SOCKS proxy on local port 1080 $ ssh -D 1080 user@remote-server # Use with browser: localhost:1080 as SOCKS5 proxy $ ssh -f -N -D 1080 user@remote-server
$ cat ~/.ssh/config Host tunnel HostName remote-server.com User admin LocalForward 8080 internal-web:80 IdentityFile ~/.ssh/id_rsa
Now just run: ssh tunnel
Which SSH flag creates a SOCKS proxy for dynamic forwarding?
Which SSH flag enables local port forwarding?
Which SSH flag enables remote port forwarding?
Which SSH flag redirects stdin from /dev/null?
Which SSH flag runs in background?
WireGuard is a modern, fast, and simple VPN. Compared to OpenVPN:
$ sudo apt install wireguard # Debian/Ubuntu $ sudo dnf install wireguard-tools # RHEL/Fedora
$ wg genkey | tee privatekey | wg pubkey > publickey
$ sudo cat > /etc/wireguard/wg0.conf << 'EOF' [Interface] Address = 10.0.0.1/24 ListenPort = 51820 PrivateKey = SERVER_PRIVATE_KEY PostUp = iptables -A FORWARD -i %i -j ACCEPT PostUp = iptables -A FORWARD -o %i -j ACCEPT PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT PostDown = iptables -D FORWARD -o %i -j ACCEPT PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE [Peer] PublicKey = CLIENT_PUBLIC_KEY AllowedIPs = 10.0.0.2/32 EOF
$ sudo cat > wg0.conf << 'EOF' [Interface] Address = 10.0.0.2/24 PrivateKey = CLIENT_PRIVATE_KEY DNS = 1.1.1.1 [Peer] PublicKey = SERVER_PUBLIC_KEY Endpoint = your-server.com:51820 AllowedIPs = 0.0.0.0/0 PersistentKeepalive = 25 EOF
$ sudo wg-quick up wg0 # Start VPN $ sudo wg-quick down wg0 # Stop VPN $ sudo wg show # Show status $ sudo systemctl enable wg-quick@wg0 # Enable on boot
What port does WireGuard use by default?
What is the default WireGuard interface name?
What tool manages WireGuard interfaces?
What key must stay secret in WireGuard?
What represents a remote VPN endpoint?
Understanding your network traffic patterns is crucial for security and performance.
$ sudo iftop # Monitor all traffic $ sudo iftop -i eth0 # Specific interface $ sudo iftop -B # Bytes instead of bits
$ sudo nethogs # Show per-process bandwidth $ sudo nethogs eth0 # Specific interface
$ vnstat -l # Live monitoring $ vnstat -h # Hourly stats $ vnstat -d # Daily stats $ vnstat -m # Monthly stats
$ cat /proc/net/dev # Interface statistics $ ip -s link # Packet error counters $ netstat -s # Protocol statistics $ sar -n DEV 1 5 # Network I/O rates
# Simple traffic monitor script $ cat traffic-monitor.sh #!/bin/bash INTERFACE="eth0" while true; do RX1=$(cat /sys/class/net/$INTERFACE/statistics/rx_bytes) TX1=$(cat /sys/class/net/$INTERFACE/statistics/tx_bytes) sleep 1 RX2=$(cat /sys/class/net/$INTERFACE/statistics/rx_bytes) TX2=$(cat /sys/class/net/$INTERFACE/statistics/tx_bytes) echo "RX: $(( (RX2-RX1)/1024 )) KB/s TX: $(( (TX2-TX1)/1024 )) KB/s" done
Which tool shows bandwidth usage per process?
What shows bandwidth per host connection?
What monitors long-term traffic history?
What is a curses-based bandwidth monitor?
Where does Linux store interface statistics?
A Virtual Private Network (VPN) creates an encrypted tunnel over an untrusted network, allowing secure remote access and privacy protection.
WireGuard is a modern, fast, and secure VPN protocol. Here's how to configure it:
OpenVPN is a mature VPN solution with wide compatibility:
What command is used to start a WireGuard interface?
What is WireGuard's default UDP port?
What iptables target allows VPN clients to access the internet?
Which key can be safely shared with VPN peers?
Load balancing distributes network traffic across multiple servers to improve performance and reliability.
HAProxy is a high-performance TCP/HTTP load balancer:
Keepalived provides VRRP (Virtual Router Redundancy Protocol) for automatic failover:
Ansible automates network configuration across multiple devices:
Bonding combines multiple network interfaces for redundancy or increased bandwidth:
What software is commonly used for TCP/HTTP load balancing?
What provides VRRP for automatic IP failover?
What tool is used for network automation and configuration management?
What load balancing algorithm distributes requests equally in sequence?