Module 9: Networking and Remote Access - IP, DNS, SSH & Firewalls

9.1 Networking Fundamentals

Linux powers modern cloud infrastructure, routers, and edge nodes. Understanding how the kernel handles packet addressing, transport protocols, and hardware socket buffers is the foundation of network operations.

9.1.1 IP Addresses, Subnets, and Default Gateways

`Network Layer Addressing`

IPv4 & CIDR Notation:A 32-bit numerical label written in dotted-decimal format (e.g., 192.168.1.50/24). The /24 prefix indicates the first 24 bits represent the network subnet mask (255.255.255.0), leaving 8 bits (254 usable host addresses).
Default Gateway:The local router IP address (typically 192.168.1.1 or 10.0.0.1) that forwards traffic destined for outside the local subnet across public internet paths.
Loopback Interface (lo / 127.0.0.1):A virtual network device routing traffic directly back to local machine memory without transmitting packets across physical wires.

9.1.2 Transport Layer: TCP vs UDP and Ports

Protocol	Connection Type	Reliability Model	Common Port Examples
TCP	Connection-oriented (3-way handshake SYN, SYN-ACK, ACK)	Guaranteed ordered packet delivery with retransmission and flow control	SSH (22), HTTP (80), HTTPS (443), MySQL (3306)
UDP	Connectionless (fire and forget)	No delivery confirmation or packet reordering; low latency transmission	DNS (53), DHCP (67/68), NTP (123), WireGuard (51820)

`Port Number Allocations`

Privileged System Ports (0 - 1023):Require root privileges to bind (e.g., ports 22, 80, 443).
Registered User Ports (1024 - 49151):Standard application ports (e.g., PostgreSQL 5432, Redis 6379, Node 3000).
Dynamic Ephemeral Ports (49152 - 65535):Temporary outbound source ports assigned by the kernel when connecting to remote servers.

9.1.3 The Linux Network Stack

When an Ethernet frame hits a Network Interface Card (NIC), hardware triggers an interrupt. The kernel allocates an sk_buff socket buffer, inspects IP headers, passes packets through Netfilter firewall tables, and delivers data to listening application sockets.

9.2 Configuring Network Interfaces

Legacy Linux tools like ifconfig and route are deprecated. Modern Linux uses the unified iproute2 suite and persistent declarative managers.

9.2.1 Modern Inspection with iproute2

Modern Command (iproute2)	Legacy Equivalent	Purpose
ip addr show (or ip a)	ifconfig	Displays all interface names, MAC addresses, and assigned IP addresses
ip link set eth0 up/down	ifconfig eth0 up/down	Enables or disables an interface link at the data link layer
ip route show (or ip r)	route -n / netstat -r	Displays kernel routing tables and the default gateway path

9.2.2 Netplan on Ubuntu and nmcli on RHEL

Manual ip addr add modifications disappear on reboot. Persistent interface configurations are defined declaratively:

`Persistent Network Configuration`

Ubuntu Netplan (/etc/netplan/*.yaml):YAML-formatted network definitions. Apply changes immediately with sudo netplan apply, or test safely with sudo netplan try (reverts automatically if connection is lost).
RHEL NetworkManager (nmcli):Command line client for NetworkManager: nmcli connection show, nmcli con up eth0, and nmcli dev status.

9.2.3 Static vs DHCP Addressing

Workstations typically receive dynamic addresses from a DHCP server (dhcp4: true). Production servers mandate static IP addresses to prevent services from moving to new IPs unexpectedly.

9.2.4 Hostname Configuration and /etc/hosts

`Host Identity Management`

hostnamectl set-hostname srv-prod-01:Sets system hostname across transient, static, and pretty namespaces permanently.
/etc/hosts (Local DNS Precedence):Maps hostnames to IP addresses locally before querying external DNS servers: 10.0.0.25 db.internal.

9.3 DNS and Name Resolution

9.3.1 /etc/resolv.conf and systemd-resolved

On Ubuntu 24.04, /etc/resolv.conf is a symbolic link pointing to a local stub resolver maintained by systemd-resolved on 127.0.0.53:53:

`DNS Resolver Inspection`

resolvectl status:Displays active upstream DNS servers (e.g., 1.1.1.1, 8.8.8.8), DNS domain search lists, and DNSSEC validation status per interface.
sudo resolvectl flush-caches:Flushes local cached DNS records to force fresh upstream lookups.

9.3.2 Query Utilities: dig, nslookup, and host

`DNS Query Utilities`

dig example.com +short:Queries DNS and prints only the resolved A record IP address directly.
dig -x 8.8.8.8 +short:Reverse DNS lookup (PTR record) to find the domain associated with an IP address.
dig @1.1.1.1 example.com MX:Queries a specific upstream DNS server directly for Mail Exchange (MX) records.
host example.com:Concise summary listing IPv4 addresses, IPv6 addresses, and mail handling records.

9.3.3 Troubleshooting DNS Failures

When a server cannot resolve domain names, verify whether the issue is network-level or DNS-level:

`DNS Triage Workflow`

1. Test IP connectivity: ping 8.8.8.8:If this succeeds, network routing and gateways are operational.
2. Test DNS query: ping google.com:If step 1 succeeds but this fails with 'unknown host', name resolution is broken.
3. Test UDP Port 53: nc -zv 8.8.8.8 53:Verifies whether upstream firewalls are blocking outbound DNS traffic.

9.4 Ports, Sockets, and Connectivity Tests

9.4.1 Socket Inspection with ss (Socket Statistics)

ss dumps kernel socket tables faster than legacy netstat:

`ss Diagnostic Flags`

sudo ss -tulnp:Lists all listening (-l) TCP (-t) and UDP (-u) ports numerically (-n) alongside process names and PIDs (-p).
ss -ta:Shows all established, listening, and closing TCP socket connections.
ss -s:Prints total socket summary counts (TCP, UDP, RAW, UNIX sockets).

9.4.2 Diagnostic Reachability: ping, traceroute, and mtr

`Connectivity Analysis Tools`

ping -c 4 host:Sends ICMP echo request packets to measure round-trip latency and packet loss percentage.
traceroute -n host:Sends packets with incrementing TTL values to map every router hop along the path to the target.
mtr host (My Traceroute):Combines ping and traceroute into a live, interactive display showing real-time jitter and packet loss at every hop.

9.4.3 Web Transfer Clients: curl and wget

`Command Line HTTP Clients`

curl -I https://example.com:Fetches and displays HTTP response headers (HTTP status, Content-Type, server headers) without downloading body payload.
curl -sSL https://get.docker.com | sh:Silent (-s), follows redirects (-L), and displays errors (-S).
wget -c https://example.com/bigfile.iso:Downloads files with automatic resumption (-c) if the network drops mid-transfer.

9.4.4 Network Probing with nc and nmap

`Port Probing and Scanning`

nc -zv host 22 80 443:Zero-I/O mode (-z) with verbose output (-v) to verify if specific TCP ports are accepting connections.
nmap -sT -p 1-1000 host:Performs full TCP connect scan across ports 1 through 1000 to identify open services.

9.5 Secure Shell (SSH) Administration

SSH (Secure Shell) encrypts all remote terminal traffic, authentication credentials, and file transfers over port 22 using public-key cryptography.

9.5.1 Connecting and Key Generation

`Key Authentication Workflow`

1. Generate Modern Keypair:ssh-keygen -t ed25519 -C "admin@company.com" (creates private key ~/.ssh/id_ed25519 and public key ~/.ssh/id_ed25519.pub).
2. Copy Public Key to Remote Server:ssh-copy-id -i ~/.ssh/id_ed25519.pub user@remote-server (appends public key to remote ~/.ssh/authorized_keys with correct 600 permissions).
3. Connect Passwordlessly:ssh user@remote-server connects securely using cryptographic signature verification.

9.5.2 Client Shortcuts (~/.ssh/config) and Daemon Hardening

`SSH Production Hardening`

Client Config (~/.ssh/config):Define host aliases: Host prod\n HostName 198.51.100.2\n User deploy\n Port 2222\n IdentityFile ~/.ssh/id_ed25519 (connect by simply typing ssh prod).
Server Hardening (/etc/ssh/sshd_config):Set PasswordAuthentication no (blocks brute-force dictionary attacks), PermitRootLogin no (requires standard user login first), and MaxAuthTries 3.
Apply Configuration Changes:Execute sudo systemctl reload ssh (does not drop current active sessions).

9.5.3 Port Forwarding and SSH Tunnels

`Tunneling Patterns`

Local Port Forwarding (ssh -L 8080:localhost:80 user@remote):Forwards local port 8080 through the encrypted SSH tunnel to port 80 on the remote server (ideal for viewing internal dashboards).
Dynamic SOCKS5 Proxy (ssh -D 1080 user@remote):Turns the SSH connection into an encrypted SOCKS5 proxy server for browser routing.

9.6 Linux Firewalls

9.6.1 UFW (Uncomplicated Firewall) on Ubuntu

UFW provides a streamlined command line interface over the kernel Netfilter framework:

`UFW Standard Commands`

sudo ufw default deny incoming:Blocks all unsolicited inbound connection requests by default.
sudo ufw default allow outgoing:Permits all outbound connections initiated by local server applications.
sudo ufw allow 22/tcp:Always allow SSH before enabling UFW to prevent locking yourself out of remote servers!
sudo ufw allow 80/tcp && sudo ufw allow 443/tcp:Opens standard web server traffic ports.
sudo ufw enable && sudo ufw status numbered:Activates firewall and prints rules with rule numbers for easy deletion (sudo ufw delete 2).

9.6.2 Firewalld and the iptables/nftables Framework

`Enterprise Firewall Architecture`

firewalld (RHEL Family):Zone-based firewall daemon: sudo firewall-cmd --permanent --add-service=https && sudo firewall-cmd --reload.
nftables (Modern Linux Kernel Standard):The successor replacing legacy iptables, ip6tables, and arptables with unified packet filtering and faster rule processing.

Knowledge Check: Module 9 Networking and Remote Access

1. Which modern command replaces ifconfig on Linux?

2. Which file maps local hostnames to IP addresses before DNS queries?

3. What flags make ss list listening TCP and UDP sockets numerically?

4. Which command copies an SSH public key to a remote server authorized_keys file?

5. In OpenSSH server hardening, which setting disables insecure password logins?

6. What Ubuntu command allows incoming web traffic on port 443 in UFW?

Previous Next