Network Management

Organisation:Copyright (C) 2021-2024 Olivier Boudeville
Contact:about (dash) howtos (at) esperide (dot) com
Creation date:Saturday, November 20, 2021
Lastly updated:Thursday, January 4, 2024

Investigating Network Issues

Tools like ping, traceroute, drill, arp, etc. are invaluable.

For example:

Use to scans all IPs with any specified prefix, and to collect information about a given IP.

Use to investigate unstable connections.

Firewall Management

On GNU/Linux, some level of knowledge about iptables is useful, notably if exposing a computer to the Internet; note though that it is to be superseded by nftables.

One should read first the very clear Arch wiki section about iptables basic concepts.

A general rule that we retain, especially for an Internet gateway, is to drop all packets by default, and then only to accept the expected ones explicitly and carefully.

Configuration of a Gateway to the Internet

Our script sets up an iptables configuration with various services that can be enabled (e.g. for masquerading, IPTV, different kinds of servers) as an example that we hope is secure enough [1].

[1]Please email us if you found otherwise! Refer to the top of this document for that.

This script expects a settings file to be available as /etc/ (this file is meant to be sourced, not executed).

An example thereof:

# Local firewall settings.
# Meant to be sourced by the script.

# Where firewall-related outputs will be written:

# Local (LAN) interface, the one we trust:

# Internet (WAN) interface, the one we distrust:

# For PPP ADSL connections:

# For direct connection to a set-top (telecom) box from your provider:


# As the IPs banned through the ban file above are quite minimal:

# IP of a test client (to avoid too many logs, selecting only related events):

# Enabled input TCP port range for traffic from LAN to gateway:

# TCP unfiltered window (e.g. for passive FTP and BEAM port ranges):

# Tells whether IPTV (TV on the Internet thanks to a box) should be allowed:

# Tells whether a SMTP server can be used:

# Typically a set-top box from one's ISP (defined as a possibly log match
# criteria):

# Classical example:

# DHT subsection, for P2P exchanges:
# More infos:



# One may use a non-standard port:


# SMTPS is obsolete:

# STARTTLS over SMTP is the proper way of securing SMTP:


# POP3S:


A script to configure iptables is best integrated to systemd, see the iptables.rules-Gateway.service file for that (typically to be placed in /etc/systemd/system). Then one may test with:

$ systemctl start iptables.rules-Gateway.service

and enable it for good with:

$ systemctl enable iptables.rules-Gateway.service

Note that often these scripts are setup remotely, while being connected thanks to SSH from another host. Care must be taken in order not to lock oneself out of the target server, notably when updating rules (this happens quite easily). We advise to prefer the restart option of our iptables script in order to reduce the risk of "bricking" one's server.

Network Troubleshooting

A few pieces of advice/information:

$ ip route add dev enp4s0 scope link
$ ip route
default via dev enp4s0 proto dhcp src metric 1002 dev enp2s0 proto kernel scope link src dev enp4s0 scope link

Here for example, in, 16 corresponds to the length of the network prefix; the next 16 bits are left to designate hosts, whose addresses therefore range in 192.168.[0..254].[1..254]. So includes the network, whereas would not.

See Also