Configuring and managing networking
A guide to configuring and managing networking in Red Hat Enterprise Linux 8
Abstract
Making open source more inclusive
Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the enormity of this endeavor, these changes will be implemented gradually over several upcoming releases. For more details, see our CTO Chris Wright’s message.
Providing feedback on Red Hat documentation
We appreciate your input on our documentation. Please let us know how we could make it better. To do so:
For simple comments on specific passages:
- Make sure you are viewing the documentation in the Multi-page HTML format. In addition, ensure you see the Feedback button in the upper right corner of the document.
- Use your mouse cursor to highlight the part of text that you want to comment on.
- Click the Add Feedback pop-up that appears below the highlighted text.
- Follow the displayed instructions.
For submitting more complex feedback, create a Bugzilla ticket:
- Go to the Bugzilla website.
- As the Component, use Documentation.
- Fill in the Description field with your suggestion for improvement. Include a link to the relevant part(s) of documentation.
- Click Submit Bug.
Chapter 1. General RHEL networking topics
This section provides details about general networking topics.
1.1. The difference between IP and non-IP networks
A network is a system of interconnected devices that can communicate sharing information and resources, such as files, printers, applications, and Internet connection. Each of these devices has a unique IP address to send and receive messages between two or more devices using a set of rules called protocol.
Categories of network communication:
- IP networks
- Networks that communicate through IP addresses. An IP network is implemented in the Internet and most internal networks. Ethernet, wireless networks, and VPN connections are typical examples.
- Non-IP networks
- Networks that are used to communicate through a lower layer rather than the transport layer. Note that these networks are rarely used. For example, InfiniBand is a non-IP network.
1.2. The difference between static and dynamic IP addressing
- Static IP addressing
When you assign a static IP address to a device, the address does not change over time unless you change it manually. Use static IP addressing if you want:
- To ensure network address consistency for servers such as DNS, and authentication servers.
- To use out-of-band management devices that work independently of other network infrastructure.
- Dynamic IP addressing
When you configure a device to use a dynamic IP address, the address can change over time. For this reason, dynamic addresses are typically used for devices that connect to the network occasionally because the IP address can be different after rebooting the host.
Dynamic IP addresses are more flexible, easier to set up, and administer. The Dynamic Host Control Protocol (DHCP) is a traditional method of dynamically assigning network configurations to hosts.
There is no strict rule defining when to use static or dynamic IP addresses. It depends on user’s needs, preferences, and the network environment.
Additional resources
For details about setting up a DHCP server, see Chapter 43, Providing DHCP services.
1.3. DHCP transaction phases
The DHCP works in four phases: Discovery, Offer, Request, Acknowledgement, also called the DORA process. DHCP uses this process to provide IP addresses to clients.
Discovery
The DHCP client sends a message to discover the DHCP server in the network. This message is broadcasted at the network and data link layer.
Offer
The DHCP server receives messages from the client and offers an IP address to the DHCP client. This message is unicast at the data link layer but broadcast at the network layer.
Request
The DHCP client requests the DHCP server for the offered IP address. This message is unicast at the data link layer but broadcast at the network layer.
Acknowledgment
The DHCP server sends an acknowledgment to the DHCP client. This message is unicast at the data link layer but broadcast at the network layer. It is the final message of the DHCP DORA process.
1.4. InfiniBand and RDMA networks
For details about InfiniBand and Remote Direct Memory Access (RDMA) networks, see the Configuring InfiniBand and RDMA networks documentation.
1.5. Legacy network scripts support in RHEL
By default, RHEL uses NetworkManager to configure and manage network connections, and the /usr/sbin/ifup
and /usr/sbin/ifdown
scripts use NetworkManager to process ifcfg
files in the /etc/sysconfig/network-scripts/
directory.
However, if you require the deprecated network scripts that processes the network configuration without using NetworkManager, you can install them:
# yum install network-scripts
After you have installed the legacy network scripts, the /usr/sbin/ifup
and /usr/sbin/ifdown
scripts link to to the deprecated shell scripts that manage the network configuration.
The legacy scripts are deprecated in RHEL 8 and will be removed in a future major version of RHEL. If you still use the legacy network scripts, for example, because you upgraded from an earlier version to RHEL 8, Red Hat recommends that you migrate your configuration to NetworkManager.
1.6. Selecting network configuration methods
To configure a network interface using NetworkManager, use one of the following tools:
-
the text user interface,
nmtui
. -
the command-line utility ,
nmcli
. -
the graphical user interface tools,
GNOME GUI
.
-
the text user interface,
To configure a network interface without using NetworkManager tools and applications:
-
edit the
ifcfg
files manually. Note that even if you edit the files directly, NetworkManager is the default on RHEL and processes these files. Only if you installed and enabled the deprecated legacy networking scrips, then these scripts process theifcfg
files.
-
edit the
To configure the network settings when the root file system is not local:
- use the kernel command-line.
Chapter 2. Consistent network interface device naming
Red Hat Enterprise Linux 8 provides methods for consistent and predictable device naming for network interfaces. These features help locating and differentiating network interfaces.
The kernel assigns names to network interfaces by concatenating a fixed prefix and a number that increases as the kernel initialize the network devices. For instance, eth0
would represent the first device being probed on start-up. However, these names do not necessarily correspond to labels on the chassis. Modern server platforms with multiple network adapters can encounter non-deterministic and counter-intuitive naming of these interfaces. This affects both network adapters embedded on the system board and add-in adapters.
In Red Hat Enterprise Linux 8, the udev
device manager supports a number of different naming schemes. By default, udev
assigns fixed names based on firmware, topology, and location information. This has the following advantages:
- Device names are fully predictable.
- Device names stay fixed even if you add or remove hardware, because no re-enumeration takes places.
- Defective hardware can be seamlessly replaced.
2.1. Network interface device naming hierarchy
If consistent device naming is enabled, which is the default in Red Hat Enterprise Linux 8, the udev
device manager generates device names based on the following schemes:
Scheme | Description | Example |
---|---|---|
1 |
Device names incorporate firmware or BIOS-provided index numbers for onboard devices. If this information is not available or applicable, |
|
2 |
Device names incorporate firmware or BIOS-provided PCI Express (PCIe) hot plug slot index numbers. If this information is not available or applicable, |
|
3 |
Device names incorporate the physical location of the connector of the hardware. If this information is not available or applicable, |
|
4 | Device names incorporate the MAC address. Red Hat Enterprise Linux does not use this scheme by default, but administrators can optionally use it. |
|
5 |
The traditional unpredictable kernel naming scheme. If |
|
By default, Red Hat Enterprise Linux selects the device name based on the NamePolicy
setting in the /usr/lib/systemd/network/99-default.link
file. The order of the values in NamePolicy
is important. Red Hat Enterprise Linux uses the first device name that is both specified in the file and that udev
generated.
If you manually configured udev
rules to change the name of kernel devices, those rules take precedence.
2.2. How the network device renaming works
By default, consistent device naming is enabled in Red Hat Enterprise Linux 8. The udev
device manager processes different rules to rename the devices. The following list describes the order in which udev
processes these rules and what actions these rules are responsible for:
-
The
/usr/lib/udev/rules.d/60-net.rules
file defines that the/lib/udev/rename_device
helper utility searches for theHWADDR
parameter in/etc/sysconfig/network-scripts/ifcfg-*
files. If the value set in the variable matches the MAC address of an interface, the helper utility renames the interface to the name set in theDEVICE
parameter of the file. -
The
/usr/lib/udev/rules.d/71-biosdevname.rules
file defines that thebiosdevname
utility renames the interface according to its naming policy, provided that it was not renamed in the previous step. -
The
/usr/lib/udev/rules.d/75-net-description.rules
file defines thatudev
examines the network interface device and sets the properties inudev
-internal variables, that will be processed in the next step. Note that some of these properties might be undefined. The
/usr/lib/udev/rules.d/80-net-setup-link.rules
file calls thenet_setup_link
udev
built-in which then applies the policy. The following is the default policy that is stored in the/usr/lib/systemd/network/99-default.link
file:[Link] NamePolicy=kernel database onboard slot path MACAddressPolicy=persistent
With this policy, if the kernel uses a persistent name,
udev
does not rename the interface. If the kernel does not use a persistent name,udev
renames the interface to the name provided by the hardware database ofudev
. If this database is not available, Red Hat Enterprise Linux falls back to the mechanisms described above.Alternatively, set the
NamePolicy
parameter in this file tomac
for media access control (MAC) address-based interface names.The
/usr/lib/udev/rules.d/80-net-setup-link.rules
file defines thatudev
renames the interface based on theudev
-internal parameters in the following order:-
ID_NET_NAME_ONBOARD
-
ID_NET_NAME_SLOT
-
ID_NET_NAME_PATH
If one parameter is not set,
udev
uses the next one. If none of the parameters are set, the interface is not renamed.-
Steps 3 and 4 implement the naming schemes 1 to 4 described in Section 2.1, “Network interface device naming hierarchy”.
Additional resources
- For details about setting custom prefixes for consistent naming, see Section 2.7, “Using prefixdevname for naming of Ethernet network interfaces”.
-
For details about the
NamePolicy
parameter, see thesystemd.link(5)
man page.
2.3. Predictable network interface device names on the x86_64 platform explained
When the consistent network device name feature is enabled, the udev
device manager creates the names of devices based on different criteria. This section describes the naming scheme when Red Hat Enterprise Linux 8 is installed on a x86_64 platform.
The interface name starts with a two-character prefix based on the type of interface:
-
en
for Ethernet -
wl
for wireless LAN (WLAN) -
ww
for wireless wide area network (WWAN)
Additionally, one of the following is appended to one of the above-mentioned prefix based on the schema the udev
device manager applies:
-
o<on-board_index_number>
s<hot_plug_slot_index_number>[f<function>][d<device_id>]
Note that all multi-function PCI devices have the
[f<function>]
number in the device name, including the function0
device.-
x<MAC_address>
[P<domain_number>]p<bus>s<slot>[f<function>][d<device_id>]
The
[P<domain_number>]
part defines the PCI geographical location. This part is only set if the domain number is not0
.[P<domain_number>]p<bus>s<slot>[f<function>][u<usb_port>][…][c<config>][i<interface>]
For USB devices, the full chain of port numbers of hubs is composed. If the name is longer than the maximum (15 characters), the name is not exported. If there are multiple USB devices in the chain,
udev
suppresses the default values for USB configuration descriptors (c1
) and USB interface descriptors (i0
).
2.4. Predictable network interface device names on the System z platform explained
When the consistent network device name feature is enabled, the udev
device manager on the System z platform creates the names of devices based on the bus ID. The bus ID identifies a device in the s390 channel subsystem.
For a channel command word (CCW) device, the bus ID is the device number with a leading 0.n
prefix where n
is the subchannel set ID.
Ethernet interfaces are named, for example, enccw0.0.1234
. Serial Line Internet Protocol (SLIP) channel-to-channel (CTC) network devices are named, for example, slccw0.0.1234
.
Use the znetconf -c
or the lscss -a
commands to display available network devices and their bus IDs.
2.5. Disabling consistent interface device naming during the installation
This section describes how to disable consistent interface device naming during the installation.
Red Hat recommends not to disable consistent device naming. Disabling consistent device naming can cause different kind of problems. For example, if you add another network interface card to the system, the assignment of the kernel device names, such as eth0
, is no longer fixed. Consequently, after a reboot, the Kernel can name the device differently.
Procedure
- Boot the Red Hat Enterprise Linux 8 installation media.
-
In the boot manager, select
Install Red Hat Enterprise Linux 8
, and press the key to edit the entry. Append the
net.ifnames=0
parameter to the kernel command line:vmlinuz... net.ifnames=0
- Press to start the installation.
2.6. Disabling consistent interface device naming on an installed System
This section describes how to disable consistent interface device naming on a system that is already installed.
Red Hat recommends not to disable consistent device naming. Disabling consistent device naming can cause different kind of problems. For example, if you add another network interface card to the system, the assignment of the kernel device names, such as eth0
, is no longer fixed. Consequently, after a reboot, the Kernel can name the device differently.
Prerequisites
- The system uses consistent interface device naming, which is the default.
Procedure
Edit the
/etc/default/grub
file and append thenet.ifnames=0
parameter to theGRUB_CMDLINE_LINUX
variable:GRUB_CMDLINE_LINUX="... *net.ifnames=0
Rebuild the
grub.cfg
file:On a system with UEFI boot mode:
# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg
On a system with legacy boot mode:
# grub2-mkconfig -o /boot/grub2/grub.cfg
- If you use interface names in configuration files or scripts, you must manually update them.
Reboot the host:
# reboot
2.7. Using prefixdevname for naming of Ethernet network interfaces
This documentation describes how to set the prefixes for consistent naming of Ethernet network interfaces in case that you do not want to use the default naming scheme of such interfaces. However, Red Hat recommends to use the default naming scheme. For more details about this scheme, see Chapter 2, Consistent network interface device naming.
2.7.1. Introduction to prefixdevname
The prefixdevname
tool is a udev helper utility that enables you to define your own prefix used for naming of the Ethernet network interfaces.
2.7.2. Limitations of prefixdevname
There are certain limitations for prefixes of Ethernet network interfaces.
The prefix that you choose must meet the following requirements:
- Be ASCII string
- Be alphanumeric string
- Be shorter than 16 characters
The prefix cannot conflict with any other well-known prefix used for network interface naming on Linux. Specifically, you cannot use these prefixes: eth
, eno
, ens
, em
.
2.7.3. Setting prefixdevname
The setting of the prefix with prefixdevname
is done during system installation.
To set and activate the required prefix for your Ethernet network interfaces, use the following procedure.
Procedure
Add the following string on the kernel command line:
net.ifnames.prefix=<required prefix>
Red Hat does not support the use of prefixdevname
on already deployed systems.
After the prefix was once set, and the operating system was rebooted, the prefix is effective every time when a new network interface appears. The new device is assigned a name in the form of <PREFIX><INDEX>
. For example, if your selected prefix is net
, and the interfaces with net0
and net1
prefixes already exist on the system, the new interface is named net2
. The prefixdevname
utility then generates the new .link
file in the /etc/systemd/network
directory that applies the name to the interface with the MAC address that just appeared. The configuration is persistent across reboots.
Chapter 3. Getting started with NetworkManager
By default, RHEL 8 uses NetworkManager to manage the network configuration and connections.
3.1. Benefits of using NetworkManager
The main benefits of using NetworkManager are:
- Offering an API through D-Bus which allows to query and control network configuration and state. In this way, networking can be checked and configured by multiple applications ensuring a synced and up-to-date networking status. For example, the RHEL web console, which monitors and configures servers through a web browser, uses the NetworkManager D-BUS interface to configure networking, as well as the Gnome GUI, the nmcli and the nm-connection-editor tools. Each change made in one of these tools is detected by all the others.
- Making Network management easier: NetworkManager ensures that network connectivity works. When it detects that there is no network configuration in a system but there are network devices, NetworkManager creates temporary connections to provide connectivity.
- Providing easy setup of connection to the user: NetworkManager offers management through different tools — GUI, nmtui, nmcli.
- Supporting configuration flexibility. For example, configuring a WiFi interface, NetworkManager scans and shows the available wifi networks. You can select an interface, and NetworkManager displays the required credentials providing automatic connection after the reboot process. NetworkManager can configure network aliases, IP addresses, static routes, DNS information, and VPN connections, as well as many connection-specific parameters. You can modify the configuration options to reflect your needs.
- Maintaining the state of devices after the reboot process and taking over interfaces which are set into managed mode during restart.
- Handling devices which are not explicitly set unmanaged but controlled manually by the user or another network service.
Additional resources
- For more information on installing and using the RHEL 8 web console, see Managing systems using the RHEL 8 web console.
3.2. An overview of utilities and applications you can use to manage NetworkManager connections
You can use the following utilities and applications to manage NetworkManager connections:
-
nmcli
: A command-line utility to manage connections. -
nmtui
: A curses-based text user interface (TUI). To use this application, install theNetworkManager-tui
package. -
nm-connection-editor
: A graphical user interface (GUI) for NetworkManager-related tasks. To start this application, enternm-connection-editor
in a terminal of a GNOME session. -
control-center
: A GUI provided by the GNOME shell for desktop users. Note that this application supports less features thannm-connection-editor
. -
The
network connection icon
in the GNOME shell: This icon represents network connection states and serves as visual indicator for the type of connection you are using.
3.3. Using NetworkManager dispatcher scripts
By default, the /etc/NetworkManager/dispatcher.d/
directory exists and NetworkManager runs scripts there, in alphabetical order. Each script must be an executable file owned by root
and must have write permission
only for the file owner.
NetworkManager executes dispatcher scripts in /etc/NetworkManager/dispatcher.d/
in alphabetical order.
Additional resources
- For an example of a dispatcher script, see the How to write a NetworkManager dispatcher script to apply ethtool commands solution.
3.4. Loading manually-created ifcfg files into NetworkManager
In Red Hat Enterprise Linux 8, if you edit an ifcfg
file, NetworkManager is not automatically aware of the change and has to be prompted to notice the change. If you use one of the tools to update NetworkManager profile settings, NetworkManager does not implement those changes until you reconnect using that profile. For example, if configuration files have been changed using an editor, NetworkManager must read the configuration files again.
The /etc/sysconfig/
directory is a location for configuration files and scripts. Most network configuration information is stored there, with the exception of VPN, mobile broadband and PPPoE configuration, which are stored in the /etc/NetworkManager/
subdirectories. For example, interface-specific information is stored in the ifcfg
files in the /etc/sysconfig/network-scripts/
directory.
Information for VPNs, mobile broadband and PPPoE connections is stored in /etc/NetworkManager/system-connections/
.
By default, RHEL uses NetworkManager to configure and manage network connections, and the /usr/sbin/ifup
and /usr/sbin/ifdown
scripts use NetworkManager to process ifcfg
files in the /etc/sysconfig/network-scripts/
directory.
If you need the legacy network scripts to manage your network settings, you can manually install them. For details, see Section 1.5, “Legacy network scripts support in RHEL” . However, note that the legacy network scripts are deprecated and will be removed in a future version of RHEL.
Procedure
To load a new configuration file:
#
nmcli connection load /etc/sysconfig/network-scripts/ifcfg-connection_name
If you updated a connection file that has already been loaded into NetworkManager, enter:
#
nmcli connection up connection_name
Additional resources
-
NetworkManager(8)
man page — Describes the network management daemon. -
NetworkManager.conf(5)
man page — Describes theNetworkManager
configuration file. -
/usr/share/doc/initscripts/sysconfig.txt
— Describesifcfg
configuration files and their directives as understood by the legacy network service. -
ifcfg(8)
man page — Describes briefly theifcfg
command.
Chapter 4. Configuring NetworkManager to ignore certain devices
By default, NetworkManager manages all devices except the lo
(loopback) device. However, you can set certain devices as unmanaged
to configure that NetworkManager ignores these devices. With this setting, you can manually manage these devices, for example, using a script.
4.1. Permanently configuring a device as unmanaged in NetworkManager
You can configure devices as unmanaged
based on several criteria, such as the interface name, MAC address, or device type. This procedure describes how to permanently set the enp1s0
interface as unmanaged
in NetworkManager.
To temporarily configure network devices as unmanaged
, see Section 4.2, “Temporarily configuring a device as unmanaged in NetworkManager”.
Procedure
Optional: Display the list of devices to identify the device you want to set as
unmanaged
:#
nmcli device status
DEVICE TYPE STATE CONNECTION enp1s0 ethernet disconnected -- ...Create the
/etc/NetworkManager/conf.d/99-unmanaged-devices.conf
file with the following content:[keyfile] unmanaged-devices=interface-name:enp1s0
To set multiple devices as unmanaged, separate the entries in the
unmanaged-devices
parameter with semicolon:[keyfile] unmanaged-devices=interface-name:interface_1;interface-name:interface_2;...
Reload the
NetworkManager
service:#
systemctl reload NetworkManager
Verification steps
Display the list of devices:
#
nmcli device status
DEVICE TYPE STATE CONNECTION enp1s0 ethernet unmanaged -- ...The
unmanaged
state next to theenp1s0
device indicates that NetworkManager does not manage this device.
Additional resources
-
For a list of criteria you can use to configure devices as unmanaged and the corresponding syntax, see the
Device List Format
section in theNetworkManager.conf(5)
man page.
4.2. Temporarily configuring a device as unmanaged in NetworkManager
You can configure devices as unmanaged
based on several criteria, such as the interface name, MAC address, or device type. This procedure describes how to temporarily set the enp1s0
interface as unmanaged
in NetworkManager.
Use this method, for example, for testing purposes. To permanently configure network devices as unmanaged
, see Section 4.1, “Permanently configuring a device as unmanaged in NetworkManager”.
Use this method, for example, for testing purposes. To permanently configure network devices as unmanaged
, see the Permanently configuring a device as unmanaged in NetworkManager section in the Configuring and managing networking
documentation.
Procedure
Optional: Display the list of devices to identify the device you want to set as
unmanaged
:#
nmcli device status
DEVICE TYPE STATE CONNECTION enp1s0 ethernet disconnected -- ...Set the
enp1s0
device to theunmanaged
state:#
nmcli device set enp1s0 managed no
Verification steps
Display the list of devices:
#
nmcli device status
DEVICE TYPE STATE CONNECTION enp1s0 ethernet unmanaged -- ...The
unmanaged
state next to theenp1s0
device indicates that NetworkManager does not manage this device.
Additional resources
-
For a list of criteria you can use to configure devices as unmanaged and the corresponding syntax, see the
Device List Format
section in theNetworkManager.conf(5)
man page.
Chapter 5. Getting started with nmtui
The nmtui
application is a text user interface (TUI) for NetworkManager
. The following section provides how you can configure a network interface using nmtui
.
The nmtui application does not support all connection types. In particular, you cannot add or modify VPN connections or Ethernet connections that require 802.1X authentication.
5.1. Starting the nmtui utility
This procedure describes how to start the NetworkManager text user interface, nmtui
.
Prerequisites
-
The
NetworkManager-tui
package is installed.
Procedure
To start
nmtui
, enter:#
nmtui
To navigate:
- Use the cursors or press Tab to step forwards and press Shift+Tab to step back through the options.
- Use Enter to select an option.
- Use the Space bar to toggle the status of check boxes.
5.2. Adding a connection profile using nmtui
The nmtui
application provides a text user interface to NetworkManager. This procedure describes how to add a new connection profile.
Prerequisites
-
The
NetworkManager-tui
package is installed.
Procedure
Start the NetworkManager text user interface utility:
#
nmtui
-
Select the
Edit a connection
menu entry, and press Enter. - Select the Enter. button, and press
-
Select
Ethernet
, and press Enter. Fill the fields with the connection details.
- Select to save the changes.
-
Select
Back
to return to the main menu. -
Select
Activate a connection
, and press Enter. - Select the new connection entry, and press Enter to activate the connection.
- Select to return to the main menu.
-
Select
Quit
.
Verification steps
Display the status of the devices and connections:
#
nmcli device status
DEVICE TYPE STATE CONNECTION enp1s0 ethernet connected Example-ConnectionTo display all settings of the connection profile:
#
nmcli connection show Example-Connection
connection.id: Example-Connection connection.uuid: b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76 connection.stable-id: -- connection.type: 802-3-ethernet connection.interface-name: enp1s0 ...
Additional resources
- For more information on testing connections, see Chapter 39, Testing basic network settings.
-
For further details about the
nmtui
application, see thenmtui(1)
man page. - If the configuration on the disk does not match the configuration on the device, starting or restarting NetworkManager creates an in-memory connection that reflects the configuration of the device. For further details and how to avoid this problem, see NetworkManager duplicates a connection after restart of NetworkManager service.
5.3. Applying changes to a modified connection using nmtui
After you modified a connection in nmtui
, you must reactivate the connection. Note that reactivating a connection in nmtui
temporarily deactivates the connection.
Procedure
In the main menu, select the
Activate a connection
menu entry:- Select the modified connection.
On the right, select the
Deactivate
button, and press Enter:- Select the connection again.
On the right, select the
Activate
button, and press Enter:
Chapter 6. Getting started with nmcli
This section describes general information about the nmcli
utility.
6.1. The different output formats of nmcli
The nmcli
utility supports different options to modify the output of nmcli
commands. Using these options, you can display only the required information. This simplifies processing the output in scripts.
By default, the nmcli
utility displays its output in a table-like format:
# nmcli device
DEVICE TYPE STATE CONNECTION
enp1s0 ethernet connected enp1s0
lo loopback unmanaged --
Using the -f
option, you can display specific columns in a custom order. For example, to display only the DEVICE
and STATE
column, enter:
# nmcli -f DEVICE,STATE device
DEVICE STATE
enp1s0 connected
lo unmanaged
The -t
option enables you to display the individual fields of the output in a colon-separated format:
# nmcli -t device
enp1s0:ethernet:connected:enp1s0
lo:loopback:unmanaged:
Combining the -f
and -t
to display only specific fields in colon-separated format can be helpful when you process the output in scripts:
# nmcli -f DEVICE,STATE -t device
enp1s0:connected
lo:unmanaged
6.2. Using tab completion in nmcli
If the bash-completion
package is installed on your host, the nmcli
utility supports tab completion. This enables you to auto-complete option names and to identify possible options and values.
For example, if you type nmcli con
and press Tab, then the shell automatically completes the command to nmcli connection
.
For the completion, the options or value you have typed must be unique. If it is not unique, then nmcli
displays all possibilities. For example, if you type nmcli connection d
and press Tab, then the command shows command delete
and down
as possible options.
You can also use tab completion to display all properties you can set in a connection profile. For example, if you type nmcli connection modify connection_name
and press Tab, the command shows the full list of available properties.
6.3. Frequent nmcli commands
The following is an overview about frequently-used nmcli
commands.
To display the list connection profiles, enter:
#
nmcli connection show
NAME UUID TYPE DEVICE enp1s0 45224a39-606f-4bf7-b3dc-d088236c15ee ethernet enp1s0To display the settings of a specific connection profile, enter:
#
nmcli connection show connection_name
connection.id: enp1s0 connection.uuid: 45224a39-606f-4bf7-b3dc-d088236c15ee connection.stable-id: -- connection.type: 802-3-ethernet ...To modify properties of a connection, enter:
#
nmcli connection modify connection_name property value
You can modify multiple properties using a single command if you pass multiple
property value
combinations to the command.To display the list of network devices, their state, and which connection profiles use the device, enter:
#
nmcli device
DEVICE TYPE STATE CONNECTION enp1s0 ethernet connected enp1s0 enp8s0 ethernet disconnected -- enp7s0 ethernet unmanaged -- ...To activate a connection, enter:
#
nmcli connection up connection_name
To deactivate a connection, enter:
#
nmcli connection down connection_name
Chapter 7. Getting started with configuring networking using the GNOME GUI
You can manage and configure network connections using the following ways on GNOME:
- the GNOME Shell network connection icon on the top right of the desktop
- the GNOME control-center application
- the GNOME nm-connection-editor application
7.1. Connecting to a network using the GNOME Shell network connection icon
If you use the GNOME GUI, you can use the GNOME Shell network connection icon to connect to a network.
Prerequisites
-
The
GNOME
package group is installed. - You are logged in to GNOME.
- If the network requires a specific configuration, such as a static IP address or an 802.1x configuration, a connection profile has already been created.
Procedure
Click the network connection icon in the top right corner of your desktop.
Depending on the connection type, select the
Wired
orWi-Fi
entry.-
For a wired connection, select
Connect
to connect to the network. -
For a Wi-Fi connection, click
Select network
, select the network to which you want to connect, and enter the password.
-
For a wired connection, select
Chapter 8. Configuring an Ethernet connection
This section describes different ways how to configure an Ethernet connection with static and dynamic IP addresses.
8.1. Configuring a static Ethernet connection using nmcli
This procedure describes adding an Ethernet connection with the following settings using the nmcli
utility:
-
A static IPv4 address -
192.0.2.1
with a/24
subnet mask -
A static IPv6 address -
2001:db8:1::1
with a/64
subnet mask -
An IPv4 default gateway -
192.0.2.254
-
An IPv6 default gateway -
2001:db8:1::fffe
-
An IPv4 DNS server -
192.0.2.200
-
An IPv6 DNS server -
2001:db8:1::ffbb
-
A DNS search domain -
example.com
Procedure
Add a new NetworkManager connection profile for the Ethernet connection:
#
nmcli connection add con-name Example-Connection ifname enp7s0 type ethernet
The further steps modify the
Example-Connection
connection profile you created.Set the IPv4 address:
#
nmcli connection modify Example-Connection ipv4.addresses 192.0.2.1/24
Set the IPv6 address:
#
nmcli connection modify Example-Connection ipv6.addresses 2001:db8:1::1/64
Set the IPv4 and IPv6 connection method to
manual
:#
nmcli connection modify Example-Connection ipv4.method manual
#nmcli connection modify Example-Connection ipv6.method manual
Set the IPv4 and IPv6 default gateways:
#
nmcli connection modify Example-Connection ipv4.gateway 192.0.2.254
#nmcli connection modify Example-Connection ipv6.gateway 2001:db8:1::fffe
Set the IPv4 and IPv6 DNS server addresses:
#
nmcli connection modify Example-Connection ipv4.dns "192.0.2.200"
#nmcli connection modify Example-Connection ipv6.dns "2001:db8:1::ffbb"
To set multiple DNS servers, specify them space-separated and enclosed in quotes.
Set the DNS search domain for the IPv4 and IPv6 connection:
#
nmcli connection modify Example-Connection ipv4.dns-search example.com
#nmcli connection modify Example-Connection ipv6.dns-search example.com
Activate the connection profile:
#
nmcli connection up Example-Connection
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/13)
Verification steps
Display the status of the devices and connections:
#
nmcli device status
DEVICE TYPE STATE CONNECTION enp7s0 ethernet connected Example-ConnectionTo display all settings of the connection profile:
#
nmcli connection show Example-Connection
connection.id: Example-Connection connection.uuid: b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76 connection.stable-id: -- connection.type: 802-3-ethernet connection.interface-name: enp7s0 ...Use the
ping
utility to verify that this host can send packets to other hosts.Ping an IP address in the same subnet.
For IPv4:
#
ping 192.0.2.3
For IPv6:
#
ping 2001:db8:2::1
If the command fails, verify the IP and subnet settings.
Ping an IP address in a remote subnet.
For IPv4:
#
ping 198.162.3.1
For IPv6:
#
ping 2001:db8:2::1
If the command fails, ping the default gateway to verify settings.
For IPv4:
#
ping 192.0.2.254
For IPv6:
#
ping 2001:db8:1::fffe
Use the
host
utility to verify that name resolution works. For example:#
host client.example.com
If the command returns any error, such as
connection timed out
orno servers could be reached
, verify your DNS settings.
Troubleshooting steps
If the connection fails or if the network interface switches between an up and down status:
- Make sure that the network cable is plugged-in to the host and a switch.
- Check whether the link failure exists only on this host or also on other hosts connected to the same switch the server is connected to.
- Verify that the network cable and the network interface are working as expected. Perform hardware diagnosis steps and replace defect cables and network interface cards.
Additional resources
-
See the
nm-settings(5)
man page for more information on connection profile properties and their settings. -
For further details about the
nmcli
utility, see thenmcli(1)
man page. - If the configuration on the disk does not match the configuration on the device, starting or restarting NetworkManager creates an in-memory connection that reflects the configuration of the device. For further details and how to avoid this problem, see NetworkManager duplicates a connection after restart of NetworkManager service.
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
8.2. Configuring a static Ethernet connection using the nmcli interactive editor
This procedure describes adding an Ethernet connection with the following settings using the nmcli
interactive mode:
-
A static IPv4 address -
192.0.2.1
with a/24
subnet mask -
A static IPv6 address -
2001:db8:1::1
with a/64
subnet mask -
An IPv4 default gateway -
192.0.2.254
-
An IPv6 default gateway -
2001:db8:1::fffe
-
An IPv4 DNS server -
192.0.2.200
-
An IPv6 DNS server -
2001:db8:1::ffbb
-
A DNS search domain -
example.com
Procedure
To add a new NetworkManager connection profile for the Ethernet connection, and starting the interactive mode, enter:
#
nmcli connection edit type ethernet con-name Example-Connection
Set the network interface:
nmcli>
set connection.interface-name enp7s0
Set the IPv4 address:
nmcli>
set ipv4.addresses 192.0.2.1/24
Set the IPv6 address:
nmcli>
set ipv6.addresses 2001:db8:1::1/64
Set the IPv4 and IPv6 connection method to
manual
:nmcli>
set ipv4.method manual
nmcli>set ipv6.method manual
Set the IPv4 and IPv6 default gateways:
nmcli>
set ipv4.gateway 192.0.2.254
nmcli>set ipv6.gateway 2001:db8:1::fffe
Set the IPv4 and IPv6 DNS server addresses:
nmcli>
set ipv4.dns 192.0.2.200
nmcli>set ipv6.dns 2001:db8:1::ffbb
To set multiple DNS servers, specify them space-separated and enclosed in quotes.
Set the DNS search domain for the IPv4 and IPv6 connection:
nmcli>
set ipv4.dns-search example.com
nmcli>set ipv6.dns-search example.com
Save and activate the connection:
nmcli>
save persistent
Saving the connection with 'autoconnect=yes'. That might result in an immediate activation of the connection. Do you still want to save? (yes/no) [yes]yes
Leave the interactive mode:
nmcli>
quit
Verification steps
Display the status of the devices and connections:
#
nmcli device status
DEVICE TYPE STATE CONNECTION enp7s0 ethernet connected Example-ConnectionTo display all settings of the connection profile:
#
nmcli connection show Example-Connection
connection.id: Example-Connection connection.uuid: b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76 connection.stable-id: -- connection.type: 802-3-ethernet connection.interface-name: enp7s0 ...Use the
ping
utility to verify that this host can send packets to other hosts.Ping an IP address in the same subnet.
For IPv4:
#
ping 192.0.2.3
For IPv6:
#
ping 2001:db8:2::1
If the command fails, verify the IP and subnet settings.
Ping an IP address in a remote subnet.
For IPv4:
#
ping 198.162.3.1
For IPv6:
#
ping 2001:db8:2::1
If the command fails, ping the default gateway to verify settings.
For IPv4:
#
ping 192.0.2.254
For IPv6:
#
ping 2001:db8:1::fffe
Use the
host
utility to verify that name resolution works. For example:#
host client.example.com
If the command returns any error, such as
connection timed out
orno servers could be reached
, verify your DNS settings.
Troubleshooting steps
If the connection fails or if the network interface switches between an up and down status:
- Make sure that the network cable is plugged-in to the host and a switch.
- Check whether the link failure exists only on this host or also on other hosts connected to the same switch the server is connected to.
- Verify that the network cable and the network interface are working as expected. Perform hardware diagnosis steps and replace defect cables and network interface cards.
Additional resources
-
See the
nm-settings(5)
man page for more information on connection profile properties and their settings. -
For further details about the
nmcli
utility, see thenmcli(1)
man page. - If the configuration on the disk does not match the configuration on the device, starting or restarting NetworkManager creates an in-memory connection that reflects the configuration of the device. For further details and how to avoid this problem, see NetworkManager duplicates a connection after restart of NetworkManager service.
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
8.3. Configuring a static Ethernet connection using RHEL System Roles
This procedure describes how to use RHEL System roles to remotely add an Ethernet connection for the enp7s0
interface with the following settings by running an Ansible playbook:
-
A static IPv4 address -
192.0.2.1
with a/24
subnet mask -
A static IPv6 address -
2001:db8:1::1
with a/64
subnet mask -
An IPv4 default gateway -
192.0.2.254
-
An IPv6 default gateway -
2001:db8:1::fffe
-
An IPv4 DNS server -
192.0.2.200
-
An IPv6 DNS server -
2001:db8:1::ffbb
-
A DNS search domain -
example.com
Run this procedure on the Ansible control node.
Prerequisites
-
The
ansible
andrhel-system-roles
packages are installed on the control node. -
If you use a different remote user than
root
when you run the playbook, this user has appropriatesudo
permissions on the managed node. - The host uses NetworkManager to configure the network.
Procedure
If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the
/etc/ansible/hosts
Ansible inventory file:node.example.com
Create the
~/ethernet-static-IP.yml
playbook with the following content:--- - name: Configure an Ethernet connection with static IP hosts: node.example.com become: true tasks: - include_role: name: linux-system-roles.network vars: network_connections: - name: enp7s0 type: ethernet autoconnect: yes ip: address: - 192.0.2.1/24 - 2001:db8:1::1/64 gateway4: 192.0.2.254 gateway6: 2001:db8:1::fffe dns: - 192.0.2.200 - 2001:db8:1::ffbb dns_search: - example.com state: up
Run the playbook:
To connect as
root
user to the managed host, enter:#
ansible-playbook -u root ~/ethernet-static-IP.yml
To connect as a user to the managed host, enter:
#
ansible-playbook -u user_name --ask-become-pass ~/ethernet-static-IP.yml
The
--ask-become-pass
option makes sure that theansible-playbook
command prompts for thesudo
password of the user defined in the-u user_name
option.
If you do not specify the
-u user_name
option,ansible-playbook
connects to the managed host as the user that is currently logged in to the control node.
Additional resources
-
For details about the parameters used in
network_connections
and for additional information about thenetwork
System Role, see the/usr/share/ansible/roles/rhel-system-roles.network/README.md
file. -
For details about the
ansible-playbook
command, see theansible-playbook(1)
man page.
8.4. Configuring a dynamic Ethernet connection using nmcli
This procedure describes adding an dynamic Ethernet connection using the nmcli
utility. With this setting, NetworkManager requests the IP settings for this connection from a DHCP server.
Prerequisites
- A DHCP server is available in the network.
Procedure
Add a new NetworkManager connection profile for the Ethernet connection:
#
nmcli connection add con-name Example-Connection ifname enp7s0 type ethernet
Optionally, change the host name NetworkManager sends to the DHCP server when using the
Example-Connection
profile:#
nmcli connection modify Example-Connection ipv4.dhcp-hostname Example ipv6.dhcp-hostname Example
Optionally, change the client ID NetworkManager sends to an IPv4 DHCP server when using the
Example-Connection
profile:#
nmcli connection modify Example-Connection ipv4.dhcp-client-id client-ID
Note that there is no
dhcp-client-id
parameter for IPv6. To create an identifier for IPv6, configure thedhclient
service.
Verification steps
Display the status of the devices and connections:
#
nmcli device status
DEVICE TYPE STATE CONNECTION enp7s0 ethernet connected Example-ConnectionTo display all settings of the connection profile:
#
nmcli connection show Example-Connection
connection.id: Example-Connection connection.uuid: b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76 connection.stable-id: -- connection.type: 802-3-ethernet connection.interface-name: enp7s0 ...Use the
ping
utility to verify that this host can send packets to other hosts.Ping an IP address in the same subnet.
For IPv4:
#
ping 192.0.2.3
For IPv6:
#
ping 2001:db8:2::1
If the command fails, verify the IP and subnet settings.
Ping an IP address in a remote subnet.
For IPv4:
#
ping 198.162.3.1
For IPv6:
#
ping 2001:db8:2::1
If the command fails, ping the default gateway to verify settings.
For IPv4:
#
ping 192.0.2.254
For IPv6:
#
ping 2001:db8:1::fffe
Use the
host
utility to verify that name resolution works. For example:#
host client.example.com
If the command returns any error, such as
connection timed out
orno servers could be reached
, verify your DNS settings.
Additional resources
-
For details about setting a client identifier for IPv6, see the
dhclient(8)
man page. -
See the
nm-settings(5)
man page for more information on connection profile properties and their settings. -
For further details about the
nmcli
utility, see thenmcli(1)
man page. - If the configuration on the disk does not match the configuration on the device, starting or restarting NetworkManager creates an in-memory connection that reflects the configuration of the device. For further details and how to avoid this problem, see NetworkManager duplicates a connection after restart of NetworkManager service.
8.5. Configuring a dynamic Ethernet connection using the nmcli interactive editor
This procedure describes adding an dynamic Ethernet connection using the interactive editor of the nmcli
utility. With this setting, NetworkManager requests the IP settings for this connection from a DHCP server.
Prerequisites
- A DHCP server is available in the network.
Procedure
To add a new NetworkManager connection profile for the Ethernet connection, and starting the interactive mode, enter:
#
nmcli connection edit type ethernet con-name Example-Connection
Set the network interface:
nmcli>
set connection.interface-name enp7s0
Optionally, change the host name NetworkManager sends to the DHCP server when using the
Example-Connection
profile:nmcli>
set ipv4.dhcp-hostname Example
nmcli>set ipv6.dhcp-hostname Example
Optionally, change the client ID NetworkManager sends to an IPv4 DHCP server when using the
Example-Connection
profile:nmcli>
set ipv4.dhcp-client-id client-ID
Note that there is no
dhcp-client-id
parameter for IPv6. To create an identifier for IPv6, configure thedhclient
service.Save and activate the connection:
nmcli>
save persistent
Saving the connection with 'autoconnect=yes'. That might result in an immediate activation of the connection. Do you still want to save? (yes/no) [yes]yes
Leave the interactive mode:
nmcli>
quit
Verification steps
Display the status of the devices and connections:
#
nmcli device status
DEVICE TYPE STATE CONNECTION enp7s0 ethernet connected Example-ConnectionTo display all settings of the connection profile:
#
nmcli connection show Example-Connection
connection.id: Example-Connection connection.uuid: b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76 connection.stable-id: -- connection.type: 802-3-ethernet connection.interface-name: enp7s0 ...Use the
ping
utility to verify that this host can send packets to other hosts.Ping an IP address in the same subnet.
For IPv4:
#
ping 192.0.2.3
For IPv6:
#
ping 2001:db8:2::1
If the command fails, verify the IP and subnet settings.
Ping an IP address in a remote subnet.
For IPv4:
#
ping 198.162.3.1
For IPv6:
#
ping 2001:db8:2::1
If the command fails, ping the default gateway to verify settings.
For IPv4:
#
ping 192.0.2.254
For IPv6:
#
ping 2001:db8:1::fffe
Use the
host
utility to verify that name resolution works. For example:#
host client.example.com
If the command returns any error, such as
connection timed out
orno servers could be reached
, verify your DNS settings.
Additional resources
-
For details about setting a client identifier for IPv6, see the
dhclient(8)
man page. -
See the
nm-settings(5)
man page for more information on connection profile properties and their settings. -
For further details about the
nmcli
utility, see thenmcli(1)
man page. - If the configuration on the disk does not match the configuration on the device, starting or restarting NetworkManager creates an in-memory connection that reflects the configuration of the device. For further details and how to avoid this problem, see NetworkManager duplicates a connection after restart of NetworkManager service.
8.6. Configuring a dynamic Ethernet connection using RHEL System Roles
This procedure describes how to use RHEL System Roles to remotely add a dynamic Ethernet connection for the enp7s0
interface by running an Ansible playbook. With this setting, the network connection requests the IP settings for this connection from a DHCP server. Run this procedure on the Ansible control node.
Prerequisites
- A DHCP server is available in the network.
-
The
ansible
andrhel-system-roles
packages are installed on the control node. -
If you use a different remote user than
root
when you run the playbook, this user has appropriatesudo
permissions on the managed node. - The host uses NetworkManager to configure the network.
Procedure
If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the
/etc/ansible/hosts
Ansible inventory file:node.example.com
Create the
~/ethernet-dynamic-IP.yml
playbook with the following content:--- - name: Configure an Ethernet connection with dynamic IP hosts: node.example.com become: true tasks: - include_role: name: linux-system-roles.network vars: network_connections: - name: enp7s0 type: ethernet autoconnect: yes ip: dhcp4: yes auto6: yes state: up
Run the playbook:
To connect as
root
user to the managed host, enter:#
ansible-playbook -u root ~/ethernet-dynamic-IP.yml
To connect as a user to the managed host, enter:
#
ansible-playbook -u user_name --ask-become-pass ~/ethernet-dynamic-IP.yml
The
--ask-become-pass
option makes sure that theansible-playbook
command promptsv for thesudo
password of the user defined in the-u user_name
option.
If you do not specify the
-u user_name
option,ansible-playbook
connects to the managed host as the user that is currently logged in to the control node.
Additional resources
-
For details about the parameters used in
network_connections
and for additional information about thenetwork
System Role, see the/usr/share/ansible/roles/rhel-system-roles.network/README.md
file. -
For details about the
ansible-playbook
command, see theansible-playbook(1)
man page.
8.7. Configuring an Ethernet connection using control-center
Ethernet connections are the most frequently used connections types in physical or virtual machines. This section describes how to configure this connection type in the GNOME control-center
:
Note that control-center
does not support as many configuration options as the nm-connection-editor
application or the nmcli
utility.
Prerequisites
- A physical or virtual Ethernet device exists in the server’s configuration.
- GNOME is installed.
Procedure
-
Press the Super key, enter
Settings
, and press Enter. -
Select
Network
in the navigation on the left. -
Click the
Wired
entry to create a new profile. button next to the -
Optional: Set a name for the connection on the
Identity
tab. On the
IPv4
tab, configure the IPv4 settings. For example, select methodManual
, set a static IPv4 address, network mask, default gateway, and DNS server:On the
IPv6
tab, configure the IPv6 settings. For example, select methodManual
, set a static IPv6 address, network mask, default gateway, and DNS server:-
Click the
control-center
automatically activates the connection. button to save the connection. The GNOME
Verification steps
Display the status of the devices and connections:
#
nmcli device status
DEVICE TYPE STATE CONNECTION enp7s0 ethernet connected Example-ConnectionTo display all settings of the connection profile:
#
nmcli connection show Example-Connection
connection.id: Example-Connection connection.uuid: b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76 connection.stable-id: -- connection.type: 802-3-ethernet connection.interface-name: enp7s0 ...Use the
ping
utility to verify that this host can send packets to other hosts.Ping an IP address in the same subnet.
For IPv4:
#
ping 192.0.2.3
For IPv6:
#
ping 2001:db8:2::1
If the command fails, verify the IP and subnet settings.
Ping an IP address in a remote subnet.
For IPv4:
#
ping 198.162.3.1
For IPv6:
#
ping 2001:db8:2::1
If the command fails, ping the default gateway to verify settings.
For IPv4:
#
ping 192.0.2.254
For IPv6:
#
ping 2001:db8:1::fffe
Use the
host
utility to verify that name resolution works. For example:#
host client.example.com
If the command returns any error, such as
connection timed out
orno servers could be reached
, verify your DNS settings.
Troubleshooting steps
If the connection fails or if the network interface switches between an up and down status:
- Make sure that the network cable is plugged-in to the host and a switch.
- Check whether the link failure exists only on this host or also on other hosts connected to the same switch the server is connected to.
- Verify that the network cable and the network interface are working as expected. Perform hardware diagnosis steps and replace defect cables and network interface cards.
Additional Resources
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
8.8. Configuring an Ethernet connection using nm-connection-editor
Ethernet connections are the most frequently used connection types in physical or virtual servers. This section describes how to configure this connection type using the nm-connection-editor
application.
Prerequisites
- A physical or virtual Ethernet device exists in the server’s configuration.
- GNOME is installed.
Procedure
Open a terminal, and enter:
$ nm-connection-editor
- Click the button to add a new connection.
-
Select the
Ethernet
connection type, and click . On the
General
tab:To automatically enable this connection when the system boots or when you restart the
NetworkManager
service:-
Select
Connect automatically with priority
. Optional: Change the priority value next to
Connect automatically with priority
.If multiple connection profiles exist for the same device, NetworkManager enables only one profile. By default, NetworkManager activates the last-used profile that has auto-connect enabled. However, if you set priority values in the profiles, NetworkManager activates the profile with the highest priority.
-
Select
-
Clear the
All users may connect to this network
check box if the profile should be available only to the user that created the connection profile.
-
On the
Ethernet
tab, select a device and, optionally, further Ethernet-related settings. -
On the
IPv4 Settings
tab, configure the IPv4 settings. For example, set a static IPv4 address, network mask, default gateway, and DNS server: -
On the
IPv6 Settings
tab, configure the IPv6 settings. For example, set a static IPv6 address, network mask, default gateway, and DNS server: - Save the connection.
-
Close
nm-connection-editor
.
Verification steps
Use the
ping
utility to verify that this host can send packets to other hosts.Ping an IP address in the same subnet.
For IPv4:
# ping 192.0.2.3
For IPv6:
# ping 2001:db8:2::1
If the command fails, verify the IP and subnet settings.
Ping an IP address in a remote subnet.
For IPv4:
# ping 198.162.3.1
For IPv6:
# ping 2001:db8:2::1
If the command fails, ping the default gateway to verify settings.
For IPv4:
# ping 192.0.2.254
For IPv6:
# ping 2001:db8:1::fff3
Use the
host
utility to verify that name resolution works. For example:# host client.example.com
If the command returns any error, such as
connection timed out
orno servers could be reached
, verify your DNS settings.
Additional Resources
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
8.9. Configuring the DHCP behavior of a NetworkManager connection
A Dynamic Host Configuration Protocol (DHCP) client requests the dynamic IP address and corresponding configuration information from a DHCP server each time a client connects to the network.
When you configured a connection to retrieve an IP address from a DHCP server, the NetworkManager requests an IP address from a DHCP server. By default, the client waits 45 seconds for this request to be completed. When a DHCP
connection is started, a dhcp client requests an IP address from a DHCP
server.
Prerequisites
- A connection that uses DHCP is configured on the host.
Procedure
Set the
ipv4.dhcp-timeout
andipv6.dhcp-timeout
properties. For example, to set both options to30
seconds, enter:#
nmcli connection modify connection_name ipv4.dhcp-timeout 30 ipv6.dhcp-timeout 30
Alternatively, set the parameters to
infinity
to configure that NetworkManager does not stop trying to request and renew an IP address until it is successful.Optional: Configure the behavior if NetworkManager does not receive an IPv4 address before the timeout:
#
nmcli connection modify connection_name ipv4.may-fail value
If you set the
ipv4.may-fail
option to:yes
, the status of the connection depends on the IPv6 configuration:- If the IPv6 configuration is enabled and successful, NetworkManager activates the IPv6 connection and no longer tries to activate the IPv4 connection.
- If the IPv6 configuration is disabled or not configured, the connection fails.
no
, the connection is deactivated. In this case:-
If the
autoconnect
property of the connection is enabled, NetworkManager retries to activate the connection as many times as set in theautoconnect-retries
property. The default is4
. - If the connection still cannot acquire a DHCP address, auto-activation fails. Note that after 5 minutes, the auto-connection process starts again to acquire an IP address from the DHCP server.
-
If the
Optional: Configure the behavior if NetworkManager does not receive an IPv6 address before the timeout:
#
nmcli connection modify connection_name ipv6.may-fail value
Additional resources
-
For further details about the properties described in this section, see the
nm-settings(5)
man page.
Chapter 9. Managing Wi-Fi connections
This section describes how to configure and manage Wi-Fi connections.
9.1. Setting the wireless regulatory domain
In Red Hat Enterprise Linux, the crda package contains the Central Regulatory Domain Agent that provides the kernel with the wireless regulatory rules for a given jurisdiction. It is used by certain udev scripts and should not be run manually unless debugging udev scripts. The kernel runs crda by sending a udev event upon a new regulatory domain change. Regulatory domain changes are triggered by the Linux wireless subsystem (IEEE-802.11). This subsystem uses the regulatory.bin
file to keep its regulatory database information.
The setregdomain
utility sets the regulatory domain for your system. Setregdomain
takes no arguments and is usually called through system script such as udev rather than manually by the administrator. If a country code look-up fails, the system administrator can define the COUNTRY
environment variable in the /etc/sysconfig/regdomain
file.
Additional resources
See the following man pages for more information about the regulatory domain:
-
setregdomain(1)
man page — Sets regulatory domain based on country code. -
crda(8)
man page — Sends to the kernel a wireless regulatory domain for a given ISO or IEC 3166 alpha2. -
regulatory.bin(5)
man page — Shows the Linux wireless regulatory database. -
iw(8)
man page — Shows or manipulates wireless devices and their configuration.
9.2. Configuring a Wi-Fi connection using nmcli
This procedure describes how to configure a Wi-fi connection profile using nmcli.
Prerequisites
- The nmcli utility to be installed.
Make sure that the WiFi radio is on (default):
~]$
nmcli radio wifi on
Procedure
To create a Wi-Fi connection profile with static
IP
configuration:~]$
nmcli con add con-name MyCafe ifname wlan0 type wifi ssid MyCafe ` `ip4 192.168.100.101/24 gw4 192.168.100.1
Set a DNS server. For example, to set
192.160.100.1
as the DNS server:~]$
nmcli con modify con-name MyCafe ipv4.dns "192.160.100.1"
Optionally, set a DNS search domain. For example, to set the search domain to
example.com
:~]$
nmcli con modify con-name MyCafe ipv4.dns-search "example.com"
To check a specific property, for example
mtu
:~]$
nmcli connection show id MyCafe | grep mtu
802-11-wireless.mtu: autoTo change the property of a setting:
~]$
nmcli connection modify id MyCafe 802-11-wireless.mtu 1350
To verify the change:
~]$
nmcli connection show id MyCafe | grep mtu
802-11-wireless.mtu: 1350
Verification steps
Use the
ping
utility to verify that this host can send packets to other hosts.Ping an IP address in the same subnet. For example:
# ping 192.168.100.103
If the command fails, verify the IP and subnet settings.
Ping an IP address in a remote subnet. For example:
# ping 198.51.16.3
If the command fails, ping the default gateway to verify settings.
# ping 192.168.100.1
Use the
host
utility to verify that name resolution works. For example:# host client.example.com
If the command returns any error, such as
connection timed out
orno servers could be reached
, verify your DNS settings.
Additional resources
-
See the
nm-settings(5)
man page for more information on properties and their settings. - If the configuration on the disk does not match the configuration on the device, starting or restarting NetworkManager creates an in-memory connection that reflects the configuration of the device. For further details and how to avoid this problem, see NetworkManager duplicates a connection after restart of NetworkManager service.
9.3. Configuring a Wi-Fi connection using control-center
When you connect to a Wi-Fi
, the network settings are prefilled depending on the current network connection. This means that the settings will be detected automatically when the interface connects to a network.
This procedure describes how to use control-center to manually configure the Wi-Fi
settings.
Procedure
-
Press the Super key to enter the
Activities Overview
, typeWi-Fi
and press Enter. In the left-hand-side menu entry you see the list of available networks. Select the gear wheel icon to the right of the
Wi-Fi
connection name that you want to edit, and the editing connection dialog appears. The Details menu window shows the connection details where you can make further configuration.Options
-
If you select
Connect automatically
, NetworkManager auto-connects to this connection whenever NetworkManager detects that it is available. If you do not want NetworkManager to connect automatically, clear the check box. Note that when the check box is clear, you have to select that connection manually in the network connection icon’s menu to cause it to connect. -
To make a connection available to other users, select the
Make available to other users
check box. You can also control the background data usage. If you leave
Restrict background data usage
unspecified (default), then NetworkManager tries to download data that you are actively using. Otherwise, select the check box and NetworkManager sets the connection as metered, and applies restriction on the background data usage.NoteTo delete a
Wi-Fi
connection, click theForget Connection
red box.
-
If you select
Select the Identity menu entry to see the basic configuration options.
SSID
— The Service Set Identifier (SSID) of the access point (AP).BSSID
— The Basic Service Set Identifier (BSSID) is the MAC address, also known as a hardware address, of the specific wireless access point you are connecting to when inInfrastructure
mode. This field is blank by default, and you are able to connect to a wireless access point bySSID
without having to specify itsBSSID
. If the BSSID is specified, it will force the system to associate to a specific access point only. For ad-hoc networks, theBSSID
is generated randomly by the mac80211 subsystem when the ad-hoc network is created. It is not displayed by NetworkManager.MAC address
— The MAC address allows you to associate a specific wireless adapter with a specific connection (or connections).Cloned Address
— A cloned MAC address to use in place of the real hardware address. Leave blank unless required.For further IP address configuration , select the IPv4 and IPv6 menu entries.
By default, both
IPv4
andIPv6
are set to automatic configuration depending on current network settings. This means that addresses such as the local IP address, DNS address, and other settings will be detected automatically when the interface connects to a network. If a DHCP server assigns the IP configuration in this network, this is sufficient, but you can also provide static configuration in theIPv4
andIPv6
Settings. In the IPv4 and IPv6 menu entries, you can see the following settings:IPv4 Method
-
Automatic (DHCP)
— Choose this option if the network you are connecting to uses Router Advertisements (RA) or aDHCP
server to assign dynamic IP addresses. You can see the assigned IP address in the Details menu entry. -
Link-Local Only
— Choose this option if the network you are connecting to does not have aDHCP
server and you do not want to assign IP addresses manually. Random addresses will be assigned as per RFC 3927 with prefix169.254/16
. -
Manual
— Choose this option if you want to assign IP addresses manually. -
Disable
—IPv4
is disabled for this connection.
-
DNS
If
Automatic
isON
, and no DHCP server is available that assigns DNS servers to this connection, switch it toOFF
to enter the IP address of a DNS server separating the IPs by comma.Routes
Note that in the
Routes
section, whenAutomatic
isON
, routes from Router Advertisements (RA) or DHCP are used, but you can also add additional static routes. WhenOFF
, only static routes are used.-
Address
— Enter theIP
address of a remote network, sub-net, or host. -
Netmask
— The netmask or prefix length of the IP address entered above. -
Gateway
— The IP address of the gateway leading to the remote network, sub-net, or host entered above. -
Metric
— A network cost, a preference value to give to this route. Lower values will be preferred over higher values.
-
Use this connection only for resources on its network
Select this check box to prevent the connection from becoming the default route.
Alternatively, to configure
IPv6
settings in aWi-Fi
connection, select the menu entry:IPv6 Method
-
Automatic
— Choose this option to useIPv6
Stateless Address AutoConfiguration (SLAAC) to create an automatic, stateless configuration based on the hardware address and Router Advertisements (RA). -
Automatic, DHCP only
— Choose this option to not use RA, but request information fromDHCPv6
directly to create a stateful configuration. -
Link-Local Only
— Choose this option if the network you are connecting to does not have aDHCP
server and you do not want to assign IP addresses manually. Random addresses will be assigned as per RFC 4862 with prefixFE80::0
. -
Manual
— Choose this option if you want to assign IP addresses manually. -
Disable
—IPv6
is disabled for this connection.
-
-
The
DNS
,Routes
,Use this connection only for resources on its network
fields are common toIPv4
settings.
To configure
Security
settings in aWi-Fi
connection, select the Security menu entry. The following configuration options are available:Security
-
None
— Do not encrypt the Wi-Fi connection. -
WEP 40/128-bit Key
— Wired Equivalent Privacy (WEP), from the IEEE 802.11 standard. Uses a single pre-shared key (PSK). WEP 128-bit Passphrase
— An MD5 hash of the passphrase to derive a WEP key.WarningIf the
Wi-Fi
use no encryption,WEP
, orWPA
, do not use the network because it is insecure and everyone can read the data you send over this network.-
LEAP
— Lightweight Extensible Authentication Protocol, from Cisco Systems. -
Dynamic WEP (802.1X)
— WEP keys are changed dynamically. -
WPA & WPA2 Personal
— Wi-Fi Protected Access (WPA), from the draft IEEE 802.11i standard. A replacement for WEP. Wi-Fi Protected Access II (WPA2), from the 802.11i-2004 standard. Personal mode uses a pre-shared key (WPA-PSK). -
WPA & WPA2 Enterprise
— WPA for use with a RADIUS authentication server to provide IEEE 802.1X network access control.
-
- Password — Enter the password to be used in the authentication process.
- Once you have finished the configuration, click the button to save it.
When you add a new connection by clicking the NetworkManager creates a new configuration file for that connection and then opens the same dialog that is used for editing an existing connection. The difference between these dialogs is that an existing connection profile has a Details menu entry.
button,9.4. Connecting to a Wi-Fi network with nmcli
This procedure describes how to connect to a wireless
connection using the nmcli utility.
Prerequisites
- The nmcli utility to be installed.
Make sure that the WiFi radio is on (default):
~]$
nmcli radio wifi on
Procedure
To refresh the available Wi-Fi connection list:
~]$
nmcli device wifi rescan
To view the available Wi-Fi access points:
~]$
nmcli dev wifi list
IN-USE SSID MODE CHAN RATE SIGNAL BARS SECURITY ... MyCafe Infra 3 405 Mbit/s 85 ▂▄▆█ WPA1 WPA2To connect to a Wi-Fi connection using nmcli:
~]$
nmcli dev wifi connect SSID-Name password wireless-password
For example:
~]$
nmcli dev wifi connect MyCafe password wireless-password
Note that if you want to disable the Wi-Fi state:
~]$
nmcli radio wifi off
9.6. Connecting to a Wi-Fi network using the GNOME GUI
This procedure describes how you can connect to a wireless network to get access to the Internet.
Procedure
- Open the GNOME Shell network connection icon menu from the top right-hand corner of the screen.
-
Select
Wi-Fi Not Connected
. -
Click the
Select Network
option. Click the name of the network to which you want to connect, and then click
Connect
.Note that if you do not see the network, the network might be hidden.
If the network is protected by a password or encryption keys are required, enter the password and click
Connect
.Note that if you do not know the password, contact the administrator of the Wi-Fi network.
- If the connection is successful, the name of the network is visible in the connection icon menu and the wireless indicator is on the top right-hand corner of the screen.
Additional resources
Chapter 10. Configuring VLAN tagging
This section describes how to configure Virtual Local Area Network (VLAN). A VLAN is a logical network within a physical network. The VLAN interface tags packets with the VLAN ID as they pass through the interface, and removes tags of returning packets.
You create a VLAN interface on top of another interface, such as an Ethernet, bond, team, or bridge device. This interface is called the parent interface
.
10.1. Configuring VLAN tagging using nmcli commands
This section describes how to configure Virtual Local Area Network (VLAN) tagging using the nmcli
utility.
Prerequisites
- The interface you plan to use as a parent to the virtual VLAN interface supports VLAN tags.
If you configure the VLAN on top of a bond interface:
- The ports of the bond are up.
-
The bond is not configured with the
fail_over_mac=follow
option. A VLAN virtual device cannot change its MAC address to match the parent’s new MAC address. In such a case, the traffic would still be sent with the then incorrect source MAC address.
- The switch the host is connected to is configured to support VLAN tags. For details, see the documentation of your switch.
Procedure
Display the network interfaces:
#
nmcli device status
DEVICE TYPE STATE CONNECTION enp1s0 ethernet disconnected enp1s0 bridge0 bridge connected bridge0 bond0 bond connected bond0 ...Create the VLAN interface. For example, to create a VLAN interface named
vlan10
that usesenp1s0
as its parent interface and that tags packets with VLAN ID10
, enter:#
nmcli connection add type vlan con-name vlan10 ifname vlan10 vlan.parent enp1s0 vlan.id 10
Note that the VLAN must be within the range from
0
to4094
.By default, the VLAN connection inherits the maximum transmission unit (MTU) from the parent interface. Optionally, set a different MTU value:
#
nmcli connection modify vlan10 802-3-ethernet.mtu 2000
Configure the IP settings of the VLAN device. Skip this step if you want to use this VLAN device as a port of other devices.
Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, and DNS server to the
vlan10
connection, enter:#
nmcli connection modify vlan10 ipv4.addresses '192.0.2.1/24'
#nmcli connection modify vlan10 ipv4.gateway '192.0.2.254'
#nmcli connection modify vlan10 ipv4.dns '192.0.2.253'
#nmcli connection modify vlan10 ipv4.method manual
Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, and DNS server to the
vlan10
connection, enter:#
nmcli connection modify vlan10 ipv6.addresses '2001:db8:1::1/32'
#nmcli connection modify vlan10 ipv6.gateway '2001:db8:1::fffe'
#nmcli connection modify vlan10 ipv6.dns '2001:db8:1::fffd'
#nmcli connection modify vlan10 ipv6.method manual
Activate the connection:
#
nmcli connection up vlan10
Verification steps
Verify the settings:
#
ip -d addr show vlan10
4: vlan10@enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 52:54:00:d5:e0:fb brd ff:ff:ff:ff:ff:ff promiscuity 0 vlan protocol 802.1Q id 10 <REORDER_HDR> numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute vlan10 valid_lft forever preferred_lft forever inet6 2001:db8:1::1/32 scope global noprefixroute valid_lft forever preferred_lft forever inet6 fe80::8dd7:9030:6f8e:89e6/64 scope link noprefixroute valid_lft forever preferred_lft forever
Additional resources
- For more information on testing connections, see Chapter 39, Testing basic network settings.
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
-
For
nmcli
examples, see thenmcli-examples(7)
man page. -
For all vlan properties you can set, see the
vlan setting
section in thenm-settings(5)
man page.
10.2. Configuring VLAN tagging using nm-connection-editor
This section describes how to configure Virtual Local Area Network (VLAN) tagging using the nm-connection-editor
application.
Prerequisites
- The interface you plan to use as a parent to the virtual VLAN interface supports VLAN tags.
If you configure the VLAN on top of a bond interface:
- The ports of the bond are up.
-
The bond is not configured with the
fail_over_mac=follow
option. A VLAN virtual device cannot change its MAC address to match the parent’s new MAC address. In such a case, the traffic would still be sent with the then incorrect source MAC address.
- The switch the host is connected to is configured to support VLAN tags. For details, see the documentation of your switch.
Procedure
Open a terminal, and enter
nm-connection-editor
:$
nm-connection-editor
- Click the button to add a new connection.
-
Select the
VLAN
connection type, and click . On the
VLAN
tab:- Select the parent interface.
-
Select the VLAN id. Note that the VLAN must be within the range from
0
to4094
. - By default, the VLAN connection inherits the maximum transmission unit (MTU) from the parent interface. Optionally, set a different MTU value.
Optionally, set the name of the VLAN interface and further VLAN-specific options.
Configure the IP settings of the VLAN device. Skip this step if you want to use this VLAN device as a port of other devices.
-
On the
IPv4 Settings
tab, configure the IPv4 settings. For example, set a static IPv4 address, network mask, default gateway, and DNS server: -
On the
IPv6 Settings
tab, configure the IPv6 settings. For example, set a static IPv6 address, network mask, default gateway, and DNS server:
-
On the
- Click to save the VLAN connection.
-
Close
nm-connection-editor
.
Verification steps
Verify the settings:
#
ip -d addr show vlan10
4: vlan10@enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 52:54:00:d5:e0:fb brd ff:ff:ff:ff:ff:ff promiscuity 0 vlan protocol 802.1Q id 10 <REORDER_HDR> numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute vlan10 valid_lft forever preferred_lft forever inet6 2001:db8:1::1/32 scope global noprefixroute valid_lft forever preferred_lft forever inet6 fe80::8dd7:9030:6f8e:89e6/64 scope link noprefixroute valid_lft forever preferred_lft forever
Additional resources
- For more information on testing connections, see Chapter 39, Testing basic network settings.
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
10.3. Configuring VLAN tagging using System Roles
You can use the networking
RHEL System Role to configure VLAN tagging. This procedure describes how to add an Ethernet connection and a VLAN with ID 10
that uses this Ethernet connection. As the parent device, the VLAN connection contains the IP, default gateway, and DNS configurations.
Depending on your environment, adjust the play accordingly. For example:
-
To use the VLAN as a port in other connections, such as a bond, omit the
ip
attribute, and set the IP configuration in the parent configuration. -
To use team, bridge, or bond devices in the VLAN, adapt the
interface_name
andtype
attributes of the ports you use in the VLAN.
Prerequisites
-
The
ansible
andrhel-system-roles
packages are installed on the control node. -
If you use a different remote user than
root
when you run the playbook, this user has appropriatesudo
permissions on the managed node.
Procedure
If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the
/etc/ansible/hosts
Ansible inventory file:node.example.com
Create the
~/vlan-ethernet.yml
playbook with the following content:--- - name: Configure a VLAN that uses an Ethernet connection hosts: node.example.com become: true tasks: - include_role: name: linux-system-roles.network vars: network_connections: # Add an Ethernet profile for the underlying device of the VLAN - name: enp1s0 type: ethernet interface_name: enp1s0 autoconnect: yes state: up ip: dhcp4: no auto6: no # Define the VLAN profile - name: vlan10 type: vlan ip: address: - "192.0.2.1/24" - "2001:db8:1::1/64" gateway4: 192.0.2.254 gateway6: 2001:db8:1::fffe dns: - 192.0.2.200 - 2001:db8:1::ffbb dns_search: - example.com vlan_id: 10 parent: enp1s0 state: up
The
parent
attribute in the VLAN profile configures the VLAN to operate on top of theenp1s0
device.Run the playbook:
To connect as
root
user to the managed host, enter:#
ansible-playbook -u root ~/vlan-ethernet.yml
To connect as a user to the managed host, enter:
#
ansible-playbook -u user_name --ask-become-pass ~/vlan-ethernet.yml
The
--ask-become-pass
option makes sure that theansible-playbook
command prompts for thesudo
password of the user defined in the-u user_name
option.
If you do not specify the
-u user_name
option,ansible-playbook
connects to the managed host as the user that is currently logged in to the control node.
Additional resources
-
For details about the parameters used in
network_connections
and for additional information about thenetwork
System Role, see the/usr/share/ansible/roles/rhel-system-roles.network/README.md
file. -
For details about the
ansible-playbook
command, see theansible-playbook(1)
man page.
Chapter 11. Configuring a network bridge
A network bridge is a link-layer device which forwards traffic between networks based on a table of MAC addresses. The bridge builds the MAC addresses table by listening to network traffic and thereby learning what hosts are connected to each network. For example, you can use a software bridge on a Red Hat Enterprise Linux 8 host to emulate a hardware bridge or in virtualization environments, to integrate virtual machines (VM) to the same network as the host.
A bridge requires a network device in each network the bridge should connect. When you configure a bridge, the bridge is called controller
and the devices it uses ports
.
You can create bridges on different types of devices, such as:
- Physical and virtual Ethernet devices
- Network bonds
- Network teams
- VLAN devices
Due to the IEEE 802.11 standard which specifies the use of 3-address frames in Wi-Fi for the efficient use of airtime, you cannot configure a bridge over Wi-Fi networks operating in Ad-Hoc or Infrastructure modes.
11.1. Configuring a network bridge using nmcli commands
This section explains how to configure a network bridge using the nmcli
utility.
Prerequisites
- Two or more physical or virtual network devices are installed on the server.
- To use Ethernet devices as ports of the bridge, the physical or virtual Ethernet devices must be installed on the server.
To use team, bond, or VLAN devices as ports of the bridge, you can either create these devices while you create the bridge or you can create them in advance as described in:
Procedure
Create a bridge interface:
#
nmcli connection add type bridge con-name bridge0 ifname bridge0
This command creates a bridge named
bridge0
, enter:Display the network interfaces, and note the names of the interfaces you want to add to the bridge:
#
nmcli device status
DEVICE TYPE STATE CONNECTION enp7s0 ethernet disconnected -- enp8s0 ethernet disconnected -- bond0 bond connected bond0 bond1 bond connected bond1 ...In this example:
-
enp7s0
andenp8s0
are not configured. To use these devices as ports, add connection profiles in the next step. -
bond0
andbond1
have existing connection profiles. To use these devices as ports, modify their profiles in the next step.
-
Assign the interfaces to the bridge.
If the interfaces you want to assign to the bridge are not configured, create new connection profiles for them:
#
nmcli connection add type ethernet slave-type bridge con-name bridge0-port1 ifname enp7s0 master bridge0
#nmcli connection add type ethernet slave-type bridge con-name bridge0-port2 ifname enp8s0 master bridge0
These commands create profiles for
enp7s0
andenp8s0
, and add them to thebridge0
connection.If you want to assign an existing connection profile to the bridge, set the
master
parameter of these connections tobridge0
:#
nmcli connection modify bond0 master bridge0
#nmcli connection modify bond1 master bridge0
These commands assign the existing connection profiles named
bond0
andbond1
to thebridge0
connection.
Configure the IP settings of the bridge. Skip this step if you want to use this bridge as a ports of other devices.
Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain of the
bridge0
connection, enter:#
nmcli connection modify bridge0 ipv4.addresses '192.0.2.1/24'
#nmcli connection modify bridge0 ipv4.gateway '192.0.2.254'
#nmcli connection modify bridge0 ipv4.dns '192.0.2.253'
#nmcli connection modify bridge0 ipv4.dns-search 'example.com'
#nmcli connection modify bridge0 ipv4.method manual
Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain of the
bridge0
connection, enter:#
nmcli connection modify bridge0 ipv6.addresses '2001:db8:1::1/64'
#nmcli connection modify bridge0 ipv6.gateway '2001:db8:1::fffe'
#nmcli connection modify bridge0 ipv6.dns '2001:db8:1::fffd'
#nmcli connection modify bridge0 ipv6.dns-search 'example.com'
#nmcli connection modify bridge0 ipv6.method manual
Optional: Configure further properties of the bridge. For example, to set the Spanning Tree Protocol (STP) priority of
bridge0
to16384
, enter:#
nmcli connection modify bridge0 bridge.priority '16384'
By default, STP is enabled.
Activate the connection:
#
nmcli connection up bridge0
Verify that the ports are connected, and the
CONNECTION
column displays the port’s connection name:#
nmcli device
DEVICE TYPE STATE CONNECTION ... enp7s0 ethernet connected bridge0-port1 enp8s0 ethernet connected bridge0-port2Red Hat Enterprise Linux activates controller and ports when the system boots. By activating any port connection, the controller is also activated. However, in this case, only one port connection is activated. By default, activating the controller does not automatically activate the ports. However, you can enable this behavior by setting:
Enable the
connection.autoconnect-slaves
parameter of the bridge connection:#
nmcli connection modify bridge0 connection.autoconnect-slaves 1
Reactivate the bridge:
#
nmcli connection up bridge0
Verification steps
Display the link status of Ethernet devices that are ports of a specific bridge:
#
ip link show master bridge0
3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:62:61:0e brd ff:ff:ff:ff:ff:ff 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:9e:f1:ce brd ff:ff:ff:ff:ff:ffDisplay the status of Ethernet devices that are ports of any bridge device:
#
bridge link show
3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state listening priority 32 cost 100 5: enp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state forwarding priority 32 cost 100 6: enp11s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state blocking priority 32 cost 100 ...To display the status for a specific Ethernet device, use the
bridge link show dev ethernet_device_name
command.
Additional resources
- For more information on testing connections, see Chapter 39, Testing basic network settings.
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
-
For
nmcli
examples, see thenmcli-examples(7)
man page. -
For all bridge properties you can set, see the
bridge settings
section in thenm-settings(5)
man page. -
For all bridge port properties you can set, see the
bridge-port settings
section in thenm-settings(5)
man page. -
For details about the
bridge
utility, see thebridge(8)
man page. - If the configuration on the disk does not match the configuration on the device, starting or restarting NetworkManager creates an in-memory connection that reflects the configuration of the device. For further details and how to avoid this problem, see NetworkManager duplicates a connection after restart of NetworkManager service.
11.2. Configuring a network bridge using nm-connection-editor
This section explains how to configure a network bridge using the nm-connection-editor
application.
Note that nm-connection-editor
can add only new ports to a bridge. To use an existing connection profile as a port, create the bridge using the nmcli
utility as described in Section 11.1, “Configuring a network bridge using nmcli commands”.
Prerequisites
- Two or more physical or virtual network devices are installed on the server.
- To use Ethernet devices as ports of the bridge, the physical or virtual Ethernet devices must be installed on the server.
- To use team, bond, or VLAN devices as ports of the bridge, ensure that these devices are not already configured.
Procedure
Open a terminal, and enter
nm-connection-editor
:$
nm-connection-editor
- Click the button to add a new connection.
-
Select the
Bridge
connection type, and click . In the
Bridge
tab:-
Optional: Set the name of the bridge interface in the
Interface name
field. Click the
button to create a new connection profile for a network interface and adding the profile as a port to the bridge.-
Select the connection type of the interface. For example, select
Ethernet
for a wired connection. - Optionally, set a connection name for the port device.
-
If you create a connection profile for an Ethernet device, open the
Ethernet
tab, and select in theDevice
field the network interface you want to add as a port to the bridge. If you selected a different device type, configure it accordingly. - Click .
-
Select the connection type of the interface. For example, select
Repeat the previous step for each interface you want to add to the bridge.
-
Optional: Set the name of the bridge interface in the
- Optional: Configure further bridge settings, such as Spanning Tree Protocol (STP) options.
Configure the IP settings of the bridge. Skip this step if you want to use this bridge as a port of other devices.
In the
IPv4 Settings
tab, configure the IPv4 settings. For example, set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain:In the
IPv6 Settings
tab, configure the IPv6 settings. For example, set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain:
- Save the bridge connection.
-
Close
nm-connection-editor
.
Verification steps
Display the link status of Ethernet devices that are ports of a specific bridge.
#
ip link show master bridge0
3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:62:61:0e brd ff:ff:ff:ff:ff:ff 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:9e:f1:ce brd ff:ff:ff:ff:ff:ffDisplay the status of Ethernet devices that are ports in any bridge device:
#
bridge link show
3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100 4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state listening priority 32 cost 100 5: enp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state forwarding priority 32 cost 100 6: enp11s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state blocking priority 32 cost 100 ...To display the status for a specific Ethernet device, use the
bridge link show dev ethernet_device_name
command.
Additional resources
- Section 13.6, “Configuring a network bond using nm-connection-editor”
- Section 12.7, “Configuring a network team using nm-connection-editor”
- Section 10.2, “Configuring VLAN tagging using nm-connection-editor”
- For more information on testing connections, see Chapter 39, Testing basic network settings.
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
11.3. Configuring a network bridge using RHEL System Roles
You can use the networking
RHEL System Role to configure a Linux bridge. This procedure describes how to configure a network bridge that uses two Ethernet devices, and sets IPv4 and IPv6 addresses, default gateways, and DNS configuration.
Set the IP configuration on the bridge and not on the ports of the Linux bridge.
Prerequisites
-
The
ansible
andrhel-system-roles
packages are installed on the control node. -
If you use a different remote user than
root
when you run the playbook, this user has appropriatesudo
permissions on the managed node. - Two or more physical or virtual network devices are installed on the server.
Procedure
If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the
/etc/ansible/hosts
Ansible inventory file:node.example.com
Create the
~/bridge-ethernet.yml
playbook with the following content:--- - name: Configure a network bridge that uses two Ethernet ports hosts: node.example.com become: true tasks: - include_role: name: linux-system-roles.network vars: network_connections: # Define the bridge profile - name: bridge0 type: bridge interface_name: bridge0 ip: address: - "192.0.2.1/24" - "2001:db8:1::1/64" gateway4: 192.0.2.254 gateway6: 2001:db8:1::fffe dns: - 192.0.2.200 - 2001:db8:1::ffbb dns_search: - example.com state: up # Add an Ethernet profile to the bridge - name: bridge0-port1 interface_name: enp7s0 type: ethernet master: bridge0 slave_type: bridge state: up # Add a second Ethernet profile to the bridge - name: bridge0-port2 interface_name: enp8s0 type: ethernet master: bridge0 slave_type: bridge state: up
Run the playbook:
To connect as
root
user to the managed host, enter:#
ansible-playbook -u root ~/bridge-ethernet.yml
To connect as a user to the managed host, enter:
#
ansible-playbook -u user_name --ask-become-pass ~/bridge-ethernet.yml
The
--ask-become-pass
option makes sure that theansible-playbook
command prompts for thesudo
password of the user defined in the-u user_name
option.
If you do not specify the
-u user_name
option,ansible-playbook
connects to the managed host as the user that is currently logged in to the control node.
Additional resources
-
For details about the parameters used in
network_connections
and for additional information about thenetwork
System Role, see the/usr/share/ansible/roles/rhel-system-roles.network/README.md
file. -
For details about the
ansible-playbook
command, see theansible-playbook(1)
man page.
Chapter 12. Configuring network teaming
This section describes the basics of network teaming, the differences between bonding and teaming, and how to configure a network team on Red Hat Enterprise Linux 8.
You can create network teams on different types of devices, such as:
- Physical and virtual Ethernet devices
- Network bonds
- Network bridges
- VLAN devices
12.1. Understanding network teaming
Network teaming is a feature that combines or aggregates network interfaces to provide a logical interface with higher throughput or redundancy.
Network teaming uses a kernel driver to implement fast handling of packet flows, as well as user-space libraries and services for other tasks. This way, network teaming is an easily extensible and scalable solution for load-balancing and redundancy requirements.
Certain network teaming features, such as the fail-over mechanism, do not support direct cable connections without a network switch. For further details, see Is bonding supported with direct connection using crossover cables?
12.2. Understanding the default behavior of controller and port interfaces
Consider the following default behavior of, when managing or troubleshooting team or bond port interfaces using the NetworkManager
service:
- Starting the controller interface does not automatically start the port interfaces.
- Starting a port interface always starts the controller interface.
- Stopping the controller interface also stops the port interface.
- A controller without ports can start static IP connections.
- A controller without ports waits for ports when starting DHCP connections.
- A controller with a DHCP connection waiting for ports completes when you add a port with a carrier.
- A controller with a DHCP connection waiting for ports continues waiting when you add a port without carrier.
12.3. Comparison of network teaming and bonding features
Learn about the features supported in network teams and network bonds:
Feature | Network bond | Network team |
---|---|---|
Broadcast Tx policy | Yes | Yes |
Round-robin Tx policy | Yes | Yes |
Active-backup Tx policy | Yes | Yes |
LACP (802.3ad) support | Yes (active only) | Yes |
Hash-based Tx policy | Yes | Yes |
User can set hash function | No | Yes |
Tx load-balancing support (TLB) | Yes | Yes |
LACP hash port select | Yes | Yes |
Load-balancing for LACP support | No | Yes |
Ethtool link monitoring | Yes | Yes |
ARP link monitoring | Yes | Yes |
NS/NA (IPv6) link monitoring | No | Yes |
Ports up/down delays | Yes | Yes |
Port priorities and stickiness (“primary” option enhancement) | No | Yes |
Separate per-port link monitoring setup | No | Yes |
Multiple link monitoring setup | Limited | Yes |
Lockless Tx/Rx path | No (rwlock) | Yes (RCU) |
VLAN support | Yes | Yes |
User-space runtime control | Limited | Yes |
Logic in user-space | No | Yes |
Extensibility | Hard | Easy |
Modular design | No | Yes |
Performance overhead | Low | Very low |
D-Bus interface | No | Yes |
Multiple device stacking | Yes | Yes |
Zero config using LLDP | No | (in planning) |
NetworkManager support | Yes | Yes |
12.4. Understanding the teamd service, runners, and link-watchers
The team service, teamd
, controls one instance of the team driver. This instance of the driver adds instances of a hardware device driver to form a team of network interfaces. The team driver presents a network interface, for example team0
, to the kernel.
The teamd
service implements the common logic to all methods of teaming. Those functions are unique to the different load sharing and backup methods, such as round-robin, and implemented by separate units of code referred to as runners
. Administrators specify runners in JavaScript Object Notation (JSON) format, and the JSON code is compiled into an instance of teamd
when the instance is created. Alternatively, when using NetworkManager
, you can set the runner in the team.runner
parameter, and NetworkManager
auto-creates the corresponding JSON code.
The following runners are available:
-
broadcast
: Transmits data over all ports. -
roundrobin
: Transmits data over all ports in turn. -
activebackup
: Transmits data over one port while the others are kept as a backup. -
loadbalance
: Transmits data over all ports with active Tx load balancing and Berkeley Packet Filter (BPF)-based Tx port selectors. -
random
: Transmits data on a randomly selected port. -
lacp
: Implements the 802.3ad Link Aggregation Control Protocol (LACP).
The teamd
services uses a link watcher to monitor the state of subordinate devices. The following link-watchers are available:
-
ethtool
: Thelibteam
library uses theethtool
utility to watch for link state changes. This is the default link-watcher. -
arp_ping
: Thelibteam
library uses thearp_ping
utility to monitor the presence of a far-end hardware address using Address Resolution Protocol (ARP). -
nsna_ping
: On IPv6 connections, thelibteam
library uses the Neighbor Advertisement and Neighbor Solicitation features from the IPv6 Neighbor Discovery protocol to monitor the presence of a neighbor’s interface.
Each runner can use any link watcher, with the exception of lacp
. This runner can only use the ethtool
link watcher.
12.5. Installing the teamd service
To configure a network team in NetworkManager
, you require the teamd
service and the team plug-in for NetworkManager
. Both are installed on Red Hat Enterprise Linux 8 by default. This section describes how you install the required packages in case that you remove them.
Prerequisites
- An active Red Hat subscription is assigned to the host.
Procedure
Install the
teamd
andNetworkManager-team
packages:# yum install teamd NetworkManager-team
12.6. Configuring a network team using nmcli commands
This section describes how to configure a network team using nmcli
utility.
Prerequisites
- Two or more physical or virtual network devices are installed on the server.
- To use Ethernet devices as ports of the team, the physical or virtual Ethernet devices must be installed on the server and connected to a switch.
To use bond, bridge, or VLAN devices as ports of the team, you can either create these devices while you create the team or you can create them in advance as described in:
Procedure
Create a team interface:
#
nmcli connection add type team con-name team0 ifname team0 team.runner activebackup
This command creates a network team named
team0
that uses theactivebackup
runner.Optionally, set a link watcher. For example, to set the
ethtool
link watcher in theteam0
connection profile:#
nmcli connection modify team0 team.link-watchers "name=ethtool"
Link watchers support different parameters. To set parameters for a link watcher, specify them space-separated in the
name
property. Note that the name property must be surrounded by quotes. For example, to use theethtool
link watcher and set itsdelay-up
parameter to2500
milliseconds (2.5 seconds):#
nmcli connection modify team0 team.link-watchers "name=ethtool delay-up=2500"
To set multiple link watchers and each of them with specific parameters, the link watchers must be separated by a comma. The following example sets the
ethtool
link watcher with thedelay-up
parameter and thearp_ping
link watcher with thesource-host
andtarget-host
parameter:#
nmcli connection modify team0 team.link-watchers "name=ethtool delay-up=2, name=arp_ping source-host=192.0.2.1 target-host=192.0.2.2"
Display the network interfaces, and note the names of the interfaces you want to add to the team:
#
nmcli device status
DEVICE TYPE STATE CONNECTION enp7s0 ethernet disconnected -- enp8s0 ethernet disconnected -- bond0 bond connected bond0 bond1 bond connected bond1 ...In this example:
-
enp7s0
andenp8s0
are not configured. To use these devices as ports, add connection profiles in the next step. Note that you can only use Ethernet interfaces in a team that are not assigned to any connection. -
bond0
andbond1
have existing connection profiles. To use these devices as ports, modify their profiles in the next step.
-
Assign the port interfaces to the team:
If the interfaces you want to assign to the team are not configured, create new connection profiles for them:
#
nmcli connection add type ethernet slave-type team con-name team0-port1 ifname enp7s0 master team0
#nmcli connection add type ethernet slave-type team con-name team0-port2 ifname enp8s0 master team0
. These commands create profiles for
enp7s0
andenp8s0
, and add them to theteam0
connection.To assign an existing connection profile to the team, set the
master
parameter of these connections toteam0
:#
nmcli connection modify bond0 master team0
#nmcli connection modify bond1 master team0
These commands assign the existing connection profiles named
bond0
andbond1
to theteam0
connection.
Configure the IP settings of the team. Skip this step if you want to use this team as a ports of other devices.
Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain the
team0
connection, enter:#
nmcli connection modify team0 ipv4.addresses '192.0.2.1/24'
#nmcli connection modify team0 ipv4.gateway '192.0.2.254'
#nmcli connection modify team0 ipv4.dns '192.0.2.253'
#nmcli connection modify team0 ipv4.dns-search 'example.com'
#nmcli connection modify team0 ipv4.method manual
Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain of the
team0
connection, enter:#
nmcli connection modify team0 ipv6.addresses '2001:db8:1::1/64'
#nmcli connection modify team0 ipv6.gateway '2001:db8:1::fffe'
#nmcli connection modify team0 ipv6.dns '2001:db8:1::fffd'
#nmcli connection modify team0 ipv6.dns-search 'example.com'
#nmcli connection modify team0 ipv6.method manual
Activate the connection:
#
nmcli connection up team0
Verification steps
Display the status of the team:
#
teamdctl team0 state
setup: runner: activebackup ports: enp7s0 link watches: link summary: up instance[link_watch_0]: name: ethtool link: up down count: 0 enp8s0 link watches: link summary: up instance[link_watch_0]: name: ethtool link: up down count: 0 runner: active port: enp7s0In this example, both ports are up.
Additional resources
- For more information on testing connections, see Chapter 39, Testing basic network settings.
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
- Section 12.4, “Understanding the teamd service, runners, and link-watchers”.
-
For
nmcli
examples, see thenmcli-examples(7)
man page. -
For all team properties you can set, see the
team
section in thenm-settings(5)
man page. -
For parameters you can set in the JSON configuration, as well as JSON examples, see the
teamd.conf(5)
man page.
12.7. Configuring a network team using nm-connection-editor
This section describes how you configure a network team using the nm-connection-editor
application.
Note that nm-connection-editor
can add only new ports to a team. To use an existing connection profile as a port, create the team using the nmcli
utility as described in Section 12.6, “Configuring a network team using nmcli commands”.
Prerequisites
- Two or more physical or virtual network devices are installed on the server.
- To use Ethernet devices as ports of the team, the physical or virtual Ethernet devices must be installed on the server.
- To use team, bond, or VLAN devices as ports of the team, ensure that these devices are not already configured.
Procedure
Open a terminal, and enter
nm-connection-editor
:$
nm-connection-editor
- Click the button to add a new connection.
-
Select the
Team
connection type, and click . In the
Team
tab:-
Optional: Set the name of the team interface in the
Interface name
field. Click the
button to add a new connection profile for a network interface and adding the profile as a port to the team.-
Select the connection type of the interface. For example, select
Ethernet
for a wired connection. - Optional: Set a connection name for the port.
-
If you create a connection profile for an Ethernet device, open the
Ethernet
tab, and select in theDevice
field the network interface you want to add as a port to the team. If you selected a different device type, configure it accordingly. Note that you can only use Ethernet interfaces in a team that are not assigned to any connection. - Click .
-
Select the connection type of the interface. For example, select
Repeat the previous step for each interface you want to add to the team.
Click the
button to set advanced options to the team connection.-
In the
Runner
tab, select the runner. -
In the
Link Watcher
tab, set the link watcher and its optional settings. - Click .
-
In the
-
Optional: Set the name of the team interface in the
Configure the IP settings of the team. Skip this step if you want to use this team as a port of other devices.
-
In the
IPv4 Settings
tab, configure the IPv4 settings. For example, set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain: -
In the
IPv6 Settings
tab, configure the IPv6 settings. For example, set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain:
-
In the
- Save the team connection.
-
Close
nm-connection-editor
.
Verification steps
Display the status of the team:
#
teamdctl team0 state
setup: runner: activebackup ports: enp7s0 link watches: link summary: up instance[link_watch_0]: name: ethtool link: up down count: 0 enp8s0 link watches: link summary: up instance[link_watch_0]: name: ethtool link: up down count: 0 runner: active port: enp7s0
Additional resources
- Section 13.6, “Configuring a network bond using nm-connection-editor”
- Section 11.2, “Configuring a network bridge using nm-connection-editor”
- Section 10.2, “Configuring VLAN tagging using nm-connection-editor”
- For more information on testing connections, see Chapter 39, Testing basic network settings.
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
- Section 12.4, “Understanding the teamd service, runners, and link-watchers”.
- If the configuration on the disk does not match the configuration on the device, starting or restarting NetworkManager creates an in-memory connection that reflects the configuration of the device. For further details and how to avoid this problem, see NetworkManager duplicates a connection after restart of NetworkManager service.
Chapter 13. Configuring network bonding
This section describes the basics of network bonding, the differences between bonding and teaming, and how to configure a network bond on Red Hat Enterprise Linux 8.
You can create bonds on different types of devices, such as:
- Physical and virtual Ethernet devices
- Network bridges
- Network teams
- VLAN devices
13.1. Understanding network bonding
Network bonding is a method to combine or aggregate network interfaces to provide a logical interface with higher throughput or redundancy.
The active-backup
, balance-tlb
, and balance-alb
modes do not require any specific configuration of the network switch. However, other bonding modes require configuring the switch to aggregate the links. For example, Cisco switches requires EtherChannel
for modes 0, 2, and 3, but for mode 4, the Link Aggregation Control Protocol (LACP) and EtherChannel
are required.
For further details, see the documentation of your switch and Linux Ethernet Bonding Driver HOWTO.
Certain network bonding features, such as the fail-over mechanism, do not support direct cable connections without a network switch. For further details, see the Is bonding supported with direct connection using crossover cables? KCS solution.
13.2. Understanding the default behavior of controller and port interfaces
Consider the following default behavior of, when managing or troubleshooting team or bond port interfaces using the NetworkManager
service:
- Starting the controller interface does not automatically start the port interfaces.
- Starting a port interface always starts the controller interface.
- Stopping the controller interface also stops the port interface.
- A controller without ports can start static IP connections.
- A controller without ports waits for ports when starting DHCP connections.
- A controller with a DHCP connection waiting for ports completes when you add a port with a carrier.
- A controller with a DHCP connection waiting for ports continues waiting when you add a port without carrier.
13.3. Comparison of network teaming and bonding features
Learn about the features supported in network teams and network bonds:
Feature | Network bond | Network team |
---|---|---|
Broadcast Tx policy | Yes | Yes |
Round-robin Tx policy | Yes | Yes |
Active-backup Tx policy | Yes | Yes |
LACP (802.3ad) support | Yes (active only) | Yes |
Hash-based Tx policy | Yes | Yes |
User can set hash function | No | Yes |
Tx load-balancing support (TLB) | Yes | Yes |
LACP hash port select | Yes | Yes |
Load-balancing for LACP support | No | Yes |
Ethtool link monitoring | Yes | Yes |
ARP link monitoring | Yes | Yes |
NS/NA (IPv6) link monitoring | No | Yes |
Ports up/down delays | Yes | Yes |
Port priorities and stickiness (“primary” option enhancement) | No | Yes |
Separate per-port link monitoring setup | No | Yes |
Multiple link monitoring setup | Limited | Yes |
Lockless Tx/Rx path | No (rwlock) | Yes (RCU) |
VLAN support | Yes | Yes |
User-space runtime control | Limited | Yes |
Logic in user-space | No | Yes |
Extensibility | Hard | Easy |
Modular design | No | Yes |
Performance overhead | Low | Very low |
D-Bus interface | No | Yes |
Multiple device stacking | Yes | Yes |
Zero config using LLDP | No | (in planning) |
NetworkManager support | Yes | Yes |
13.4. Upstream Switch Configuration Depending on the Bonding Modes
The following table describes which settings you must apply to the upstream switch depending on the bonding mode:
Bonding mode | Configuration on the switch |
---|---|
| Requires static Etherchannel enabled (not LACP-negotiated) |
| Requires autonomous ports |
| Requires static Etherchannel enabled (not LACP-negotiated) |
| Requires static Etherchannel enabled (not LACP-negotiated) |
| Requires LACP-negotiated Etherchannel enabled |
| Requires autonomous ports |
| Requires autonomous ports |
For configuring these settings on your switch, see the switch documentation.
13.5. Configuring a network bond using nmcli commands
This section describes how to configure a network bond using nmcli
commands.
Prerequisites
- Two or more physical or virtual network devices are installed on the server.
- To use Ethernet devices as ports of the bond, the physical or virtual Ethernet devices must be installed on the server.
To use team, bridge, or VLAN devices as ports of the bond, you can either create these devices while you create the bond or you can create them in advance as described in:
Procedure
Create a bond interface:
#
nmcli connection add type bond con-name bond0 ifname bond0 bond.options "mode=active-backup"
This command creates a bond named
bond0
that uses theactive-backup
mode.To additionally set a Media Independent Interface (MII) monitoring interval, add the
miimon=interval
option to thebond.options
property. For example, to use the same command but, additionally, set the MII monitoring interval to1000
milliseconds (1 second), enter:#
nmcli connection add type bond con-name bond0 ifname bond0 bond.options "mode=active-backup,miimon=1000"
Display the network interfaces, and note names of interfaces you plan to add to the bond:
#
nmcli device status
DEVICE TYPE STATE CONNECTION enp7s0 ethernet disconnected -- enp8s0 ethernet disconnected -- bridge0 bridge connected bridge0 bridge1 bridge connected bridge1 ...In this example:
-
enp7s0
andenp8s0
are not configured. To use these devices as ports, add connection profiles in the next step. -
bridge0
andbridge1
have existing connection profiles. To use these devices as ports, modify their profiles in the next step.
-
Assign interfaces to the bond:
If the interfaces you want to assign to the bond are not configured, create new connection profiles for them:
#
nmcli connection add type ethernet slave-type bond con-name bond0-port1 ifname enp7s0 master bond0
#nmcli connection add type ethernet slave-type bond con-name bond0-port2 ifname enp8s0 master bond0
These commands create profiles for
enp7s0
andenp8s0
, and add them to thebond0
connection.To assign an existing connection profile to the bond, set the
master
parameter of these connections tobond0
:#
nmcli connection modify bridge0 master bond0
#nmcli connection modify bridge1 master bond0
These commands assign the existing connection profiles named
bridge0
andbridge1
to thebond0
connection.
Configure the IP settings of the bond. Skip this step if you want to use this bond as a port of other devices.
Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain to the
bond0
connection, enter:#
nmcli connection modify bond0 ipv4.addresses '192.0.2.1/24'
#nmcli connection modify bond0 ipv4.gateway '192.0.2.254'
#nmcli connection modify bond0 ipv4.dns '192.0.2.253'
#nmcli connection modify bond0 ipv4.dns-search 'example.com'
#nmcli connection modify bond0 ipv4.method manual
Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain to the
bond0
connection, enter:#
nmcli connection modify bond0 ipv6.addresses '2001:db8:1::1/64
#nmcli connection modify bond0 ipv6.gateway '2001:db8:1::fffe'
#nmcli connection modify bond0 ipv6.dns '2001:db8:1::fffd'
#nmcli connection modify bond0 ipv6.dns-search 'example.com'
#nmcli connection modify bond0 ipv6.method manual
Activate the connection:
#
nmcli connection up bond0
Verify that the ports are connected, and the
CONNECTION
column displays the port’s connection name:#
nmcli device
DEVICE TYPE STATE CONNECTION ... enp7s0 ethernet connected bond0-port1 enp8s0 ethernet connected bond0-port2Red Hat Enterprise Linux activates controller and port devices when the system boots. By activating any port connection, the controller is also activated. However, in this case, only one port connection is activated. By default, activating the controller does not automatically activate the ports. However, you can enable this behavior by setting:
Enable the
connection.autoconnect-slaves
parameter of the bond’s connection:#
nmcli connection modify bond0 connection.autoconnect-slaves 1
Reactivate the bridge:
#
nmcli connection up bond0
Verification steps
Display the status of the bond:
#
cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011) Bonding Mode: fault-tolerance (active-backup) Primary Slave: None Currently Active Slave: enp7s0 MII Status: up MII Polling Interval (ms): 100 Up Delay (ms): 0 Down Delay (ms): 0 Slave Interface: enp7s0 MII Status: up Speed: Unknown Duplex: Unknown Link Failure Count: 0 Permanent HW addr: 52:54:00:d5:e0:fb Slave queue ID: 0 Slave Interface: enp8s0 MII Status: up Speed: Unknown Duplex: Unknown Link Failure Count: 0 Permanent HW addr: 52:54:00:b2:e2:63 Slave queue ID: 0In this example, both ports are up.
To verify that bonding failover works:
- Temporarily remove the network cable from the host. Note that there is no method to properly test link failure events using the command line.
Display the status of the bond:
#
cat /proc/net/bonding/bond0
Additional resources
- For more information on testing connections, see Chapter 39, Testing basic network settings.
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
-
For
nmcli
examples, see thenmcli-examples(7)
man page. -
For a list of options you can set in the
bond.options
parameter of thenmcli
command when you create a bond, see https://www.kernel.org/doc/Documentation/networking/bonding.txt.
13.6. Configuring a network bond using nm-connection-editor
This section describes how to configure a network bond using the nm-connection-editor
application.
Note that nm-connection-editor
can add only new ports to a bond. To use an existing connection profile as a port, create the bond using the nmcli
utility as described in Section 13.5, “Configuring a network bond using nmcli commands”.
Prerequisites
- Two or more physical or virtual network devices are installed on the server.
- To use Ethernet devices as ports of the bond, the physical or virtual Ethernet devices must be installed on the server.
- To use team, bond, or VLAN devices as ports of the bond, ensure that these devices are not already configured.
Procedure
Open a terminal, and enter
nm-connection-editor
:$
nm-connection-editor
- Click the button to add a new connection.
-
Select the
Bond
connection type, and click . In the
Bond
tab:-
Optional: Set the name of the bond interface in the
Interface name
field. Click the
button to add a network interface as a port to the bond.-
Select the connection type of the interface. For example, select
Ethernet
for a wired connection. - Optional: Set a connection name for the port.
-
If you create a connection profile for an Ethernet device, open the
Ethernet
tab, and select in theDevice
field the network interface you want to add as a port to the bond. If you selected a different device type, configure it accordingly. Note that you can only use Ethernet interfaces in a bond that are not configured. - Click .
-
Select the connection type of the interface. For example, select
Repeat the previous step for each interface you want to add to the bond:
- Optional: Set other options, such as the Media Independent Interface (MII) monitoring interval.
-
Optional: Set the name of the bond interface in the
Configure the IP settings of the bond. Skip this step if you want to use this bond as a port of other devices.
In the
IPv4 Settings
tab, configure the IPv4 settings. For example, set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain:In the
IPv6 Settings
tab, configure the IPv6 settings. For example, set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain:
- Click to save the bond connection.
-
Close
nm-connection-editor
.
Verification steps
View the status of the bond:
$
cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011) Bonding Mode: fault-tolerance (active-backup) Primary Slave: None Currently Active Slave: enp7s0 MII Status: up MII Polling Interval (ms): 100 Up Delay (ms): 0 Down Delay (ms): 0 Slave Interface: enp7s0 MII Status: up Speed: Unknown Duplex: Unknown Link Failure Count: 0 Permanent HW addr: 52:54:00:d5:e0:fb Slave queue ID: 0 Slave Interface: enp8s0 MII Status: up Speed: Unknown Duplex: Unknown Link Failure Count: 0 Permanent HW addr: 52:54:00:b2:e2:63 Slave queue ID: 0In this example, both ports are up.
Additional resources
- Section 12.7, “Configuring a network team using nm-connection-editor”
- Section 11.2, “Configuring a network bridge using nm-connection-editor”
- Section 10.2, “Configuring VLAN tagging using nm-connection-editor”
- For more information on testing connections, see Chapter 39, Testing basic network settings.
- If the connection does not have a default gateway, see Section 18.8, “Configuring NetworkManager to avoid using a specific profile to provide a default gateway”.
13.7. Configuring a network bond using RHEL System Roles
You can use the network
RHEL System Role to configure a network bond. This procedure describes how to configure a bond in active-backup mode that uses two Ethernet devices, and sets an IPv4 and IPv6 addresses, default gateways, and DNS configuration.
Set the IP configuration on the bridge and not on the ports of the Linux bridge.
Prerequisites
-
The
ansible
andrhel-system-roles
packages are installed on the control node. -
If you use a different remote user than
root
when you run the playbook, this user has appropriatesudo
permissions on the managed node. - Two or more physical or virtual network devices are installed on the server.
Procedure
If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the
/etc/ansible/hosts
Ansible inventory file:node.example.com
Create the
~/bond-ethernet.yml
playbook with the following content:--- - name: Configure a network bond that uses two Ethernet ports hosts: node.example.com become: true tasks: - include_role: name: linux-system-roles.network vars: network_connections: # Define the bond profile - name: bond0 type: bond interface_name: bond0 ip: address: - "192.0.2.1/24" - "2001:db8:1::1/64" gateway4: 192.0.2.254 gateway6: 2001:db8:1::fffe dns: - 192.0.2.200 - 2001:db8:1::ffbb dns_search: - example.com bond: mode: active-backup state: up # Add an Ethernet profile to the bond - name: bond0-port1 interface_name: enp7s0 type: ethernet master: bond0 state: up # Add a second Ethernet profile to the bond - name: bond0-port2 interface_name: enp8s0 type: ethernet master: bond0 state: up
Run the playbook:
To connect as
root
user to the managed host, enter:#
ansible-playbook -u root ~/bond-ethernet.yml
To connect as a user to the managed host, enter:
#
ansible-playbook -u user_name --ask-become-pass ~/bond-ethernet.yml
The
--ask-become-pass
option makes sure that theansible-playbook
command prompts for thesudo
password of the user defined in the-u user_name
option.
If you do not specify the
-u user_name
option,ansible-playbook
connects to the managed host as the user that is currently logged in to the control node.
Additional resources
-
For details about the parameters used in
network_connections
and for additional information about thenetwork
System Role, see the/usr/share/ansible/roles/rhel-system-roles.network/README.md
file. -
For details about the
ansible-playbook
command, see theansible-playbook(1)
man page.
13.8. Creating a network bond to enable switching between an Ethernet and wireless connection without interrupting the VPN
RHEL users who connect their workstation to their company’s network typically use a VPN to access remote resources. However, if the workstation switches between an Ethernet and Wi-Fi connection, for example, if you release a laptop from a docking station with an Ethernet connection, the VPN connection is interrupted. To avoid this problem, you can create a network bond that uses the Ethernet and Wi-Fi connection in active-backup
mode.
Prerequisites
- The host contains an Ethernet and a Wi-Fi device.
An Ethernet and Wi-Fi NetworkManager connection profile has been created and both connections work independently.
This procedure uses the following connection profiles to create a network bond named
bond0
:-
Docking_station
associated with theenp11s0u1
Ethernet device -
Wi-Fi
associated with thewlp61s0
Wi-Fi device
-
Procedure
Create a bond interface in
active-backup
mode:#
nmcli connection add type bond con-name bond0 ifname bond0 bond.options "mode=active-backup"
This command names both the interface and connection profile
bond0
.Configure the IPv4 settings of the bond:
- If a DHCP server in your network assigns IPv4 addresses to hosts, no action is required.
If your local network requires static IPv4 addresses, set the address, network mask, default gateway, DNS server, and DNS search domain to the
bond0
connection:#
nmcli connection modify bond0 ipv4.addresses '192.0.2.1/24'
#nmcli connection modify bond0 ipv4.gateway '192.0.2.254'
#nmcli connection modify bond0 ipv4.dns '192.0.2.253'
#nmcli connection modify bond0 ipv4.dns-search 'example.com'
#nmcli connection modify bond0 ipv4.method manual
Configure the IPv6 settings of the bond:
- If your router or a DHCP server in your network assigns IPv6 addresses to hosts, no action is required.
If your local network requires static IPv6 addresses, set the address, network mask, default gateway, DNS server, and DNS search domain to the
bond0
connection:#
nmcli connection modify bond0 ipv6.addresses '2001:db8:1::1/64'
#nmcli connection modify bond0 ipv6.gateway '2001:db8:1::fffe'
#nmcli connection modify bond0 ipv6.dns '2001:db8:1::fffd'
#nmcli connection modify bond0 ipv6.dns-search 'example.com'
#nmcli connection modify bond0 ipv6.method manual
Display the connection profiles:
# nmcli connection show NAME UUID TYPE DEVICE Docking_station 256dd073-fecc-339d-91ae-9834a00407f9 ethernet enp11s0u1 Wi-Fi 1f1531c7-8737-4c60-91af-2d21164417e8 wifi wlp61s0 ...
You require the names of the connection profiles and the Ethernet device name in the next steps.
Assign the connection profile of the Ethernet connection to the bond:
#
nmcli connection modify Docking_station master bond0
Assign the connection profile of the Wi-Fi connection to the bond:
#
nmcli connection modify Wi-Fi master bond0
If your Wi-Fi network uses MAC filtering to allow only MAC addresses on a allow list to access the network, configure that NetworkManager dynamically assigns the MAC address of the active port to the bond:
#
nmcli connection modify bond0 +bond.options fail_over_mac=1
With this setting, you must set only the MAC address of the Wi-Fi device to the allow list instead of the MAC address of both the Ethernet and Wi-Fi device.
Set the device associated with the Ethernet connection as primary device of the bond:
#
nmcli con modify bond0 +bond.options "primary=enp11s0u1"
With this setting, the bond always uses the Ethernet connection if it is available.
Configure that NetworkManager automatically activates ports when the
bond0
device is activated:#
nmcli connection modify bond0 connection.autoconnect-slaves 1
Activate the
bond0
connection:#
nmcli connection up bond0
Verification steps
Display the currently active device, the status of the bond and its ports:
#
cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011) Bonding Mode: fault-tolerance (active-backup) (fail_over_mac active) Primary Slave: enp11s0u1 (primary_reselect always) Currently Active Slave: enp11s0u1 MII Status: up MII Polling Interval (ms): 1 Up Delay (ms): 0 Down Delay (ms): 0 Peer Notification Delay (ms): 0 Slave Interface: enp11s0u1 MII Status: up Speed: 1000 Mbps Duplex: full Link Failure Count: 0 Permanent HW addr: 00:53:00:59:da:b7 Slave queue ID: 0 Slave Interface: wlp61s0 MII Status: up Speed: Unknown Duplex: Unknown Link Failure Count: 2 Permanent HW addr: 00:53:00:b3:22:ba Slave queue ID: 0
Chapter 14. Configuring a VPN connection
This section explains how to configure a virtual private network (VPN) connection.
A VPN is a way of connecting to a local network over the Internet. IPsec
provided by Libreswan
is the preferred method for creating a VPN. Libreswan
is an user-space IPsec
implementation for VPN. A VPN enables the communication between your LAN, and another, remote LAN by setting up a tunnel across an intermediate network such as the Internet. For security reasons, a VPN tunnel always uses authentication and encryption. For cryptographic operations, Libreswan
uses the NSS
library.
14.1. Configuring a VPN connection with control-center
This procedure describes how to configure a VPN connection using control-center
.
Prerequisites
-
The
NetworkManager-libreswan-gnome
package is installed.
Procedure
-
Press the Super key, type
Settings
, and press Enter to open thecontrol-center
application. -
Select the
Network
entry on the left. - Click the + icon.
-
Select
VPN
. Select the
Identity
menu entry to see the basic configuration options:General
Gateway
— The name orIP
address of the remote VPN gateway.Authentication
Type
-
IKEv2 (Certificate)
- client is authenticated by certificate. It is more secure (default). IKEv1 (XAUTH)
- client is authenticated by user name and password, or a pre-shared key (PSK).The following configuration settings are available under the
Advanced
section:Figure 14.1. Advanced options of a VPN connection
WarningWhen configuring an IPsec-based VPN connection using the
gnome-control-center
application, theAdvanced
dialog displays the configuration, but it does not allow any changes. As a consequence, users cannot change any advanced IPsec options. Use thenm-connection-editor
ornmcli
tools instead to perform configuration of the advanced properties.Identification
Domain
— If required, enter the Domain Name.Security
-
Phase1 Algorithms
— corresponds to theike
Libreswan parameter — enter the algorithms to be used to authenticate and set up an encrypted channel. Phase2 Algorithms
— corresponds to theesp
Libreswan parameter — enter the algorithms to be used for theIPsec
negotiations.Check the
Disable PFS
field to turn off Perfect Forward Secrecy (PFS) to ensure compatibility with old servers that do not support PFS.-
Phase1 Lifetime
— corresponds to theikelifetime
Libreswan parameter — how long the key used to encrypt the traffic will be valid. Phase2 Lifetime
— corresponds to thesalifetime
Libreswan parameter — how long a particular instance of a connection should last before expiring.Note that the encryption key should be changed from time to time for security reasons.
Remote network
— corresponds to therightsubnet
Libreswan parameter — the destination private remote network that should be reached through the VPN.Check the
narrowing
field to enable narrowing. Note that it is only effective in IKEv2 negotiation.-
Enable fragmentation
— corresponds to thefragmentation
Libreswan parameter — whether or not to allow IKE fragmentation. Valid values areyes
(default) orno
. -
Enable Mobike
— corresponds to themobike
Libreswan parameter — whether to allow Mobility and Multihoming Protocol (MOBIKE, RFC 4555) to enable a connection to migrate its endpoint without needing to restart the connection from scratch. This is used on mobile devices that switch between wired, wireless, or mobile data connections. The values areno
(default) oryes
.
-
Select the
menu entry:IPv4 Method
-
Automatic (DHCP)
— Choose this option if the network you are connecting to uses Router Advertisements (RA) or aDHCP
server to assign dynamicIP
addresses. -
Link-Local Only
— Choose this option if the network you are connecting to does not have aDHCP
server and you do not want to assignIP
addresses manually. Random addresses will be assigned as per RFC 3927 with prefix169.254/16
. -
Manual
— Choose this option if you want to assignIP
addresses manually. Disable
—IPv4
is disabled for this connection.DNS
In the
DNS
section, whenAutomatic
isON
, switch it toOFF
to enter the IP address of a DNS server you want to use separating the IPs by comma.Routes
Note that in the
Routes
section, whenAutomatic
isON
, routes from DHCP are used, but you can also add additional static routes. WhenOFF
, only static routes are used.-
Address
— Enter theIP
address of a remote network or host. -
Netmask
— The netmask or prefix length of theIP
address entered above. -
Gateway
— TheIP
address of the gateway leading to the remote network or host entered above. Metric
— A network cost, a preference value to give to this route. Lower values will be preferred over higher values.Use this connection only for resources on its network
Select this check box to prevent the connection from becoming the default route. Selecting this option means that only traffic specifically destined for routes learned automatically over the connection or entered here manually is routed over the connection.
-
To configure
IPv6
settings in aVPN
connection, select the menu entry:IPv6 Method
-
Automatic
— Choose this option to useIPv6
Stateless Address AutoConfiguration (SLAAC) to create an automatic, stateless configuration based on the hardware address and Router Advertisements (RA). -
Automatic, DHCP only
— Choose this option to not use RA, but request information fromDHCPv6
directly to create a stateful configuration. -
Link-Local Only
— Choose this option if the network you are connecting to does not have aDHCP
server and you do not want to assignIP
addresses manually. Random addresses will be assigned as per RFC 4862 with prefixFE80::0
. -
Manual
— Choose this option if you want to assignIP
addresses manually. Disable
—IPv6
is disabled for this connection.Note that
DNS
,Routes
,Use this connection only for resources on its network
are common toIPv4
settings.
-
-
Once you have finished editing the
VPN
connection, click the button to customize the configuration or the button to save it for the existing one. -
Switch the profile to
ON
to active theVPN
connection.
Additional resources
-
For more details on the supported
Libreswan
parameters, see thenm-settings-libreswan(5)
man page.
14.2. Configuring a VPN connection using nm-connection-editor
This procedure describes how to configure a VPN connection using nm-connection-editor
.
Prerequisites
-
The
NetworkManager-libreswan-gnome
package is installed. If you configure an Internet Key Exchange version 2 (IKEv2) connection:
- The certificate is imported into the IPsec network security services (NSS) database.
- The nickname of the certificate in the NSS database is known.
Procedure
Open a terminal, and enter:
$ nm-connection-editor
- Click the button to add a new connection.
-
Select the
IPsec based VPN
connection type, and click . On the
VPN
tab:Enter the host name or IP address of the VPN gateway into the
Gateway
field, and select an authentication type. Based on the authentication type, you must enter different additional information:-
IKEv2 (Certifiate)
authenticates the client by using a certificate, which is more secure. This setting requires the nickname of the certificate in the IPsec NSS database IKEv1 (XAUTH)
authenticates the user by using a user name and password (pre-shared key). This setting requires that you enter the following values:- User name
- Password
- Group name
- Secret
-
If the remote server specifies a local identifier for the IKE exchange, enter the exact string in the
Remote ID
field. In the remote server runs Libreswan, this value is set in the server’sleftid
parameter.Optionally, configure additional settings by clicking the
button. You can configure the following settings:Identification
-
Domain
— If required, enter the domain name.
-
Security
-
Phase1 Algorithms
corresponds to theike
Libreswan parameter. Enter the algorithms to be used to authenticate and set up an encrypted channel. Phase2 Algorithms
corresponds to theesp
Libreswan parameter. Enter the algorithms to be used for theIPsec
negotiations.Check the
Disable PFS
field to turn off Perfect Forward Secrecy (PFS) to ensure compatibility with old servers that do not support PFS.-
Phase1 Lifetime
corresponds to theikelifetime
Libreswan parameter. This parameter defines how long the key used to encrypt the traffic is valid. -
Phase2 Lifetime
corresponds to thesalifetime
Libreswan parameter. This parameter defines how long a security association is valid.
-
Connectivity
Remote network
corresponds to therightsubnet
Libreswan parameter and defines the destination private remote network that should be reached through the VPN.Check the
narrowing
field to enable narrowing. Note that it is only effective in the IKEv2 negotiation.-
Enable fragmentation
corresponds to thefragmentation
Libreswan parameter and defines whether or not to allow IKE fragmentation. Valid values areyes
(default) orno
. -
Enable Mobike
corresponds to themobike
Libreswan parameter. The parameter defines whether to allow Mobility and Multihoming Protocol (MOBIKE) (RFC 4555) to enable a connection to migrate its endpoint without needing to restart the connection from scratch. This is used on mobile devices that switch between wired, wireless or mobile data connections. The values areno
(default) oryes
.
On the
IPv4 Settings
tab, select the IP assignment method and, optionally, set additional static addresses, DNS servers, search domains, and routes.- Save the connection.
-
Close
nm-connection-editor
.
When you add a new connection by clicking the NetworkManager creates a new configuration file for that connection and then opens the same dialog that is used for editing an existing connection. The difference between these dialogs is that an existing connection profile has a Details menu entry.
button,Additional resources
-
For further details on the supported IPsec parameters, see the
nm-settings-libreswan(5)
man page.
Chapter 15. Configuring IP tunnels
Similar to a VPN, an IP tunnel directly connects two networks over a third network, such as the Internet. However, not all tunnel protocols support encryption.
The routers in both networks that establish the tunnel requires at least two interfaces:
- One interface that is connected to the local network
- One interface that is connected to the network through which the tunnel is established.
To establish the tunnel, you create a virtual interface on both routers with an IP address from the remote subnet.
NetworkManager supports the following IP tunnels:
- Generic Routing Encapsulation (GRE)
- Generic Routing Encapsulation over IPv6 (IP6GRE)
- Generic Routing Encapsulation Terminal Access Point (GRETAP)
- Generic Routing Encapsulation Terminal Access Point over IPv6 (IP6GRETAP)
- IPv4 over IPv4 (IPIP)
- IPv4 over IPv6 (IPIP6)
- IPv6 over IPv6 (IP6IP6)
- Simple Internet Transition (SIT)
Depending on the type, these tunnels act either on layer 2 or 3 of the Open Systems Interconnection (OSI) model.
15.1. Configuring an IPIP tunnel using nmcli to encapsulate IPv4 traffic in IPv4 packets
An IP over IP (IPIP) tunnel operates on OSI layer 3 and encapsulates IPv4 traffic in IPv4 packets as described in RFC 2003.
Data sent through an IPIP tunnel is not encrypted. For security reasons, use the tunnel only for data that is already encrypted, for example, by other protocols, such as HTTPS.
Note that IPIP tunnels support only unicast packets. If you require an IPv4 tunnel that supports multicast, see Section 15.2, “Configuring a GRE tunnel using nmcli to encapsulate layer-3 traffic in IPv4 packets”.
This procedure describes how to create an IPIP tunnel between two RHEL routers to connect two internal subnets over the Internet as shown in the following diagram:

Prerequisites
- Each RHEL router has a network interface that is connected to its local subnet.
- Each RHEL router has a network interface that is connected to the Internet.
- The traffic you want to send through the tunnel is IPv4 unicast.
Procedure
On the RHEL router in network A:
Create an IPIP tunnel interface named
tun0
:#
nmcli connection add type ip-tunnel ip-tunnel.mode ipip con-name tun0 ifname tun0 remote 198.51.100.5 local 203.0.113.10
The
remote
andlocal
parameters set the public IP addresses of the remote and the local routers.Set the IPv4 address to the
tun0
device:#
nmcli connection modify tun0 ipv4.addresses '10.0.1.1/30'
Note that a
/30
subnet with two usable IP addresses is sufficient for the tunnel.Configure the
tun0
connection to use a manual IPv4 configuration:#
nmcli connection modify tun0 ipv4.method manual
Add a static route that routes traffic to the
172.16.0.0/24
network to the tunnel IP on router B:#
nmcli connection modify tun0 +ipv4.routes "172.16.0.0/24 10.0.1.2"
Enable the
tun0
connection.#
nmcli connection up tun0
Enable packet forwarding:
#
echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
#sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf
On the RHEL router in network B:
Create an IPIP tunnel interface named
tun0
:#
nmcli connection add type ip-tunnel ip-tunnel.mode ipip con-name tun0 ifname tun0 remote 203.0.113.10 local 198.51.100.5
The
remote
andlocal
parameters set the public IP addresses of the remote and local routers.Set the IPv4 address to the
tun0
device:#
nmcli connection modify tun0 ipv4.addresses '10.0.1.2/30'
Configure the
tun0
connection to use a manual IPv4 configuration:#
nmcli connection modify tun0 ipv4.method manual
Add a static route that routes traffic to the
192.0.2.0/24
network to the tunnel IP on router A:#
nmcli connection modify tun0 +ipv4.routes "192.0.2.0/24 10.0.1.1"
Enable the
tun0
connection.#
nmcli connection up tun0
Enable packet forwarding:
#
echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
#sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf
Verification steps
From each RHEL router, ping the IP address of the internal interface of the other router:
On Router A, ping
172.16.0.1
:#
ping 172.16.0.1
On Router B, ping
192.0.2.1
:#
ping 192.0.2.1
Additional resources
-
For further details about using
nmcli
, see thenmcli
man page. -
For details about the tunnel settings you can set with
nmcli
, see theip-tunnel settings
section in thenm-settings(5)
man page.
15.2. Configuring a GRE tunnel using nmcli to encapsulate layer-3 traffic in IPv4 packets
A Generic Routing Encapsulation (GRE) tunnel encapsulates layer-3 traffic in IPv4 packets as described in RFC 2784. A GRE tunnel can encapsulate any layer 3 protocol with a valid Ethernet type.
Data sent through a GRE tunnel is not encrypted. For security reasons, use the tunnel only for data that is already encrypted, for example, by other protocols, such as HTTPS.
This procedure describes how to create a GRE tunnel between two RHEL routers to connect two internal subnets over the Internet as shown in the following diagram:

The gre0
device name is reserved. Use gre1
or a different name for the device.
Prerequisites
- Each RHEL router has a network interface that is connected to its local subnet.
- Each RHEL router has a network interface that is connected to the Internet.
Procedure
On the RHEL router in network A:
Create a GRE tunnel interface named
gre1
:#
nmcli connection add type ip-tunnel ip-tunnel.mode gre con-name gre1 ifname gre1 remote 198.51.100.5 local 203.0.113.10
The
remote
andlocal
parameters set the public IP addresses of the remote and the local routers.Set the IPv4 address to the
gre1
device:#
nmcli connection modify gre1 ipv4.addresses '10.0.1.1/30'
Note that a
/30
subnet with two usable IP addresses is sufficient for the tunnel.Configure the
gre1
connection to use a manual IPv4 configuration:#
nmcli connection modify gre1 ipv4.method manual
Add a static route that routes traffic to the
172.16.0.0/24
network to the tunnel IP on router B:#
nmcli connection modify tun0 +ipv4.routes "172.16.0.0/24 10.0.1.2"
Enable the
gre1
connection.#
nmcli connection up gre1
Enable packet forwarding:
#
echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
#sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf
On the RHEL router in network B:
Create a GRE tunnel interface named
gre1
:#
nmcli connection add type ip-tunnel ip-tunnel.mode ipip con-name gre1 ifname gre1 remote 203.0.113.10 local 198.51.100.5
The
remote
andlocal
parameters sets the public IP addresses of the remote and the local routers.Set the IPv4 address to the
gre1
device:#
nmcli connection modify gre1 ipv4.addresses '10.0.1.2/30'
Configure the
gre1
connection to use a manual IPv4 configuration:#
nmcli connection modify gre1 ipv4.method manual
Add a static route that routes traffic to the
192.0.2.0/24
network to the tunnel IP on router A:#
nmcli connection modify tun0 +ipv4.routes "192.0.2.0/24 10.0.1.1"
Enable the
gre1
connection.#
nmcli connection up gre1
Enable packet forwarding:
#
echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
#sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf
Verification steps
From each RHEL router, ping the IP address of the internal interface of the other router:
On Router A, ping
172.16.0.1
:#
ping 172.16.0.1
On Router B, ping
192.0.2.1
:#
ping 192.0.2.1
Additional resources
-
For further details about using
nmcli
, see thenmcli
man page. -
For details about the tunnel settings you can set with
nmcli
, see theip-tunnel settings
section in thenm-settings(5)
man page.
15.3. Configuring a GRETAP tunnel to transfer Ethernet frames over IPv4
A Generic Routing Encapsulation Terminal Access Point (GRETAP) tunnel operates on OSI level 2 and encapsulates Ethernet traffic in IPv4 packets as described in RFC 2784.
Data sent through a GRETAP tunnel is not encrypted. For security reasons, establish the tunnel over a VPN or a different encrypted connection.
This procedure describes how to create a GRETAP tunnel between two RHEL routers to connect two networks using a bridge as shown in the following diagram:

The gretap0
device name is reserved. Use gretap1
or a different name for the device.
Prerequisites
- Each RHEL router has a network interface that is connected to its local network, and the interface has no IP configuration assigned.
- Each RHEL router has a network interface that is connected to the Internet.
Procedure
On the RHEL router in network A:
Create a bridge interface named
bridge0
:#
nmcli connection add type bridge con-name bridge0 ifname bridge0
Configure the IP settings of the bridge:
#
nmcli connection modify bridge0 ipv4.addresses '192.0.2.1/24'
#nmcli connection modify bridge0 ipv4.method manual
Add a new connection profile for the interface that is connected to local network to the bridge:
#
nmcli connection add type ethernet slave-type bridge con-name bridge0-port1 ifname enp1s0 master bridge0
Add a new connection profile for the GRETAP tunnel interface to the bridge:
#
nmcli connection add type ip-tunnel ip-tunnel.mode gretap slave-type bridge con-name bridge0-port2 ifname gretap1 remote 198.51.100.5 local 203.0.113.10 master bridge0
The
remote
andlocal
parameters set the public IP addresses of the remote and the local routers.Optional: Disable the Spanning Tree Protocol (STP) if you do not need it:
#
nmcli connection modify bridge0 bridge.stp no
By default, STP is enabled and causes a delay before you can use the connection.
Configure that activating the
bridge0
connection automatically activates the ports of the bridge:#
nmcli connection modify bridge0 connection.autoconnect-slaves 1
Active the
bridge0
connection:#
nmcli connection up bridge0
On the RHEL router in network B:
Create a bridge interface named
bridge0
:#
nmcli connection add type bridge con-name bridge0 ifname bridge0
Configure the IP settings of the bridge:
#
nmcli connection modify bridge0 ipv4.addresses '192.0.2.2/24'
#nmcli connection modify bridge0 ipv4.method manual
Add a new connection profile for the interface that is connected to local network to the bridge:
#
nmcli connection add type ethernet slave-type bridge con-name bridge0-port1 ifname enp1s0 master bridge0
Add a new connection profile for the GRETAP tunnel interface to the bridge:
#
nmcli connection add type ip-tunnel ip-tunnel.mode gretap slave-type bridge con-name bridge0-port2 ifname gretap1 remote 203.0.113.10 local 198.51.100.5 master bridge0
The
remote
andlocal
parameters set the public IP addresses of the remote and the local routers.Optional: Disable the Spanning Tree Protocol (STP) if you do not need it:
#
nmcli connection modify bridge0 bridge.stp no
Configure that activating the
bridge0
connection automatically activates the ports of the bridge:#
nmcli connection modify bridge0 connection.autoconnect-slaves 1
Active the
bridge0
connection:#
nmcli connection up bridge0
Verification steps
On both routers, verify that the
enp1s0
andgretap1
connections are connected and that theCONNECTION
column displays the connection name of the port:#
nmcli device
nmcli device DEVICE TYPE STATE CONNECTION ... bridge0 bridge connected bridge0 enp1s0 ethernet connected bridge0-port1 gretap1 iptunnel connected bridge0-port2From each RHEL router, ping the IP address of the internal interface of the other router:
On Router A, ping
192.0.2.2
:#
ping 192.0.2.2
On Router B, ping
192.0.2.1
:#
ping 192.0.2.1
Additional resources
-
For further details about using
nmcli
, see thenmcli
man page. -
For details about the tunnel settings you can set with
nmcli
, see theip-tunnel settings
section in thenm-settings(5)
man page.
15.4. Additional resources
-
For a list of tunnel interfaces and on temporarily configuring tunnels using the
ip
utility, see theip-link(8)
man page.
Chapter 16. Configuring Fibre Channel over Ethernet
Based on the IEEE T11 FC-BB-5 standard, Fibre Channel over Ethernet (FCoE) is a protocol to transmit Fibre Channel frames over Ethernet networks. Typically, data centers have a dedicated LAN and Storage Area Network (SAN) that are separated from each other with their own specific configuration. FCoE combines these networks into a single and converged network structure. Benefits of FCoE are, for example, lower hardware and energy costs.
16.1. Using hardware FCoE HBAs in RHEL
In Red Hat Enterprise Linux you can use hardware FCoE Host Bus Adapter (HBA) supported by the following drivers:
-
qedf
-
bnx2fc
-
fnic
If you use such a HBA, you configure the FCoE settings in the setup of the HBA. For details, see the documentation of the adapter.
After you configured the HBA in its setup, the exported Logical Unit Numbers (LUN) from the Storage Area Network (SAN) are automatically available to RHEL as /dev/sd*
devices. You can use these devices similar to local storage devices.
16.2. Setting up a software FCoE device
A software FCoE device enables you to access Logical Unit Numbers (LUN) over FCoE using an Ethernet adapter that partially supports FCoE offload.
RHEL does not support software FCoE devices that require the fcoe.ko
kernel module. For details, see FCoE software removal in the Considerations in adopting RHEL 8
documentation.
After you complete this procedure, the exported LUNs from the Storage Area Network (SAN) are automatically available to RHEL as /dev/sd*
devices. You can use these devices similar to local storage devices.
Prerequisites
-
The Host Bus Adapter (HBA) uses the
qedf
,bnx2fc
, orfnic
driver and does not require thefcoe.ko
kernel module. - The SAN uses a VLAN to separate the storage traffic from normal Ethernet traffic.
- The network switch has been configured to support the VLAN.
- The HBA of the server is configured in its BIOS. For details, see the documentation of your HBA.
- The HBA is connected to the network and the link is up.
Procedure
Install the
fcoe-utils
package:#
yum install fcoe-utils
Copy the
/etc/fcoe/cfg-ethx
template file to/etc/fcoe/cfg-interface_name
. For example, if you want to configure theenp1s0
interface to use FCoE, enter:#
cp /etc/fcoe/cfg-ethx /etc/fcoe/cfg-enp1s0
Enable and start the
fcoe
service:#
systemctl enable --now fcoe
Discover the FCoE VLAN ID, start the initiator, and create a network device for the discovered VLAN:
#
fipvlan -s -c enp1s0
Created VLAN device enp1s0.200 Starting FCoE on interface enp1s0.200 Fibre Channel Forwarders Discovered interface | VLAN | FCF MAC ------------------------------------------ enp1s0 | 200 | 00:53:00:a7:e7:1bOptional: To display details about the discovered targets, the LUNs, and the devices associated with the LUNs, enter:
#
fcoeadm -t
Interface: enp1s0.200 Roles: FCP Target Node Name: 0x500a0980824acd15 Port Name: 0x500a0982824acd15 Target ID: 0 MaxFrameSize: 2048 bytes OS Device Name: rport-11:0-1 FC-ID (Port ID): 0xba00a0 State: Online LUN ID Device Name Capacity Block Size Description ------ ----------- ---------- ---------- --------------------- 0 sdb 28.38 GiB 512 NETAPP LUN (rev 820a) ...This example shows that LUN 0 from the SAN has been attached to the host as the
/dev/sdb
device.
Verification steps
Use the
fcoeadm -i
command to display information about all active FCoE interfaces:#
fcoeadm -i
Description: BCM57840 NetXtreme II 10 Gigabit Ethernet Revision: 11 Manufacturer: Broadcom Inc. and subsidiaries Serial Number: 000AG703A9B7 Driver: bnx2x Unknown Number of Ports: 1 Symbolic Name: bnx2fc (QLogic BCM57840) v2.12.13 over enp1s0.200 OS Device Name: host11 Node Name: 0x2000000af70ae935 Port Name: 0x2001000af70ae935 Fabric Name: 0x20c8002a6aa7e701 Speed: 10 Gbit Supported Speed: 1 Gbit, 10 Gbit MaxFrameSize: 2048 bytes FC-ID (Port ID): 0xba02c0 State: Online
Additional resources
-
For further details about the
fcoeadm
utility, see thefcoeadm(8)
man page. -
For details about how to mount storage connected through a software FCoE when the system boots, see the
/usr/share/doc/fcoe-utils/README
file.
16.3. Additional resources
-
For details about using Fibre Channel devices, see the Using Fibre Channel devices section in the
Managing storage devices
guide.
Chapter 17. Authenticating a RHEL client to the network using the 802.1X standard
Administrators frequently use port-based Network Access Control (NAC) based on the IEEE 802.1X standard to protect a network from unauthorized LAN and Wi-Fi clients. The procedures in this section describe different options to configure network authentication.
17.1. Configuring 802.1X network authentication on an existing Ethernet connection using nmcli
Using the nmcli
utility, you can configure the client to authenticate itself to the network. This procedure describes how to configure Protected Extensible Authentication Protocol (PEAP) authentication with the Microsoft Challenge-Handshake Authentication Protocol version 2 (MSCHAPv2) in an existing NetworkManager Ethernet connection profile named enp1s0
.
Prerequisites
- The network must have 802.1X network authentication.
- The Ethernet connection profile exists in NetworkManager and has a valid IP configuration.
-
If the client is required to verify the certificate of the authenticator, the Certificate Authority (CA) certificate must be stored in the
/etc/pki/ca-trust/source/anchors/
directory. -
The
wpa_supplicant
package is installed.
Procedure
Set the Extensible Authentication Protocol (EAP) to
peap
, the inner authentication protocol tomschapv2
, and the user name:#
nmcli connection modify enp1s0 802-1x.eap peap 802-1x.phase2-auth mschapv2 802-1x.identity user_name
Note that you must set the
802-1x.eap
,802-1x.phase2-auth
, and802-1x.identity
parameters in a single command.Optionally, store the password in the configuration:
#
nmcli connection modify enp1s0 802-1x.password password
ImportantBy default, NetworkManager stores the password in clear text in the
/etc/sysconfig/network-scripts/keys-connection_name
file, that is readable only by theroot
user. However, clear text passwords in a configuration file can be a security risk.To increase the security, set the
802-1x.password-flags
parameter to0x1
. With this setting, on servers with the GNOME desktop environment or thenm-applet
running, NetworkManager retrieves the password from these services. In other cases, NetworkManager prompts for the password.If the client is required to verify the certificate of the authenticator, set the
802-1x.ca-cert
parameter in the connection profile to the path of the CA certificate:#
nmcli connection modify enp1s0 802-1x.ca-cert /etc/pki/ca-trust/source/anchors/ca.crt
NoteFor security reasons, Red Hat recommends using the certificate of the authenticator to enable clients to validate the identity of the authenticator.
Activate the connection profile:
#
nmcli connection up enp1s0
Verification steps
- Access resources on the network that require network authentication.
Additional resources
- For details about adding a NetworkManager Ethernet connection profile, see Chapter 8, Configuring an Ethernet connection.
-
For further 802.1X-related parameters and their descriptions, see the
802-1x settings
section in thenm-settings(5)
man page. -
For further details about the
nmcli
utility, see thenmcli(1)
man page.
17.2. Configuring a static Ethernet connection with 802.1X network authentication using RHEL System Roles
Using RHEL System Roles, you can automate the creation of an Ethernet connection that uses the 802.1X standard to authenticate the client. This procedure describes how to remotely add an Ethernet connection for the enp1s0
interface with the following settings by running an Ansible playbook:
-
A static IPv4 address -
192.0.2.1
with a/24
subnet mask -
A static IPv6 address -
2001:db8:1::1
with a/64
subnet mask -
An IPv4 default gateway -
192.0.2.254
-
An IPv6 default gateway -
2001:db8:1::fffe
-
An IPv4 DNS server -
192.0.2.200
-
An IPv6 DNS server -
2001:db8:1::ffbb
-
A DNS search domain -
example.com
-
802.1X network authentication using the
TLS
Extensible Authentication Protocol (EAP)
Run this procedure on the Ansible control node.
Prerequisites
-
The
ansible
andrhel-system-roles
packages are installed on the control node. -
If you use a different remote user than
root
when you run the playbook, you must have appropriatesudo
permissions on the managed node. - The network supports 802.1X network authentication.
- The managed node uses NetworkManager.
The following files required for TLS authentication exist on the control node:
-
The client key stored in the
/srv/data/client.key
file. -
The client certificate stored in the
/srv/data/client.crt
file. -
The Certificate Authority (CA) certificate stored in the
/srv/data/ca.crt
file.
-
The client key stored in the
Procedure
If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the
/etc/ansible/hosts
Ansible inventory file:node.example.com
Create the
~/enable-802.1x.yml
playbook with the following content:--- - name: Configure an Ethernet connection with 802.1X authentication hosts: node.example.com become: true tasks: - name: Copy client key for 802.1X authentication copy: src: "/srv/data/client.key" dest: "/etc/pki/tls/private/client.key" mode: 0600 - name: Copy client certificate for 802.1X authentication copy: src: "/srv/data/client.crt" dest: "/etc/pki/tls/certs/client.crt" - name: Copy CA certificate for 802.1X authentication copy: src: "/srv/data/ca.crt" dest: "/etc/pki/ca-trust/source/anchors/ca.crt" - include_role: name: linux-system-roles.network vars: network_connections: - name: enp1s0 type: ethernet autoconnect: yes ip: address: - 192.0.2.1/24 - 2001:db8:1::1/64 gateway4: 192.0.2.254 gateway6: 2001:db8:1::fffe dns: - 192.0.2.200 - 2001:db8:1::ffbb dns_search: - example.com ieee802_1x: identity: user_name eap: tls private_key: "/etc/pki/tls/private/client.key" private_key_password: "password" client_cert: "/etc/pki/tls/certs/client.crt" ca_cert: "/etc/pki/ca-trust/source/anchors/ca.crt" domain_suffix_match: example.com state: up
Run the playbook:
To connect as
root
user to the managed host, enter:#
ansible-playbook -u root ~/enable-802.1x.yml
To connect as a user to the managed host, enter:
#
ansible-playbook -u user_name --ask-become-pass ~/ethernet-static-IP.yml
The
--ask-become-pass
option makes sure that theansible-playbook
command prompts for thesudo
password of the user defined in the-u user_name
option.
If you do not specify the
-u user_name
option,ansible-playbook
connects to the managed host as the user that is currently logged in to the control node.
Additional resources
-
For details about the parameters used in
network_connections
and for additional information about thenetwork
System Role, see the/usr/share/ansible/roles/rhel-system-roles.network/README.md
file. -
For details about the 802.1X parameters, see the
ieee802_1x
section in the/usr/share/ansible/roles/rhel-system-roles.network/README.md
file. -
For details about the
ansible-playbook
command, see theansible-playbook(1)
man page.
17.3. Configuring 802.1X network authentication on an existing Wi-Fi connection using nmcli
Using the nmcli
utility, you can configure the client to authenticate itself to the network. This procedure describes how to configure Protected Extensible Authentication Protocol (PEAP) authentication with the Microsoft Challenge-Handshake Authentication Protocol version 2 (MSCHAPv2) in an existing NetworkManager Wi-Fi connection profile named wlp1s0
.
Prerequisites
- The network must have 802.1X network authentication.
- The Wi-Fi connection profile exists in NetworkManager and has a valid IP configuration.
-
If the client is required to verify the certificate of the authenticator, the Certificate Authority (CA) certificate must be stored in the
/etc/pki/ca-trust/source/anchors/
directory. -
The
wpa_supplicant
package is installed.
Procedure
Set the Wi-Fi security mode to
wpa-eap
, the Extensible Authentication Protocol (EAP) topeap
, the inner authentication protocol tomschapv2
, and the user name:#
nmcli connection modify wpl1s0 802-11-wireless-security.key-mgmt wpa-eap 802-1x.eap peap 802-1x.phase2-auth mschapv2 802-1x.identity user_name
Note that you must set the
802-11-wireless-security.key-mgmt
,802-1x.eap
,802-1x.phase2-auth
, and802-1x.identity
parameters in a single command.Optionally, store the password in the configuration:
#
nmcli connection modify wpl1s0 802-1x.password password
ImportantBy default, NetworkManager stores the password in clear text in the
/etc/sysconfig/network-scripts/keys-connection_name
file, that is readable only by theroot
user. However, clear text passwords in a configuration file can be a security risk.To increase the security, set the
802-1x.password-flags
parameter to0x1
. With this setting, on servers with the GNOME desktop environment or thenm-applet
running, NetworkManager retrieves the password from these services. In other cases, NetworkManager prompts for the password.If the client is required to verify the certificate of the authenticator, set the
802-1x.ca-cert
parameter in the connection profile to the path of the CA certificate:#
nmcli connection modify wpl1s0 802-1x.ca-cert /etc/pki/ca-trust/source/anchors/ca.crt
NoteFor security reasons, Red Hat recommends using the certificate of the authenticator to enable clients to validate the identity of the authenticator.
Activate the connection profile:
#
nmcli connection up wpl1s0
Verification steps
- Access resources on the network that require network authentication.
Additional resources
- For details about adding a NetworkManager Ethernet connection profile, see Chapter 9, Managing Wi-Fi connections.
-
For further 802.1X-related parameters and their descriptions, see the
802-1x settings
section in thenm-settings(5)
man page. -
For further details about the
nmcli
utility, see thenmcli(1)
man page.
Chapter 18. Managing the default gateway setting
The default gateway is a router that forwards network packets when no other route matches the destination of a packet. In a local network, the default gateway is typically the host that is one hop closer to the internet.
18.1. Setting the default gateway on an existing connection using nmcli
In most situations, administrators set the default gateway when they create a connection as explained in, for example, Section 8.1, “Configuring a static Ethernet connection using nmcli”.
This section describes how to set or update the default gateway on a previously created connection using the nmcli
utility.
Prerequisites
- At least one static IP address must be configured on the connection on which the default gateway will be set.
-
If the user is logged in on a physical console, user permissions are sufficient. Otherwise, user must have
root
permissions.
Procedure
Set the IP address of the default gateway.
For example, to set the IPv4 address of the default gateway on the
example
connection to192.0.2.1
:$
sudo nmcli connection modify example ipv4.gateway "192.0.2.1"
For example, to set the IPv6 address of the default gateway on the
example
connection to2001:db8:1::1
:$
sudo nmcli connection modify example ipv6.gateway "2001:db8:1::1"
Restart the network connection for changes to take effect. For example, to restart the
example
connection using the command line:$
sudo nmcli connection up example
WarningAll connections currently using this network connection are temporarily interrupted during the restart.
Optionally, verify that the route is active.
To display the IPv4 default gateway:
$
ip -4 route
default via 192.0.2.1 dev example proto static metric 100To display the IPv6 default gateway:
$
ip -6 route
default via 2001:db8:1::1 dev example proto static metric 100 pref medium
Additional resources
18.2. Setting the default gateway on an existing connection using the nmcli interactive mode
In most situations, administrators set the default gateway when they create a connection as explained in, for example, Section 8.5, “Configuring a dynamic Ethernet connection using the nmcli interactive editor”.
This section describes how to set or update the default gateway on a previously created connection using the interactive mode of the nmcli
utility.
Prerequisites
- At least one static IP address must be configured on the connection on which the default gateway will be set.
-
If the user is logged in on a physical console, user permissions are sufficient. Otherwise, the user must have
root
permissions.
Procedure
Open the
nmcli
interactive mode for the required connection. For example, to open thenmcli
interactive mode for the example connection:$
sudo nmcli connection edit example
Set the default gateway.
For example, to set the IPv4 address of the default gateway on the
example
connection to192.0.2.1
:nmcli>
set ipv4.gateway 192.0.2.1
For example, to set the IPv6 address of the default gateway on the
example
connection to2001:db8:1::1
:nmcli>
set ipv6.gateway 2001:db8:1::1
Optionally, verify that the default gateway was set correctly:
nmcli>
print
... ipv4.gateway: 192.0.2.1 ... ipv6.gateway: 2001:db8:1::1 ...Save the configuration:
nmcli>
save persistent
Restart the network connection for changes to take effect:
nmcli>
activate example
WarningAll connections currently using this network connection are temporarily interrupted during the restart.
Leave the
nmcli
interactive mode:nmcli>
quit
Optionally, verify that the route is active.
To display the IPv4 default gateway:
$
ip -4 route
default via 192.0.2.1 dev example proto static metric 100To display the IPv6 default gateway:
$
ip -6 route
default via 2001:db8:1::1 dev example proto static metric 100 pref medium
18.3. Setting the default gateway on an existing connection using nm-connection-editor
In most situations, administrators set the default gateway when they create a connection. This section describes how to set or update the default gateway on a previously created connection using the nm-connection-editor
application.
Prerequisites
- At least one static IP address must be configured on the connection on which the default gateway will be set.
Procedure
Open a terminal, and enter
nm-connection-editor
:$
nm-connection-editor
- Select the connection to modify, and click the gear wheel icon to edit the existing connection.
Set the IPv4 default gateway. For example, to set the IPv4 address of the default gateway on the connection to
192.0.2.1
:-
Open the
IPv4 Settings
tab. Enter the address in the
gateway
field next to the IP range the gateway’s address is within:
-
Open the
Set the IPv6 default gateway. For example, to set the IPv6 address of the default gateway on the connection to
2001:db8:1::1
:-
Open the
IPv6
tab. Enter the address in the
gateway
field next to the IP range the gateway’s address is within:
-
Open the
- Click .
- Click .
Restart the network connection for changes to take effect. For example, to restart the
example
connection using the command line:$
sudo nmcli connection up example
WarningAll connections currently using this network connection are temporarily interrupted during the restart.
Optionally, verify that the route is active.
To display the IPv4 default gateway:
$
ip -4 route
default via 192.0.2.1 dev example proto static metric 100To display the IPv6 default gateway:
$
ip -6 route
default via 2001:db8:1::1 dev example proto static metric 100 pref medium
Additional resources
18.4. Setting the default gateway on an existing connection using control-center
In most situations, administrators set the default gateway when they create a connection. This section describes how to set or update the default gateway on a previously created connection using the control-center
application.
Prerequisites
- At least one static IP address must be configured on the connection on which the default gateway will be set.
-
The network configuration of the connection is open in the
control-center
application.
Procedure
Set the IPv4 default gateway. For example, to set the IPv4 address of the default gateway on the connection to
192.0.2.1
:-
Open the
IPv4
tab. Enter the address in the
gateway
field next to the IP range the gateway’s address is within:
-
Open the
Set the IPv6 default gateway. For example, to set the IPv6 address of the default gateway on the connection to
2001:db8:1::1
:-
Open the
IPv6
tab. Enter the address in the
gateway
field next to the IP range the gateway’s address is within:
-
Open the
- Click .
Back in the
Network
window, disable and re-enable the connection by switching the button for the connection to and back to for changes to take effect.WarningAll connections currently using this network connection are temporarily interrupted during the restart.
Optionally, verify that the route is active.
To display the IPv4 default gateway:
$
ip -4 route
default via 192.0.2.1 dev example proto static metric 100To display the IPv6 default gateway:
$
ip -6 route
default via 2001:db8:1::1 dev example proto static metric 100 pref medium
Additional resources
18.5. Setting the default gateway on an existing connection using System Roles
You can use the networking
RHEL System Role to set the default gateway.
When you run a play that uses the networking
RHEL System Role, the System Role overrides an existing connection profile with the same name if the settings do not match the ones specified in the play. Therefore, always specify the whole configuration of the network connection profile in the play, even if, for example, the IP configuration already exists. Otherwise, the role resets these values to their defaults.
Depending on whether it already exists, the procedure creates or updates the enp1s0
connection profile with the following settings:
-
A static IPv4 address -
198.51.100.20
with a/24
subnet mask -
A static IPv6 address -
2001:db8:1::1
with a/64
subnet mask -
An IPv4 default gateway -
198.51.100.254
-
An IPv6 default gateway -
2001:db8:1::fffe
-
An IPv4 DNS server -
198.51.100.200
-
An IPv6 DNS server -
2001:db8:1::ffbb
-
A DNS search domain -
example.com
Prerequisites
-
The
ansible
andrhel-system-roles
packages are installed on the control node. -
If you use a different remote user than
root
when you run the playbook, this user has appropriatesudo
permissions on the managed node.
Procedure
If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the
/etc/ansible/hosts
Ansible inventory file:node.example.com
Create the
~/ethernet-connection.yml
playbook with the following content:--- - name: Configure an Ethernet connection with static IP and default gateway hosts: node.example.com become: true tasks: - include_role: name: linux-system-roles.network vars: network_connections: - name: enp1s0 type: ethernet autoconnect: yes ip: address: - 198.51.100.20/24 - 2001:db8:1::1/64 gateway4: 198.51.100.254 gateway6: 2001:db8:1::fffe dns: - 198.51.100.200 - 2001:db8:1::ffbb dns_search: - example.com state: up
Run the playbook:
To connect as
root
user to the managed host, enter:#
ansible-playbook -u root ~/ethernet-connection.yml
To connect as a user to the managed host, enter:
#
ansible-playbook -u user_name --ask-become-pass ~/ethernet-connection.yml
The
--ask-become-pass
option makes sure that theansible-playbook
command prompts for thesudo
password of the user defined in the-u user_name
option.
If you do not specify the
-u user_name
option,ansible-playbook
connects to the managed host as the user that is currently logged in to the control node.
Additional resources
-
For details about the parameters used in
network_connections
and for additional information about thenetwork
System Role, see the/usr/share/ansible/roles/rhel-system-roles.network/README.md
file. -
For details about the
ansible-playbook
command, see theansible-playbook(1)
man page.
18.6. Setting the default gateway on an existing connection when using the legacy network scripts
This procedure describes how to configure a default gateway when you use the legacy network scripts. The example sets the default gateway to 192.0.2.1
that is reachable via the enp1s0
interface.
Prerequisites
-
The
NetworkManager
package is not installed, or theNetworkManager
service is disabled. -
The
network-scripts
package is installed.
Procedure
Set the
GATEWAY
parameter in the/etc/sysconfig/network-scripts/ifcfg-enp1s0
file to192.0.2.1
:GATEWAY=192.0.2.1
Add the
default
entry in the/etc/sysconfig/network-scripts/route-enp0s1
file:default via 192.0.2.1
Restart the network:
# systemctl restart network
18.7. How NetworkManager manages multiple default gateways
In certain situations, for example for fallback reasons, you set multiple default gateways on a host. However, to avoid asynchronous routing issues, each default gateway of the same protocol requires a separate metric value. Note that RHEL only uses the connection to the default gateway that has the lowest metric set.
You can set the metric for both the IPv4 and IPv6 gateway of a connection using the following command:
# nmcli connection modify connection-name ipv4.route-metric value ipv6.route-metric value
Do not set the same metric value for the same protocol in multiple connection profiles to avoid routing issues.
If you set a default gateway without a metric value, NetworkManager automatically sets the metric value based on the interface type. For that, NetworkManager assigns the default value of this network type to the first connection that is activated, and sets an incremented value to each other connection of the same type in the order they are activated. For example, if two Ethernet connections with a default gateway exist, NetworkManager sets a metric of 100
on the route to the default gateway of the connection that you activate first. For the second connection, NetworkManager sets 101
.
The following is an overview of frequently-used network types and their default metrics:
Connection type | Default metric value |
---|---|
VPN | 50 |
Ethernet | 100 |
MACsec | 125 |
InfiniBand | 150 |
Bond | 300 |
Team | 350 |
VLAN | 400 |
Bridge | 425 |
TUN | 450 |
Wi-Fi | 600 |
IP tunnel | 675 |
Additional resources
- For details about policy-based routing, see Chapter 20, Configuring policy-based routing to define alternative routes.
- For details about Multipath TCP, see Chapter 25, Getting started with Multipath TCP.
18.8. Configuring NetworkManager to avoid using a specific profile to provide a default gateway
You can configure that NetworkManager never uses a specific profile to provide the default gateway. Follow this procedure for connection profiles that are not connected to the default gateway.
Prerequisites
- The NetworkManager connection profile for the connection that is not connected to the default gateway exists.
Procedure
If the connection uses a dynamic IP configuration, configure that NetworkManager does not use the connection as the default route for IPv4 and IPv6 connections:
#
nmcli connection modify connection_name ipv4.never-default yes ipv6.never-default yes
Note that setting
ipv4.never-default
andipv6.never-default
toyes
, automatically removes the default gateway’s IP address for the corresponding protocol from the connection profile.Activate the connection:
#
nmcli connection up connection_name
Verification steps
-
Use the
ip -4 route
andip -6 route
commands to verify that RHEL does not use the network interface for the default route for the IPv4 and IPv6 protocol.
18.9. Fixing unexpected routing behavior due to multiple default gateways
There are only a few scenarios, such as when using multipath TCP, in which you require multiple default gateways on a host. In most cases, you configure only a single default gateway to avoid unexpected routing behavior or asynchronous routing issues.
To route traffic to different internet providers, use policy-based routing instead of multiple default gateways.
Prerequisites
- The host uses NetworkManager to manage network connections, which is the default.
- The host has multiple network interfaces.
- The host has multiple default gateways configured.
Procedure
Display the routing table:
For IPv4, enter:
#
ip -4 route
default via 192.0.2.1 dev enp1s0 proto static metric 101 default via 198.51.100.1 dev enp7s0 proto static metric 102 ...For IPv6, enter:
#
ip -6 route
default via 2001:db8:1::1 dev enp1s0 proto static metric 101 pref medium default via 2001:db8:2::1 dev enp7s0 proto static metric 102 pref medium ...
Entries starting with
default
indicate a default route. Note the interface names of these entries displayed next todev
.Use the following commands to display the NetworkManager connections that use the interfaces you identified in the previous step:
#
nmcli -f GENERAL.CONNECTION,IP4.GATEWAY,IP6.GATEWAY device show enp1s0
GENERAL.CONNECTION: Corporate-LAN IP4.GATEWAY: 192.168.122.1 IP6.GATEWAY: 2001:db8:1::1 #nmcli -f GENERAL.CONNECTION,IP4.GATEWAY,IP6.GATEWAY device show enp7s0
GENERAL.CONNECTION: Internet-Provider IP4.GATEWAY: 198.51.100.1 IP6.GATEWAY: 2001:db8:2::1In these examples, the profiles named
Corporate-LAN
andInternet-Provider
have the default gateways set. Because, in a local network, the default gateway is typically the host that is one hop closer to the internet, the rest of this procedure assumes that the default gateways in theCorporate-LAN
are incorrect.Configure that NetworkManager does not use the
Corporate-LAN
connection as the default route for IPv4 and IPv6 connections:#
nmcli connection modify Corporate-LAN ipv4.never-default yes ipv6.never-default yes
Note that setting
ipv4.never-default
andipv6.never-default
toyes
, automatically removes the default gateway’s IP address for the corresponding protocol from the connection profile.Activate the
Corporate-LAN
connection:#
nmcli connection up Corporate-LAN
Verification steps
Display the IPv4 and IPv6 routing tables and verify that only one default gateway is available for each protocol:
For IPv4, enter:
#
ip -4 route
default via 192.0.2.1 dev enp1s0 proto static metric 101 ...For IPv6, enter:
#
ip -6 route
default via 2001:db8:1::1 dev enp1s0 proto static metric 101 pref medium ...
Additional resources
- For details about policy-based routing, see Chapter 20, Configuring policy-based routing to define alternative routes.
- For details about Multipath TCP, see Chapter 25, Getting started with Multipath TCP.
Chapter 19. Configuring static routes
By default, and if a default gateway is configured, Red Hat Enterprise Linux forwards traffic for networks that are not directly connected to the host to the default gateway. Using a static route, you can configure that Red Hat Enterprise Linux forwards the traffic for a specific host or network to a different router than the default gateway. This section describes different options how to configure static routes.
19.1. How to use the nmcli command to configure a static route
To configure a static route, use the nmcli
utility with the following syntax:
$ nmcli connection modify connection_name ipv4.routes "ip[/prefix] [next_hop] [metric] [attribute=value] [attribute=value] ..."
The command supports the following route attributes:
-
table=n
-
src=address
-
tos=n
-
onlink=true|false
-
window=n
-
cwnd=n
-
mtu=n
-
lock-window=true|false
-
lock-cwdn=true|false
-
lock-mtu=true|false
If you use the ipv4.routes
sub-command, nmcli
overrides all current settings of this parameter. To add an additional route, use the nmcli connection modify connection_name +ipv4.routes "…"
command. In a similar way, you can use nmcli connection modify connection_name -ipv4.routes "…"
to remove a specific route.
19.2. Configuring a static route using an nmcli command
You can add a static route to the configuration of a network connection using the nmcli connection modify
command.
The procedure in this section describes how to add a route to the 192.0.2.0/24
network that uses the gateway running on 198.51.100.1
, which is reachable through the example
connection.
Prerequisites
- The network is configured
- The gateway for the static route must be directly reachable on the interface.
-
If the user is logged in on a physical console, user permissions are sufficient. Otherwise, the command requires
root
permissions.
Procedure
Add the static route to the
example
connection:$
sudo nmcli connection modify example +ipv4.routes "192.0.2.0/24 198.51.100.1"
To set multiple routes in one step, pass the individual routes comma-separated to the command. For example, to add a route to the
192.0.2.0/24
and203.0.113.0/24
networks, both routed through the198.51.100.1
gateway, enter:$
sudo nmcli connection modify example +ipv4.routes "192.0.2.0/24 198.51.100.1, 203.0.113.0/24 198.51.100.1"
Optionally, verify that the routes were added correctly to the configuration:
$
nmcli connection show example
... ipv4.routes: { ip = 192.0.2.1/24, nh = 198.51.100.1 } ...Restart the network connection:
$
sudo nmcli connection up example
WarningRestarting the connection briefly disrupts connectivity on that interface.
Optionally, verify that the route is active:
$
ip route
... 192.0.2.0/24 via 198.51.100.1 dev example proto static metric 100
Additional resources
-
For further details about
nmcli
, see thenmcli(1)
man page.
19.3. Configuring a static route using control-center
You can use control-center
in GNOME to add a static route to the configuration of a network connection.
The procedure in this section describes how to add a route to the 192.0.2.0/24
network that uses the gateway running on 198.51.100.1
.
Prerequisites
- The network is configured.
- The gateway for the static route must be directly reachable on the interface.
-
The network configuration of the connection is opened in the
control-center
application. See Section 8.8, “Configuring an Ethernet connection using nm-connection-editor”.
Procedure
-
Open the
IPv4
tab. -
Optionally, disable automatic routes by clicking the
Routes
section of theIPv4
tab to use only static routes. If automatic routes are enabled, Red Hat Enterprise Linux uses static routes and routes received from a DHCP server. button in the Enter the address, netmask, gateway, and optionally a metric value:
- Click .
Back in the
Network
window, disable and re-enable the connection by switching the button for the connection to and back to for changes to take effect.WarningRestarting the connection briefly disrupts connectivity on that interface.
Optionally, verify that the route is active:
$
ip route
... 192.0.2.0/24 via 198.51.100.1 dev example proto static metric 100
19.4. Configuring a static route using nm-connection-editor
You can use the nm-connection-editor
application to add a static route to the configuration of a network connection.
The procedure in this section describes how to add a route to the 192.0.2.0/24
network that uses the gateway running on 198.51.100.1
, which is reachable trough the example
connection.
Prerequisites
- The network is configured.
- The gateway for the static route must be directly reachable on the interface.
Procedure
Open a terminal and enter
nm-connection-editor
:$
nm-connection-editor
-
Select the
example
connection and click the gear wheel icon to edit the existing connection. -
Open the
IPv4
tab. - Click the button.
Click the
button and enter the address, netmask, gateway, and optionally a metric value.- Click .
- Click .
Restart the network connection for changes to take effect. For example, to restart the
example
connection using the command line:$
sudo nmcli connection up example
Optionally, verify that the route is active:
$
ip route
... 192.0.2.0/24 via 198.51.100.1 dev example proto static metric 100
19.5. Configuring a static route using the nmcli interactive mode
You can use the interactive mode of the nmcli
utility to add a static route to the configuration of a network connection.
The procedure in this section describes how to add a route to the 192.0.2.0/24
network that uses the gateway running on 198.51.100.1
, which is reachable trough the example
connection.
Prerequisites
- The network is configured
- The gateway for the static route must be directly reachable on the interface.
-
If the user is logged in on a physical console, user permissions are sufficient. Otherwise, the command requires
root
permissions.
Procedure
Open the
nmcli
interactive mode for theexample
connection:$
sudo nmcli connection edit example
Add the static route:
nmcli>
set ipv4.routes 192.0.2.0/24 198.51.100.1
Optionally, verify that the routes were added correctly to the configuration:
nmcli>
print
... ipv4.routes: { ip = 192.0.2.1/24, nh = 198.51.100.1 } ...The
ip
attribute displays the network to route and thenh
attribute the gateway (next hop).Save the configuration:
nmcli>
save persistent
Restart the network connection:
nmcli>
activate example
WarningWhen you restart the connection, all connections currently using this connection will be temporarily interrupted.
Leave the
nmcli
interactive mode:nmcli>
quit
Optionally, verify that the route is active:
$
ip route
... 192.0.2.0/24 via 198.51.100.1 dev example proto static metric 100
Additional resources
-
For the list of commands available in the interactive mode, enter
help
in the interactive shell.
19.6. Configuring a static route using RHEL System Roles
You can use the networking
RHEL System Role to configure static routes.
When you run a play that uses the networking
RHEL System Role, the System Role overrides an existing connection profile with the same name if the settings do not match the ones specified in the play. Therefore, always specify the whole configuration of the network connection profile in the play, even if, for example, the IP configuration already exists. Otherwise, the role resets these values to their defaults.
Depending on whether it already exists, the procedure creates or updates the enp7s0
connection profile with the following settings:
-
A static IPv4 address -
198.51.100.20
with a/24
subnet mask -
A static IPv6 address -
2001:db8:1::1
with a/64
subnet mask -
An IPv4 default gateway -
198.51.100.254
-
An IPv6 default gateway -
2001:db8:1::fffe
-
An IPv4 DNS server -
198.51.100.200
-
An IPv6 DNS server -
2001:db8:1::ffbb
-
A DNS search domain -
example.com
Static routes:
-
192.0.2.0/24
with gateway198.51.100.1
-
203.0.113.0/24
with gateway198.51.100.2
-
Prerequisites
-
The
ansible
andrhel-system-roles
packages are installed on the control node. -
If you use a different remote user than
root
when you run the playbook, this user has appropriatesudo
permissions on the managed node.
Procedure
If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the
/etc/ansible/hosts
Ansible inventory file:node.example.com
Create the
~/add-static-routes.yml
playbook with the following content:--- - name: Configure an Ethernet connection with static IP and additional routes hosts: node.example.com become: true tasks: - include_role: name: linux-system-roles.network vars: network_connections: - name: enp7s0 type: ethernet autoconnect: yes ip: address: - 198.51.100.20/24 - 2001:db8:1::1/64 gateway4: 198.51.100.254 gateway6: 2001:db8:1::fffe dns: - 198.51.100.200 - 2001:db8:1::ffbb dns_search: - example.com route: - network: 192.0.2.0 prefix: 24 gateway: 198.51.100.1 - network: 203.0.113.0 prefix: 24 gateway: 198.51.100.2 state: up
Run the playbook:
To connect as
root
user to the managed host, enter:#
ansible-playbook -u root ~/add-static-routes.yml
To connect as a user to the managed host, enter:
#
ansible-playbook -u user_name --ask-become-pass ~/add-static-routes.yml
The
--ask-become-pass
option makes sure that theansible-playbook
command prompts for thesudo
password of the user defined in the-u user_name
option.
If you do not specify the
-u user_name
option,ansible-playbook
connects to the managed host as the user that is currently logged in to the control node.
Verification steps
Display the routing table:
#
ip -4 route
default via 198.51.100.254 dev enp7s0 proto static metric 100 192.0.2.0/24 via 198.51.100.1 dev enp7s0 proto static metric 100 203.0.113.0/24 via 198.51.100.2 dev enp7s0 proto static metric 100 ...
Additional resources
-
For details about the parameters used in
network_connections
and for additional information about thenetwork
System Role, see the/usr/share/ansible/roles/rhel-system-roles.network/README.md
file. -
For details about the
ansible-playbook
command, see theansible-playbook(1)
man page.
19.7. Creating static routes configuration files in key-value-format when using the legacy network scripts
This procedure describes how to manually create a routing configuration file for an IPv4 route to the 192.0.2.0/24
network when you use the legacy network scripts instead of NetworkManager. In this example, the corresponding gateway with the IP address 198.51.100.1
is reachable via the enp1s0
interface.
The example in this procedure uses configuration entries in key-value-format.
The legacy network scripts support the key-value-format only for static IPv4 routes. For IPv6 routes, use the ip
-command-format. See Section 19.8, “Creating static routes configuration files in ip-command-format when using the legacy network scripts”.
Prerequisites
- The gateway for the static route must be directly reachable on the interface.
-
The
NetworkManager
package is not installed, or theNetworkManager
service is disabled. -
The
network-scripts
package is installed.
Procedure
Add the static IPv4 route to the
/etc/sysconfig/network-scripts/route-enp0s1
file:ADDRESS0=192.0.2.0 NETMASK0=255.255.255.0 GATEWAY0=198.51.100.1
-
The
ADDRESS0
variable defines the network of the first routing entry. -
The
NETMASK0
variable defines the netmask of the first routing entry. The
GATEWAY0
variable defines the IP address of the gateway to the remote network or host for the first routing entry.If you add multiple static routes, increase the number in the variable names. Note that the variables for each route must be numbered sequentially. For example,
ADDRESS0
,ADDRESS1
,ADDRESS3
, and so on.
-
The
Restart the network:
# systemctl restart network
Additional resources
-
For further details about configuring legacy network scripts, see the
/usr/share/doc/network-scripts/sysconfig.txt
file.
19.8. Creating static routes configuration files in ip-command-format when using the legacy network scripts
This procedure describes how to manually create a routing configuration file for the following static routes when you use legacy network scripts:
-
An IPv4 route to the
192.0.2.0/24
network. The corresponding gateway with the IP address198.51.100.1
is reachable via theenp1s0
interface. -
An IPv6 route to the
2001:db8:1::/64
network. The corresponding gateway with the IP address2001:db8:2::1
is reachable via theenp1s0
interface.
The example in this procedure uses configuration entries in ip
-command-format.
Prerequisites
- The gateway for the static route must be directly reachable on the interface.
-
The
NetworkManager
package is not installed, or theNetworkManager
service is disabled. -
The
network-scripts
package is installed.
Procedure
Add the static IPv4 route to the
/etc/sysconfig/network-scripts/route-enp0s1
file:192.0.2.0/24 via 198.51.100.1 dev enp0s1
Add the static IPv6 route to the
/etc/sysconfig/network-scripts/route6-enp0s1
file:2001:db8:1::/64 via 2001:db8:2::1 dev enp0s1
Restart the network:
# systemctl restart network
Additional Resources
-
For further details about configuring legacy network scripts, see the
/usr/share/doc/network-scripts/sysconfig.txt
file.
Chapter 20. Configuring policy-based routing to define alternative routes
By default, the kernel in RHEL decides where to forward network packets based on the destination address using a routing table. Policy-based routing enables you to configure complex routing scenarios. For example, you can route packets based on various criteria, such as the source address, packet metadata, or protocol.
This section describes of how to configure policy-based routing using NetworkManager.
On systems that use NetworkManager, only the nmcli
utility supports setting routing rules and assigning routes to specific tables.
20.1. Routing traffic from a specific subnet to a different default gateway using NetworkManager
This section describes how to configure RHEL as a router that, by default, routes all traffic to Internet provider A using the default route. Using policy-based routing, RHEL routes traffic received from the internal workstations subnet to provider B.
The procedure assumes the following network topology:
Prerequisites
-
The system uses
NetworkManager
to configure the network, which is the default on RHEL 8. The RHEL router you want to set up in the procedure has four network interfaces:
-
The
enp7s0
interface is connected to the network of provider A. The gateway IP in the provider’s network is198.51.100.2
, and the network uses a/30
network mask. -
The
enp1s0
interface is connected to the network of provider B. The gateway IP in the provider’s network is192.0.2.2
, and the network uses a/30
network mask. -
The
enp8s0
interface is connected to the10.0.0.0/24
subnet with internal workstations. -
The
enp9s0
interface is connected to the203.0.113.0/24
subnet with the company’s servers.
-
The
-
Hosts in the internal workstations subnet use
10.0.0.1
as the default gateway. In the procedure, you assign this IP address to theenp8s0
network interface of the router. -
Hosts in the server subnet use
203.0.113.1
as the default gateway. In the procedure, you assign this IP address to theenp9s0
network interface of the router. -
The
firewalld
service is enabled and active.
Procedure
Configure the network interface to provider A:
#
nmcli connection add type ethernet con-name Provider-A ifname enp7s0 ipv4.method manual ipv4.addresses 198.51.100.1/30 ipv4.gateway 198.51.100.2 ipv4.dns 198.51.100.200 connection.zone external
The
nmcli connection add
command creates a NetworkManager connection profile. The following list describes the options of the command:-
type
ethernet
: Defines that the connection type is Ethernet. -
con-name
connection_name
: Sets the name of the profile. Use a meaningful name to avoid confusion. -
ifname
network_device
: Sets the network interface. -
ipv4.method
manual
: Enables to configure a static IP address. -
ipv4.addresses
IP_address/subnet_mask
: Sets the IPv4 addresses and subnet mask. -
ipv4.gateway
IP_address
: Sets the default gateway address. -
ipv4.dns
IP_of_DNS_server
: Sets the IPv4 address of the DNS server. -
connection.zone
firewalld_zone
: Assigns the network interface to the definedfirewalld
zone. Note thatfirewalld
automatically enables masquerading for interfaces assigned to theexternal
zone.
-
Configure the network interface to provider B:
#
nmcli connection add type ethernet con-name Provider-B ifname enp1s0 ipv4.method manual ipv4.addresses 192.0.2.1/30 ipv4.routes "0.0.0.0/0 192.0.2.2 table=5000" connection.zone external
This command uses the
ipv4.routes
parameter instead ofipv4.gateway
to set the default gateway. This is required to assign the default gateway for this connection to a different routing table (5000
) than the default. NetworkManager automatically creates this new routing table when the connection is activated.Configure the network interface to the internal workstations subnet:
#
nmcli connection add type ethernet con-name Internal-Workstations ifname enp8s0 ipv4.method manual ipv4.addresses 10.0.0.1/24 ipv4.routes "10.0.0.0/24 src=192.0.2.1 table=5000" ipv4.routing-rules "priority 5 from 10.0.0.0/24 table 5000" connection.zone internal
This command uses the
ipv4.routes
parameter to add a static route to the routing table with ID5000
. This static route for the10.0.0.0/24
subnet uses the IP of the local network interface to provider B (192.0.2.1
) as next hop.Additionally, the command uses the
ipv4.routing-rules
parameter to add a routing rule with priority5
that routes traffic from the10.0.0.0/24
subnet to table5000
. Low values have a high priority.Note that the syntax in the
ipv4.routing-rules
parameter is the same as in anip route add
command, except thatipv4.routing-rules
always requires specifying a priority.Configure the network interface to the server subnet:
#
nmcli connection add type ethernet con-name Servers ifname enp9s0 ipv4.method manual ipv4.addresses 203.0.113.1/24 connection.zone internal
Verification steps
On a RHEL host in the internal workstation subnet:
Install the
traceroute
package:#
yum install traceroute
Use the
traceroute
utility to display the route to a host on the Internet:#
traceroute redhat.com
traceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets 1 10.0.0.1 (10.0.0.1) 0.337 ms 0.260 ms 0.223 ms 2 192.0.2.1 (192.0.2.1) 0.884 ms 1.066 ms 1.248 ms ...The output of the command displays that the router sends packets over
192.0.2.1
, which is the network of provider B.
On a RHEL host in the server subnet:
Install the
traceroute
package:#
yum install traceroute
Use the
traceroute
utility to display the route to a host on the Internet:#
traceroute redhat.com
traceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets 1 203.0.113.1 (203.0.113.1) 2.179 ms 2.073 ms 1.944 ms 2 198.51.100.2 (198.51.100.2) 1.868 ms 1.798 ms 1.549 ms ...The output of the command displays that the router sends packets over
198.51.100.2
, which is the network of provider A.
Troubleshooting steps
On the RHEL router:
Display the rule list:
#
ip rule list
0: from all lookup local 5: from 10.0.0.0/24 lookup 5000 32766: from all lookup main 32767: from all lookup defaultBy default, RHEL contains rules for the tables
local
,main
, anddefault
.Display the routes in table
5000
:#
ip route list table 5000
0.0.0.0/0 via 192.0.2.2 dev enp1s0 proto static metric 100 10.0.0.0/24 dev enp8s0 proto static scope link src 192.0.2.1 metric 102Display the interfaces and firewall zones:
#
firewall-cmd --get-active-zones
external interfaces: enp1s0 enp7s0 internal interfaces: enp8s0 enp9s0Verify that the
external
zone has masquerading enabled:#
firewall-cmd --info-zone=external
external (active) target: default icmp-block-inversion: no interfaces: enp1s0 enp7s0 sources: services: ssh ports: protocols: masquerade: yes ...
Additional resources
-
For further details about the
ipv4.*
parameters you can set in thenmcli connection add
command, see theIPv4 settings
section in thenm-settings(5)
man page. -
For further details about the
connection.*
parameters you can set in thenmcli connection add
command, see theConnection settings
section in thenm-settings(5)
man page. -
For further details about managing NetworkManager connections using
nmcli
, see theConnection management commands
section in thenmcli(1)
man page.
20.2. Overview of configuration files involved in policy-based routing when using the legacy network scripts
If you use the legacy network scripts instead of NetworkManager to configure your network, you can also configure policy-based routing.
Configuring the network using the legacy network scripts provided by the network-scripts
package is deprecated in RHEL 8. Red Hat recommends that you use NetworkManager to configure policy-based routing. For an example, see Section 20.1, “Routing traffic from a specific subnet to a different default gateway using NetworkManager”.
The following configuration files are involved in policy-based routing when you use the legacy network scripts:
/etc/sysconfig/network-scripts/route-interface
: This file defines the IPv4 routes. Use thetable
option to specify the routing table. For example:192.0.2.0/24 via 198.51.100.1 table 1 203.0.113.0/24 via 198.51.100.2 table 2
-
/etc/sysconfig/network-scripts/route6-interface
: This file defines the IPv6 routes. /etc/sysconfig/network-scripts/rule-interface
: This file defines the rules for IPv4 source networks for which the kernel routes traffic to specific routing tables. For example:from 192.0.2.0/24 lookup 1 from 203.0.113.0/24 lookup 2
-
/etc/sysconfig/network-scripts/rule6-interface
: This file defines the rules for IPv6 source networks for which the kernel routes traffic to specific routing tables. /etc/iproute2/rt_tables
: This file defines the mappings if you want to use names instead of numbers to refer to specific routing tables. For example:1 Provider_A 2 Provider_B
Additional resources
-
For further details about IP routing, see the
ip-route(8)
man page. -
For further details about routing rules, see the
ip-rule(8)
man page.
20.3. Routing traffic from a specific subnet to a different default gateway using the legacy network scripts
This section describes how to configure RHEL as a router that, by default, routes all traffic to internet provider A using the default route. Using policy-based routing, RHEL routes traffic received from the internal workstations subnet to provider B.
Configuring the network using the legacy network scripts provided by the network-scripts
package is deprecated in RHEL 8. Follow the procedure in this section only if you use the legacy network scripts instead of NetworkManager on your host. If you use NetworkManager to manage your network settings, see Section 20.1, “Routing traffic from a specific subnet to a different default gateway using NetworkManager”.
The procedure assumes the following network topology:
The legacy network scripts process configuration files in alphabetical order. Therefore, you must name the configuration files in a way that ensures that an interface, that is used in rules and routes of other interfaces, are up when a depending interface requires it. To accomplish the correct order, this procedure uses numbers in the ifcfg-*
, route-*
, and rules-*
files.
Prerequisites
-
The
NetworkManager
package is not installed, or theNetworkManager
service is disabled. -
The
network-scripts
package is installed. The RHEL router you want to set up in the procedure has four network interfaces:
-
The
enp7s0
interface is connected to the network of provider A. The gateway IP in the provider’s network is198.51.100.2
, and the network uses a/30
network mask. -
The
enp1s0
interface is connected to the network of provider B. The gateway IP in the provider’s network is192.0.2.2
, and the network uses a/30
network mask. -
The
enp8s0
interface is connected to the10.0.0.0/24
subnet with internal workstations. -
The
enp9s0
interface is connected to the203.0.113.0/24
subnet with the company’s servers.
-
The
-
Hosts in the internal workstations subnet use
10.0.0.1
as the default gateway. In the procedure, you assign this IP address to theenp8s0
network interface of the router. -
Hosts in the server subnet use
203.0.113.1
as the default gateway. In the procedure, you assign this IP address to theenp9s0
network interface of the router. -
The
firewalld
service is enabled and active.
Procedure
Add the configuration for the network interface to provider A by creating the
/etc/sysconfig/network-scripts/ifcfg-1_Provider-A
file with the following content:TYPE=Ethernet IPADDR=198.51.100.1 PREFIX=30 GATEWAY=198.51.100.2 DNS1=198.51.100.200 DEFROUTE=yes NAME=1_Provider-A DEVICE=enp7s0 ONBOOT=yes ZONE=external
The following list describes the parameters used in the configuration file:
-
TYPE
=Ethernet
: Defines that the connection type is Ethernet. -
IPADDR
=IP_address
: Sets the IPv4 address. -
PREFIX
=subnet_mask
: Sets the subnet mask. -
GATEWAY
=IP_address
: Sets the default gateway address. -
DNS1
=IP_of_DNS_server
: Sets the IPv4 address of the DNS server. -
DEFROUTE
=yes|no
: Defines whether the connection is a default route or not. -
NAME
=connection_name
: Sets the name of the connection profile. Use a meaningful name to avoid confusion. -
DEVICE
=network_device
: Sets the network interface. -
ONBOOT
=yes
: Defines that RHEL starts this connection when the system boots. -
ZONE
=firewalld_zone
: Assigns the network interface to the definedfirewalld
zone. Note thatfirewalld
automatically enables masquerading for interfaces assigned to theexternal
zone.
-
Add the configuration for the network interface to provider B:
Create the
/etc/sysconfig/network-scripts/ifcfg-2_Provider-B
file with the following content:TYPE=Ethernet IPADDR=192.0.2.1 PREFIX=30 DEFROUTE=no NAME=2_Provider-B DEVICE=enp1s0 ONBOOT=yes ZONE=external
Note that the configuration file for this interface does not contain a default gateway setting.
Assign the gateway for the
2_Provider-B
connection to a separate routing table. Therefore, create the/etc/sysconfig/network-scripts/route-2_Provider-B
file with the following content:0.0.0.0/0 via 192.0.2.2 table 5000
This entry assigns the gateway and traffic from all subnets routed through this gateway to table
5000.
Create the configuration for the network interface to the internal workstations subnet:
Create the
/etc/sysconfig/network-scripts/ifcfg-3_Internal-Workstations
file with the following content:TYPE=Ethernet IPADDR=10.0.0.1 PREFIX=24 DEFROUTE=no NAME=3_Internal-Workstations DEVICE=enp8s0 ONBOOT=yes ZONE=internal
Add the routing rule configuration for the internal workstation subnet. Therefore, create the
/etc/sysconfig/network-scripts/rule-3_Internal-Workstations
file with the following content:pri 5 from 10.0.0.0/24 table 5000
This configuration defines a routing rule with priority
5
that routes all traffic from the10.0.0.0/24
subnet to table5000
. Low values have a high priority.Create the
/etc/sysconfig/network-scripts/route-3_Internal-Workstations
file with the following content to add a static route to the routing table with ID5000
:10.0.0.0/24 via 192.0.2.1 table 5000
This static route defines that RHEL sends traffic from the
10.0.0.0/24
subnet to the IP of the local network interface to provider B (192.0.2.1
). This interface is to routing table5000
and used as the next hop.
Add the configuration for the network interface to the server subnet by creating the
/etc/sysconfig/network-scripts/ifcfg-4_Servers
file with the following content:TYPE=Ethernet IPADDR=203.0.113.1 PREFIX=24 DEFROUTE=no NAME=4_Servers DEVICE=enp9s0 ONBOOT=yes ZONE=internal
Restart the network:
# systemctl restart network
Verification steps
On a RHEL host in the internal workstation subnet:
Install the
traceroute
package:#
yum install traceroute
Use the
traceroute
utility to display the route to a host on the internet:#
traceroute redhat.com
traceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets 1 10.0.0.1 (10.0.0.1) 0.337 ms 0.260 ms 0.223 ms 2 192.0.2.1 (192.0.2.1) 0.884 ms 1.066 ms 1.248 ms ...The output of the command displays that the router sends packets over
192.0.2.1
, which is the network of provider B.
On a RHEL host in the server subnet:
Install the
traceroute
package:#
yum install traceroute
Use the
traceroute
utility to display the route to a host on the internet:#
traceroute redhat.com
traceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets 1 203.0.113.1 (203.0.113.1) 2.179 ms 2.073 ms 1.944 ms 2 198.51.100.2 (198.51.100.2) 1.868 ms 1.798 ms 1.549 ms ...The output of the command displays that the router sends packets over
198.51.100.2
, which is the network of provider A.
Troubleshooting steps
On the RHEL router:
Display the rule list:
#
ip rule list
0: from all lookup local 5: from 10.0.0.0/24 lookup 5000 32766: from all lookup main 32767: from all lookup defaultBy default, RHEL contains rules for the tables
local
,main
, anddefault
.Display the routes in table
5000
:#
ip route list table 5000
default via 192.0.2.2 dev enp1s0 10.0.0.0/24 via 192.0.2.1 dev enp1s0Display the interfaces and firewall zones:
#
firewall-cmd --get-active-zones
external interfaces: enp1s0 enp7s0 internal interfaces: enp8s0 enp9s0Verify that the
external
zone has masquerading enabled:#
firewall-cmd --info-zone=external
external (active) target: default icmp-block-inversion: no interfaces: enp1s0 enp7s0 sources: services: ssh ports: protocols: masquerade: yes ...
Additional resources
- Section 20.2, “Overview of configuration files involved in policy-based routing when using the legacy network scripts”
-
The
ip-route(8)
man page -
The
ip-rule(8)
man page -
For further details about the legacy networking scripts, see the
/usr/share/doc/network-scripts/sysconfig.txt
file
Chapter 21. Creating a dummy interface
As a Red Hat Enterprise Linux user, you can create and use dummy network interfaces for debugging and testing purposes. A dummy interface provides a device to route packets without actually transmitting them. It enables you to create additional loopback-like devices managed by NetworkManager and makes an inactive SLIP (Serial Line Internet Protocol) address look like a real address for local programs.
21.1. Creating a dummy interface with both an IPv4 and IPv6 address using nmcli
You can create a dummy interface with various settings. This procedure describes how to create a dummy interface with both an IPv4 and IPv6 address. After creating the dummy interface, NetworkManager automatically assigns it to the default public
firewall zone.
To configure a dummy interface without IPv4 or IPv6 address, set the ipv4.method
and ipv6.method
parameters to disabled
. Otherwise, IP auto-configuration fails, and NetworkManager deactivates the connection and removes the dummy device.
Procedure
To create a dummy interface named dummy0 with static IPv4 and IPv6 addresses, enter:
#
nmcli connection add type dummy ifname dummy0 ipv4.method manual ipv4.addresses 192.0.2.1/24 ipv6.method manual ipv6.addresses 2001:db8:2::1/64
Optional:To view the dummy interface, enter:
#
nmcli connection show
NAME UUID TYPE DEVICE enp1s0 db1060e9-c164-476f-b2b5-caec62dc1b05 ethernet ens3 dummy-dummy0 aaf6eb56-73e5-4746-9037-eed42caa8a65 dummy dummy0
Additional resources
- The nm-settings(5) man page
Chapter 22. Using netconsole to log kernel messages over a network
Using the netconsole
kernel module and the same-named service, you can log kernel messages over a network to debug the kernel when logging to disk fails or when using a serial console is not possible.
22.1. Configuring the netconsole service to log kernel messages to a remote host
Using the netconsole
kernel module, you can log kernel messages to a remote system log service.
Prerequisites
-
A system log service, such as
rsyslog
is installed on the remote host. - The remote system log service is configured to receive incoming log entries from this host.
Procedure
Install the
netconsole-service
package:#
yum install netconsole-service
Edit the
/etc/sysconfig/netconsole
file and set theSYSLOGADDR
parameter to the IP address of the remote host:#
SYSLOGADDR=192.0.2.1
Enable and start the
netconsole
service:#
systemctl enable --now netconsole
Verification steps
-
Display the
/var/log/messages
file on the remote system log server.
Additional resources
-
For details about enabling the remote host to receive the log messages, see the Configuring a remote logging solution section in the
Configuring basic system settings
documentation.
Chapter 23. Systemd network targets and services
NetworkManager configures the network during the system boot process. However, when booting with a remote root (/), such as if the root directory is stored on an iSCSI device, the network settings are applied in the initial RAM disk (initrd
) before RHEL is started. For example, if the network configuration is specified on the kernel command line using rd.neednet=1
or a configuration is specified to mount remote file systems, then the network settings are applied on initrd
.
This section describes different targets such as network
, network-online
, and NetworkManager-wait-online
service that are used while applying network settings, and how to configure the systemd
service to start after the network-online
service is started.
23.1. Differences between the network and network-online systemd target
Systemd maintains the network
and network-online
target units. The special units such as NetworkManager-wait-online.service
, have WantedBy=network-online.target
and Before=network-online.target
parameters. If enabled, these units get started with network-online.target
and delay the target to be reached until some form of network connectivity is established. They delay the network-online
target until the network is connected.
The network-online
target starts a service, which adds substantial delays to further execution. Systemd automatically adds dependencies with Wants
and After
parameters for this target unit to all the System V (SysV) init
script service units with a Linux Standard Base (LSB) header referring to the $network
facility. The LSB header is metadata for init
scripts. You can use it to specify dependencies. This is similar to the systemd
target.
The network
target does not significantly delay the execution of the boot process. Reaching the network
target means that the service that is responsible for setting up the network has started. However, it does not mean that a network device was configured. This target is important during the shutdown of the system. For example, if you have a service that was ordered after the network
target during bootup, then this dependency is reversed during the shutdown. The network does not get disconnected until your service has been stopped. All mount units for remote network file systems automatically start the network-online
target unit and order themselves after it.
The network-online
target unit is only useful during the system starts. After the system has completed booting up, this target does not track the online state of the network. Therefore, you cannot use network-online
to monitor the network connection. This target provides a one-time system startup concept.
23.2. Overview of NetworkManager-wait-online
The synchronous legacy network scripts iterate through all configuration files to set up devices. They apply all network-related configurations and ensure that the network is online.
The NetworkManager-wait-online
service waits with a timeout for the network to be configured. This network configuration involves plugging-in an Ethernet device, scanning for a Wi-Fi device, and so forth. NetworkManager automatically activates suitable profiles that are configured to start automatically. The failure of the automatic activation process due to a DHCP timeout or similar event might keep NetworkManager busy for an extended period of time. Depending on the configuration, NetworkManager retries activating the same profile or a different profile.
When the startup completes, either all profiles are in a disconnected state or are successfully activated. You can configure profiles to auto-connect. The following are a few examples of parameters that set timeouts or define when the connection is considered active:
-
connection.wait-device-timeout
- sets the timeout for the driver to detect the device -
ipv4.may-fail
andipv6.may-fail
- sets activation with one IP address family ready, or whether a particular address family must have completed configuration. -
ipv4.gateway-ping-timeout
- delays activation.
Additional resources
-
The
nm-settings(5)
man page
23.3. Configuring a systemd service to start after the network has been started
Red Hat Enterprise Linux installs systemd
service files in the /usr/lib/systemd/system/
directory. This procedure creates a drop-in snippet for a service file in /etc/systemd/system/service_name.service.d/
that is used together with the service file in /usr/lib/systemd/system/
to start a particular service after the network is online. It has a higher priority if settings in the drop-in snippet overlap with the ones in the service file in /usr/lib/systemd/system/
.
Procedure
To open the service file in the editor, enter:
#
systemctl edit service_name
Enter the following, and save the changes:
[Unit] After=network-online.target
Reload the
systemd
service.#
systemctl daemon-reload
Chapter 24. Linux traffic control
Linux offers tools for managing and manipulating the transmission of packets. The Linux Traffic Control (TC) subsystem helps in policing, classifying, shaping, and scheduling network traffic. TC also mangles the packet content during classification by using filters and actions. The TC subsystem achieves this by using queuing disciplines (qdisc
), a fundamental element of the TC architecture.
The scheduling mechanism arranges or rearranges the packets before they enter or exit different queues. The most common scheduler is the First-In-First-Out (FIFO) scheduler. You can do the qdiscs
operations temporarily using the tc
utility or permanently using NetworkManager.
This section explains queuing disciplines and describes how to update the default qdiscs
in RHEL.
24.1. Overview of queuing disciplines
Queuing disciplines (qdiscs
) help with queuing up and, later, scheduling of traffic transmission by a network interface. A qdisc
has two operations;
- enqueue requests so that a packet can be queued up for later transmission and
- dequeue requests so that one of the queued-up packets can be chosen for immediate transmission.
Every qdisc
has a 16-bit hexadecimal identification number called a handle
, with an attached colon, such as 1:
or abcd:
. This number is called the qdisc
major number. If a qdisc
has classes, then the identifiers are formed as a pair of two numbers with the major number before the minor, <major>:<minor>
, for example abcd:1
. The numbering scheme for the minor numbers depends on the qdisc
type. Sometimes the numbering is systematic, where the first-class has the ID <major>:1
, the second one <major>:2
, and so on. Some qdiscs
allow the user to set class minor numbers arbitrarily when creating the class.
Classful qdiscs
Different types of qdiscs
exist and help in the transfer of packets to and from a networking interface. You can configure qdiscs
with root, parent, or child classes. The point where children can be attached are called classes. Classes in qdisc
are flexible and can always contain either multiple children classes or a single child, qdisc
. There is no prohibition against a class containing a classful qdisc
itself, this facilitates complex traffic control scenarios. Classful qdiscs
do not store any packets themselves. Instead, they enqueue and dequeue requests down to one of their children according to criteria specific to the qdisc
. Eventually, this recursive packet passing ends up where the packets are stored (or picked up from in the case of dequeuing).
Classless qdiscs
Some qdiscs
contain no child classes and they are called classless qdiscs
. Classless qdiscs
require less customization compared to classful qdiscs
. It is usually enough to attach them to an interface.
Additional resources
-
For detailed information about classless and classful
qdiscs
, refer to thetc(8)
man page. -
For detailed information about actions, refer to the
actions
andtc-actions.8
man pages.
24.2. Available qdiscs in RHEL
Each qdisc
addresses unique networking-related issues. The following is the list of qdiscs
available in RHEL. You can use any of the following qdisc
to shape network traffic based on your networking requirements.
Table 24.1. Available schedulers in RHEL
qdisc name | Included in | Offload support |
---|---|---|
Asynchronous Transfer Mode (ATM) |
| |
Class-Based Queueing |
| |
Credit-Based Shaper |
| Yes |
CHOose and Keep for responsive flows, CHOose and Kill for unresponsive flows (CHOKE) |
| |
Controlled Delay (CoDel) |
| |
Deficit Round Robin (DRR) |
| |
Differentiated Services marker (DSMARK) |
| |
Enhanced Transmission Selection (ETS) |
| Yes |
Fair Queue (FQ) |
| |
Fair Queuing Controlled Delay (FQ_CODel) |
| |
Generalized Random Early Detection (GRED) |
| |
Hierarchical Fair Service Curve (HSFC) |
| |
Heavy-Hitter Filter (HHF) |
| |
Hierarchy Token Bucket (HTB) |
| |
INGRESS |
| Yes |
Multi Queue Priority (MQPRIO) |
| Yes |
Multiqueue (MULTIQ) |
| Yes |
Network Emulator (NETEM) |
| |
Proportional Integral-controller Enhanced (PIE) |
| |
PLUG |
| |
Quick Fair Queueing (QFQ) |
| |
Random Early Detection (RED) |
| Yes |
Stochastic Fair Blue (SFB) |
| |
Stochastic Fairness Queueing (SFQ) |
| |
Token Bucket Filter (TBF) |
| Yes |
Trivial Link Equalizer (TEQL) |
|
The qdisc
offload requires hardware and driver support on NIC.
Additional resources
-
For complete information of parameters and filters used to configure the
qdiscs
, refer to thetc(8)
,cbq
,cbs
,choke
,CoDel
,drr
,fq
,htb
,mqprio
,netem
,pie
,sfb
,pfifo
,tc-red
,sfq
,tbf
, andprio
man pages.
24.3. Inspecting qdiscs of a network interface using the tc utility
By default, Red Hat Enterprise Linux systems use fq_codel
qdisc
. This procedure describes how to inspect qdisc
counters.
Procedure
Optional: View your current
qdisc
:#
tc qdisc show dev enp0s1
Inspect the current
qdisc
counters:#
tc -s qdisc show dev enp0s1
qdisc fq_codel 0: root refcnt 2 limit 10240p flows 1024 quantum 1514 target 5.0ms interval 100.0ms memory_limit 32Mb ecn Sent 1008193 bytes 5559 pkt (dropped 233, overlimits 55 requeues 77) backlog 0b 0p requeues 0 ....
-
dropped
- the number of times a packet is dropped because all queues are full -
overlimits
- the number of times the configured link capacity is filled -
sent
- the number of dequeues
24.4. Updating the default qdisc
If you observe networking packet losses with the current qdisc
, you can change the qdisc
based on your network-requirements. You can select the qdisc
, which meets your network requirements. This procedure describes how to change the default qdisc
in Red Hat Enterprise Linux.
Procedure
View the current default
qdisc
:#
sysctl -a | grep qdisc
net.core.default_qdisc = fq_codelView the
qdisc
of current Ethernet connection:#
tc -s qdisc show dev enp0s1
qdisc fq_codel 0: root refcnt 2 limit 10240p flows 1024 quantum 1514 target 5.0ms interval 100.0ms memory_limit 32Mb ecn Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0 maxpacket 0 drop_overlimit 0 new_flow_count 0 ecn_mark 0 new_flows_len 0 old_flows_len 0Update the existing
qdisc
:#
sysctl -w net.core.default_qdisc=pfifo_fast
To apply the changes, reload the network driver:
#
rmmod NETWORKDRIVERNAME
#
modprobe NETWORKDRIVERNAME
Start the network interface:
#
ip link set enp0s1 up
Verification steps
View the
qdisc
of the Ethernet connection:#
tc -s qdisc show dev enp0s1
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1 Sent 373186 bytes 5333 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0 ....
Additional resources
-
For further information about making these changes persistent, see How to set
sysctl
variables on Red Hat Enterprise Linux article.
24.5. Temporarily setting the current qdisk of a network interface using the tc utility
You can update the current qdisc
without changing the default one. This procedure describes how to change the current qdisc
in Red Hat Enterprise Linux.
Procedure
Optional: View the current
qdisc
:#
tc -s qdisc show dev enp0s1
Update the current
qdisc
:#
tc qdisc replace dev enp0s1 root htb
Verification step
View the updated current
qdisc
:#
tc -s qdisc show dev enp0s1
qdisc htb 8001: root refcnt 2 r2q 10 default 0 direct_packets_stat 0 direct_qlen 1000 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0
24.6. Permanently setting the current qdisk of a network interface using NetworkManager
You can update the current qdisc
value of a NetworkManager connection.
Procedure
Optional: View the current
qdisc
:# tc qdisc show dev enp0s1 qdisc fq_codel 0: root refcnt 2
Update the current
qdisc
:# nmcli connection modify enp0s1 tc.qdiscs ‘root pfifo_fast’
Optional: To add another
qdisc
over the existingqdisc
, use the+tc.qdisc
option:# nmcli connection modify enp0s1 +tc.qdisc ‘ingress handle ffff:’
Activate the changes:
# nmcli connection up enp0s1
Verification steps
View current
qdisc
the network interface:# tc qdisc show dev _enp0s1_ qdisc _pfifo_fast_ 8001: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1 qdisc ingress ffff: parent ffff:fff1 ----------------
Additional resources
-
For more information, see the
nm-settings(5)
man page.
Chapter 25. Getting started with Multipath TCP
The Multipath TCP is provided as a Technology Preview only. Technology Preview features are not supported with Red Hat production Service Level Agreements (SLAs), might not be functionally complete, and Red Hat does not recommend using them for production. These previews provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.
See Technology Preview Features Support Scope on the Red Hat Customer Portal for information about the support scope for Technology Preview features.
Multipath TCP (MPTCP) is an extension to the Transmission Control Protocol (TCP). Using Internet Protocol (IP), a host can send packets to a destination. TCP ensures reliable delivery of the data through the Internet and automatically adjusts its bandwidth in response to network load.
The following are the advantages of MPTCP:
- It enables TCP for use on devices equipped with two or more network interfaces.
- It allows users to simultaneously use different network interfaces or switch seamlessly from one connection to another.
- It improves resource usage within the network and resilience to network failure.
This section describes how to:
- create a new MPTCP connection,
-
use
iproute2
to add new subflows and IP addresses to the MPTCP connections, and - disable MPTCP in the kernel to avoid applications using MPTCP connections.
25.1. Preparing RHEL to enable MPTCP support
Few applications natively support MPTCP. Mostly, the connection and stream-oriented sockets request TCP protocol in the socket() call to the operating system. You can enable MPTCP support in RHEL using the sysctl
tool for natively MPTCP-supported programs. The MPTCP implementation is also designed to allow usage of MPTCP protocol for applications requesting IPPROTO_TCP
call to the kernel.
This procedure describes how to enable MPTCP support and prepare RHEL for enabling MPTCP system-wide using a SystemTap script.
Prerequisites
The following packages are installed:
-
kernel-debuginfo
-
kernel-debuginfo-common
-
systemtap
-
systemtap-devel
-
kernel-devel
-
nmap-ncat
Procedure
Enable MPTCP sockets in the kernel:
#
echo "net.mptcp.enabled=1" > /etc/sysctl.d/90-enable-MPTCP.conf
#sysctl -p /etc/sysctl.d/90-enable-MPTCP.conf
Create a
mptcp.stap
file with the following content:#! /usr/bin/env stap %{ #include <linux/in.h> #include <linux/ip.h> %} /* according to [1], RSI contains 'type' and RDX * contains 'protocol'. * [1] https://github.com/torvalds/linux/blob/master/arch/x86/entry/entry_64.S#L79 */ function mptcpify () %{ if (CONTEXT->kregs->si == SOCK_STREAM && (CONTEXT->kregs->dx == IPPROTO_TCP || CONTEXT->kregs->dx == 0)) { CONTEXT->kregs->dx = IPPROTO_MPTCP; STAP_RETVALUE = 1; } else { STAP_RETVALUE = 0; } %} probe kernel.function("__sys_socket") { if (mptcpify() == 1) { printf("command %16s mptcpified\n", execname()); } }
Replace the TCP socket with MPTCP:
#
stap -vg mptcp.stap
Note: Use Ctrl+C to convert the connection back to TCP from MPTCP.
Start a server that listens to TCP port 4321:
#
ncat -4 -l 4321
Connect to the server and exchange traffic. For example, the client here writes “Hello world” to the server 5 times, then it terminates the connection.
#
ncat -4 192.0.2.1 4321
Hello world 1
Hello world 2
Hello world 3
Hello world 4
Hello world 5
Press Ctrl+D to quit.
Verification steps
Verify that MPTCP is enabled in the kernel:
#
sysctl -a | grep mptcp.enabled
net.mptcp.enabled = 1After the
mptcp.stap
script installs the kernel probe, the following warnings appear in the kerneldmesg
output#
dmesg
... [ 1752.694072] Kprobes globally unoptimized [ 1752.730147] stap_1ade3b3356f3e68765322e26dec00c3d_1476: module_layout: kernel tainted. [ 1752.732162] Disabling lock debugging due to kernel taint [ 1752.733468] stap_1ade3b3356f3e68765322e26dec00c3d_1476: loading out-of-tree module taints kernel. [ 1752.737219] stap_1ade3b3356f3e68765322e26dec00c3d_1476: module verification failed: signature and/or required key missing - tainting kernelAfter the connection is established, verify the
ss
output to see the subflow-specific status:#
ss -nti '( dport :4321 )' dst 192.0.2.1
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process ESTAB 0 0 192.0.2.2:60874 192.0.2.1:4321 cubic wscale:7,7 rto:201 rtt:0.042/0.017 mss:1448 pmtu:1500 rcvmss:536 advmss:1448 cwnd:10 bytes_sent:64 bytes_$cked:65 segs_out:6 segs_in:5 data_segs_out:4 send 2758095238bps lastsnd:57 lastrcv:3054 lastack:57 pacing_rate 540361516$bps delivery_rate 413714280bps delivered:5 rcv_space:29200 rcv_ssthresh:29200 minrtt:0.009 tcp-ulp-mptcp flags:Mmec token:0000(id:0)/4bffe73d(id:0) seq:c11f40d6c5337463 sfseq:1 ssnoff:f7455705 maplen:0Capture traffic using
tcpdump
and check for MPTCP sub-option usage:#
tcpdump -tnni interface tcp port 4321
client Out IP 192.0.2.2.60802 > 192.0.2.1.4321: Flags [S], seq 3420255622, win 29200, options [mss 1460,sackOK,TS val 411 4539945 ecr 0,nop,wscale 7,mptcp capable v1], length 0 client In IP 192.0.2.1.4321 > 192.0.2.2.60802: Flags [S.], seq 2619315374, ack 3420255623, win 28960, options [mss 1460 sackOK,TS val 3241564233 ecr 4114539945,nop,wscale 7,mptcp capable v1 {0xb6f8dc721aee7f64}], length 0 client Out IP 192.0.2.2.60802 > 192.0.2.1.4321: Flags [.], ack 1, win 229, options [nop,nop,TS val 4114539945 ecr 3241564 233,mptcp capable v1 {0xcc58d5d632a32d13,0xb6f8dc721aee7f64}], length 0 client Out IP 192.0.2.2.60802 > 192.0.2.1.4321: Flags [P.], seq 1:17, ack 1, win 229, options [nop,nop,TS val 4114539945 ecr 3241564233,mptcp capable v1 {0xcc58d5d632a32d13,0xb6f8dc721aee7f64},nop,nop], length 16 client In IP 192.0.2.1.4321 > 192.0.2.2.60802: Flags [.], ack 17, win 227, options [nop,nop,TS val 3241564233 ecr 411459945,mptcp dss ack 1105509586894558345], length 0 client Out IP 192.0.2.2.60802 > 192.0.2.1.4321: Flags [P.], seq 17:33, ack 1, win 229, options [nop,nop,TS val 4114540939 ecr 3241564233,mptcp dss ack 13265586846326199424 seq 105509586894558345 subseq 17 len 16,nop,nop], length 16The
tcpdump
package is required to run this command.
Additional resources
- For more information see, How can I download or install debuginfo packages for RHEL systems? article.
-
For more information on
IPPROTO_TCP
, refer to thetcp(7)
man pages.
25.2. Using iproute2 to notify applications about multiple available paths
By default, the MPTCP socket starts with a single subflow but you can add new subflows and IP addresses to the connection once you create it for the first time. This procedure describes how to update per connection limits for subflows and IP addresses, and add new IP addresses (endpoints) to the MPTCP connection.
Note that MPTCP does not yet support mixed IPv6 and IPv4 endpoints for the same socket. Use endpoints belonging to the same address family.
Procedure
Set the per connection and IP address limits to 1 on the server:
#
ip mptcp limits set subflow 1
Set the per connection and IP address limits to 1 on the client:
#
ip mptcp limits set subflow 1 add_addr_accepted 1
Add IP address 198.51.100.1 as a new MPTCP endpoint on the server:
#
ip mptcp endpoint add 198.51.100.1 dev enp1s0 signal
ImportantYou can set the following values for flags to
subflow
,backup
,signal
. Setting the flag to;-
signal
, sends anADD_ADDR
packet after the three-way-handshake is completed -
subflow
, sends anMP_JOIN SYN
by the client -
backup
, sets the endpoint as a backup address
-
Start the server binding to 0.0.0.0 with the
-k
argument to prevent [systemitem]‘ncat’ from closing the listening socket after accepting the first connection and making the server rejectMP_JOIN SYN
done by the client.#
ncat -4 0.0.0.0 -k -l 4321
Start the client and connect to the server to exchange traffic. For example, the client here writes “Hello world” to the server 5 times, then it terminates the connection.
#
ncat -4 192.0.2.1 4321
Hello world 1
Hello world 2
Hello world 3
Hello world 4
Hello world 5
Press Ctrl+D to quit.
Verification steps
Verify the connection and IP address limit:
#
ip mptcp limit show
Verify the newly added endpoint:
#
ip mptcp endpoint show
Capture traffic using
tcpdump
and check for MPTCP sub-option usage:#
tcpdump -tnni interface tcp port 4321
client Out IP 192.0.2.2.56868 > 192.0.2.1.4321: Flags [S], seq 3107783947, win 29200, options [mss 1460,sackOK,TS val 2568752336 ecr 0,nop,wscale 7,mptcp capable v1], length 0 client In IP 192.0.2.1.4321 > 192.0.2.2.56868: Flags [S.], seq 4222339923, ack 3107783948, win 28960, options [mss 1460,sackOK,TS val 1713130246 ecr 2568752336,nop,wscale 7,mptcp capable v1 {0xf51c07a47cc2ba75}], length 0 client Out IP 192.0.2.2.56868 > 192.0.2.1.4321: Flags [.], ack 1, win 229, options [nop,nop,TS val 2568752336 ecr 1713130246,mptcp capable v1 {0xb243376cc5af60bd,0xf51c07a47cc2ba75}], length 0 client Out IP 192.0.2.2.56868 > 192.0.2.1.4321: Flags [P.], seq 1:17, ack 1, win 229, options [nop,nop,TS val 2568752336 ecr 1713130246,mptcp capable v1 {0xb243376cc5af60bd,0xf51c07a47cc2ba75},nop,nop], length 16 client In IP 192.0.2.1.4321 > 192.0.2.2.56868: Flags [.], ack 17, win 227, options [nop,nop,TS val 1713130246 ecr 2568752336,mptcp add-addr id 1 198.51.100.1 hmac 0xe445335073818837,mptcp dss ack 5562689076006296132], length 0 client Out IP 198.51.100.2.42403 > 198.51.100.1.4321: Flags [S], seq 3356992178, win 29200, options [mss 1460,sackOK,TS val 4038525523 ecr 0,nop,wscale 7,mptcp join backup id 0 token 0xad58df1 nonce 0x74a8137f], length 0 client In IP 198.51.100.1.4321 > 198.51.100.2.42403: Flags [S.], seq 1680863152, ack 3356992179, win 28960, options [mss 1460,sackOK,TS val 4213669942 ecr 4038525523,nop,wscale 7,mptcp join backup id 0 hmac 0x9eff7a1bf4e65937 nonce 0x77303fd8], length 0 client Out IP 198.51.100.2.42403 > 198.51.100.1.4321: Flags [.], ack 1, win 229, options [nop,nop,TS val 4038525523 ecr 4213669942,mptcp join hmac 0xdfdc0129424f627ea774c094461328ce49d195bc], length 0 client In IP 198.51.100.1.4321 > 198.51.100.2.42403: Flags [.], ack 1, win 227, options [nop,nop,TS val 4213669942 ecr 4038525523,mptcp dss ack 5562689076006296132], length 0The
tcpdump
package is required to run this command.
Additional resources
-
For more information on available endpoint flags, refer to the
ip-mptcp(8)
man page.
25.3. Disabling Multipath TCP in the kernel
This procedure describes how to disable the MPTCP option in the kernel.
Procedure
Disable the
mptcp.enabled
option.#
echo "net.mptcp.enabled=0" > /etc/sysctl.d/90-enable-MPTCP.conf
#sysctl -p /etc/sysctl.d/90-enable-MPTCP.conf
Verification steps
Verify whether the
mptcp.enabled
is disabled in the kernel.#
sysctl -a | grep mptcp.enabled
net.mptcp.enabled = 0
Chapter 26. Configuring the order of DNS servers
Most applications use the getaddrinfo()
function of the glibc
library to resolve DNS requests. By default, glibc
sends all DNS requests to the first DNS server specified in the /etc/resolv.conf
file. If this server does not reply, Red Hat Enterprise Linux uses the next server in this file.
This section describes how to customize the order of DNS servers.
26.1. How NetworkManager orders DNS servers in /etc/resolv.conf
NetworkManager orders DNS servers in the /etc/resolv.conf
file based on the following rules:
- If only one connection profile exists, NetworkManager uses the order of IPv4 and IPv6 DNS server specified in that connection.
If multiple connection profiles are activated, NetworkManager orders DNS servers based on a DNS priority value. If you set DNS priorities, the behavior of NetworkManager depends on the value set in the
dns
parameter. You can set this parameter in the[main]
section in the/etc/NetworkManager/NetworkManager.conf
file:dns=default
or if thedns
parameter is not set:NetworkManager orders the DNS servers from different connections based on the
ipv4.dns-priority
andipv6.dns-priority
parameter in each connection.If you set no value or you set
ipv4.dns-priority
andipv6.dns-priority
to0
, NetworkManager uses the global default value. See the section called “Default values of DNS priority parameters”.dns=dnsmasq
ordns=systemd-resolved
:When you use one of these settings, NetworkManager sets either
127.0.0.1
fordnsmasq
or127.0.0.53
asnameserver
entry in the/etc/resolv.conf
file.Both the
dnsmasq
andsystemd-resolved
services forward queries for the search domain set in a NetworkManager connection to the DNS server specified in that connection, and forwardes queries to other domains to the connection with the default route. When multiple connections have the same search domain set,dnsmasq
andsystemd-resolved
forward queries for this domain to the DNS server set in the connection with the lowest priority value.
Default values of DNS priority parameters
NetworkManager uses the following default values for connections:
-
50
for VPN connections -
100
for other connections
Valid DNS priority values:
You can set both the global default and connection-specific ipv4.dns-priority
and ipv6.dns-priority
parameters to a value between -2147483647
and 2147483647
.
- A lower value has a higher priority.
- Negative values have the special effect of excluding other configurations with a greater value. For example, if at least one connection with a negative priority value exists, NetworkManager uses only the DNS servers specified in the connection profile with the lowest priority.
If multiple connections have the same DNS priority, NetworkManager prioritizes the DNS in the following order:
- VPN connections
- Connection with an active default route. The active default route is the default route the lowest metric.
Additional resources
-
For further details about how NetworkManager orders DNS server entries in the
/etc/resolv.conf
file, see thedns-priority
parameter description in theipv4
andipv6
sections in thenm-settings(5)
man page. -
For details about using
systemd-resolved
to use different DNS servers for different domains, see Chapter 34, Using different DNS servers for different domains.
26.2. Setting a NetworkManager-wide default DNS server priority value
NetworkManager uses the following DNS priority default values for connections:
-
50
for VPN connections -
100
for other connections
This section describes how to override these system-wide defaults with a custom default value for IPv4 and IPv6 connections.
Procedure
Edit the
/etc/NetworkManager/NetworkManager.conf
file:Add the
[connection]
section, if it does not exist:[connection]
Add the custom default values to the
[connection]
section. For example, to set the new default for both IPv4 and IPv6 to200
, add:ipv4.dns-priority=200 ipv6.dns-priority=200
You can set the parameters to a value between
-2147483647
and2147483647
. Note that setting the parameters to0
enables the built-in defaults (50
for VPN connections and100
for other connections).
Reload the
NetworkManager
service:#
systemctl reload NetworkManager
Additional resources
-
For additional details about setting default values for all NetworkManager connections, see
Connection Section
in theNetworkManager.conf(5)
man page.
26.3. Setting the DNS priority of a NetworkManager connection
This section describes how to define the order of DNS servers when NetworkManager creates or updates the /etc/resolv.conf
file.
Note that setting DNS priorities makes only sense if you have multiple connections with different DNS servers configured. If you have only one connection with multiple DNS servers configured, manually set the DNS servers in the preferred order in the connection profile.
Prerequisites
- The system has multiple NetworkManager connections configured.
-
The system either has no
dns
parameter set in the/etc/NetworkManager/NetworkManager.conf
file or the parameter is set todefault
.
Procedure
Optionally, display the available connections:
#
nmcli connection show
NAME UUID TYPE DEVICE Example_con_1 d17ee488-4665-4de2-b28a-48befab0cd43 ethernet enp1s0 Example_con_2 916e4f67-7145-3ffa-9f7b-e7cada8f6bf7 ethernet enp7s0 ...Set the
ipv4.dns-priority
andipv6.dns-priority
parameters. For example, to set both parameters to10
for theExample_con_1
connection:#
nmcli connection modify Example_con_1 ipv4.dns-priority 10 ipv6.dns-priority 10
- Optionally, repeat the previous step for other connections.
Re-activate the connection you updated:
#
nmcli connection up Example_con_1
Verification steps
Display the contents of the
/etc/resolv.conf
file to verify that the DNS server order is correct:#
cat /etc/resolv.conf
Chapter 27. Configuring ip networking with ifcfg files
This section describes how to configure a network interface manually by editing the ifcfg
files.
Interface configuration (ifcfg) files control the software interfaces for individual network devices. As the system boots, it uses these files to determine what interfaces to bring up and how to configure them. These files are usually named ifcfg-name
, where the suffix name refers to the name of the device that the configuration file controls. By convention, the ifcfg
file’s suffix is the same as the string given by the DEVICE
directive in the configuration file itself.
27.1. Configuring an interface with static network settings using ifcfg files
This procedure describes how to configure a network interface using ifcfg
files.
Procedure
To configure an interface with static network settings using
ifcfg
files, for an interface with the nameenp1s0
, create a file with the nameifcfg-enp1s0
in the/etc/sysconfig/network-scripts/
directory that contains:For
IPv4
configuration:DEVICE=enp1s0 BOOTPROTO=none ONBOOT=yes PREFIX=24 IPADDR=10.0.1.27 GATEWAY=10.0.1.1
For
IPv6
configuration:DEVICE=enp1s0 BOOTPROTO=none ONBOOT=yes IPV6INIT=yes IPV6ADDR=2001:db8:1::2/64
Additional resources
- For more information on testing connections, see Chapter 39, Testing basic network settings.
-
For more
IPv6
ifcfg configuration options, see nm-settings-ifcfg-rh(5) man page.
27.2. Configuring an interface with dynamic network settings using ifcfg files
This procedure describes how to configure a network interface with dynamic network settings using ifcfg
files.
Procedure
To configure an interface named em1 with dynamic network settings using
ifcfg
files, create a file with the nameifcfg-em1
in the/etc/sysconfig/network-scripts/
directory that contains:DEVICE=em1 BOOTPROTO=dhcp ONBOOT=yes
To configure an interface to send a different host name to the
DHCP
server, add the following line to theifcfg
file:DHCP_HOSTNAME=hostname
To configure an interface to send a different fully qualified domain name (FQDN) to the
DHCP
server, add the following line to theifcfg
file:DHCP_FQDN=fully.qualified.domain.name
NoteOnly one directive, either
DHCP_HOSTNAME
orDHCP_FQDN
, should be used in a givenifcfg
file. In case bothDHCP_HOSTNAME
andDHCP_FQDN
are specified, only the latter is used.To configure an interface to use particular
DNS
servers, add the following lines to theifcfg
file:PEERDNS=no DNS1=ip-address DNS2=ip-address
where ip-address is the address of a
DNS
server. This will cause the network service to update/etc/resolv.conf
with the specifiedDNS
servers specified. Only oneDNS
server address is necessary, the other is optional.
27.3. Managing system-wide and private connection profiles with ifcfg files
This procedure describes how to configure ifcfg
files to manage the system-wide and private connection profiles.
Procedure
The permissions correspond to the USERS
directive in the ifcfg
files. If the USERS
directive is not present, the network profile will be available to all users.
As an example, modify the
ifcfg
file with the following row, which will make the connection available only to the users listed:USERS="joe bob alice"
Chapter 28. Using NetworkManager to disable IPv6 for a specific connection
This section describes how to disable the IPv6 protocol on a system that uses NetworkManager to manage network interfaces. If you disable IPv6, NetworkManager automatically sets the corresponding sysctl
values in the Kernel.
The NetworkManager service sets certain sysctl
values when it starts a connection. To avoid unexpected behavior, do not manually set sysctl
values to disable IPv6.
Prerequisites
- The system uses NetworkManager to manage network interfaces, which is the default on Red Hat Enterprise Linux 8.
- The system runs Red Hat Enterprise Linux 8.1 or later.
28.1. Disabling IPv6 on a connection using nmcli
Use this section to disable the IPv6 protocol using the nmcli
utility.
Procedure
Optionally, display the list of network connections:
# nmcli connection show NAME UUID TYPE DEVICE Example 7a7e0151-9c18-4e6f-89ee-65bb2d64d365 ethernet enp1s0 ...
Set the
ipv6.method
parameter of the connection todisabled
:# nmcli connection modify Example ipv6.method "disabled"
Restart the network connection:
# nmcli connection up Example
Verification steps
Enter the
ip address show
command to display the IP settings of the device:# ip address show enp1s0 2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 52:54:00:6b:74:be brd ff:ff:ff:ff:ff:ff inet 192.0.2.1/24 brd 192.10.2.255 scope global noprefixroute enp1s0 valid_lft forever preferred_lft forever
If no
inet6
entry is displayed, IPv6 is disabled on the device.Verify that the
/proc/sys/net/ipv6/conf/enp1s0/disable_ipv6
file now contains the value1
:# cat /proc/sys/net/ipv6/conf/enp1s0/disable_ipv6 1
The value
1
means that IPv6 is disabled for the device.
Chapter 29. Manually configuring the /etc/resolv.conf file
By default, NetworkManager on Red Hat Enterprise Linux (RHEL) 8 dynamically updates the /etc/resolv.conf
file with the DNS settings from active NetworkManager connection profiles. This section describes different options on how to disable this feature to manually configure DNS settings in /etc/resolv.conf
.
29.1. Disabling DNS processing in the NetworkManager configuration
This section describes how to disable DNS processing in the NetworkManager configuration to manually configure the /etc/resolv.conf
file.
Procedure
As the root user, create the
/etc/NetworkManager/conf.d/90-dns-none.conf
file with the following content by using a text editor:[main] dns=none
Reload the
NetworkManager
service:# systemctl reload NetworkManager
NoteAfter you reload the service, NetworkManager no longer updates the
/etc/resolv.conf
file. However, the last contents of the file are preserved.-
Optionally, remove the
Generated by NetworkManager
comment from/etc/resolv.conf
to avoid confusion.
Verification steps
-
Edit the
/etc/resolv.conf
file and manually update the configuration. Reload the
NetworkManager
service:# systemctl reload NetworkManager
Display the
/etc/resolv.conf
file:# cat /etc/resolv.conf
If you successfully disabled DNS processing, NetworkManager did not override the manually configured settings.
Additional resources
-
For further details, see the description of the
dns
parameter in theNetworkManager.conf(5)
man page.
29.2. Replacing /etc/resolv.conf with a symbolic link to manually configure DNS settings
NetworkManager does not automatically update the DNS configuration if /etc/resolv.conf
is a symbolic link. This section describes how to replace /etc/resolv.conf
with a symbolic link to an alternative file with the DNS configuration.
Prerequisites
-
The
rc-manager
option is not set tofile
. To verify, use theNetworkManager --print-config
command.
Procedure
-
Create a file, such as
/etc/resolv.conf.manually-configured
, and add the DNS configuration for your environment to it. Use the same parameters and syntax as in the original/etc/resolv.conf
. Remove the
/etc/resolv.conf
file:# rm /etc/resolv.conf
Create a symbolic link named
/etc/resolv.conf
that refers to/etc/resolv.conf.manually-configured
:# ln -s /etc/resolv.conf.manually-configured /etc/resolv.conf
Additional resources
-
For details about parameters you can set in
/etc/resolv.conf
, see theresolv.conf(5)
man page. -
For further details about why NetworkManager does not process DNS settings if
/etc/resolv.conf
is a symbolic link, see the description of therc-manager
parameter in theNetworkManager.conf(5)
man page.
Chapter 30. Configuring 802.3 link settings
You can configure the 802.3 link settings of an Ethernet connection by modifying the following configuration parameters:
-
802-3-ethernet.auto-negotiate
-
802-3-ethernet.speed
-
802-3-ethernet.duplex
You can configure the 802.3 link settings to the following main modes:
- Ignore link negotiation
- Enforce the auto-negotiation activation
-
Manually set the
speed
andduplex
link settings
30.1. Configuring 802.3 link settings with nmcli tool
This procedure describes how to configure 802.3 link settings using the nmcli
tool.
Prerequisites
- The NetworkManager must be installed and running.
Procedure
To ignore link negotiation, set the following parameters:
~]# nmcli connection modify connection_name 802-3-ethernet.auto-negotiate no 802-3-ethernet.speed 0 802-3-ethernet.duplex ""
Note, that the auto-negotiation parameter is not disabled even if the speed and duplex parameters are not set and the auto-negotiation parameter is set to no.
To enforce the auto-negotiation activation, enter the following command:
~]# nmcli connection modify connection_name 802-3-ethernet.auto-negotiate yes 802-3-ethernet.speed 0 802-3-ethernet.duplex ""
That allows to negotiate all the available speed and duplex modes supported by the NIC.
You can also enable auto-negotiation while advertising and allowing only one speed/duplex mode. This can be useful if you want to enforce
1000BASE-T
and10GBASE-T
Ethernet link configuration, as these standards mandate auto-negotiation enabled. To enforce1000BASE-T
standard:~]# nmcli connection modify connection_name 802-3-ethernet.auto-negotiate yes 802-3-ethernet.speed 1000 802-3-ethernet.duplex full
To manually set the speed and duplex link settings, enter the following command:
~]# nmcli connection modify connection_name 802-3-ethernet.auto-negotiate no 802-3-ethernet.speed [speed in Mbit/s] 802-3-ethernet.duplex [full|half]
Chapter 31. Configuring ethtool offload features
Network interface cards can use the TCP offload engine (TOE) to offload processing certain operations to the network controller to improve the network throughput.
This section describes how to set offload features.
31.1. Offload features supported by NetworkManager
You can set the following ethtool
offload features using NetworkManager:
- ethtool.feature-esp-hw-offload
- ethtool.feature-esp-tx-csum-hw-offload
- ethtool.feature-fcoe-mtu
- ethtool.feature-gro
- ethtool.feature-gso
- ethtool.feature-highdma
- ethtool.feature-hw-tc-offload
- ethtool.feature-l2-fwd-offload
- ethtool.feature-loopback
- ethtool.feature-lro
- ethtool.feature-ntuple
- ethtool.feature-rx
- ethtool.feature-rx-all
- ethtool.feature-rx-fcs
- ethtool.feature-rx-gro-hw
- ethtool.feature-rx-udp_tunnel-port-offload
- ethtool.feature-rx-vlan-filter
- ethtool.feature-rx-vlan-stag-filter
- ethtool.feature-rx-vlan-stag-hw-parse
- ethtool.feature-rxhash
- ethtool.feature-rxvlan
- ethtool.feature-sg
- ethtool.feature-tls-hw-record
- ethtool.feature-tls-hw-tx-offload
- ethtool.feature-tso
- ethtool.feature-tx
- ethtool.feature-tx-checksum-fcoe-crc
- ethtool.feature-tx-checksum-ip-generic
- ethtool.feature-tx-checksum-ipv4
- ethtool.feature-tx-checksum-ipv6
- ethtool.feature-tx-checksum-sctp
- ethtool.feature-tx-esp-segmentation
- ethtool.feature-tx-fcoe-segmentation
- ethtool.feature-tx-gre-csum-segmentation
- ethtool.feature-tx-gre-segmentation
- ethtool.feature-tx-gso-partial
- ethtool.feature-tx-gso-robust
- ethtool.feature-tx-ipxip4-segmentation
- ethtool.feature-tx-ipxip6-segmentation
- ethtool.feature-tx-nocache-copy
- ethtool.feature-tx-scatter-gather
- ethtool.feature-tx-scatter-gather-fraglist
- ethtool.feature-tx-sctp-segmentation
- ethtool.feature-tx-tcp-ecn-segmentation
- ethtool.feature-tx-tcp-mangleid-segmentation
- ethtool.feature-tx-tcp-segmentation
- ethtool.feature-tx-tcp6-segmentation
- ethtool.feature-tx-udp-segmentation
- ethtool.feature-tx-udp_tnl-csum-segmentation
- ethtool.feature-tx-udp_tnl-segmentation
- ethtool.feature-tx-vlan-stag-hw-insert
- ethtool.feature-txvlan
For details about the individual offload features, see the documentation of the ethtool
utility and the kernel documentation.
31.2. Configuring an ethtool offload feature using NetworkManager
This section describes how you enable and disable ethtool
offload features using NetworkManager, as well as how you remove the setting for a feature from a NetworkManager connection profile.
Procedure
For example, to enable the RX offload feature and disable TX offload in the
enp1s0
connection profile, enter:# nmcli con modify enp1s0 ethtool.feature-rx on ethtool.feature-tx off
This command explicitly enables RX offload and disables TX offload.
To remove the setting of an offload feature that you previously enabled or disabled, set the feature’s parameter to
ignore
. For example, to remove the configuration for TX offload, enter:# nmcli con modify enp1s0 ethtool.feature-tx ignore
Reactivate the network profile:
# nmcli connection up enp1s0
Verification steps
Use the
ethtool -k
command to display the current offload features of a network device:# ethtool -k network_device
Additional resources
-
For a list of
ethtool
offload features NetworkManager supports, see Section 31.1, “Offload features supported by NetworkManager”.
31.3. Using System Roles to set ethtool features
You can use the networking
RHEL System Role to configure ethtool
features of a NetworkManager connection.
When you run a play that uses the networking
RHEL System Role, the System Role overrides an existing connection profile with the same name if the settings do not match the ones specified in the play. Therefore, always specify the whole configuration of the network connection profile in the play, even if, for example the IP configuration, already exists. Otherwise the role resets these values to their defaults.
Depending on whether it already exists, the procedure creates or updates the enp1s0
connection profile with the following settings:
-
A static IPv4 address -
198.51.100.20
with a/24
subnet mask -
A static IPv6 address -
2001:db8:1::1
with a/64
subnet mask -
An IPv4 default gateway -
198.51.100.254
-
An IPv6 default gateway -
2001:db8:1::fffe
-
An IPv4 DNS server -
198.51.100.200
-
An IPv6 DNS server -
2001:db8:1::ffbb
-
A DNS search domain -
example.com
ethtool
features:- Generic receive offload (GRO): disabled
- Generic segmentation offload (GSO): enabled
- TX Stream Control Transmission Protocol (SCTP) segmentation: disabled
Prerequisites
-
The
ansible
andrhel-system-roles
packages are installed on the control node. -
If you use a different remote user than root when you run the playbook, this user has appropriate
sudo
permissions on the managed node.
Procedure
If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the
/etc/ansible/hosts
Ansible inventory file:node.example.com
Create the
~/configure-ethernet-device-with-ethtool-features.yml
playbook with the following content:--- - name. Configure an Ethernet connection with ethtool features hosts: node.example.com become: true tasks: - include_role: name: linux-system-roles.network vars: network_connections: - name: enp1s0 type: ethernet autoconnect: yes ip: address: - 198.51.100.20/24 - 2001:db8:1::1/64 gateway4: 198.51.100.254 gateway6: 2001:db8:1::fffe dns: - 198.51.100.200 - 2001:db8:1::ffbb dns_search: - example.com ethtool: feature: gro: "no" gso: "yes" tx_sctp_segmentation: "no" state: up
Run the playbook:
To connect as
root
user to the managed host, enter:#
ansible-playbook -u root ~/configure-ethernet-device-with-ethtool-features.yml
To connect as a user to the managed host, enter:
#
ansible-playbook -u user_name --ask-become-pass ~/configure-ethernet-device-with-ethtool-features.yml
The
--ask-become-pass
option makes sure that theansible-playbook
command prompts for thesudo
password of the user defined in the-u user_name
option.
If you do not specify the
-u user_name
option,ansible-playbook
connects to the managed host as the user that is currently logged in to the control node.
Additional resources
-
For a full list of
ethtool
features and details about the parameters used innetwork_connections
, and for additional information about thenetwork
system role, see the/usr/share/ansible/roles/rhel-system-roles.network/README.md
file. -
For details about the
ansible-playbook
command, see theansible-playbook(1)
man page.
Chapter 32. Configuring ethtool coalesce settings
Using interrupt coalescing, the system collects network packets and generates a single interrupt for multiple packets. This increases the amount of data sent to the kernel with one hardware interrupt, which reduces the interrupt load, and maximizes the throughput.
This section provides different options to set the ethtool
coalesce settings.
32.1. Coalesce settings supported by NetworkManager
You can set the following ethtool
coalesce settings using NetworkManager:
- [parameter]`coalesce-adaptive-rx´
- [parameter]`coalesce-adaptive-tx´
- [parameter]`coalesce-pkt-rate-high´
- [parameter]`coalesce-pkt-rate-low´
- [parameter]`coalesce-rx-frames´
- [parameter]`coalesce-rx-frames-high´
- [parameter]`coalesce-rx-frames-irq´
- [parameter]`coalesce-rx-frames-low´
- [parameter]`coalesce-rx-usecs´
- [parameter]`coalesce-rx-usecs-high´
- [parameter]`coalesce-rx-usecs-irq´
- [parameter]`coalesce-rx-usecs-low´
- [parameter]`coalesce-sample-interval´
- [parameter]`coalesce-stats-block-usecs´
- [parameter]`coalesce-tx-frames´
- [parameter]`coalesce-tx-frames-high´
- [parameter]`coalesce-tx-frames-irq´
- [parameter]`coalesce-tx-frames-low´
- [parameter]`coalesce-tx-usecs´
- [parameter]`coalesce-tx-usecs-high´
- [parameter]`coalesce-tx-usecs-irq´
- [parameter]`coalesce-tx-usecs-low´
32.2. Configuring ethtool coalesce settings using NetworkManager
This section describes how to set ethtool
coalesce settings using NetworkManager, as well as how you remove the setting from a NetworkManager connection profile.
Procedure
For example, to set the maximum number of received packets to delay to
128
in theenp1s0
connection profile, enter:# nmcli connection modify enp1s0 ethtool.coalesce-rx-frames 128
To remove a coalesce setting, set the setting to
ignore
. For example, to remove theethtool.coalesce-rx-frames
setting, enter:# nmcli connection modify enp1s0 ethtool.coalesce-rx-frames ignore
To reactivate the network profile:
# nmcli connection up enp1s0
Verification steps
Use the
ethtool -c
command to display the current offload features of a network device:# ethtool -c network_device
Additional resources
-
For a list of
ethtool
coalesce settings which NetworkManager supports, see Section 32.1, “Coalesce settings supported by NetworkManager”
Chapter 33. Configuring MACsec
The following section provides information on how to configure Media Control Access Security
(MACsec
), which is an 802.1AE IEEE standard security technology for secure communication in all traffic on Ethernet links.
33.1. Introduction to MACsec
Media Access Control Security
(MACsec
, IEEE 802.1AE) encrypts and authenticates all traffic in LANs with the GCM-AES-128 algorithm. MACsec
can protect not only IP
but also Address Resolution Protocol (ARP), Neighbor Discovery (ND), or DHCP
. While IPsec
operates on the network layer (layer 3) and SSL
or TLS
on the application layer (layer 7), MACsec
operates in the data link layer (layer 2). Combine MACsec
with security protocols for other networking layers to take advantage of different security features that these standards provide.
33.2. Using MACsec with nmcli tool
This procedure shows how to configure MACsec
with nmcli
tool.
Prerequisites
- The NetworkManager must be running.
-
You already have a 16-byte hexadecimal CAK (
$MKA_CAK
) and a 32-byte hexadecimal CKN ($MKA_CKN
).
Procedure
To add new connection using
nmcli
, enter:~]# nmcli connection add type macsec \ con-name test-macsec+ ifname macsec0 \ connection.autoconnect no \ macsec.parent enp1s0 macsec.mode psk \ macsec.mka-cak $MKA_CAK \ macsec.mka-ckn $MKA_CKN
Replace macsec0 with the device name you want to configure.
To activate the connection, enter:
~]# nmcli connection up test-macsec+
After this step, the macsec0 device is configured and can be used for networking.
33.3. Using MACsec with wpa_supplicant
This procedure shows how to enable MACsec
with a switch that performs authentication using a pre-shared Connectivity Association Key/CAK Name (CAK/CKN) pair.
Procedure
Create a CAK/CKN pair. For example, the following command generates a 16-byte key in hexadecimal notation:
~]$
dd if=/dev/urandom count=16 bs=1 2> /dev/null | hexdump -e '1/2 "%02x"'
Create the
wpa_supplicant.conf
configuration file and add the following lines to it:ctrl_interface=/var/run/wpa_supplicant eapol_version=3 ap_scan=0 fast_reauth=1 network={ key_mgmt=NONE eapol_flags=0 macsec_policy=1 mka_cak=0011... # 16 bytes hexadecimal mka_ckn=2233... # 32 bytes hexadecimal }
Use the values from the previous step to complete the
mka_cak
andmka_ckn
lines in thewpa_supplicant.conf
configuration file.For more information, see the
wpa_supplicant.conf(5)
man page.Assuming you are using wlp61s0 to connect to your network, start wpa_supplicant using the following command:
~]# wpa_supplicant -i wlp61s0 -Dmacsec_linux -c wpa_supplicant.conf
Chapter 34. Using different DNS servers for different domains
By default, Red Hat Enterprise Linux (RHEL) sends all DNS requests to the first DNS server specified in the /etc/resolv.conf
file. If this server does not reply, RHEL uses the next server in this file.
In environments where one DNS server cannot resolve all domains, administrators can configure RHEL to send DNS requests for a specific domain to a selected DNS server. For example, you can configure one DNS server to resolve queries for example.com
and another DNS server to resolve queries for example.net
. For all other DNS requests, RHEL uses the DNS server configured in the connection with the default gateway.
In RHEL 8, Red Hat provides systemd-resolved
as an unsupported Technology Preview.
34.1. Sending DNS requests for a specific domain to a selected DNS server
This section configures systemd-resolved
service and NetworkManager to send DNS queries for a specific domain to a selected DNS server.
If you complete the procedure in this section, RHEL uses the DNS service provided by systemd-resolved
in the /etc/resolv.conf
file. The systemd-resolved
service starts a DNS service that listens on port 53
IP address 127.0.0.53
. The service dynamically routes DNS requests to the corresponding DNS servers specified in NetworkManager.
The 127.0.0.53
address is only reachable from the local system and not from the network.
Prerequisites
- The system has multiple NetworkManager connections configured.
A DNS server and search domain are configured in the NetworkManager connections that are responsible for resolving a specific domain
For example, if the DNS server specified in a VPN connection should resolve queries for the
example.com
domain, the VPN connection profile must have:-
Configured a DNS server that can resolve
example.com
-
Configured the search domain to
example.com
in theipv4.dns-search
andipv6.dns-search
parameters
-
Configured a DNS server that can resolve
Procedure
Start and enable the
systemd-resolved
service:# systemctl --now enable systemd-resolved
Edit the
/etc/NetworkManager/NetworkManager.conf
file, and set the following entry in the[main]
section:dns=systemd-resolved
Reload the
NetworkManager
service:# systemctl reload NetworkManager
Verification steps
Verify that the
nameserver
entry in the/etc/resolv.conf
file refers to127.0.0.53
:# cat /etc/resolv.conf nameserver 127.0.0.53
Verify that the
systemd-resolved
service listens on port53
on the local IP address127.0.0.53
:# netstat -tulpn | grep "127.0.0.53:53" tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 1050/systemd-resolv udp 0 0 127.0.0.53:53 0.0.0.0:* 1050/systemd-resolv
Additional resources
-
For further details, see the description of the
dns
parameter in theNetworkManager.conf(5)
man page.
Chapter 35. Getting started with IPVLAN
This document describes the IPVLAN driver.
35.1. IPVLAN overview
IPVLAN is a driver for a virtual network device that can be used in container environment to access the host network. IPVLAN exposes a single MAC address to the external network regardless the number of IPVLAN device created inside the host network. This means that a user can have multiple IPVLAN devices in multiple containers and the corresponding switch reads a single MAC address. IPVLAN driver is useful when the local switch imposes constraints on the total number of MAC addresses that it can manage.
35.2. IPVLAN modes
The following modes are available for IPVLAN:
L2 mode
In IPVLAN L2 mode, virtual devices receive and respond to Address Resolution Protocol (ARP) requests. The
netfilter
framework runs only inside the container that owns the virtual device. Nonetfilter
chains are executed in the default namespace on the containerized traffic. Using L2 mode provides good performance, but less control on the network traffic.L3 mode
In L3 mode, virtual devices process only L3 traffic and above. Virtual devices do not respond to ARP request and users must configure the neighbour entries for the IPVLAN IP addresses on the relevant peers manually. The egress traffic of a relevant container is landed on the
netfilter
POSTROUTING and OUTPUT chains in the default namespace while the ingress traffic is threaded in the same way as L2 mode. Using L3 mode provides good control but decreases the network traffic performance.L3S mode
In L3S mode, virtual devices process the same way as in L3 mode, except that both egress and ingress traffics of a relevant container are landed on
netfilter
chain in the default namespace. L3S mode behaves in a similar way to L3 mode but provides greater control of the network.
The IPVLAN virtual device does not receive broadcast and multicast traffic in case of L3 and L3S modes.
35.3. Overview of MACVLAN
The MACVLAN driver allows to create multiple virtual network devices on top of a single NIC, each of them identified by its own unique MAC address. Packets which land on the physical NIC are demultiplexed towards the relevant MACVLAN device via MAC address of the destination. MACVLAN devices do not add any level of encapsulation.
35.4. Comparison of IPVLAN and MACVLAN
The following table shows the major differences between MACVLAN and IPVLAN.
MACVLAN | IPVLAN |
---|---|
Uses MAC address for each MACVLAN device. The overlimit of MAC addresses of MAC table in switch might cause loosing the connectivity. | Uses single MAC address which does not limit the number of IPVLAN devices. |
Netfilter rules for global namespace cannot affect traffic to or from MACVLAN device in a child namespace. | It is possible to control traffic to or from IPVLAN device in L3 mode and L3S mode. |
Note that both IPVLAN and MACVLAN do not require any level of incapsulation.
35.5. Creating and configuring the IPVLAN device using iproute2
This procedure shows how to set up the IPVLAN device using iproute2.
Procedure
To create an IPVLAN device, enter the following command:
~]# ip link add link real_NIC_device name IPVLAN_device type ipvlan mode l2
Note that network interface controller (NIC) is a hardware component which connects a computer to a network.
Example 35.1. Creating an IPVLAN device
~]# ip link add link enp0s31f6 name my_ipvlan type ipvlan mode l2 ~]# ip link 47: my_ipvlan@enp0s31f6: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether e8:6a:6e:8a:a2:44 brd ff:ff:ff:ff:ff:ff
To assign an
IPv4
orIPv6
address to the interface, enter the following command:~]# ip addr add dev IPVLAN_device IP_address/subnet_mask_prefix
In case of configuring an IPVLAN device in L3 mode or L3S mode, make the following setups:
Configure the neighbor setup for the remote peer on the remote host:
~]# ip neigh add dev peer_device IPVLAN_device_IP_address lladdr MAC_address
where MAC_address is the MAC address of the real NIC on which an IPVLAN device is based on.
Configure an IPVLAN device for L3 mode with the following command:
~]# ip neigh add dev real_NIC_device peer_IP_address lladdr peer_MAC_address
For L3S mode:
~]# ip route dev add real_NIC_device peer_IP_address/32
where IP-address represents the address of the remote peer.
To set an IPVLAN device active, enter the following command:
~]# ip link set dev IPVLAN_device up
To check if the IPVLAN device is active, execute the following command on the remote host:
~]# ping IP_address
where the IP_address uses the IP address of the IPVLAN device.
Chapter 36. Configuring virtual routing and forwarding (VRF)
With Virtual routing and forwarding (VRF), Administrators can use multiple routing tables simultaneously on the same host. For that, VRF partitions a network at layer 3. This enables the administrator to isolate traffic using separate and independent route tables per VRF domain. This technique is similar to virtual LANs (VLAN), which partitions a network at layer 2, where the operating system uses different VLAN tags to isolate traffic sharing the same physical medium.
One benefit of VRF over partitioning on layer 2 is that routing scales better considering the number of peers involved.
Red Hat Enterprise Linux uses a virtual vrt
device for each VRF domain and adds routes to a VRF domain by adding existing network devices to a VRF device. Addresses and routes previously attached to the original device will be moved inside the VRF domain.
Note that each VRF domain is isolated from each other.
36.1. Permanently reusing the same IP address on different interfaces
This procedure describes how to permanently use the same IP address on different interfaces in one server by using the VRF feature.
To enable remote peers to contact both VRF interfaces while reusing the same IP address, the network interfaces must belong to different broadcasting domains. A broadcast domain in a network is a set of nodes, which receive broadcast traffic sent by any of them. In most configurations, all nodes connected to the same switch belong to the same broadcasting domain.
Prerequisites
-
You are logged in as the
root
user. - The network interfaces are not configured.
Procedure
Create and configure the first VRF device:
Create a connection for the VRF device and assign it to a routing table. For example, to create a VRF device named
vrf0
that is assigned to the1001
routing table:# nmcli connection add type vrf ifname vrf0 con-name vrf0 table 1001 ipv4.method disabled ipv6.method disabled
Enable the
vrf0
device:# nmcli connection up vrf0
Assign a network device to the VRF just created. For example, to add the
enp1s0
Ethernet device to thevrf0
VRF device and assign an IP address and the subnet mask toenp1s0
, enter:# nmcli connection add type ethernet con-name vrf.enp1s0 ifname enp1s0 master vrf0 ipv4.method manual ipv4.address 192.0.2.1/24
Activate the
vrf.enp1s0
connection:# nmcli connection up vrf.enp1s0
Create and configure the next VRF device:
Create the VRF device and assign it to a routing table. For example, to create a VRF device named
vrf1
that is assigned to the1002
routing table, enter:# nmcli connection add type vrf ifname vrf1 con-name vrf1 table 1002 ipv4.method disabled ipv6.method disabled
Activate the
vrf1
device:# nmcli connection up vrf1
Assign a network device to the VRF just created. For example, to add the
enp7s0
Ethernet device to thevrf1
VRF device and assign an IP address and the subnet mask toenp7s0
, enter:# nmcli connection add type ethernet con-name vrf.enp7s0 ifname enp7s0 master vrf1 ipv4.method manual ipv4.address 192.0.2.1/24
Activate the
vrf.enp7s0
device:# nmcli connection up vrf.enp7s0
36.2. Temporarily reusing the same IP address on different interfaces
The procedure in this section describes how to temporarily use the same IP address on different interfaces in one server by using the virtual routing and forwarding (VRF) feature. Use this procedure only for testing purposes, because the configuration is temporary and lost after you reboot the system.
To enable remote peers to contact both VRF interfaces while reusing the same IP address, the network interfaces must belong to different broadcasting domains. A broadcast domain in a network is a set of nodes which receive broadcast traffic sent by any of them. In most configurations, all nodes connected to the same switch belong to the same broadcasting domain.
Prerequisites
-
You are logged in as the
root
user. - The network interfaces are not configured.
Procedure
Create and configure the first VRF device:
Create the VRF device and assign it to a routing table. For example, to create a VRF device named
blue
that is assigned to the1001
routing table:# ip link add dev blue type vrf table 1001
Enable the
blue
device:# ip link set dev blue up
Assign a network device to the VRF device. For example, to add the
enp1s0
Ethernet device to theblue
VRF device:# ip link set dev enp1s0 master blue
Enable the
enp1s0
device:# ip link set dev enp1s0 up
Assign an IP address and subnet mask to the
enp1s0
device. For example, to set it to192.0.2.1/24
:# ip addr add dev enp1s0 192.0.2.1/24
Create and configure the next VRF device:
Create the VRF device and assign it to a routing table. For example, to create a VRF device named
red
that is assigned to the1002
routing table:# ip link add dev red type vrf table 1002
Enable the
red
device:# ip link set dev red up
Assign a network device to the VRF device. For example, to add the
enp7s0
Ethernet device to thered
VRF device:# ip link set dev enp7s0 master red
Enable the
enp7s0
device:# ip link set dev enp7s0 up
Assign the same IP address and subnet mask to the
enp7s0
device as you used forenp1s0
in theblue
VRF domain:# ip addr add dev enp7s0 192.0.2.1/24
- Optionally, create further VRF devices as described above.
Chapter 37. Setting the routing protocols for your system
This section describes how to use the Free Range Routing (FRRouting, or FRR) feature to enable and set the required routing protocols for your system.
37.1. Introduction to FRRouting
Free Range Routing (FRRouting, or FRR) is a routing protocol stack, which is provided by the frr
package available in the AppStream repository.
FRR replaces Quagga that was used on previous RHEL versions. As such, FRR provides TCP/IP-based routing services with support for multiple IPv4 and IPv6 routing protocols.
The supported protocols are:
- Border Gateway Protocol (BGP)
- Intermediate System to Intermediate System (IS-IS)
- Open Shortest Path First (OSPF)
- Protocol-Independent Multicast (PIM)
- Routing Information Protocol (RIP)
- Routing Information Protocol next generation (RIPng)
- Enhanced Interior Gateway Routing Protocol (EIGRP)
- Next Hop Resolution Protocol (NHRP)
- Bidirectional Forwarding Detection (BFD)
- Policy-based Routing (PBR)
FRR is a collection of the following services:
- zebra
- bgpd
- isisd
- ospfd
- ospf6d
- pimd
- ripd
- ripngd
- eigrpd
- nhrpd
- bfdd
- pbrd
- staticd
- fabricd
If frr
is installed, the system can act as a dedicated router, which exchanges routing information with other routers in either internal or external network using the routing protocols.
37.2. Setting up FRRouting
Prerequisites
-
Make sure that the
frr
package is installed on your system:
# yum install frr
Procedure
Edit the
/etc/frr/daemons
configuration file, and enable the required daemons for your system.For example, to enable the
ripd
daemon, include the following line:ripd=yes
WarningThe
zebra
daemon must always be enabled, so that you must setzebra=yes
to be able to use FRR.ImportantBy default,
/etc/frr/daemons
contains[daemon_name]=no
entries for all daemons. Therefore, all daemons are disabled, and starting FRR after a new installation of the system has no effect.Start the
frr
service:# systemctl start frr
Optionally, you can also set FRR to start automatically on boot:
# systemctl enable frr
37.3. Modifying the configuration of FRR
This section describes:
- How to enable an additional daemon after you set up FRR
- How to disable a daemon after you set up FRR
Enabling an additional daemon
Prerequisites
- FRR is set up as described in Section 37.2, “Setting up FRRouting”.
Procedure
To enable one or more additional daemons:
Edit the
/etc/frr/daemons
configuration file, and modify the line for the required daemons to stateyes
instead ofno
.For example, to enable the
ripd
daemon:ripd=yes
Reload the
frr
service:# systemctl reload frr
Disabling a daemon
Prerequisites
- FRR is set up as described in Section 37.2, “Setting up FRRouting”.
Procedure
To disable one or more daemons:
Edit the
/etc/frr/daemons
configuration file, and modify the line for the required daemons to stateno
instead ofyes
.For example, to disable the
ripd
daemon:ripd=no
Reload the
frr
service:# systemctl reload frr
37.4. Modifying a configuration of a particular daemon
With the default configuration, every routing daemon in FRR can only act as a plain router.
For any additional configuration of a daemon, use the following procedure.
Procedure
Within the
/etc/frr/
directory, create a configuration file for the required daemon, and name the file as follows:[daemon_name].conf
For example, to further configure the
eigrpd
daemon, create theeigrpd.conf
file in the mentioned directory.Populate the new file with the required content.
For configuration examples of particular FRR daemons, see the
/usr/share/doc/frr/
directory.Reload the
frr
service:# systemctl reload frr
Chapter 38. Monitoring and tuning the RX ring buffer
Receive (RX) ring buffers are shared buffers between the device driver and Network Interface Card (NIC), and store incoming packets until the device driver can process them.
You can increase the size of the Ethernet device RX ring buffer if the packet drop rate causes applications to report:
- a loss of data,
- cluster fence,
- slow performance,
- timeouts, and
- failed backups.
This section describes how to identify the number of dropped packets and increase the RX ring buffer to reduce a high packet drop rate.
38.1. Displaying the number of dropped packets
The ethtool
utility enables administrators to query, configure, or control network driver settings.
The exhaustion of the RX ring buffer causes an increment in the counters, such as "discard" or "drop" in the output of ethtool -S interface_name
. The discarded packets indicate that the available buffer is filling up faster than the kernel can process the packets.
This procedure describes how to display drop counters using ethtool
.
Procedure
To display drop counters for the
enp1s0
interface, enter:$ ethtool -S enp1s0
38.2. Increasing the RX ring buffer to reduce a high packet drop rate
The ethtool
utility helps to increase the RX buffer to reduce a high packet drop rate.
Procedure
To view the maximum RX ring buffer size:
# ethtool -g enp1s0 Ring parameters for enp1s0: Pre-set maximums: RX: 4080 RX Mini: 0 RX Jumbo: 16320 TX: 255 Current hardware settings: RX: 255 RX Mini: 0 RX Jumbo: 0 TX: 255
If the values in the
Pre-set maximums
section are higher than in theCurrent hardware settings
section, increase RX ring buffer:To temporary change the RX ring buffer of the
enp1s0
device to4080
, enter:# ethtool -G enp1s0 rx 4080
To permanently change the RX ring buffer create a NetworkManager dispatcher script.
For details, see the How to make NIC ethtool settings persistent (apply automatically at boot) article and create a dispatcher script.
Depending on the driver your network interface card uses, changing in the ring buffer can shortly interrupt the network connection.
Additional resources
- For further information about statistics that cover more reasons for discards of unwanted packets, see the ifconfig and ip commands report packet drops in RHEL7 article.
- Should I be concerned about a 0.05% packet drop rate?
-
The
ethtool(8)
man page.
Chapter 39. Testing basic network settings
This section describes how to perform basic network testing.
39.1. Using the ping utility to verify the IP connection to other hosts
The ping
utility sends ICMP packets to a remote host. You can use this functionality to test if the IP connection to a different host works.
Procedure
Ping the IP address of a host in the same subnet, such as your default gateway:
# ping 192.0.2.3
If the command fails, verify the default gateway settings.
Ping an IP address of a host in a remote subnet:
# ping 198.162.3.1
If the command fails, verify the default gateway settings, and ensure that the gateway forwards packets between the connected networks.
39.2. Using the host utility to verify name resolution
This procedure describes how to verify name resolution in Red Hat Enterprise Linux 8.
Procedure
Use the
host
utility to verify that name resolution works. For example, to resolve theclient.example.com
hostname to an IP address, enter:# host client.example.com
If the command returns an error, such as
connection timed out
orno servers could be reached
, verify your DNS settings.
Chapter 40. Introduction to NetworkManager Debugging
Increasing the log levels for all or certain domains helps to log more details of the operations NetworkManager performs. Administrators can use this information to troubleshoot problems. NetworkManager provides different levels and domains to produce logging information. The /etc/NetworkManager/NetworkManager.conf
file is the main configuration file for NetworkManager. The logs are stored in the journal.
This section provides information on enabling debug logging for NetworkManager and using different logging levels and domains to configure the amount of logging details.
40.1. Debugging levels and domains
You can use the levels
and domains
parameters to manage the debugging for NetworkManager. The level defines the verbosity level, whereas the domains define the category of the messages to record the logs with given severity (level
).
Log levels | Description |
---|---|
| Does not log any messages about NetworkManager |
| Logs only critical errors |
| Logs warnings that can reflect the operation |
| Logs various informational messages that are useful for tracking state and operations |
| Enables verbose logging for debugging purposes |
|
Enables more verbose logging than the |
Note that subsequent levels log all messages from earlier levels. For example, setting the log level to INFO
also logs messages contained in the ERR
and WARN
log level.
Additional resources
-
For details on
domains
, refer to theNetworkManager.conf(5)
man page.
40.2. Setting the NetworkManager log level
By default, all the log domains are set to record the INFO
log level. Disable rate-limiting before collecting debug logs. With rate-limiting, systemd-journald
drops messages if there are too many of them in a short time. This can occur when the log level is TRACE
.
This procedure disables rate-limiting and enables recording debug logs for the all (ALL) domains.
Procedure
To disable rate-limiting, edit the
/etc/systemd/journald.conf
file, uncomment theRateLimitBurst
parameter in the[Journal]
section, and set its value as0
:RateLimitBurst=0
Restart the
systemd-journald
service.#
systemctl restart systemd-journald
Create the
/etc/NetworkManager/conf.d/95-nm-debug.conf
file with the following content:[logging] domains=ALL:DEBUG
The
domains
parameter can contain multiple comma-separateddomain:level
pairs.Restart the NetworkManager service.
#
systemctl restart NetworkManager
40.3. Temporarily setting log levels at run time using nmcli
You can change the log level at run time using nmcli
. However, Red Hat recommends to enable debugging using configuration files and restart NetworkManager. Updating debugging levels
and domains
using the .conf
file helps to debug boot issues and captures all the logs from the initial state.
Procedure
Optional: Display the current logging settings:
#
nmcli general logging
LEVEL DOMAINS INFO PLATFORM,RFKILL,ETHER,WIFI,BT,MB,DHCP4,DHCP6,PPP,WIFI_SCAN,IP4,IP6,A UTOIP4,DNS,VPN,SHARING,SUPPLICANT,AGENTS,SETTINGS,SUSPEND,CORE,DEVICE,OLPC, WIMAX,INFINIBAND,FIREWALL,ADSL,BOND,VLAN,BRIDGE,DBUS_PROPS,TEAM,CONCHECK,DC B,DISPATCHTo modify the logging level and domains, use the following options:
To set the log level for all domains to the same
LEVEL
, enter:#
nmcli general logging level LEVEL domains ALL
To change the level for specific domains, enter:
#
nmcli general logging level LEVEL domains DOMAINS
Note that updating the logging level using this command disables logging for all the other domains.
To change the level of specific domains and preserve the level of all other domains, enter:
#
nmcli general logging level KEEP domains DOMAIN:LEVEL,DOMAIN:LEVEL
40.4. Viewing NetworkManager logs
You can view the NetworkManager logs for troubleshooting.
Procedure
To view the logs, enter:
#
journalctl -u NetworkManager -b
Additional resources
-
The
NetworkManager.conf(5)
man page -
The
journalctl
man page
Chapter 41. Capturing network packets
To debug network issues and communications, you can capture network packets. The following sections provide instructions and additional information about capturing network packets.
41.1. Using xdpdump to capture network packets including packets dropped by XDP programs
The xdpdump
utility captures network packets. Unlike the tcpdump
utility, xdpdump
uses an extended Berkeley Packet Filter(eBPF) program for this task. This enables xdpdump
to also capture packets dropped by Express Data Path (XDP) programs. User-space utilities, such as tcpdump
, are not able to capture these dropped packages, as well as original packets modified by an XDP program.
You can use xdpdump
to debug XDP programs that are already attached to an interface. Therefore, the utility can capture packets before an XDP program is started and after it has finished. In the latter case, xdpdump
also captures the XDP action. By default, xdpdump
captures incoming packets at the entry of the XDP program.
Red Hat provides xdpdump
as an unsupported Technology Preview.
Note that xdpdump
has no packet filter or decode capabilities. However, you can use it in combination with tcpdump
for packet decoding.
The procedure describes how to capture all packets on the enp1s0
interface and write them to the /root/capture.pcap
file.
Prerequisites
- A network driver that supports XDP programs.
-
An XDP program is loaded to the
enp1s0
interface. If no program is loaded,xdpdump
captures packets in a similar waytcpdump
does, for backward compatibility.
Procedure
To capture packets on the
enp1s0
interface and write them to the/root/capture.pcap
file, enter:#
xdpdump -i enp1s0 -w /root/capture.pcap
- To stop capturing packets, press Ctrl+C.
Additional resources
-
For further details about
xdpdump
, see thexdpdump(8)
man page. -
If you are a developer and you are interested in the source code of
xdpdump
, download and install the corresponding source RPM (SRPM) from the Red Hat Customer Portal.
41.2. Additional resources
- The How to capture network packets with tcpdump? knowledge base solution.
Chapter 42. Using a specific kernel version in RHEL
The kernel is a core component of a Linux operating system that manages the system resources, and provides the interface between hardware and software applications. In some cases, the kernel might affect the network functionality so it is always recommended to use the latest version of the kernel. If required, it is also possible to downgrade the kernel version to a previous version of the same x-stream kernel and select specific version while system boot-up for troubleshooting.
This section explains how to select a kernel in the GRUB boot loader in case you upgrade or downgrade the kernel.
42.1. Starting RHEL using a previous kernel version
By default, after you update, the system boots the latest version of the kernel. Red Hat Enterprise Linux allows to have three kernel versions installed at the same time. This is defined in the /etc/dnf/dnf.conf
file (installonly_limit=3
).
If you observe any issues when the system is loaded with the new kernel, you can reboot it with the previous kernel and restore the production machine. Contact support for troubleshooting the issue.
Procedure
- Start the system.
- In the GRUB boot loader, you see the installed kernels. Use the ↑ and ↓ keys to select a kernel, and press Enter to boot it.
Additional resources
-
Changing the default kernel to boot using the
grubby
tool. - For more information on installing and updating the Kernel, refer to the Updating Kernel with yum section.
Chapter 43. Providing DHCP services
The Dynamic Host Configuration Protocol (DHCP) is a network protocol that automatically assigns IP information to clients.
This section explains general information on the dhcpd
service, as well as how to set up a DHCP server and DHCP relay.
If a procedure requires different steps for providing DHCP in IPv4 and IPv6 networks, the sections in this chapter contain procedures for both protocols.
43.1. The differences when using dhcpd for DHCPv4 and DHCPv6
The dhcpd
service supports providing both DHCPv4 and DHCPv6 on one server. However, you need a separate instance of dhcpd
with separate configuration files to provide DHCP for each protocol.
- DHCPv4
-
Configuration file:
/etc/dhcp/dhcpd.conf
-
Systemd service name:
dhcpd
-
Configuration file:
- DHCPv6
-
Configuration file:
/etc/dhcp/dhcpd6.conf
-
Systemd service name:
dhcpd6
-
Configuration file:
43.2. The lease database of the dhcpd service
A DHCP lease is the time period for which the dhcpd
service allocates a network address to a client. The dhcpd
service stores the DHCP leases in the following databases:
-
For DHCPv4:
/var/lib/dhcpd/dhcpd.leases
-
For DHCPv6:
/var/lib/dhcpd/dhcpd6.leases
Manually updating the database files can corrupt the databases.
The lease databases contain information about the allocated leases, such as the IP address assigned to a media access control (MAC) address or the time stamp when the lease expires. Note that all time stamps in the lease databases are in Coordinated Universal Time (UTC).
The dhcpd
service recreates the databases periodically:
The service renames the existing files:
-
/var/lib/dhcpd/dhcpd.leases
to/var/lib/dhcpd/dhcpd.leases~
-
/var/lib/dhcpd/dhcpd6.leases
to/var/lib/dhcpd/dhcpd6.leases~
-
-
The service writes all known leases to the newly created
/var/lib/dhcpd/dhcpd.leases
and/var/lib/dhcpd/dhcpd6.leases
files.
Additional resources
-
For further details about what is stored in the lease database, see the
dhcpd.leases(5)
man page. - Section 43.10, “Restoring a corrupt lease database”
43.3. Comparison of DHCPv6 to radvd
In an IPv6 network, only router advertisement messages provide information on an IPv6 default gateway. As a consequence, if you want to use DHCPv6 in subnets that require a default gateway setting, you must additionally configure a router advertisement service, such as Router Advertisement Daemon (radvd
).
The radvd
service uses flags in router advertisement packets to announce the availability of a DHCPv6 server.
This section compares DHCPv6 and radvd
, and provides information about configuring radvd
.
DHCPv6 | radvd | |
---|---|---|
Provides information on the default gateway | no | yes |
Guarantees random addresses to protect privacy | yes | no |
Sends further network configuration options | yes | no |
Maps media access control (MAC) addresses to IPv6 addresses | yes | no |
43.4. Configuring the radvd service for IPv6 routers
The router advertisement daemon (radvd
) sends router advertisement messages that are required for IPv6 stateless autoconfiguration. This enables users to automatically configure their addresses, settings, routes, and to choose a default router based on these advertisements.
The procedure in this section explains how to configure radvd
.
Prerequisites
-
You are logged in as the
root
user.
Procedure
Install the
radvd
package:# yum install radvd
Edit the
/etc/radvd.conf
file, and add the following configuration:interface enp1s0 { AdvSendAdvert on; AdvManagedFlag on; AdvOtherConfigFlag on; prefix 2001:db8:0:1::/64 { }; };
These settings configures
radvd
to send router advertisement messages on theenp1s0
device for the2001:db8:0:1::/64
subnet. TheAdvManagedFlag on
setting defines that the client should receive the IP address from a DHCP server, and theAdvOtherConfigFlag
parameter set toon
defines that clients should receive non-address information from the DHCP server as well.Optionally, configure that
radvd
automatically starts when the system boots:# systemctl enable radvd
Start the
radvd
service:# systemctl start radvd
Optionally, display the content of router advertisement packages and the configured values
radvd
sends:# radvdump
Additional resources
-
For further details about configuring
radvd
, see theradvd.conf(5)
man page. -
For an example configuration of
radvd
, see the/usr/share/doc/radvd/radvd.conf.example
file.
43.5. Setting network interfaces for the DHCP servers
By default, the dhcpd
service processes requests only on network interfaces that have an IP address in the subnet defined in the configuration file of the service.
For example, in the following scenario, dhcpd
listens only on the enp0s1
network interface:
-
You have only a
subnet
definition for the 192.0.2.0/24 network in the/etc/dhcp/dhcpd.conf
file. -
The
enp0s1
network interface is connected to the 192.0.2.0/24 subnet. -
The
enp7s0
interface is connected to a different subnet.
Only follow the procedure in this section if the DHCP server contains multiple network interfaces connected to the same network but the service should listen only on specific interfaces.
Depending on whether you want to provide DHCP for IPv4, IPv6, or both protocols, see the procedure for:
Prerequisites
-
You are logged in as the
root
user. -
The
dhcp-server
package is installed.
Procedure
For IPv4 networks:
Copy the
/usr/lib/systemd/system/dhcpd.service
file to the/etc/systemd/system/
directory:# cp /usr/lib/systemd/system/dhcpd.service /etc/systemd/system/
Do not edit the
/usr/lib/systemd/system/dhcpd.service
file. Future updates of thedhcp-server
package can override the changes.Edit the
/etc/systemd/system/dhcpd.service
file, and append the names of the interface, thatdhcpd
should listen on to the command in theExecStart
parameter:ExecStart=/usr/sbin/dhcpd -f -cf /etc/dhcp/dhcpd.conf -user dhcpd -group dhcpd --no-pid $DHCPDARGS enp0s1 enp7s0
This example configures that
dhcpd
listens only on theenp0s1
andenp7s0
interfaces.Reload the
systemd
manager configuration:# systemctl daemon-reload
Restart the
dhcpd
service:# systemctl restart dhcpd.service
For IPv6 networks:
Copy the
/usr/lib/systemd/system/dhcpd6.service
file to the/etc/systemd/system/
directory:# cp /usr/lib/systemd/system/dhcpd6.service /etc/systemd/system/
Do not edit the
/usr/lib/systemd/system/dhcpd6.service
file. Future updates of thedhcp-server
package can override the changes.Edit the
/etc/systemd/system/dhcpd6.service
file, and append the names of the interface, thatdhcpd
should listen on to the command in theExecStart
parameter:ExecStart=/usr/sbin/dhcpd -f -6 -cf /etc/dhcp/dhcpd6.conf -user dhcpd -group dhcpd --no-pid $DHCPDARGS enp0s1 enp7s0
This example configures that
dhcpd
listens only on theenp0s1
andenp7s0
interfaces.Reload the
systemd
manager configuration:# systemctl daemon-reload
Restart the
dhcpd6
service:# systemctl restart dhcpd6.service
43.6. Setting up the DHCP service for subnets directly connected to the DHCP server
Use the following procedure if the DHCP server is directly connected to the subnet for which the server should answer DHCP requests. This is the case if a network interface of the server has an IP address of this subnet assigned.
Depending on whether you want to provide DHCP for IPv4, IPv6, or both protocols, see the procedure for:
Prerequisites
-
You are logged in as the
root
user. -
The
dhcpd-server
package is installed.
Procedure
For IPv4 networks:
Edit the
/etc/dhcp/dhcpd.conf
file:Optionally, add global parameters that
dhcpd
uses as default if no other directives contain these settings:option domain-name "example.com"; default-lease-time 86400;
This example sets the default domain name for the connection to
example.com
, and the default lease time to86400
seconds (1 day).Add the
authoritative
statement on a new line:authoritative;
ImportantWithout the
authoritative
statement, thedhcpd
service does not answerDHCPREQUEST
messages withDHCPNAK
if a client asks for an address that is outside of the pool.For each IPv4 subnet directly connected to an interface of the server, add a
subnet
declaration:subnet 192.0.2.0 netmask 255.255.255.0 { range 192.0.2.20 192.0.2.100; option domain-name-servers 192.0.2.1; option routers 192.0.2.1; option broadcast-address 192.0.2.255; max-lease-time 172800; }
This example adds a subnet declaration for the 192.0.2.0/24 network. With this configuration, the DHCP server assigns the following settings to a client that sends a DHCP request from this subnet:
-
A free IPv4 address from the range defined in the
range
parameter -
IP of the DNS server for this subnet:
192.0.2.1
-
Default gateway for this subnet:
192.0.2.1
-
Broadcast address for this subnet:
192.0.2.255
-
The maximum lease time, after which clients in this subnet release the IP and send a new request to the server:
172800
seconds (2 days)
-
A free IPv4 address from the range defined in the
Optionally, configure that
dhcpd
starts automatically when the system boots:# systemctl enable dhcpd
Start the
dhcpd
service:# systemctl start dhcpd
For IPv6 networks:
Edit the
/etc/dhcp/dhcpd6.conf
file:Optionally, add global parameters that
dhcpd
uses as default if no other directives contain these settings:option dhcp6.domain-search "example.com"; default-lease-time 86400;
This example sets the default domain name for the connection to
example.com
, and the default lease time to86400
seconds (1 day).Add the
authoritative
statement on a new line:authoritative;
ImportantWithout the
authoritative
statement, thedhcpd
service does not answerDHCPREQUEST
messages withDHCPNAK
if a client asks for an address that is outside of the pool.For each IPv6 subnet directly connected to an interface of the server, add a
subnet
declaration:subnet6 2001:db8:0:1::/64 { range6 2001:db8:0:1::20 2001:db8:0:1::100; option dhcp6.name-servers 2001:db8:0:1::1; max-lease-time 172800; }
This example adds a subnet declaration for the 2001:db8:0:1::/64 network. With this configuration, the DHCP server assigns the following settings to a client that sends a DHCP request from this subnet:
-
A free IPv6 address from the range defined in the
range6
parameter. -
The IP of the DNS server for this subnet is
2001:db8:0:1::1
. The maximum lease time, after which clients in this subnet release the IP and send a new request to the server is
172800
seconds (2 days).Note that IPv6 requires uses router advertisement messages to identify the default gateway.
-
A free IPv6 address from the range defined in the
Optionally, configure that
dhcpd6
starts automatically when the system boots:# systemctl enable dhcpd6
Start the
dhcpd6
service:# systemctl start dhcpd6
Additional resources
-
For a list of all parameters you can set in
/etc/dhcp/dhcpd.conf
and/etc/dhcp/dhcpd6.conf
, see thedhcp-options(5)
man page. -
For further details about the
authoritative
statement, seeThe authoritative statement
section in thedhcpd.conf(5)
man page. -
For example configurations, see the
/usr/share/doc/dhcp-server/dhcpd.conf.example
and/usr/share/doc/dhcp-server/dhcpd6.conf.example
files.
43.7. Setting up the DHCP service for subnets that are not directly connected to the DHCP server
Use the following procedure if the DHCP server is not directly connected to the subnet for which the server should answer DHCP requests. This is the case if a DHCP relay agent forwards requests to the DHCP server, because none of the DHCP server’s interfaces is directly connected to the subnet the server should serve.
Depending on whether you want to provide DHCP for IPv4, IPv6, or both protocols, see the procedure for:
Prerequisites
-
You are logged in as the
root
user. -
The
dhcpd-server
package is installed.
Procedure
For IPv4 networks:
Edit the
/etc/dhcp/dhcpd.conf
file:Optionally, add global parameters that
dhcpd
uses as default if no other directives contain these settings:option domain-name "example.com"; default-lease-time 86400;
This example sets the default domain name for the connection to
example.com
, and the default lease time to86400
seconds (1 day).Add the
authoritative
statement on a new line:authoritative;
ImportantWithout the
authoritative
statement, thedhcpd
service does not answerDHCPREQUEST
messages withDHCPNAK
if a client asks for an address that is outside of the pool.Add a
shared-network
declaration, such as the following, for IPv4 subnets that are not directly connected to an interface of the server:shared-network example { option domain-name-servers 192.0.2.1; ... subnet 192.0.2.0 netmask 255.255.255.0 { range 192.0.2.20 192.0.2.100; option routers 192.0.2.1; } subnet 198.51.100.0 netmask 255.255.255.0 { range 198.51.100.20 198.51.100.100; option routers 198.51.100.1; } ... }
This example adds a shared network declaration, that contains a
subnet
declaration for both the 192.0.2.0/24 and 198.51.100.0/24 networks. With this configuration, the DHCP server assigns the following settings to a client that sends a DHCP request from one of these subnets:-
The IP of the DNS server for clients from both subnets is:
192.0.2.1
. -
A free IPv4 address from the range defined in the
range
parameter, depending on from which subnet the client sent the request. -
The default gateway is either
192.0.2.1
or198.51.100.1
depending on from which subnet the client sent the request.
-
The IP of the DNS server for clients from both subnets is:
Add a
subnet
declaration for the subnet the server is directly connected to and that is used to reach the remote subnets specified inshared-network
above:subnet 203.0.113.0 netmask 255.255.255.0 { }
NoteIf the server does not provide DHCP service to this subnet, the
subnet
declaration must be empty as shown in the example. Without a declaration for the directly connected subnet,dhcpd
does not start.
Optionally, configure that
dhcpd
starts automatically when the system boots:# systemctl enable dhcpd
Start the
dhcpd
service:# systemctl start dhcpd
For IPv6 networks:
Edit the
/etc/dhcp/dhcpd6.conf
file:Optionally, add global parameters that
dhcpd
uses as default if no other directives contain these settings:option dhcp6.domain-search "example.com"; default-lease-time 86400;
This example sets the default domain name for the connection to
example.com
, and the default lease time to86400
seconds (1 day).Add the
authoritative
statement on a new line:authoritative;
ImportantWithout the
authoritative
statement, thedhcpd
service does not answerDHCPREQUEST
messages withDHCPNAK
if a client asks for an address that is outside of the pool.Add a
shared-network
declaration, such as the following, for IPv6 subnets that are not directly connected to an interface of the server:shared-network example { option domain-name-servers 2001:db8:0:1::1:1 ... subnet6 2001:db8:0:1::1:0/120 { range6 2001:db8:0:1::1:20 2001:db8:0:1::1:100 } subnet6 2001:db8:0:1::2:0/120 { range6 2001:db8:0:1::2:20 2001:db8:0:1::2:100 } ... }
This example adds a shared network declaration that contains a
subnet6
declaration for both the 2001:db8:0:1::1:0/120 and 2001:db8:0:1::2:0/120 networks. With this configuration, the DHCP server assigns the following settings to a client that sends a DHCP request from one of these subnets:-
The IP of the DNS server for clients from both subnets is
2001:db8:0:1::1:1
. A free IPv6 address from the range defined in the
range6
parameter, depending on from which subnet the client sent the request.Note that IPv6 requires uses router advertisement messages to identify the default gateway.
-
The IP of the DNS server for clients from both subnets is
Add a
subnet6
declaration for the subnet the server is directly connected to and that is used to reach the remote subnets specified inshared-network
above:subnet6 2001:db8:0:1::50:0/120 { }
NoteIf the server does not provide DHCP service to this subnet, the
subnet6
declaration must be empty as shown in the example. Without a declaration for the directly connected subnet,dhcpd
does not start.
Optionally, configure that
dhcpd6
starts automatically when the system boots:# systemctl enable dhcpd6
Start the
dhcpd6
service:# systemctl start dhcpd6
Additional resources
-
For a list of all parameters you can set in
/etc/dhcp/dhcpd.conf
and/etc/dhcp/dhcpd6.conf
, see thedhcp-options(5)
man page. -
For further details about the
authoritative
statement, seeThe authoritative statement
section in thedhcpd.conf(5)
man page. -
For example configurations, see the
/usr/share/doc/dhcp-server/dhcpd.conf.example
and/usr/share/doc/dhcp-server/dhcpd6.conf.example
files. - Section 43.11, “Setting up a DHCP relay agent”
43.8. Assigning a static address to a host using DHCP
Using a host
declaration, you can configure the DHCP server to assign a fixed IP address to a media access control (MAC) address of a host. For example, use this method to always assign the same IP address to a server or network device.
If you configure a fixed IP address for a MAC address, the IP address must be outside of the address pool you specified in the fixed-address
and fixed-address6
parameters.
Depending on whether you want to configure fixed addresses for IPv4, IPv6, or both protocols, see the procedure for:
Prerequisites
-
The
dhcpd
service is configured and running. -
You are logged in as the
root
user.
Procedure
For IPv4 networks:
Edit the
/etc/dhcp/dhcpd.conf
file:Add a
host
declaration:host server.example.com { hardware ethernet 52:54:00:72:2f:6e; fixed-address 192.0.2.130; }
This example configures the DHCP server to always assigns the
192.0.2.130
IP address to the host with the52:54:00:72:2f:6e
MAC address.The
dhcpd
service identifies systems by the MAC address specified in thefixed-address
parameter, and not by the name in thehost
declaration. As a consequence, you can set this name to any string that does not match otherhost
declarations. To configure the same system for multiple networks, use a different name, otherwise,dhcpd
fails to start.-
Optionally, add further settings to the
host
declaration that are specific for this host.
Restart the
dhcpd
service:# systemctl start dhcpd
For IPv6 networks:
Edit the
/etc/dhcp/dhcpd6.conf
file:Add a
host
declaration:host server.example.com { hardware ethernet 52:54:00:72:2f:6e; fixed-address6 2001:db8:0:1::200; }
This example configures the DHCP server to always assign the
2001:db8:0:1::20
IP address to the host with the52:54:00:72:2f:6e
MAC address.The
dhcpd
service identifies systems by the MAC address specified in thefixed-address6
parameter, and not by the name in thehost
declaration. As a consequence, you can set this name to any string, as long as it is unique to otherhost
declarations. To configure the same system for multiple networks, use a different name because, otherwise,dhcpd
fails to start.-
Optionally, add further settings to the
host
declaration that are specific for this host.
Restart the
dhcpd6
service:# systemctl start dhcpd6
Additional resources
-
For a list of all parameters you can set in
/etc/dhcp/dhcpd.conf
and/etc/dhcp/dhcpd6.conf
, see thedhcp-options(5)
man page. -
For example configurations, see the
/usr/share/doc/dhcp-server/dhcpd.conf.example
and/usr/share/doc/dhcp-server/dhcpd6.conf.example
files.
43.10. Restoring a corrupt lease database
If the DHCP server logs an error that is related to the lease database, such as Corrupt lease file - possible data loss!
,you can restore the lease database from the copy the dhcpd
service created. Note that this copy might not reflect the latest status of the database.
If you remove the lease database instead of replacing it with a backup, you lose all information about the currently assigned leases. As a consequence, the DHCP server could assign leases to clients that have been previously assigned to other hosts and are not expired yet. This leads to IP conflicts.
Depending on whether you want to restore the DHCPv4, DHCPv6, or both databases, see the procedure for:
Prerequisites
-
You are logged in as the
root
user. - The lease database is corrupt.
Procedure
Restoring the DHCPv4 lease database:
Stop the
dhcpd
service:# systemctl stop dhcpd
Rename the corrupt lease database:
# mv /var/lib/dhcpd/dhcpd.leases /var/lib/dhcpd/dhcpd.leases.corrupt
Restore the copy of the lease database that the
dhcp
service created when it refreshed the lease database:# cp -p /var/lib/dhcpd/dhcpd.leases~ /var/lib/dhcpd/dhcpd.leases
ImportantIf you have a more recent backup of the lease database, restore this backup instead.
Start the
dhcpd
service:# systemctl start dhcpd
Restoring the DHCPv6 lease database:
Stop the
dhcpd6
service:# systemctl stop dhcpd6
Rename the corrupt lease database:
# mv /var/lib/dhcpd/dhcpd6.leases /var/lib/dhcpd/dhcpd6.leases.corrupt
Restore the copy of the lease database that the
dhcp
service created when it refreshed the lease database:# cp -p /var/lib/dhcpd/dhcpd6.leases~ /var/lib/dhcpd/dhcpd6.leases
ImportantIf you have a more recent backup of the lease database, restore this backup instead.
Start the
dhcpd6
service:# systemctl start dhcpd6
Additional resources
43.11. Setting up a DHCP relay agent
The DHCP Relay Agent (dhcrelay
) enables the relay of DHCP and BOOTP requests from a subnet with no DHCP server on it to one or more DHCP servers on other subnets. When a DHCP client requests information, the DHCP Relay Agent forwards the request to the list of DHCP servers specified. When a DHCP server returns a reply, the DHCP Relay Agent forwards this request to the client.
Depending on whether you want to set up a DHCP relay for IPv4, IPv6, or both protocols, see the procedure for:
Prerequisites
-
You are logged in as the
root
user.
Procedure
For IPv4 networks:
Install the
dhcp-relay
package:# yum install dhcp-relay
Copy the
/lib/systemd/system/dhcrelay.service
file to the/etc/systemd/system/
directory:# cp /lib/systemd/system/dhcrelay.service /etc/systemd/system/
Do not edit the
/usr/lib/systemd/system/dhcrelay.service
file. Future updates of thedhcp-relay
package can override the changes.Edit the
/etc/systemd/system/dhcrelay.service
file, and append the-i interface
parameter, together with a list of IP addresses of DHCPv4 servers that are responsible for the subnet:ExecStart=/usr/sbin/dhcrelay -d --no-pid -i enp1s0 192.0.2.1
With these additional parameters,
dhcrelay
listens for DHCPv4 requests on theenp1s0
interface and forwards them to the DHCP server with the IP192.0.2.1
.Reload the
systemd
manager configuration:# systemctl daemon-reload
Optionally, configure that the
dhcrelay
service starts when the system boots:# systemctl enable dhcrelay.service
Start the
dhcrelay
service:# systemctl start dhcrelay.service
For IPv6 networks:
Install the
dhcp-relay
package:# yum install dhcp-relay
Copy the
/lib/systemd/system/dhcrelay.service
file to the/etc/systemd/system/
directory and name the filedhcrelay6.service
:# cp /lib/systemd/system/dhcrelay.service /etc/systemd/system/dhcrelay6.service
Do not edit the
/usr/lib/systemd/system/dhcrelay.service
file. Future updates of thedhcp-relay
package can override the changes.Edit the
/etc/systemd/system/dhcrelay6.service
file, and append the-l receiving_interface
and-u outgoing_interface
parameters:ExecStart=/usr/sbin/dhcrelay -d --no-pid -l enp1s0 -u enp7s0
With these additional parameters,
dhcrelay
listens for DHCPv6 requests on theenp1s0
interface and forwards them to the network connected to theenp7s0
interface.Reload the
systemd
manager configuration:# systemctl daemon-reload
Optionally, configure that the
dhcrelay6
service starts when the system boots:# systemctl enable dhcrelay6.service
Start the
dhcrelay6
service:# systemctl start dhcrelay6.service
Additional resources
-
For further details about
dhcrelay
, see thedhcrelay(8)
man page.
Additional resources
Chapter 44. Using and configuring firewalld
A firewall is a way to protect machines from any unwanted traffic from outside. It enables users to control incoming network traffic on host machines by defining a set of firewall rules. These rules are used to sort the incoming traffic and either block it or allow through.
Note that firewalld
with nftables
backend does not support passing custom nftables
rules to firewalld
, using the --direct
option.
44.1. When to use firewalld, nftables, or iptables
The following is a brief overview in which scenario you should use one of the following utilities:
-
firewalld
: Use thefirewalld
utility for simple firewall use cases. The utility is easy to use and covers the typical use cases for these scenarios. -
nftables
: Use thenftables
utility to set up complex and performance critical firewalls, such as for a whole network. -
iptables
: Theiptables
utility on Red Hat Enterprise Linux 8 uses thenf_tables
kernel API instead of thelegacy
back end. Thenf_tables
API provides backward compatibility so that scripts that useiptables
commands still work on Red Hat Enterprise Linux 8. For new firewall scripts, Red Hat recommends to usenftables
.
To avoid that the different firewall services influence each other, run only one of them on a RHEL host, and disable the other services.
44.2. Getting started with firewalld
44.2.1. firewalld
firewalld
is a firewall service daemon that provides a dynamic customizable host-based firewall with a D-Bus
interface. Being dynamic, it enables creating, changing, and deleting the rules without the necessity to restart the firewall daemon each time the rules are changed.
firewalld
uses the concepts of zones and services, that simplify the traffic management. Zones are predefined sets of rules. Network interfaces and sources can be assigned to a zone. The traffic allowed depends on the network your computer is connected to and the security level this network is assigned. Firewall services are predefined rules that cover all necessary settings to allow incoming traffic for a specific service and they apply within a zone.
Services use one or more ports or addresses for network communication. Firewalls filter communication based on ports. To allow network traffic for a service, its ports must be open. firewalld
blocks all traffic on ports that are not explicitly set as open. Some zones, such as trusted, allow all traffic by default.
Additional resources
-
firewalld(1)
man page
44.2.2. Zones
firewalld
can be used to separate networks into different zones according to the level of trust that the user has decided to place on the interfaces and traffic within that network. A connection can only be part of one zone, but a zone can be used for many network connections.
NetworkManager
notifies firewalld
of the zone of an interface. You can assign zones to interfaces with:
-
NetworkManager
-
firewall-config
tool -
firewall-cmd
command-line tool - The RHEL web console
The latter three can only edit the appropriate NetworkManager
configuration files. If you change the zone of the interface using the web console, firewall-cmd
or firewall-config
, the request is forwarded to NetworkManager
and is not handled by firewalld
.
The predefined zones are stored in the /usr/lib/firewalld/zones/
directory and can be instantly applied to any available network interface. These files are copied to the /etc/firewalld/zones/
directory only after they are modified. The default settings of the predefined zones are as follows:
block
-
Any incoming network connections are rejected with an icmp-host-prohibited message for
IPv4
and icmp6-adm-prohibited forIPv6
. Only network connections initiated from within the system are possible. dmz
- For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.
drop
- Any incoming network packets are dropped without any notification. Only outgoing network connections are possible.
external
- For use on external networks with masquerading enabled, especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.
home
- For use at home when you mostly trust the other computers on the network. Only selected incoming connections are accepted.
internal
- For use on internal networks when you mostly trust the other computers on the network. Only selected incoming connections are accepted.
public
- For use in public areas where you do not trust other computers on the network. Only selected incoming connections are accepted.
trusted
- All network connections are accepted.
work
- For use at work where you mostly trust the other computers on the network. Only selected incoming connections are accepted.
One of these zones is set as the default zone. When interface connections are added to NetworkManager
, they are assigned to the default zone. On installation, the default zone in firewalld
is set to be the public
zone. The default zone can be changed.
The network zone names should be self-explanatory and to allow users to quickly make a reasonable decision. To avoid any security problems, review the default zone configuration and disable any unnecessary services according to your needs and risk assessments.
Additional resources
-
firewalld.zone(5)
man page
44.2.3. Predefined services
A service can be a list of local ports, protocols, source ports, and destinations, as well as a list of firewall helper modules automatically loaded if a service is enabled. Using services saves users time because they can achieve several tasks, such as opening ports, defining protocols, enabling packet forwarding and more, in a single step, rather than setting up everything one after another.
Service configuration options and generic file information are described in the firewalld.service(5)
man page. The services are specified by means of individual XML configuration files, which are named in the following format: service-name.xml
. Protocol names are preferred over service or application names in firewalld
.
Services can be added and removed using the graphical firewall-config
tool, firewall-cmd
, and firewall-offline-cmd
.
Alternatively, you can edit the XML files in the /etc/firewalld/services/
directory. If a service is not added or changed by the user, then no corresponding XML file is found in /etc/firewalld/services/
. The files in the /usr/lib/firewalld/services/
directory can be used as templates if you want to add or change a service.
Additional resources
-
firewalld.service(5)
man page
44.3. Installing the firewall-config
GUI configuration tool
To use the firewall-config
GUI configuration tool, install the firewall-config
package.
Procedure
Enter the following command as
root
:# yum install firewall-config
Alternatively, in
GNOME, use the Super key and type `Software
to launch theSoftware Sources
application. Typefirewall
to the search box, which appears after selecting the search button in the top-right corner. Select theFirewall
item from the search results, and click on the button.-
To run
firewall-config
, use either thefirewall-config
command or press the Super key to enter theActivities Overview
, typefirewall
, and press Enter.
44.4. Viewing the current status and settings of firewalld
44.4.1. Viewing the current status of firewalld
The firewall service, firewalld
, is installed on the system by default. Use the firewalld
CLI interface to check that the service is running.
Procedure
To see the status of the service:
# firewall-cmd --state
For more information about the service status, use the
systemctl status
sub-command:# systemctl status firewalld firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago Docs: man:firewalld(1) Main PID: 705 (firewalld) Tasks: 2 (limit: 4915) CGroup: /system.slice/firewalld.service └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid
Additional resources
It is important to know how firewalld
is set up and which rules are in force before you try to edit the settings. To display the firewall settings, see Section 44.4.2, “Viewing current firewalld settings”
44.4.2. Viewing current firewalld settings
44.4.2.1. Viewing allowed services using GUI
To view the list of services using the graphical firewall-config tool, press the Super key to enter the Activities Overview, type firewall
, and press Enter. The firewall-config tool appears. You can now view the list of services under the Services
tab.
Alternatively, to start the graphical firewall configuration tool using the command-line, enter the following command:
$ firewall-config
The Firewall Configuration
window opens. Note that this command can be run as a normal user, but you are prompted for an administrator password occasionally.
44.4.2.2. Viewing firewalld
settings using CLI
With the CLI client, it is possible to get different views of the current firewall settings. The --list-all
option shows a complete overview of the firewalld
settings.
firewalld
uses zones to manage the traffic. If a zone is not specified by the --zone
option, the command is effective in the default zone assigned to the active network interface and connection.
To list all the relevant information for the default zone:
# firewall-cmd --list-all public target: default icmp-block-inversion: no interfaces: sources: services: ssh dhcpv6-client ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules:
To specify the zone for which to display the settings, add the --zone=zone-name
argument to the firewall-cmd --list-all
command, for example:
# firewall-cmd --list-all --zone=home home target: default icmp-block-inversion: no interfaces: sources: services: ssh mdns samba-client dhcpv6-client ... [trimmed for clarity]
To see the settings for particular information, such as services or ports, use a specific option. See the firewalld
manual pages or get a list of the options using the command help:
# firewall-cmd --help Usage: firewall-cmd [OPTIONS...] General Options -h, --help Prints a short help text and exists -V, --version Print the version string of firewalld -q, --quiet Do not print status messages Status Options --state Return and print firewalld state --reload Reload firewall and keep state information ... [trimmed for clarity]
For example, to see which services are allowed in the current zone:
# firewall-cmd --list-services ssh dhcpv6-client
Listing the settings for a certain subpart using the CLI tool can sometimes be difficult to interpret. For example, you allow the SSH
service and firewalld
opens the necessary port (22) for the service. Later, if you list the allowed services, the list shows the SSH
service, but if you list open ports, it does not show any. Therefore, it is recommended to use the --list-all
option to make sure you receive a complete information.
44.5. Starting firewalld
Procedure
To start
firewalld
, enter the following command asroot
:# systemctl unmask firewalld # systemctl start firewalld
To ensure
firewalld
starts automatically at system start, enter the following command asroot
:# systemctl enable firewalld
44.6. Stopping firewalld
Procedure
To stop
firewalld
, enter the following command asroot
:# systemctl stop firewalld
To prevent
firewalld
from starting automatically at system start:# systemctl disable firewalld
To make sure firewalld is not started by accessing the
firewalld
D-Bus
interface and also if other services requirefirewalld
:# systemctl mask firewalld
44.7. Runtime and permanent settings
Any changes committed in runtime mode only apply while firewalld
is running. When firewalld
is restarted, the settings revert to their permanent values.
To make the changes persistent across reboots, apply them again using the --permanent
option. Alternatively, to make changes persistent while firewalld
is running, use the --runtime-to-permanent
firewall-cmd
option.
If you set the rules while firewalld
is running using only the --permanent
option, they do not become effective before firewalld
is restarted. However, restarting firewalld
closes all open ports and stops the networking traffic.
Modifying settings in runtime and permanent configuration using CLI
Using the CLI, you do not modify the firewall settings in both modes at the same time. You only modify either runtime or permanent mode. To modify the firewall settings in the permanent mode, use the --permanent
option with the firewall-cmd
command.
# firewall-cmd --permanent <other options>
Without this option, the command modifies runtime mode.
To change settings in both modes, you can use two methods:
Change runtime settings and then make them permanent as follows:
# firewall-cmd <other options> # firewall-cmd --runtime-to-permanent
Set permanent settings and reload the settings into runtime mode:
# firewall-cmd --permanent <other options> # firewall-cmd --reload
The first method allows you to test the settings before you apply them to the permanent mode.
It is possible, especially on remote systems, that an incorrect setting results in a user locking themselves out of a machine. To prevent such situations, use the --timeout
option. After a specified amount of time, any change reverts to its previous state. Using this options excludes the --permanent
option.
For example, to add the SSH
service for 15 minutes:
# firewall-cmd --add-service=ssh --timeout 15m
44.8. Verifying the permanent firewalld configuration
In certain situations, for example after manually editing firewalld
configuration files, administrators want to verify that the changes are correct. This section describes how to verify the permanent configuration of the firewalld
service.
Prerequisites
-
The
firewalld
service is running.
Procedure
Verify the permanent configuration of the
firewalld
service:# firewall-cmd --check-config success
If the permanent configuration is valid, the command returns
success
. In other cases, the command returns an error with further details, such as the following:# firewall-cmd --check-config Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}
44.9. Controlling network traffic using firewalld
44.9.1. Disabling all traffic in case of emergency using CLI
In an emergency situation, such as a system attack, it is possible to disable all network traffic and cut off the attacker.
Procedure
To immediately disable networking traffic, switch panic mode on:
# firewall-cmd --panic-on
Enabling panic mode stops all networking traffic. From this reason, it should be used only when you have the physical access to the machine or if you are logged in using a serial console.
Switching off panic mode reverts the firewall to its permanent settings. To switch panic mode off:
# firewall-cmd --panic-off
To see whether panic mode is switched on or off, use:
# firewall-cmd --query-panic
44.9.2. Controlling traffic with predefined services using CLI
The most straightforward method to control traffic is to add a predefined service to firewalld
. This opens all necessary ports and modifies other settings according to the service definition file.
Procedure
Check that the service is not already allowed:
# firewall-cmd --list-services ssh dhcpv6-client
List all predefined services:
# firewall-cmd --get-services RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine condor-collector ctdb dhcp dhcpv6 dhcpv6-client dns docker-registry ... [trimmed for clarity]
Add the service to the allowed services:
# firewall-cmd --add-service=<service-name>
Make the new settings persistent:
# firewall-cmd --runtime-to-permanent
44.9.3. Controlling traffic with predefined services using GUI
To enable or disable a predefined or custom service:
- Start the firewall-config tool and select the network zone whose services are to be configured.
-
Select the
Services
tab. - Select the check box for each type of service you want to trust or clear the check box to block a service.
To edit a service:
- Start the firewall-config tool.
-
Select
Permanent
from the menu labeledConfiguration
. Additional icons and menu buttons appear at the bottom of the window. - Select the service you want to configure.
The Ports
, Protocols
, and Source Port
tabs enable adding, changing, and removing of ports, protocols, and source port for the selected service. The modules tab is for configuring Netfilter helper modules. The Destination
tab enables limiting traffic to a particular destination address and Internet Protocol (IPv4
or IPv6
).
It is not possible to alter service settings in Runtime
mode.
44.9.4. Adding new services
Services can be added and removed using the graphical firewall-config tool, firewall-cmd
, and firewall-offline-cmd
. Alternatively, you can edit the XML files in /etc/firewalld/services/
. If a service is not added or changed by the user, then no corresponding XML file are found in /etc/firewalld/services/
. The files /usr/lib/firewalld/services/
can be used as templates if you want to add or change a service.
Service names must be alphanumeric and can, additionally, include only _
(underscore) and -
(dash) characters.
Procedure
To add a new service in a terminal, use firewall-cmd
, or firewall-offline-cmd
in case of not active firewalld
.
Enter the following command to add a new and empty service:
$
firewall-cmd --new-service=service-name --permanent
To add a new service using a local file, use the following command:
$
firewall-cmd --new-service-from-file=service-name.xml --permanent
You can change the service name with the additional
--name=service-name
option.As soon as service settings are changed, an updated copy of the service is placed into
/etc/firewalld/services/
.As
root
, you can enter the following command to copy a service manually:# cp /usr/lib/firewalld/services/service-name.xml /etc/firewalld/services/service-name.xml
firewalld
loads files from /usr/lib/firewalld/services
in the first place. If files are placed in /etc/firewalld/services
and they are valid, then these will override the matching files from /usr/lib/firewalld/services
. The overridden files in /usr/lib/firewalld/services
are used as soon as the matching files in /etc/firewalld/services
have been removed or if firewalld
has been asked to load the defaults of the services. This applies to the permanent environment only. A reload is needed to get these fallbacks also in the runtime environment.
44.9.5. Controlling ports using CLI
Ports are logical devices that enable an operating system to receive and distinguish network traffic and forward it accordingly to system services. These are usually represented by a daemon that listens on the port, that is it waits for any traffic coming to this port.
Normally, system services listen on standard ports that are reserved for them. The httpd
daemon, for example, listens on port 80. However, system administrators by default configure daemons to listen on different ports to enhance security or for other reasons.
44.9.5.1. Opening a port
Through open ports, the system is accessible from the outside, which represents a security risk. Generally, keep ports closed and only open them if they are required for certain services.
Procedure
To get a list of open ports in the current zone:
List all allowed ports:
# firewall-cmd --list-ports
Add a port to the allowed ports to open it for incoming traffic:
# firewall-cmd --add-port=port-number/port-type
Make the new settings persistent:
# firewall-cmd --runtime-to-permanent
The port types are either tcp
, udp
, sctp
, or dccp
. The type must match the type of network communication.
44.9.5.2. Closing a port
When an open port is no longer needed, close that port in firewalld
. It is highly recommended to close all unnecessary ports as soon as they are not used because leaving a port open represents a security risk.
Procedure
To close a port, remove it from the list of allowed ports:
List all allowed ports:
# firewall-cmd --list-ports [WARNING] ==== This command will only give you a list of ports that have been opened as ports. You will not be able to see any open ports that have been opened as a service. Therefore, you should consider using the --list-all option instead of --list-ports. ====
Remove the port from the allowed ports to close it for the incoming traffic:
# firewall-cmd --remove-port=port-number/port-type
Make the new settings persistent:
# firewall-cmd --runtime-to-permanent
44.9.6. Opening ports using GUI
To permit traffic through the firewall to a certain port:
- Start the firewall-config tool and select the network zone whose settings you want to change.
-
Select the
Ports
tab and click the button on the right-hand side. ThePort and Protocol
window opens. - Enter the port number or range of ports to permit.
-
Select
tcp
orudp
from the list.
44.9.7. Controlling traffic with protocols using GUI
To permit traffic through the firewall using a certain protocol:
- Start the firewall-config tool and select the network zone whose settings you want to change.
-
Select the
Protocols
tab and click theAdd
button on the right-hand side. TheProtocol
window opens. -
Either select a protocol from the list or select the
Other Protocol
check box and enter the protocol in the field.
44.9.8. Opening source ports using GUI
To permit traffic through the firewall from a certain port:
- Start the firewall-config tool and select the network zone whose settings you want to change.
-
Select the
Source Port
tab and click theAdd
button on the right-hand side. TheSource Port
window opens. -
Enter the port number or range of ports to permit. Select
tcp
orudp
from the list.
44.10. Working with firewalld zones
Zones represent a concept to manage incoming traffic more transparently. The zones are connected to networking interfaces or assigned a range of source addresses. You manage firewall rules for each zone independently, which enables you to define complex firewall settings and apply them to the traffic.
44.10.1. Listing zones
Procedure
To see which zones are available on your system:
# firewall-cmd --get-zones
The
firewall-cmd --get-zones
command displays all zones that are available on the system, but it does not show any details for particular zones.To see detailed information for all zones:
# firewall-cmd --list-all-zones
To see detailed information for a specific zone:
# firewall-cmd --zone=zone-name --list-all
44.10.2. Modifying firewalld settings for a certain zone
The Section 44.9.2, “Controlling traffic with predefined services using CLI” and Section 44.9.5, “Controlling ports using CLI” explain how to add services or modify ports in the scope of the current working zone. Sometimes, it is required to set up rules in a different zone.
Procedure
-
To work in a different zone, use the
--zone=zone-name
option. For example, to allow theSSH
service in the zone public:
# firewall-cmd --add-service=ssh --zone=public
44.10.3. Changing the default zone
System administrators assign a zone to a networking interface in its configuration files. If an interface is not assigned to a specific zone, it is assigned to the default zone. After each restart of the firewalld
service, firewalld
loads the settings for the default zone and makes it active.
Procedure
To set up the default zone:
Display the current default zone:
# firewall-cmd --get-default-zone
Set the new default zone:
# firewall-cmd --set-default-zone zone-name
NoteFollowing this procedure, the setting is a permanent setting, even without the
--permanent
option.
44.10.4. Assigning a network interface to a zone
It is possible to define different sets of rules for different zones and then change the settings quickly by changing the zone for the interface that is being used. With multiple interfaces, a specific zone can be set for each of them to distinguish traffic that is coming through them.
Procedure
To assign the zone to a specific interface:
List the active zones and the interfaces assigned to them:
# firewall-cmd --get-active-zones
Assign the interface to a different zone:
# firewall-cmd --zone=zone_name --change-interface=interface_name --permanent
44.10.5. Assigning a zone to a connection using nmcli
This procedure describes how to add a firewalld zone to a NetworkManager connection using the nmcli
utility.
Procedure
Assign the zone to the NetworkManager connection profile:
# nmcli connection modify profile connection.zone zone_name
Reload the connection:
# nmcli connection up profile
44.10.6. Manually assigning a zone to a network connection in an ifcfg file
When the connection is managed by NetworkManager, it must be aware of a zone that it uses. For every network connection, a zone can be specified, which provides the flexibility of various firewall settings according to the location of the computer with portable devices. Thus, zones and settings can be specified for different locations, such as company or home.
Procedure
To set a zone for a connection, edit the
/etc/sysconfig/network-scripts/ifcfg-connection_name
file and add a line that assigns a zone to this connection:ZONE=zone_name
44.10.7. Creating a new zone
To use custom zones, create a new zone and use it just like a predefined zone. New zones require the --permanent
option, otherwise the command does not work.
Procedure
To create a new zone:
Create a new zone:
# firewall-cmd --new-zone=zone-name
Check if the new zone is added to your permanent settings:
# firewall-cmd --get-zones
Make the new settings persistent:
# firewall-cmd --runtime-to-permanent
44.10.8. Zone configuration files
Zones can also be created using a zone configuration file. This approach can be helpful when you need to create a new zone, but want to reuse the settings from a different zone and only alter them a little.
A firewalld
zone configuration file contains the information for a zone. These are the zone description, services, ports, protocols, icmp-blocks, masquerade, forward-ports and rich language rules in an XML file format. The file name has to be zone-name.xml
where the length of zone-name is currently limited to 17 chars. The zone configuration files are located in the /usr/lib/firewalld/zones/
and /etc/firewalld/zones/
directories.
The following example shows a configuration that allows one service (SSH
) and one port range, for both the TCP
and UDP
protocols:
<?xml version="1.0" encoding="utf-8"?> <zone> <short>My zone</short> <description>Here you can describe the characteristic features of the zone.</description> <service name="ssh"/> <port port="1025-65535" protocol="tcp"/> <port port="1025-65535" protocol="udp"/> </zone>
To change settings for that zone, add or remove sections to add ports, forward ports, services, and so on.
Additional resources
-
For more information, see the
firewalld.zone
manual pages.
44.10.9. Using zone targets to set default behavior for incoming traffic
For every zone, you can set a default behavior that handles incoming traffic that is not further specified. Such behaviour is defined by setting the target of the zone. There are four options - default
, ACCEPT
, REJECT
, and DROP
. By setting the target to ACCEPT
, you accept all incoming packets except those disabled by a specific rule. If you set the target to REJECT
or DROP
, you disable all incoming packets except those that you have allowed in specific rules. When packets are rejected, the source machine is informed about the rejection, while there is no information sent when the packets are dropped.
Procedure
To set a target for a zone:
List the information for the specific zone to see the default target:
$ firewall-cmd --zone=zone-name --list-all
Set a new target in the zone:
# firewall-cmd --permanent --zone=zone-name --set-target=<default|ACCEPT|REJECT|DROP>
44.11. Using zones to manage incoming traffic depending on a source
44.11.1. Using zones to manage incoming traffic depending on a source
You can use zones to manage incoming traffic based on its source. That enables you to sort incoming traffic and route it through different zones to allow or disallow services that can be reached by that traffic.
If you add a source to a zone, the zone becomes active and any incoming traffic from that source will be directed through it. You can specify different settings for each zone, which is applied to the traffic from the given sources accordingly. You can use more zones even if you only have one network interface.
44.11.2. Adding a source
To route incoming traffic into a specific source, add the source to that zone. The source can be an IP address or an IP mask in the Classless Inter-domain Routing (CIDR) notation.
In case you add multiple zones with an overlapping network range, they are ordered alphanumerically by zone name and only the first one is considered.
To set the source in the current zone:
# firewall-cmd --add-source=<source>
To set the source IP address for a specific zone:
# firewall-cmd --zone=zone-name --add-source=<source>
The following procedure allows all incoming traffic from 192.168.2.15 in the trusted
zone:
Procedure
List all available zones:
# firewall-cmd --get-zones
Add the source IP to the trusted zone in the permanent mode:
# firewall-cmd --zone=trusted --add-source=192.168.2.15
Make the new settings persistent:
# firewall-cmd --runtime-to-permanent
44.11.3. Removing a source
Removing a source from the zone cuts off the traffic coming from it.
Procedure
List allowed sources for the required zone:
# firewall-cmd --zone=zone-name --list-sources
Remove the source from the zone permanently:
# firewall-cmd --zone=zone-name --remove-source=<source>
Make the new settings persistent:
# firewall-cmd --runtime-to-permanent
44.11.4. Adding a source port
To enable sorting the traffic based on a port of origin, specify a source port using the --add-source-port
option. You can also combine this with the --add-source
option to limit the traffic to a certain IP address or IP range.
Procedure
To add a source port:
# firewall-cmd --zone=zone-name --add-source-port=<port-name>/<tcp|udp|sctp|dccp>
44.11.5. Removing a source port
By removing a source port you disable sorting the traffic based on a port of origin.
Procedure
To remove a source port:
# firewall-cmd --zone=zone-name --remove-source-port=<port-name>/<tcp|udp|sctp|dccp>
44.11.6. Using zones and sources to allow a service for only a specific domain
To allow traffic from a specific network to use a service on a machine, use zones and source. The following procedure allows traffic from 192.168.1.0/24 to be able to reach the HTTP service while any other traffic is blocked.
Procedure
List all available zones:
# firewall-cmd --get-zones block dmz drop external home internal public trusted work
Add the source to the trusted zone to route the traffic originating from the source through the zone:
# firewall-cmd --zone=trusted --add-source=192.168.1.0/24
Add the http service in the trusted zone:
# firewall-cmd --zone=trusted --add-service=http
Make the new settings persistent:
# firewall-cmd --runtime-to-permanent
Check that the trusted zone is active and that the service is allowed in it:
# firewall-cmd --zone=trusted --list-all trusted (active) target: ACCEPT sources: 192.168.1.0/24 services: http
44.11.7. Configuring traffic accepted by a zone based on a protocol
You can allow incoming traffic to be accepted by a zone based on a protocol. All traffic using the specified protocol is accepted by a zone, in which you can apply further rules and filtering.
44.11.7.1. Adding a protocol to a zone
By adding a protocol to a certain zone, you allow all traffic with this protocol to be accepted by this zone.
Procedure
To add a protocol to a zone:
# firewall-cmd --zone=zone-name --add-protocol=port-name/tcp|udp|sctp|dccp|igmp
To receive multicast traffic, use the igmp
value with the --add-protocol
option.
44.11.7.2. Removing a protocol from a zone
By removing a protocol from a certain zone, you stop accepting all traffic based on this protocol by the zone.
Procedure
To remove a protocol from a zone:
# firewall-cmd --zone=zone-name --remove-protocol=port-name/tcp|udp|sctp|dccp|igmp
44.12. Configuring IP address masquerading
The following procedure describes how to enable IP masquerading on your system. IP masquerading hides individual machines behind a gateway when accessing the Internet.
Procedure
To check if IP masquerading is enabled (for example, for the
external
zone), enter the following command asroot
:# firewall-cmd --zone=external --query-masquerade
The command prints
yes
with exit status0
if enabled. It printsno
with exit status1
otherwise. Ifzone
is omitted, the default zone will be used.To enable IP masquerading, enter the following command as
root
:# firewall-cmd --zone=external --add-masquerade
-
To make this setting persistent, repeat the command adding the
--permanent
option.
To disable IP masquerading, enter the following command as root
:
# firewall-cmd --zone=external --remove-masquerade --permanent
44.13. Port forwarding
Redirecting ports using this method only works for IPv4-based traffic. For IPv6 redirecting setup, you must use rich rules.
To redirect to an external system, it is necessary to enable masquerading. For more information, see Configuring IP address masquerading.
44.13.1. Adding a port to redirect
Using firewalld
, you can set up ports redirection so that any incoming traffic that reaches a certain port on your system is delivered to another internal port of your choice or to an external port on another machine.
Prerequisites
- Before you redirect traffic from one port to another port, or another address, you have to know three things: which port the packets arrive at, what protocol is used, and where you want to redirect them.
Procedure
To redirect a port to another port:
# firewall-cmd --add-forward-port=port=port-number:proto=tcp|udp|sctp|dccp:toport=port-number
To redirect a port to another port at a different IP address:
Add the port to be forwarded:
# firewall-cmd --add-forward-port=port=port-number:proto=tcp|udp:toport=port-number:toaddr=IP
Enable masquerade:
# firewall-cmd --add-masquerade
44.13.2. Redirecting TCP port 80 to port 88 on the same machine
Follow the steps to redirect the TCP port 80 to port 88.
Procedure
Redirect the port 80 to port 88 for TCP traffic:
# firewall-cmd --add-forward-port=port=80:proto=tcp:toport=88
Make the new settings persistent:
# firewall-cmd --runtime-to-permanent
Check that the port is redirected:
# firewall-cmd --list-all
44.13.3. Removing a redirected port
To remove a redirected port:
# firewall-cmd --remove-forward-port=port=port-number:proto=<tcp|udp>:toport=port-number:toaddr=<IP>
To remove a forwarded port redirected to a different address, use the following procedure.
Procedure
Remove the forwarded port:
# firewall-cmd --remove-forward-port=port=port-number:proto=<tcp|udp>:toport=port-number:toaddr=<IP>
Disable masquerade:
# firewall-cmd --remove-masquerade
44.13.4. Removing TCP port 80 forwarded to port 88 on the same machine
To remove the port redirection:
Procedure
List redirected ports:
~]# firewall-cmd --list-forward-ports port=80:proto=tcp:toport=88:toaddr=
Remove the redirected port from the firewall::
~]# firewall-cmd --remove-forward-port=port=80:proto=tcp:toport=88:toaddr=
Make the new settings persistent:
~]# firewall-cmd --runtime-to-permanent
44.14. Managing ICMP requests
The Internet Control Message Protocol
(ICMP
) is a supporting protocol that is used by various network devices to send error messages and operational information indicating a connection problem, for example, that a requested service is not available. ICMP
differs from transport protocols such as TCP and UDP because it is not used to exchange data between systems.
Unfortunately, it is possible to use the ICMP
messages, especially echo-request
and echo-reply
, to reveal information about your network and misuse such information for various kinds of fraudulent activities. Therefore, firewalld
enables blocking the ICMP
requests to protect your network information.
44.14.1. Listing and blocking ICMP requests
Listing ICMP
requests
The ICMP
requests are described in individual XML files that are located in the /usr/lib/firewalld/icmptypes/
directory. You can read these files to see a description of the request. The firewall-cmd
command controls the ICMP
requests manipulation.
To list all available
ICMP
types:# firewall-cmd --get-icmptypes
The
ICMP
request can be used by IPv4, IPv6, or by both protocols. To see for which protocol theICMP
request is used:# firewall-cmd --info-icmptype=<icmptype>
The status of an
ICMP
request showsyes
if the request is currently blocked orno
if it is not. To see if anICMP
request is currently blocked:# firewall-cmd --query-icmp-block=<icmptype>
Blocking or unblocking ICMP
requests
When your server blocks ICMP
requests, it does not provide the information that it normally would. However, that does not mean that no information is given at all. The clients receive information that the particular ICMP
request is being blocked (rejected). Blocking the ICMP
requests should be considered carefully, because it can cause communication problems, especially with IPv6 traffic.
To see if an
ICMP
request is currently blocked:# firewall-cmd --query-icmp-block=<icmptype>
To block an
ICMP
request:# firewall-cmd --add-icmp-block=<icmptype>
To remove the block for an
ICMP
request:# firewall-cmd --remove-icmp-block=<icmptype>
Blocking ICMP
requests without providing any information at all
Normally, if you block ICMP
requests, clients know that you are blocking it. So, a potential attacker who is sniffing for live IP addresses is still able to see that your IP address is online. To hide this information completely, you have to drop all ICMP
requests.
-
To block and drop all
ICMP
requests:
Set the target of your zone to
DROP
:# firewall-cmd --permanent --set-target=DROP
Now, all traffic, including ICMP
requests, is dropped, except traffic which you have explicitly allowed.
-
To block and drop certain
ICMP
requests and allow others:
Set the target of your zone to
DROP
:# firewall-cmd --permanent --set-target=DROP
Add the ICMP block inversion to block all
ICMP
requests at once:# firewall-cmd --add-icmp-block-inversion
Add the ICMP block for those
ICMP
requests that you want to allow:# firewall-cmd --add-icmp-block=<icmptype>
Make the new settings persistent:
# firewall-cmd --runtime-to-permanent
The block inversion inverts the setting of the ICMP
requests blocks, so all requests, that were not previously blocked, are blocked because of the target of your zone changes to DROP
. The requests that were blocked are not blocked. This means that if you want to unblock a request, you must use the blocking command.
- To revert the block inversion to a fully permissive setting:
Set the target of your zone to
default
orACCEPT
:# firewall-cmd --permanent --set-target=default
Remove all added blocks for
ICMP
requests:# firewall-cmd --remove-icmp-block=<icmptype>
Remove the
ICMP
block inversion:# firewall-cmd --remove-icmp-block-inversion
Make the new settings persistent:
# firewall-cmd --runtime-to-permanent
44.14.2. Configuring the ICMP filter using GUI
-
To enable or disable an
ICMP
filter, start the firewall-config tool and select the network zone whose messages are to be filtered. Select theICMP Filter
tab and select the check box for each type ofICMP
message you want to filter. Clear the check box to disable a filter. This setting is per direction and the default allows everything. -
To edit an
ICMP
type, start the firewall-config tool and selectPermanent
mode from the menu labeledConfiguration
. Additional icons appear at the bottom of the window. Select in the following dialog to enable masquerading and to make forwarding to another machine working. -
To enable inverting the
ICMP Filter
, click theInvert Filter
check box on the right. Only markedICMP
types are now accepted, all other are rejected. In a zone using the DROP target, they are dropped.
44.15. Setting and controlling IP sets using firewalld
To see the list of IP set types supported by firewalld
, enter the following command as root.
~]# firewall-cmd --get-ipset-types hash:ip hash:ip,mark hash:ip,port hash:ip,port,ip hash:ip,port,net hash:mac hash:net hash:net,iface hash:net,net hash:net,port hash:net,port,net
44.15.1. Configuring IP set options using CLI
IP sets can be used in firewalld
zones as sources and also as sources in rich rules. In Red Hat Enterprise Linux, the preferred method is to use the IP sets created with firewalld
in a direct rule.
To list the IP sets known to
firewalld
in the permanent environment, use the following command asroot
:# firewall-cmd --permanent --get-ipsets
To add a new IP set, use the following command using the permanent environment as
root
:# firewall-cmd --permanent --new-ipset=test --type=hash:net success
The previous command creates a new IP set with the name test and the
hash:net
type forIPv4
. To create an IP set for use withIPv6
, add the--option=family=inet6
option. To make the new setting effective in the runtime environment, reloadfirewalld
.List the new IP set with the following command as
root
:# firewall-cmd --permanent --get-ipsets test
To get more information about the IP set, use the following command as
root
:# firewall-cmd --permanent --info-ipset=test test type: hash:net options: entries:
Note that the IP set does not have any entries at the moment.
To add an entry to the test IP set, use the following command as
root
:# firewall-cmd --permanent --ipset=test --add-entry=192.168.0.1 success
The previous command adds the IP address 192.168.0.1 to the IP set.
To get the list of current entries in the IP set, use the following command as
root
:# firewall-cmd --permanent --ipset=test --get-entries 192.168.0.1
Generate a file containing a list of IP addresses, for example:
# cat > iplist.txt <<EOL 192.168.0.2 192.168.0.3 192.168.1.0/24 192.168.2.254 EOL
The file with the list of IP addresses for an IP set should contain an entry per line. Lines starting with a hash, a semi-colon, or empty lines are ignored.
To add the addresses from the iplist.txt file, use the following command as
root
:# firewall-cmd --permanent --ipset=test --add-entries-from-file=iplist.txt success
To see the extended entries list of the IP set, use the following command as
root
:# firewall-cmd --permanent --ipset=test --get-entries 192.168.0.1 192.168.0.2 192.168.0.3 192.168.1.0/24 192.168.2.254
To remove the addresses from the IP set and to check the updated entries list, use the following commands as
root
:# firewall-cmd --permanent --ipset=test --remove-entries-from-file=iplist.txt success # firewall-cmd --permanent --ipset=test --get-entries 192.168.0.1
You can add the IP set as a source to a zone to handle all traffic coming in from any of the addresses listed in the IP set with a zone. For example, to add the test IP set as a source to the drop zone to drop all packets coming from all entries listed in the test IP set, use the following command as
root
:# firewall-cmd --permanent --zone=drop --add-source=ipset:test success
The
ipset:
prefix in the source showsfirewalld
that the source is an IP set and not an IP address or an address range.
Only the creation and removal of IP sets is limited to the permanent environment, all other IP set options can be used also in the runtime environment without the --permanent
option.
Red Hat does not recommend using IP sets that are not managed through firewalld
. To use such IP sets, a permanent direct rule is required to reference the set, and a custom service must be added to create these IP sets. This service needs to be started before firewalld starts, otherwise firewalld
is not able to add the direct rules using these sets. You can add permanent direct rules with the /etc/firewalld/direct.xml
file.
44.16. Prioritizing rich rules
By default, rich rules are organized based on their rule action. For example, deny
rules have precedence over allow
rules. The priority
parameter in rich rules provides administrators fine-grained control over rich rules and their execution order.
44.16.1. How the priority parameter organizes rules into different chains
You can set the priority
parameter in a rich rule to any number between -32768
and 32767
, and lower values have higher precedence.
The firewalld
service organizes rules based on their priority value into different chains:
-
Priority lower than 0: the rule is redirected into a chain with the
_pre
suffix. -
Priority higher than 0: the rule is redirected into a chain with the
_post
suffix. -
Priority equals 0: based on the action, the rule is redirected into a chain with the
_log
,_deny
, or_allow
the action.
Inside these sub-chains, firewalld
sorts the rules based on their priority value.
44.16.2. Setting the priority of a rich rule
The procedure describes an example of how to create a rich rule that uses the priority
parameter to log all traffic that is not allowed or denied by other rules. You can use this rule to flag unexpected traffic.
Procedure
Add a rich rule with a very low precedence to log all traffic that has not been matched by other rules:
# firewall-cmd --add-rich-rule='rule priority=32767 log prefix="UNEXPECTED: " limit value="5/m"'
The command additionally limits the number of log entries to
5
per minute.Optionally, display the
nftables
rule that the command in the previous step created:# nft list chain inet firewalld filter_IN_public_post table inet firewalld { chain filter_IN_public_post { log prefix "UNEXPECTED: " limit rate 5/minute } }
44.17. Configuring firewall lockdown
Local applications or services are able to change the firewall configuration if they are running as root
(for example, libvirt). With this feature, the administrator can lock the firewall configuration so that either no applications or only applications that are added to the lockdown allow list are able to request firewall changes. The lockdown settings default to disabled. If enabled, the user can be sure that there are no unwanted configuration changes made to the firewall by local applications or services.
44.17.1. Configuring lockdown using CLI
To query whether lockdown is enabled, use the following command as
root
:# firewall-cmd --query-lockdown
The command prints
yes
with exit status0
if lockdown is enabled. It printsno
with exit status1
otherwise.To enable lockdown, enter the following command as
root
:# firewall-cmd --lockdown-on
To disable lockdown, use the following command as
root
:# firewall-cmd --lockdown-off
44.17.2. Configuring lockdown allowlist options using CLI
The lockdown allowlist can contain commands, security contexts, users and user IDs. If a command entry on the allowlist ends with an asterisk "*", then all command lines starting with that command will match. If the "*" is not there then the absolute command including arguments must match.
The context is the security (SELinux) context of a running application or service. To get the context of a running application use the following command:
$
ps -e --context
That command returns all running applications. Pipe the output through the grep tool to get the application of interest. For example:
$ ps -e --context | grep example_program
To list all command lines that are in the allowlist, enter the following command as
root
:# firewall-cmd --list-lockdown-whitelist-commands
To add a command command to the allowlist, enter the following command as
root
:# firewall-cmd --add-lockdown-whitelist-command='/usr/bin/python3 -Es /usr/bin/command'
To remove a command command from the allowlist, enter the following command as
root
:# firewall-cmd --remove-lockdown-whitelist-command='/usr/bin/python3 -Es /usr/bin/command'
To query whether the command command is in the allowlist, enter the following command as
root
:# firewall-cmd --query-lockdown-whitelist-command='/usr/bin/python3 -Es /usr/bin/command'
The command prints
yes
with exit status0
if true. It printsno
with exit status1
otherwise.To list all security contexts that are in the allowlist, enter the following command as
root
:# firewall-cmd --list-lockdown-whitelist-contexts
To add a context context to the allowlist, enter the following command as
root
:# firewall-cmd --add-lockdown-whitelist-context=context
To remove a context context from the allowlist, enter the following command as
root
:# firewall-cmd --remove-lockdown-whitelist-context=context
To query whether the context context is in the allowlist, enter the following command as
root
:# firewall-cmd --query-lockdown-whitelist-context=context
Prints
yes
with exit status0
, if true, printsno
with exit status1
otherwise.To list all user IDs that are in the allowlist, enter the following command as
root
:# firewall-cmd --list-lockdown-whitelist-uids
To add a user ID uid to the allowlist, enter the following command as
root
:# firewall-cmd --add-lockdown-whitelist-uid=uid
To remove a user ID uid from the allowlist, enter the following command as
root
:# firewall-cmd --remove-lockdown-whitelist-uid=uid
To query whether the user ID uid is in the allowlist, enter the following command:
$
firewall-cmd --query-lockdown-whitelist-uid=uid
Prints
yes
with exit status0
, if true, printsno
with exit status1
otherwise.To list all user names that are in the allowlist, enter the following command as
root
:# firewall-cmd --list-lockdown-whitelist-users
To add a user name user to the allowlist, enter the following command as
root
:# firewall-cmd --add-lockdown-whitelist-user=user
To remove a user name user from the allowlist, enter the following command as
root
:# firewall-cmd --remove-lockdown-whitelist-user=user
To query whether the user name user is in the allowlist, enter the following command:
$
firewall-cmd --query-lockdown-whitelist-user=user
Prints
yes
with exit status0
, if true, printsno
with exit status1
otherwise.
44.17.3. Configuring lockdown allowlist options using configuration files
The default allowlist configuration file contains the NetworkManager
context and the default context of libvirt
. The user ID 0 is also on the list.
<?xml version="1.0" encoding="utf-8"?> <whitelist> <selinux context="system_u:system_r:NetworkManager_t:s0"/> <selinux context="system_u:system_r:virtd_t:s0-s0:c0.c1023"/> <user id="0"/> </whitelist>
Following is an example allowlist configuration file enabling all commands for the firewall-cmd
utility, for a user called user whose user ID is 815
:
<?xml version="1.0" encoding="utf-8"?> <whitelist> <command name="/usr/libexec/platform-python -s /bin/firewall-cmd*"/> <selinux context="system_u:system_r:NetworkManager_t:s0"/> <user id="815"/> <user name="user"/> </whitelist>
This example shows both user id
and user name
, but only one option is required. Python is the interpreter and is prepended to the command line. You can also use a specific command, for example:
/usr/bin/python3 /bin/firewall-cmd --lockdown-on
In that example, only the --lockdown-on
command is allowed.
In Red Hat Enterprise Linux, all utilities are placed in the /usr/bin/
directory and the /bin/
directory is sym-linked to the /usr/bin/
directory. In other words, although the path for firewall-cmd
when entered as root
might resolve to /bin/firewall-cmd
, /usr/bin/firewall-cmd
can now be used. All new scripts should use the new location. But be aware that if scripts that run as root
are written to use the /bin/firewall-cmd
path, then that command path must be added in the allowlist in addition to the /usr/bin/firewall-cmd
path traditionally used only for non-root
users.
The *
at the end of the name attribute of a command means that all commands that start with this string match. If the *
is not there then the absolute command including arguments must match.
44.18. Log for denied packets
With the LogDenied
option in the firewalld
, it is possible to add a simple logging mechanism for denied packets. These are the packets that are rejected or dropped. To change the setting of the logging, edit the /etc/firewalld/firewalld.conf
file or use the command-line or GUI configuration tool.
If LogDenied
is enabled, logging rules are added right before the reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also the final reject and drop rules in zones. The possible values for this setting are: all
, unicast
, broadcast
, multicast
, and off
. The default setting is off
. With the unicast
, broadcast
, and multicast
setting, the pkttype
match is used to match the link-layer packet type. With all
, all packets are logged.
To list the actual LogDenied
setting with firewall-cmd, use the following command as root
:
# firewall-cmd --get-log-denied off
To change the LogDenied
setting, use the following command as root
:
# firewall-cmd --set-log-denied=all success
To change the LogDenied
setting with the firewalld
GUI configuration tool, start firewall-config, click the Options
menu and select Change Log Denied
. The LogDenied
window appears. Select the new LogDenied
setting from the menu and click OK.
Chapter 45. Getting started with nftables
The nftables
framework provides packet classification facilities and it is the designated successor to the iptables
, ip6tables
, arptables
, and ebtables
tools. It offers numerous improvements in convenience, features, and performance over previous packet-filtering tools, most notably:
- lookup tables instead of linear processing
-
a single framework for both the
IPv4
andIPv6
protocols - rules all applied atomically instead of fetching, updating, and storing a complete rule set
-
support for debugging and tracing in the rule set (
nftrace
) and monitoring trace events (in thenft
tool) - more consistent and compact syntax, no protocol-specific extensions
- a Netlink API for third-party applications
Similarly to iptables
, nftables
use tables for storing chains. The chains contain individual rules for performing actions. The nft
tool replaces all tools from the previous packet-filtering frameworks. The libnftnl
library can be used for low-level interaction with nftables
Netlink API over the libmnl
library.
Effect of the modules on the nftables
rules set can be observed using the nft
list rule set command. Since these tools add tables, chains, rules, sets, and other objects to the nftables
rule set, be aware that nftables
rule-set operations, such as the nft flush ruleset
command, might affect rule sets installed using the formerly separate legacy commands.
45.1. Migrating from iptables to nftables
If you upgraded your server to RHEL 8 or your firewall configuration still uses iptables
rules, you can migrate your iptables
rules to nftables
.
45.1.1. When to use firewalld, nftables, or iptables
The following is a brief overview in which scenario you should use one of the following utilities:
-
firewalld
: Use thefirewalld
utility for simple firewall use cases. The utility is easy to use and covers the typical use cases for these scenarios. -
nftables
: Use thenftables
utility to set up complex and performance critical firewalls, such as for a whole network. -
iptables
: Theiptables
utility on Red Hat Enterprise Linux 8 uses thenf_tables
kernel API instead of thelegacy
back end. Thenf_tables
API provides backward compatibility so that scripts that useiptables
commands still work on Red Hat Enterprise Linux 8. For new firewall scripts, Red Hat recommends to usenftables
.
To avoid that the different firewall services influence each other, run only one of them on a RHEL host, and disable the other services.
45.1.2. Converting iptables rules to nftables rules
Red Hat Enterprise Linux 8 provides the iptables-translate
and ip6tables-translate
tools to convert existing iptables
or ip6tables
rules into the equivalent ones for nftables
.
Note that some extensions lack translation support. If such an extension exists, the tool prints the untranslated rule prefixed with the #
sign. For example:
# iptables-translate -A INPUT -j CHECKSUM --checksum-fill nft # -A INPUT -j CHECKSUM --checksum-fill
Additionally, users can use the iptables-restore-translate
and ip6tables-restore-translate
tools to translate a dump of rules. Note that before that, users can use the iptables-save
or ip6tables-save
commands to print a dump of current rules. For example:
# iptables-save >/tmp/iptables.dump # iptables-restore-translate -f /tmp/iptables.dump # Translated by iptables-restore-translate v1.8.0 on Wed Oct 17 17:00:13 2018 add table ip nat ...
For more information and a list of possible options and values, enter the iptables-translate --help
command.
45.2. Writing and executing nftables scripts
The nftables
framework provides a native scripting environment that brings a major benefit over using shell scripts to maintain firewall rules: the execution of scripts is atomic. This means that the system either applies the whole script or prevents t