Set up the network

$ run as a normal user# run as root (or with sudo)

Exam objectives in this chapter

Start, stop and check the status of network services
Set IPv4 and IPv6 addresses
Set up hostname resolution
Make network services start at boot

Read an IPv4 address and its mask

An IPv4 address is 4 numbers from 0 to 255. The mask (or prefix) tells which part is the network and which part is the host.

An address like 192.168.122.10/24 has two parts:

192.168.122.10 is the address of this computer.
/24 is the prefix. The first 24 bits (the first 3 numbers) are the network. The last number is the host.

The same mask can be written in two ways. Linux tools use the prefix form.

Prefix	Mask	Usable hosts
`/8`	255.0.0.0	16,777,214
`/16`	255.255.0.0	65,534
`/24`	255.255.255.0	254
`/25`	255.255.255.128	126
`/26`	255.255.255.192	62
`/30`	255.255.255.252	2

Each number is 8 bits. In binary, 255 is 11111111 and 192 is 11000000. The prefix counts the 1 bits of the mask from the left. The number of hosts is 2 to the power of (32 − prefix), minus 2: one address is for the network itself and one is for broadcast.

Private ranges are only used inside networks and are not routed on the internet: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. The address 127.0.0.1 is the computer itself (loopback).

Remember

/24 = 255.255.255.0 = 254 hosts. Each step up (/25, /26 …) halves the hosts.

Exam tip

The exam gives the address in prefix form, like 192.168.4.10/24. Type it in that form in nmcli.

8.2

Read an IPv6 address

An IPv6 address is 128 bits, written as 8 groups of 4 hexadecimal digits. You can shorten it.

Example: 2001:0db8:0000:0000:0000:0000:0000:0010 becomes 2001:db8::10.

Remove the zeros at the start of each group: 0db8 becomes db8.
Replace one run of groups that are all zero with ::. You can do this only once in an address.

Most networks use a /64 prefix: the first 64 bits are the network, the last 64 bits are the host.

Address	Meaning
`::1`	The computer itself (loopback)
`fe80::/10`	Link-local. Every card has one. It works only on the local network.
`2000::/3`	Global addresses, used on the internet
`fd00::/8`	Unique local addresses, for private networks

Remember

:: can appear only once. A link-local address (fe80::) is normal: it does not mean IPv6 is set up.

8.3

Know MAC addresses, protocols and ports

The MAC address finds a card on the local network. The IP address finds a computer across networks. The port finds the program on that computer.

A MAC address is 6 bytes in hexadecimal, like 52:54:00:3a:7c:01. It is set by the maker of the network card. You see it with ip link.
TCP makes a connection and checks that all data arrives (SSH, web, mail). UDP sends without a connection (DNS questions, NTP time).
A port is a number from 1 to 65535. Ports under 1024 are for well-known services.

Port	Service
22/tcp	SSH
53/udp and tcp	DNS
80/tcp, 443/tcp	HTTP, HTTPS
123/udp	NTP (time)
2049/tcp	NFS

The file /etc/services lists the well-known port numbers and their names.

$grep -w 22 /etc/services
ssh             22/tcp
ssh             22/udp

At work

In a security review, first list the ports that listen (next lessons). Every open port must have an owner and a reason.

8.4

See your addresses and network cards

Use ip to look at the network. It shows the real settings that the kernel uses right now.

Show all addresses. ip a is short for ip address show.

$ip a
$ip -br a
lo               UNKNOWN        127.0.0.1/8 ::1/128
enp1s0           UP             192.168.122.10/24 fe80::5054:ff:fe3a:7c01/64

Show only one card and only IPv4.
```
$ip -4 addr show dev enp1s0
```
Show the cards (links), their MAC address and state. -s adds counters for errors and dropped packets.
```
$ip link show
$ip -s link show enp1s0
```

Network card names tell where the card sits: en = Ethernet, o1 = on board, s1 = slot, p1s0 = PCI bus 1, slot 0. So eno1, ens160 and enp1s0 are all normal names.

Watch out

Changes with ip addr add or ip link set are lost after a reboot. Use nmcli for settings that must stay.

8.5

Check the route and the default gateway

The routing table says where packets go. The default route (default gateway) is used for every address that has no better route.

$ip route show
default via 192.168.122.1 dev enp1s0 proto static metric 100
192.168.122.0/24 dev enp1s0 proto kernel scope link src 192.168.122.10 metric 100

The first line is the default gateway. The second line says: the local network is reached directly on enp1s0.

To see which way the system will use for one address:

$ip route get 8.8.8.8
8.8.8.8 via 192.168.122.1 dev enp1s0 src 192.168.122.10 uid 1000

Then test the way, step by step:

Can you reach the gateway? ping it 3 times.
```
$ping -c 3 192.168.122.1
```
Can you reach an address on the internet?
```
$ping -c 3 8.8.8.8
```
Where does the path stop? tracepath shows every router on the way.
```
$tracepath -n 8.8.8.8
```

Remember

Gateway ping works but internet ping fails = a problem after your gateway. Internet ping by number works but by name fails = a DNS problem.

8.6

Check that a port or service answers

ss shows which ports listen on this system and which connections are open.

$ss -tuln
#ss -tulpn

The letters: t = TCP, u = UDP, l = only listening ports, n = numbers (no names), p = show the program. You need root to see the programs of other users.

#ss -tlpn sport = :22
State  Recv-Q Send-Q Local Address:Port  Peer Address:Port Process
LISTEN 0      128          0.0.0.0:22         0.0.0.0:*     users:(("sshd",pid=1021,fd=3))

A service can listen but still be blocked by the firewall. So also check the firewall (chapter 23) and test from another computer.

$curl -I http://server1.example.com

Check it

Is the service running, and does it listen on the right address and port?

#systemctl status sshd
#ss -tlpn

At work

0.0.0.0:22 means "all IPv4 addresses". 127.0.0.1:5432 means "only this computer" — a database that should not be reachable from outside.

8.7

Know who may change the network

root can change everything. A normal user may change the network only when they are logged in on the local console.

NetworkManager asks PolicyKit who may do what. Check your own rights:

$nmcli general permissions

A user who logs in with SSH gets auth or no for most actions. Use sudo or work as root to change the network over SSH.

Watch out

When you work over SSH, a wrong change can cut your own connection. Check the new settings twice before nmcli con up. On a virtual machine, keep the console open.

8.8

Change the IPv4 address with nmcli

NetworkManager keeps the settings in a connection profile. Change the profile with nmcli connection modify, then activate it with nmcli connection up.

Find the profile name and the device.

$nmcli connection show
NAME    UUID                                  TYPE      DEVICE
enp1s0  3f0c3a8e-6c35-4c5a-9a0e-7f1a2b3c4d5e  ethernet  enp1s0

Set a fixed address, the gateway and a DNS server. ipv4.method manual turns off DHCP.

#nmcli connection modify enp1s0 ipv4.method manual ipv4.addresses 192.168.122.10/24 \
    ipv4.gateway 192.168.122.1 ipv4.dns 192.168.122.1

Activate the profile again so the change is used now.
```
#nmcli connection up enp1s0
```

Check it

The address, the route and DNS must be right.

$ip -br a show enp1s0
$ip route show default
$cat /etc/resolv.conf

You can use short words: con for connection, mod for modify, ipv4.addresses can also be written as ip4. Tab completion works for nmcli: press Tab twice to see the next possible words.

To go back to DHCP:

#nmcli con mod enp1s0 ipv4.method auto ipv4.addresses "" ipv4.gateway "" ipv4.dns ""
#nmcli con up enp1s0

Remember

modify, then up. Without up, the change waits in the profile.

Exam tip

Reboot at the end of the exam and check the address again. A setting that is only active (and not saved in the profile) is lost after a reboot.

8.9

Add an IPv6 address or a second IP

A profile can have many addresses. A + before the setting adds a value, a - removes one.

Add a second IPv4 address to the same card.

#nmcli con mod enp1s0 +ipv4.addresses 192.168.122.110/24

Add a fixed IPv6 address and gateway.

#nmcli con mod enp1s0 ipv6.method manual ipv6.addresses 2001:db8:10::10/64 ipv6.gateway 2001:db8:10::1

Activate the changes.
```
#nmcli con up enp1s0
```

Check it

$ip -br a show enp1s0
$ping -6 -c 2 2001:db8:10::1

To remove one address again:

#nmcli con mod enp1s0 -ipv4.addresses 192.168.122.110/24

Remember

+ adds, - removes, no sign replaces all values.

8.10

Make a new connection profile

One device can have many profiles, but only one is active at a time. A new profile is useful when you want to switch between setups, or for a new network card.

Make the profile. con-name is the profile name, ifname is the device.

#nmcli con add con-name lab-static type ethernet ifname enp1s0 \
    ipv4.method manual ipv4.addresses 192.168.122.10/24 ipv4.gateway 192.168.122.1 ipv4.dns 192.168.122.1

Switch to the new profile, and back.

#nmcli con up lab-static
#nmcli con up enp1s0

Delete a profile you do not need.
```
#nmcli con delete lab-static
```

Watch out

When two profiles for one device both have autoconnect on, you do not know which one starts after a reboot. Turn off the one you do not want: nmcli con mod enp1s0 connection.autoconnect no.

8.11

Change the network with nmtui (menus)

nmtui is a text menu for the same settings. It is easy when you do not remember the nmcli words.

Start it as root.
```
#nmtui
```
Choose Edit a connection, pick the profile, change IPv4 CONFIGURATION from Automatic to Manual and fill in the address with its prefix, the gateway and the DNS server.
Choose OK, then Back, then Activate a connection. Deactivate and activate the profile so the change is used.

Use the arrow keys and Tab to move, Space to tick a box, Enter to choose.

Exam tip

nmtui is fast and safe for one address. Use nmcli when you must type many settings or work in a script.

8.12

Read and edit the profile files

Each profile is saved as a text file (keyfile) in /etc/NetworkManager/system-connections/. You can read it, and edit it if you reload NetworkManager after that.

#ls /etc/NetworkManager/system-connections/
enp1s0.nmconnection
#cat /etc/NetworkManager/system-connections/enp1s0.nmconnection

enp1s0.nmconnection

[connection]
id=enp1s0
type=ethernet
interface-name=enp1s0
 
[ipv4]
method=manual
address1=192.168.122.10/24,192.168.122.1
dns=192.168.122.1;

After a change by hand, tell NetworkManager to read the files again and activate the profile:

#nmcli con reload
#nmcli con up enp1s0

Watch out

The file must belong to root and have mode 600 (-rw-------), or NetworkManager will not use it. In RHEL 10 the old ifcfg files in /etc/sysconfig/network-scripts/ are no longer used.

8.13

Change the hostname

hostnamectl changes the name of the system now and after a reboot. It writes the name to /etc/hostname.

Show the current name.
```
$hostnamectl
```
Set the new name. Use the full name (FQDN).
```
#hostnamectl set-hostname server1.example.com
```
Check it. A new shell shows the new name in the prompt.
```
$hostname
server1.example.com
```

nmcli general hostname server1.example.com does the same job.

Remember

hostnamectl set-hostname = now + after reboot. The hostname command alone only changes the name until the next reboot.

8.14

Set up DNS and /etc/hosts

Linux first looks in /etc/hosts, then asks the DNS servers. The order is set in /etc/nsswitch.conf.

Add a name to /etc/hosts for a computer that has no DNS name. Format: address, full name, short names.

/etc/hosts

127.0.0.1       localhost localhost.localdomain
::1             localhost localhost.localdomain
192.168.122.20  server2.example.com server2

Set the DNS servers in the profile. NetworkManager then writes /etc/resolv.conf for you. Do not edit that file by hand: your change is lost on the next update.
```
#nmcli con mod enp1s0 ipv4.dns "192.168.122.1 1.1.1.1" ipv4.dns-search example.com
#nmcli con up enp1s0
```
When DHCP also sends DNS servers and you only want yours:
```
#nmcli con mod enp1s0 ipv4.ignore-auto-dns yes
```

Check it

Test the names. getent follows the same order as the system (hosts file and DNS). dig, host and nslookup ask DNS only.

$getent hosts server2
192.168.122.20  server2.example.com server2
$dig +short www.redhat.com
$nslookup www.redhat.com

/etc/nsswitch.conf (part)

hosts:      files dns myhostname

dig, host and nslookup are in the package bind-utils.

Remember

hosts file first, then DNS. getent hosts tests both, dig tests only DNS.

At work

When an app cannot reach a name but dig works, compare with getent hosts. An old line in /etc/hosts often wins over DNS.

8.15

Start network services at boot

The network itself starts at boot when NetworkManager is enabled and the profile has autoconnect on. Other network services (like SSH or a web server) start at boot when you enable them with systemd.

Make sure NetworkManager runs now and at boot.
```
#systemctl enable --now NetworkManager
```

Make sure the profile starts by itself.

#nmcli con mod enp1s0 connection.autoconnect yes

Start, stop and check a network service, and make it start at boot.

#systemctl status sshd
#systemctl restart sshd
#systemctl enable --now sshd

Check it

After a reboot, the profile and the service must be active.

$nmcli -f NAME,DEVICE,STATE con show --active
$systemctl is-enabled sshd
$systemctl is-active sshd

Remember

enable = start at boot. --now = also start it right now.

8.16

Remember the main points

The most important facts of this chapter, in short.

An IPv4 address has 4 numbers; the prefix (/24) tells which part is the network. IPv6 addresses are 128 bits, written in hex.
ip a shows addresses, ip route the routes, ss -tulpn the listening ports.
NetworkManager keeps settings in connection profiles; change them with nmcli or nmtui. Changes made with ip are lost at reboot.
Static IPv4: nmcli con mod NAME ipv4.method manual ipv4.addresses IP/PREFIX ipv4.gateway GW ipv4.dns DNS, then nmcli con up NAME.
RHEL 10 saves profiles as keyfiles in /etc/NetworkManager/system-connections/.
hostnamectl set-hostname NAME sets the hostname for good.
Name lookup uses /etc/hosts first, then DNS (see /etc/nsswitch.conf); test with getent hosts NAME.
Root (or a user allowed by polkit) can change the network.

8.17

Learn the key terms

The words of this chapter in simple English.

Term	Meaning
IP address	The address of a network card in a network.
Prefix / netmask	Which part of the address is the network (`/24` = 255.255.255.0).
Gateway	The router that sends traffic to other networks.
DNS	The service that turns names into IP addresses.
MAC address	The hardware address of a network card.
Port	A number that points to one service on a host (22 = SSH, 80 = HTTP).
NetworkManager	The service that manages the network on RHEL.
Connection profile	A saved set of network settings for a device.
Device	A network card or other network interface, like `enp1s0`.
Hostname	The name of the system.