Difficulty moving beyond the basics of Linux networking

[u/Crispi002]

I am studying Linux server networking in virtual machines, and I am still very much a beginner. There is an activity I was working on, but I can only manage (with some difficulty and delay) the IP addressing and connectivity testing, while the rest of the scenario seems way too complex for my level.

The practical tasks I need to resolve involve a multi-server architecture covering the following points:

• Routing and NAT (PAT, port-forwarding, and static NAT) using nftables, with traffic blocking policies and logging.
• Infrastructure services configuration, such as DHCP with automatic record updates and DNS servers with internal and external views.
• Implementation of directory and authentication services using OpenLDAP and FreeRADIUS.
• Remote access VPN configuration via OpenVPN.
• Deployment of advanced services, including secure email (SMTPS/IMAPS), web servers with SSL/TLS certificates, directory-restricted FTP (jail), and monitoring with Cacti.

I don't know, it feels like for every small configuration multiple specific lines are required to achieve the goal, how can I learn more dynamically?

[u/tdhuck]

Sounds to me like you are trying to do too much. Break it down, focus on one thing at a time.

[u/syberman01 → u/tdhuck]

Break it down, focus on one t

Any specific break-down list? I'm looking to learn as well.

[u/tdhuck → u/syberman01]

The list would be in what is most important for you, the network, what is needed next. For example, don't focus on DNS if you don't know how to handle DHCP because DNS is something that you set in the DHCP scope.

It also depends if you are learning in a home lab (real setup) or if it is virtual, etc. You can't work on routing/firewall if you don't know how basic networking works, just as an example.

[u/jrcomputing → u/tdhuck]

You've got the right idea, but I'd argue the opposite on DNS vs DHCP here. DHCP is just a distribution mechanism, and for servers you usually assign static IPs anyway. DNS is the actual foundational piece that everything above Layer 3 relies on.

​Also, for the specific task of dynamic record updates, DNS has to exist first so DHCP has somewhere to send those updates.

I always try to start at L1/L2 and move up the stack when troubleshooting or building. The cleaner progression is basic link and static IP networking first, then nftables to understand packet flow and ports, then DNS, and finally DHCP/DDNS integration once the core services are running.

[u/w0lrah → u/jrcomputing]

and for servers you usually assign static IPs anyway

Using DHCP reservations...

Hardcoded static IPs do more harm than good. DHCP is a simple, stable service, trivial to run high-availability but rarely necessary to. The only things that should have hardcoded statics on the device itself as opposed to receiving a static address through a DHCP reservation are the DHCP server(s) it/themselves and anything that needs to be online for DHCP to be useful.

[u/Phrewfuf → u/w0lrah]

Only after going through a huge re-addressing project will anyone have this opinion. Although...some refuse to accept it despite having taken part in one.

I too despise statically configured IPs.

[u/tdhuck → u/jrcomputing]

That's why I said it was just an example. You can setup DHCP and get to the DNS section and not know what to fill in. Also, I'm not sure of the exact scenario the OP is in. Regardless, each item needs to be looked at and understood (to a certain degree) before moving to the next or else you are just going to keep getting confused.

[u/lizardhistorian]

Setting up email from scratch is a PITA. I did it once and vowed never again.

[u/well_shoothed → u/lizardhistorian]

We outsourced our email for years until this one email I needed just would. not. get delivered.

Get on chat email provider. WTF is going on?

"Oh. That. Those emails are coming from an IP block that's failing spam filters."

"Don't care. I need an email from a company in that block. Just undo the filter. I'll take responsibility for it in writing."

"Sorry, we can't do that."

"This isn't a request. I'm telling you, I need the filter disabled. You're blocking a business critical email from a vendor."

"Sorry, we can't do that."

And that's why we run our own email.

[u/DaryllSwer → u/well_shoothed]

Never had this problem with Google Workspace as the email provider over here. I also know many businesses who've used Google enterprise email services for decades with no issues.

Hosting own email server is perfectly valid, nothing wrong with that. But a PITA.

[u/well_shoothed → u/DaryllSwer]

PITA to setup, and so nice to be able to run:

tail -f /var/log/maillog

and see a staffer's mail WAS accepted by the recipient mailserver.

That and having actual ownership of the rules. The problem we had with gmail for business (granted this was a decad-ish ago) was there were certain cases they, too, would just unilaterally delete emails--not even spam them--just delete them without notice.

(That was what led us to leaving gmail to another provider.... aaaaand then bringing it in-house when they did the same thing but different.)

[u/DaryllSwer → u/well_shoothed]

Hard to say what happened a decade ago. But these days with DNS it should be fine: DKIM and more.

I've legit never had business emails fall through. Unless the sender has broken config on their end.

It's good that people still run their own mail servers though. I have nothing against it technically. Just a lot of overhead.

[u/whythehellnote → u/well_shoothed]

and see a staffer's mail WAS accepted by the recipient mailserver.

Doesn't mean it was delivered to their inbox though

[u/well_shoothed → u/whythehellnote]

Ya don' say...

[u/nof → u/lizardhistorian]

Let me tell you about ye olden days of sendmail.cf file syntax nightmares.

[u/LordEli]

most of these things aren't linux specific. do you want to host all of these things on a linux box? you're effectively building a linux router. better to just go with pfsense or opnsense which is designed for this

[u/rankinrez → u/LordEli]

I would argue it’s much more flexible - and tunable - using vanilla Linux than either of those.

It’s RFC1925 rule 6a to me. I don’t really see what advantage the extra layers of abstraction bring. It just makes it harder to understand what it going on under the hood.

Now look nothing wrong with them both fine projects.

[u/InvestigatorOk6009]

you are welcome!

[u/rankinrez]

Tbh I’d nearly say it’s easier to learn networking concepts with a different framework - like a vendor like Cisco/Arista/Juniper/Nokia or whatever.

Then look at Linux when you know the standards and how things work. And get your head around how they are implemented in Linux.

lwn.net archives are good for Linux. As are the netdev conference videos on YouTube. “Linux Kernel Routing” by Rami Rosen is a decent reference. You can of course look at the kernel code, as well as the FRR/Bird mailing lists and code to really see how they program the kernel.

[u/DaryllSwer → u/rankinrez]

Are VRFs easier now on Linux?

[u/rankinrez → u/DaryllSwer]

Yeah between Linux VRFs (L3 mdev device) and network namespaces you’re very well served depending what you want to to do.

[u/zaypuma]

You have a good wishlist, but you won't be able to do it all in one push. Any two of those lines could be a whole career, so if you want to touch on all of them, then just cover the basics (setup and security hardening) and move on. If you feel inspired by any aspect of it while you study the basics, then please dive in. Ride that feeling while it lasts.

And check out /r/homelab projects for inspiration.

[u/gm85]

Take it one step at a time, don't focus on everything at once. The best way to learn Linux is through interacting with it and then you get a feel for the services, the configuration files and using the built-in components like SYSCTL.

For instance, regarding your first task, I would recommend:

-Start with a basic routing configuration. Have 2 interfaces configured with different subnets and have two separate computers configured behind these interfaces to use this system as a default gateway. Enable sysctl net.ipv4.ip_forward to allow Linux to forward traffic between both interfaces.

-Next, start with a very basic nftables configuration. Learn the difference between INPUT, OUTPUT and FORWARD. For instance: use INPUT to block the two computers from accessing services configured on the router (such as SSH), then use FORWARD to block computer 1 from accessing services on computer 2.

-Once you have set up some basic rules in nftables, then you can expand to add NAT via masquerade. Then you can look at port forwarding.

Once you're comfortable with the routing components, start with a fresh copy of Linux and set up an email server, or a web server.

[u/jrcomputing → u/gm85]

Just for sanity's sake (as someone who knew all this but tried recently, anyway), personal mail servers sending direct to the internet are pretty much dead in the water these days. Residential ISPs block outbound port 25, and without clean reverse DNS (PTR records) and IP reputation, major providers will just black-hole your traffic anyway.

​That said, it is still great practice to set up Postfix/Dovecot in a lab. Learning how SMTP, IMAP, TLS, and local mail routing work inside your own network is super valuable, even if you never point MX records at your living room. And understanding the DMARC/DKIM/SPF stack is very important these days, even if you're not self hosting.

[u/Dead_Mans_Pudding]

My main question would be is this for a course or self study? If it is for a course, fair game. If this is self study I would focus more on something like my CCNA and fortinet courses/certs. I am an old man and I let my NSE 7's lapse a couple of years ago but when I was active Fortinet had great, free learning. They also have a massive market share. If you are an entry level networking student and just want to learn Linux, I would become comfortable with the basic show and troubleshooting commands if I were you.

[u/Zealousideal_Fly8402]

Maybe consider the formal CompTIA Network+ certification to get your fundamentals down first.

[u/umataro]

You need some Daniil Baturin's Task-centered iproute2 user guide in your life - https://baturin.org/docs/iproute2/

I've been working with linux networking for 25 years and this is the first time I bookmarked a page about it. I use it to teach our newbies too. There is no other book, guide, video or course that covers as much breadth with such a hands-on approach.

[u/Mishoniko]

I think you want r/sysadmin, that stuff is more their wheelhouse.