Quick Debian/Ubuntu networking tips

Mike Green
Oct 19, 2009 · 3 min read

Like anyone else, at times I forget how to do certain things when it comes to networking.

Here are a few reminders / tips specific to Debian and Ubuntu.

IPv4 Specific

Enable Proxy ARP (Address Resolution Protocol)

iface eth0 inet static
...
post_up echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp

Route incoming traffic to another server

Using iptables, issue the following command from the shell:

iptables -t nat -I PREROUTING -d <original ip> -j DNAT --to <other server>

Where <original ip> is the IP where incoming traffic is received, and <other server> is where the traffic should be routed to.

Route outgoing web traffic via another IP

Assuming that eth0 is the public interface, using iptables issue the following command from the shell:

iptables -t nat -A POSTROUTING -o eth0 -p tcp -m tcp --dport 80 -j SNAT --to-source <ip>

Where <ip> is the IP address to be used.

Note: You can substitute tcp for udp, or use a different port for other applications such as FTP. Also, the IP must be routable to your server.

Viewing the NAT table

iptables -t nat -L

Flush iptables

iptables -F && iptables -t nat -F && iptables -t mangle -F

IPv6 Specific

Enable Proxy NDP for IPv6 (Neighbor Detection Protocol)

iface eth0 inet static
...
post_up echo 1 > /proc/sys/net/ipv6/conf/eth0/proxy_ndp

Manually announce an IPv6 neighbor

ip -6 neigh add proxy <ipv6> dev eth0

Where <ipv6> is the actual IPv6 address.

Enable IPv6 forwarding

net.ipv6.conf.all.forwarding=1

Adding more than one IPv6 address per interface

iface eth0 inet6 static
...
up /sbin/ifconfig eth0 inet6 add <ip>/<netmask>

Where <ip>/<netmask> is the actual IPv6 and netmask respectively, i.e.: dead:beef:cafe:1::1/64.

Note: The last entry takes priority.

Setup a 6to4 tunnel (IPv6 to IPv4 translation)

printf "2002:%02x%02x:%02x%02x::1n" $(echo <ipv4> | tr . ' ')

Where <ipv4> is the actual IPv4 address, i.e.., 91.2.3.4 would result in 2002:5b02:0304::1.

Edit /etc/network/interfaces, add:

auto tun6to4
iface tun6to4 inet6 v4tunnel
address <ipv6 obtained>
netmask 16
gateway ::192.88.99.1
endpoint any
local <actual ipv4>

Where the <ipv6 obtained> and <actual ipv4> is from the explanation given earlier. For example:

auto tun6to4
iface tun6to4 inet6 v4tunnel
address 2002:5b02:0304::1
netmask 16
gateway ::192.88.99.1
endpoint any
local 91.2.3.4

Note: 192.88.99.1 will automatically select the nearest IPv6 to IPv4 gateway.

Application Specific

Setup OpenVPN tap tunnel interface on a bridge

iface vmbr0 inet static
...
bridge_ports tap0
...
pre-up /usr/sbin/openvpn --mktun --dev tap0
post-down /usr/sbin/openvpn --rmtun --dev tap0

Enable OpenVZ/Proxmox for IPv6

...
IPV6="yes"
...

Adding a failover IP (OVH)

auto eth0:<alias number>
iface eth0:<alias number> inet static
address <failover ip>
netmask 255.255.255.255

Where <alias number> is a sequential number starting at 0 (zero) and <failover ip> is the actual failover IP address. For example:

auto eth0:0
iface eth0:0 inet static
address 91.2.3.4
netmask 255.255.255.255

Myatu’s

Myatu’s Tech Blog, from the site that has been wasting bits…

Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore

If you have a story to tell, knowledge to share, or a perspective to offer — welcome home. It’s easy and free to post your thinking on any topic. Write on Medium

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store