Wiki

• FrontPage
• RecentChanges
• FindPage
• HelpContents
• NetworkConfiguration

Translation(s): English - Español - Français - Italiano - Português (Brasil) - 简体中文

Table of Contents

4 ways to configure the network

• The interfaces configuration file at /etc/network/interfaces (this page): for basic or simple configurations (e.g. workstation)

• NetworkManager: This is the default for Laptop configuration

• Systemd: Debian reference Doc Chapter 5

• Netplan: Debian reference Doc Chapter 5

Setting up an Ethernet Interface

The majority of network setup can be done via the interfaces configuration file at /etc/network/interfaces. Here, you can give your network card an IP address (or use dhcp), set up routing information, configure IP masquerading, set default routes and much more.

Remember to add interfaces that you want brought up at boot time to the 'auto' line.

See interfaces for more options.

Starting and Stopping Interfaces

Interfaces configured with /etc/network/interfaces can be brought up and down with the ifup and ifdown commands. For example, with an interface named enp7s0:

sudo ifdown enp7s0
sudo ifup enp7s0

Some outdated guides claim you need to restart the networking service to apply changes to /etc/network/interfaces. This was deprecated because it is possible that not all interfaces will be restarted.

Reinitialize new network setup

If you make more fundamental network changes to /etc/network/interfaces (e.g. adding new virtual interfaces like a bridge), you can reinitialize the network configuration by restarting the networking daemon:

sudo systemctl status networking
sudo systemctl restart networking

Network Interface Names

See NetworkInterfaceNames. Since Stretch, old-style interface names (eth0, wlan1 etc.) have been replaced by names based on hardware location (enp0s31f6, wlp1s7 etc.). For USB dongles, these can even include the MAC address: enx2c56ac39ec0d).

You can list interfaces with: ls /sys/class/net

{i} Replace eno1 with your default interface name in the examples below.

Upgrading and Network Interface Names

Buster still supports the old naming system as long as the file /etc/udev/rules.d/70-local-persistent-net.rules exists, but Bullseye users need to switch.

Using DHCP to automatically configure the interface

If you're just using DHCP, all you need is something like:

auto eno1
allow-hotplug eno1
iface eno1 inet dhcp

For IPv6 with DHCPv6, append the following:

iface eno1 inet6 dhcp

Or for IPv6 with stateless address autoconfiguration ("SLAAC"), append the following:

iface eno1 inet6 auto

See also IPv6PrefixDelegation.

Configuring the interface manually

If you configure the interface manually, use something like this to set the default gateway (network, broadcast and gateway are optional):

auto eno1
iface eno1 inet static
 address 192.0.2.7/24
 gateway 192.0.2.254

If you want to add an IPv6 address too, append something like:

iface eno1 inet6 static
 address 2001:db8::c0ca:1eaf/64
 gateway 2001:db8::1ead:ed:beef

See interfaces for more options.

Make sure to disable all DHCP services, e.g. dhcpcd.

Mixing manual and automatic configuration is also possible, e.g. to use IPv6 SLAAC for internet connectivity and static addresses within the network:

# manual unique local address
iface eno1 inet6 static
 address fdc3:cafe::3/64
 # use SLAAC to get global IPv6 address from the router
 # we may not enable ipv6 forwarding, otherwise SLAAC gets disabled
 autoconf 1
 accept_ra 2

Setting the speed and duplex

/!\ Autonegotiation repeatedly failing is often a symptom of faulty cabling - investigate physical matters before assuming that the interfaces' autonegotiation algorithms are incompatible.

If you turn off autonegotiation and set speed and duplex manually, the partner interface at the other end of the cable will assume that the absence of autonegotiation indicates a speed of 10Mbps and a duplex of half. For error-free operation when setting speed and duplex manually, set exactly the same speed and duplex for the devices at both ends of the cable.

If you set your interface's speed and duplex by hand, some trial and error may be required. Here are the basic steps:

1. install ethtool and net-tools, so that you have the ethtool and mii-tool programs

   • one or both of these might work for your interface
2. have a way to login to the system in case the network interface becomes nonfunctional

   • an SSH connection could be disrupted, so you need a fallback strategy

3. identify the interface in question (often eno1)

   • adjust the remainder of these instructions accordingly
4. try to determine what its current speed and duplex settings are...

   1. try sudo ethtool eno1 and see whether the "Speed:" and "Duplex:" lines look right

      • if not, ethtool may not be supported by your device

   2. try sudo mii-tool -v eno1 and see whether its output looks right

      • if not, mii-tool may not be supported by your device

   3. if neither is supported, you may have to set parameters directly on the kernel driver module:

      1. identify which driver module you're using by reading the output of dmesg and lsmod

      2. try modinfo MODULENAME to see what parameters it accepts, if any (you can use modinfo even on modules that are not loaded, for comparison)

      3. ToDo: where does one set kernel module parameters?

5. try to change the settings of the interface with one of these (assuming 100 Mbps and full duplex):

   • sudo ethtool -s eno1 speed 100 duplex full autoneg off

   • sudo mii-tool -F 100baseTx-FD eno1

6. re-check to see whether the interface settings actually changed
7. try sending some data in and out of the system to see whether the NIC is operating correctly

8. put the successful command in /etc/network/interfaces so it runs when you bring the interface up (e.g. at boot time)

   • some drivers begin autonegotiation when they're loaded, so you may need to delay the command a few seconds until autonegotiation finishes

    iface eno1 inet static
    address .../...
    gateway ...
    up sleep 5; ethtool -s eno1 ...

9. reboot the machine to make sure it comes up correctly
   • be prepared to intervene manually (e.g. Ctrl-Alt-Del and then boot into single-user mode from GRUB or LILO)

Bringing up an interface without an IP address

To create a network interface without an IP address at all, use the manual method and the pre-up and post-down commands:

iface eno1 inet manual
 pre-up ifconfig $IFACE up
 post-down ifconfig $IFACE down

If the interface is a VLAN interface, the up/down commands must be executed after/before the vlan hooks. You also have to install the vlan package.

iface eno1.99 inet manual
 post-up ifconfig $IFACE up
 pre-down ifconfig $IFACE down

Note: If you create the VLAN interface only to put it in a bridge, there is no need to define the VLAN interface manually. Just configure the bridge, and the VLAN interface will be created automatically when creating the bridge (see below).

Defining the (DNS) Nameservers

nameserver 1.1.1.1
nameserver 8.8.8.8

[802-3-ethernet]
duplex=full
mac-address=XX:XX:XX:XX:XX:XX

[connection]
id=Wired connection 1
uuid=xxx-xxxxxx-xxxxxx-xxxxxx-xxx
type=802-3-ethernet
timestamp=1385213042

[ipv6]
method=auto

[ipv4]
method=auto
dns=208.67.222.222;
ignore-auto-dns=true

apt install systemd-resolved

systemctl enable systemd-resolved
ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

hosts: mymachines resolve [!UNAVAIL=return] files dns myhostname 

resolvectl

resolvectl flush-cache

supersede domain-name "example.com";
supersede domain-search "example.com";
supersede domain-name-servers 127.0.0.1;

echo 'make_resolv_conf() { :; }' > /etc/dhcp/dhclient-enter-hooks.d/leave_my_resolv_conf_alone
chmod 755 /etc/dhcp/dhclient-enter-hooks.d/leave_my_resolv_conf_alone

supersede domain-name-servers 12.34.56.78, 12.34.56.79;

prepend domain-name-servers 12.34.56.78, 12.34.56.79;

append domain-name " virt vpn";

dns-nameservers 12.34.56.78 12.34.56.79

rm -f /etc/resolv.conf
editor /etc/resolv.conf
chattr +i /etc/resolv.conf

Bridging

Bridging puts multiple interfaces into the same network segment. This is very popular for virtualization, and for connecting a server to multiple switches for high availability.

See BridgeNetworkConnections for more information.

Firewall

See nftables or ufw for more information.

Howto use vlan

An IEEE_802.1Q VLAN lets you split a single physical LAN into multiple virtual LANs. This lets network administrators do some configuration at layer 2 that would otherwise need to be done at the IP layer.

Add this to /etc/modules:

8021q

Then add a section to /etc/network/interfaces like:

auto eno1.222
iface eno1.222 inet static
 address 10.10.10.1/24

See vlan-interfaces for more information.

Bridges and VLANs

If you create VLAN interfaces only to put them into a bridge, there is no need to define the VLAN interfaces manually. Just config the bridge, and the VLAN interface will be created automatically when creating the bridge, e.g:

auto br1
iface br1 inet manual
 bridge_ports eno1.99 eno2.99
 up /usr/sbin/brctl stp br1 on

Howto create fault tolerant bonding with vlan

To "bond" two Ethernet connections together to create an auto failover interface, see Bonding.

Network config

Cisco switch interface example config:

interface GigabitEthernet1/2
 description eno2
 switchport
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 10,20,30
 switchport mode trunk
 no ip address
 no cdp enable
 spanning-tree portfast trunk

bonding with active backup

Create a file /etc/modprobe.d/bonding.conf containing:

alias bond0 bonding
options bonding mode=active-backup miimon=100 downdelay=200 updelay=200 primary=eno2

/etc/network/interfaces

# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto bond0
iface bond0 inet manual
 up ifconfig bond0 0.0.0.0 up
 slaves eno2 eno1
auto vlan10
iface vlan10 inet static
 address 10.10.10.12/24
 vlan-raw-device bond0
 gateway 10.10.0.1
 dns-search hup.hu
 dns-nameservers 10.10.0.2
auto vlan20
iface vlan20 inet static
 address 10.20.10.12/24
 vlan-raw-device bond0
auto vlan30
iface vlan30 inet static
 address 10.30.10.12/24
 vlan-raw-device bond0

• In Debian Buster, you must use interface names for VLANs in the form of: bond0.10, bond0.20, and bond0.30 instead of vlan10, vlan20, vlan30

• https://www.kernel.org/doc/Documentation/networking/bonding.txt - Linux kernel documentation on bonding

How to set the MTU (Max transfer unit / packet size) with VLANS over a bonded interface

MTU needs to be configured on the bonding interface and slave interfaces after the reset of the configuration has been applied to the bonding interfaces. This is done using a post-up line in the bonding interface configuration.

auto bond0
iface bond0 inet manual
 up ifconfig lacptrunk0 0.0.0.0 up
 slaves eno1 eno2
# bond-mode 4 = 802.3ad
 bond-mode 4
 bond-miimon 100
 bond-downdelay 200
 bond-updelay 200
 bond-lacp-rate 1
 bond-xmit-hash-policy layer2+3
 post-up ifconfig eno1 mtu 9000 && ifconfig eno2 mtu 9000 && ifconfig bond0 mtu 9000

#vlan devices will use the MTU set on bond0 device
auto vlan101
iface vlan101 inet static

 address 10.101.60.123/24
 gateway 10.155.60.1
 vlan-raw-device bond0

auto vlan151
iface vlan151 inet static

 address 192.168.1.1/24
 vlan-raw-device bond0

Multiple IP addresses on one Interface

{i} if you just need your web server to respond to two domain names, virtual hosts are a better solution than multiple addresses.

{X} Interface aliases are deprecated and should not really be used anymore. (citation needed)

This /etc/network/interfaces example assigns multiple IP addresses to eno1.

auto eno1
allow-hotplug eno1

iface eno1 inet static
 address 192.168.1.42/24
 gateway 192.168.1.1
 up /sbin/ip addr add 192.168.1.43/24 dev $IFACE label $IFACE:0
 down /sbin/ip addr del 192.168.1.43/24 dev $IFACE label $IFACE:0
 up /sbin/ip addr add 192.168.1.44/24 dev $IFACE label $IFACE:1
 down /sbin/ip addr del 192.168.1.44/24 dev $IFACE label $IFACE:1
 up /sbin/ip addr add 10.10.10.14/24 dev $IFACE label $IFACE:2
 down /sbin/ip addr del 10.10.10.14/24 dev $IFACE label $IFACE:2

iface eno1 inet6 static
 address 2001:db8:1234::1/64
 gateway fe80::1
 up /sbin/ip address add 2001:db8:1234:5678::1/64 dev $IFACE
 down /sbin/ip address del 2001:db8:1234:5678::1/64 dev $IFACE

CategoryNetwork CategorySystemAdministration