Linux Network Configurer

Linux Network Configurer

Overview

Generates ready-to-apply network configuration files and commands for any Linux networking task. Detects the user's network stack (NetworkManager, systemd-networkd, or legacy ifupdown) and produces the correct config format. Writes all files to disk and prints only the apply commands.

Language: Respond in the user's language. Config files and comments in English.

When to Use

• User wants to set a static IP address
• User wants to configure routing, VLANs, bonding, or bridges
• User wants to set up WireGuard or OpenVPN
• User wants to configure iptables, nftables, or firewalld rules
• User asks "why is my network not working?" — include troubleshooting
• User wants to configure DNS resolvers or /etc/hosts

When NOT to Use

• User wants to audit firewall rules → linux-config-auditor
• User wants to harden the full server → linux-security-hardener
• User wants to write a network monitoring script → linux-shell-scriptor

Step 1 — Detect Task Type

Map the user's request to a task category. If the request covers multiple areas, handle them all.

Step 2 — Detect the Network Stack

Ask at most one question if the network stack is unknown:

"Which network manager does your system use?"

1. NetworkManager — most desktop and RHEL/Rocky/Alma systems
2. systemd-networkd — most servers, Ubuntu Server, Arch Linux
3. ifupdown (/etc/network/interfaces) — older Debian/Ubuntu
4. Not sure — I'll generate all three formats

If the user specifies their distro, auto-detect:

Netplan (Ubuntu 18.04+): Netplan is a YAML frontend that writes to either NetworkManager or systemd-networkd. Always prefer Netplan on Ubuntu — it survives upgrades better than editing lower-level configs directly. Use netplan try instead of netplan apply — auto-reverts after 120s if no confirmation.

Configuration Patterns

Static IP

systemd-networkd (/etc/systemd/network/10-static.network):

[Match]
Name=eth0

[Network]
Address=192.168.1.100/24
Gateway=192.168.1.1
DNS=1.1.1.1
DNS=8.8.8.8

[Route]
Gateway=192.168.1.1

Apply:

systemctl restart systemd-networkd
networkctl status

Netplan (/etc/netplan/01-static.yaml) — Ubuntu Server:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      addresses:
        - 192.168.1.100/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses: [1.1.1.1, 8.8.8.8]
      dhcp4: false

Apply:

netplan apply

NetworkManager (/etc/NetworkManager/system-connections/static.nmconnection):

[connection]
id=static-eth0
type=ethernet
interface-name=eth0

[ipv4]
method=manual
addresses=192.168.1.100/24
gateway=192.168.1.1
dns=1.1.1.1;8.8.8.8;

[ipv6]
method=disabled

Apply:

chmod 600 /etc/NetworkManager/system-connections/static.nmconnection
nmcli connection reload
nmcli connection up static-eth0

ifupdown (/etc/network/interfaces):

auto eth0
iface eth0 inet static
    address 192.168.1.100/24
    gateway 192.168.1.1
    dns-nameservers 1.1.1.1 8.8.8.8

Apply:

ifdown eth0 && ifup eth0

VLAN Configuration

systemd-networkd — two files needed:

/etc/systemd/network/10-vlan100.netdev:

[NetDev]
Name=eth0.100
Kind=vlan

[VLAN]
Id=100

/etc/systemd/network/10-vlan100.network:

[Match]
Name=eth0.100

[Network]
Address=10.100.0.1/24

Apply: systemctl restart systemd-networkd

ip commands (immediate, not persistent):

ip link add link eth0 name eth0.100 type vlan id 100
ip addr add 10.100.0.1/24 dev eth0.100
ip link set eth0.100 up

Interface Bonding (LACP / Active-Backup)

systemd-networkd — three files:

/etc/systemd/network/10-bond0.netdev:

[NetDev]
Name=bond0
Kind=bond

[Bond]
Mode=802.3ad          # LACP — use active-backup for failover only
TransmitHashPolicy=layer3+4
LACPTransmitRate=fast
MIIMonitorSec=100ms

/etc/systemd/network/10-bond-slave.network (apply to each slave interface):

[Match]
Name=eth0

[Network]
Bond=bond0

/etc/systemd/network/10-bond0.network:

[Match]
Name=bond0

[Network]
Address=192.168.1.100/24
Gateway=192.168.1.1

Bridge Interface (for VMs / LXC containers)

systemd-networkd:

/etc/systemd/network/10-bridge.netdev:

[NetDev]
Name=br0
Kind=bridge

/etc/systemd/network/10-bridge-bind.network:

[Match]
Name=eth0

[Network]
Bridge=br0

/etc/systemd/network/10-bridge.network:

[Match]
Name=br0

[Network]
Address=192.168.1.100/24
Gateway=192.168.1.1

WireGuard VPN

Generate a complete WireGuard server + client config pair.

Server (/etc/wireguard/wg0.conf):

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <SERVER_PRIVATE_KEY>

# Enable IP forwarding and NAT for client internet access
# iptables version (most systems):
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
# nftables alternative (Debian 12+, RHEL 9+):
# PostUp = nft add rule inet filter forward iifname wg0 accept; nft add rule inet nat postrouting oifname eth0 masquerade
# PostDown = nft flush ruleset

[Peer]
# Client 1
PublicKey = <CLIENT1_PUBLIC_KEY>
AllowedIPs = 10.8.0.2/32

Client (wg0-client.conf):

[Interface]
Address = 10.8.0.2/24
PrivateKey = <CLIENT_PRIVATE_KEY>
DNS = 1.1.1.1

[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0    # Route all traffic through VPN
PersistentKeepalive = 25
# MTU = 1280              # Uncomment if experiencing fragmentation issues

Key generation commands:

# Generate server keys
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key

# Generate client keys
wg genkey | tee client1_private.key | wg pubkey > client1_public.key

# Enable and start
sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.d/99-wireguard.conf
systemctl enable --now wg-quick@wg0
wg show

iptables Ruleset

Generate a complete stateful iptables ruleset as a script:

#!/usr/bin/env bash
# Flush existing rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

# Default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT

# Allow established/related
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP/HTTPS (remove if not a web server)
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow ICMP ping
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Log and drop everything else
iptables -A INPUT -j LOG --log-prefix "IPT-DROP: " --log-level 4
iptables -A INPUT -j DROP

# Save rules
iptables-save > /etc/iptables/rules.v4

nftables Ruleset

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        iif lo accept
        ct state established,related accept
        ct state invalid drop

        tcp dport 22 accept
        tcp dport { 80, 443 } accept
        icmp type echo-request accept
        icmpv6 type { echo-request, nd-neighbor-solicit, nd-router-advert } accept

        log prefix "nft-drop: " drop
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}

Apply: nft -f /etc/nftables.conf && systemctl enable nftables

Tailscale VPN (easier alternative to WireGuard)

Use when the user wants a zero-config mesh VPN without managing a server.

# Install (Ubuntu/Debian)
curl -fsSL https://tailscale.com/install.sh | sh

# Authenticate and connect
tailscale up

# Advertise this machine as a subnet router (optional — exposes LAN)
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.d/99-tailscale.conf
sysctl -p /etc/sysctl.d/99-tailscale.conf
tailscale up --advertise-routes=192.168.1.0/24

# Enable exit node (route all client traffic through this server)
tailscale up --advertise-exit-node

# Check status
tailscale status
tailscale ip          # your Tailscale IP (100.x.x.x range)

Key differences from WireGuard:

• No server to configure — Tailscale manages the coordination
• Devices connect directly peer-to-peer (DERP relay as fallback)
• Access control defined in Tailscale admin console, not config files
• Requires Tailscale account (free tier: 100 devices)

DNS Configuration

systemd-resolved (modern systems):

# /etc/systemd/resolved.conf
[Resolve]
DNS=1.1.1.1 8.8.8.8
FallbackDNS=9.9.9.9
DNSSEC=yes
DNSOverTLS=yes

# Apply
systemctl restart systemd-resolved
resolvectl status

Direct /etc/resolv.conf (when not using systemd-resolved):

nameserver 1.1.1.1
nameserver 8.8.8.8
options ndots:5

Prevent DHCP from overwriting DNS:

# NetworkManager
echo "[main]
dns=none" > /etc/NetworkManager/conf.d/no-dns-update.conf
systemctl restart NetworkManager

Network Troubleshooting Checklist

When the user reports network issues, run through this and generate the diagnostic commands:

# 1. Check interface state
ip link show
ip addr show

# 2. Check routing table
ip route show
ip route get 8.8.8.8

# 3. Test layer 3 connectivity
ping -c 3 192.168.1.1      # gateway
ping -c 3 8.8.8.8          # internet IP (bypasses DNS)
ping -c 3 google.com       # tests DNS + internet

# 4. DNS resolution
resolvectl query google.com
# or: nslookup google.com
# or: dig google.com @1.1.1.1

# 5. Check firewall
iptables -L -n -v
nft list ruleset

# 6. Check listening services
ss -tlnp
# or: netstat -tlnp

# 7. Trace the route
traceroute 8.8.8.8
# or: mtr 8.8.8.8

# 8. Check logs for network errors
journalctl -u NetworkManager --since "1 hour ago"
journalctl -u systemd-networkd --since "1 hour ago"
dmesg | grep -i "eth\|net\|link"

Output Format

Write all config files silently to ./network-config/ in the current working directory.

Then print ONLY:

✅ Network config written to ./network-config/

▶ Files created:
  [list each file with its destination path on the system]

▶ To apply:
  [exact commands to apply the config — in order]

▶ To verify:
  ip addr show
  ip route show
  ping -c 3 8.8.8.8

⚠️  Test in a second SSH session before disconnecting — wrong network config can lock you out.

Safety Rules

• Always warn about applying network changes over SSH — wrong config = lockout
• Always include rollback — show how to revert if something breaks
• Validate before apply — include syntax check commands (netplan try, wg showconf)
• netplan try instead of netplan apply when possible — auto-reverts after 120s if no confirmation
• Never disable the primary interface without confirming there's console/IPMI access

Safe Remote Apply Sequence

Always include this workflow when the user is applying config over SSH:

1. Open a SECOND SSH session to the server — keep it open as a safety net
2. Apply config in the FIRST session
3. From the SECOND session: verify connectivity (ping, ssh test)
4. Only close the first session once verified
5. If something breaks: use the second session to revert

For Netplan specifically:

# netplan try auto-reverts after 120s if you don't confirm
netplan try
# If you can still SSH in:
netplan apply   # or press Enter if prompted
# If locked out — wait 120s, netplan will revert automatically

⚠️ Netplan try timer details:

• The 120-second countdown starts immediately and cannot be paused or extended
• The revert will fire even if your SSH session is still active — you'll lose the connection
• Always test in a SECOND SSH session before the timer expires
• If the SECOND session can't connect: wait 120s for automatic revert, do NOT close the first session