linux-networking
Purpose
This skill handles Linux networking tasks, including IP configuration with Netplan, firewall management via UFW or Nftables, DNS setup, VPN configuration for Wireguard or Tailscale, and inter-instance routing on systems like System76.
When to Use
Use this skill for server setup on Ubuntu/Debian systems, securing applications with firewalls, establishing secure remote access via VPN, resolving DNS issues in containerized environments, or optimizing routing between networked instances in data centers or edge devices.
Key Capabilities
- Configure static/dynamic IP addresses using Netplan YAML files (e.g., set interface to DHCP or static IP).
- Manage firewalls with UFW for simple rules (e.g., allow/deny ports) or Nftables for advanced packet filtering via tables and chains.
- Handle DNS resolution with tools like systemd-resolved or /etc/resolv.conf edits.
- Set up VPNs: Wireguard for peer-to-peer tunnels using wg-quick, or Tailscale for automatic mesh networks with key authentication.
- Implement inter-instance routing on System76 hardware, such as setting up OSPF or static routes for multi-device communication.
Usage Patterns
Always run commands with sudo for root privileges. For scripts, check if services like NetworkManager or systemd-networkd are active. Use environment variables for sensitive data, e.g., export TAILSCALE_API_KEY=$SERVICE_API_KEY before Tailscale operations. In AI responses, structure tasks as sequential commands: first validate config files, then apply changes, and finally verify with diagnostic tools. For automation, wrap commands in bash scripts with error checks, e.g., use set -e to exit on failure.
Common Commands/API
- Netplan configuration: Edit /etc/netplan/01-netcfg.yaml with content like
network: version: 2 renderer: networkd ethernets: eno1: dhcp4: true, then run sudo netplan apply.
- UFW firewall: Enable with
sudo ufw enable, add rules like sudo ufw allow 22/tcp, and check status with sudo ufw status verbose.
- Nftables firewall: Load rules from /etc/nftables.conf (e.g.,
table ip filter { chain input { type filter hook input priority 0; policy accept; } }), then apply with sudo nft -f /etc/nftables.conf.
- DNS management: Edit /etc/resolv.conf (e.g., add
nameserver 8.8.8.8), or use systemd-resolve --set-dns=8.8.8.8 eth0.
- Wireguard VPN: Generate keys with
wg genkey | tee privatekey | wg pubkey > publickey, configure /etc/wireguard/wg0.conf with [Interface] PrivateKey = <key> Address = 10.0.0.1/24, and start with sudo wg-quick up wg0.
- Tailscale VPN: Authenticate with
tailscale up --authkey $TAILSCALE_API_KEY, then manage peers via Tailscale API (e.g., GET https://api.tailscale.com/api/v2/devices).
- Inter-instance routing: Add static routes with
sudo ip route add 192.168.1.0/24 via 10.0.0.1, or configure OSPF on System76 using quagga with commands like router ospf in vtysh.
Integration Notes
Integrate with orchestration tools like Ansible by using modules such as ansible.builtin.shell for running Netplan commands, or community.general.ufw for firewall rules. For Tailscale, pass API keys via environment variables (e.g., $TAILSCALE_API_KEY) and use their HTTP API for device management. Wireguard integrates with systemd by enabling services via sudo systemctl enable wg-quick@wg0. Ensure compatibility with NetworkManager by disabling it for Netplan (e.g., sudo systemctl stop NetworkManager). For DNS, link with systemd-resolved in containers by mounting /etc/resolv.conf. Always validate configs with tools like nmcli or ip a before applying changes.
Error Handling
Check for permission errors by prefixing commands with sudo; if netplan apply fails with "Invalid YAML", validate the file with yamllint /etc/netplan/01-netcfg.yaml. For UFW/Nftables, use sudo ufw status or sudo nft list ruleset to debug rules; common issues include port conflicts—resolve by checking with ss -tuln. VPN errors: If Wireguard fails to start, verify keys with wg show and check logs with journalctl -u wg-quick@wg0; for Tailscale, handle authentication failures by re-exporting $TAILSCALE_API_KEY and retrying. Routing problems: Use ip route show to diagnose; if routes don't propagate, restart networking with sudo systemctl restart networking. Always log outputs in scripts using >> error.log 2>&1.
Concrete Usage Examples
- Set up a basic firewall on Ubuntu: First, enable UFW with
sudo ufw enable. Then, allow SSH: sudo ufw allow 22. Verify: sudo ufw status. This secures the server while permitting remote access.
- Configure a Wireguard VPN tunnel: Create a config file at /etc/wireguard/wg0.conf with
[Interface] Address = 10.0.0.1/24 PrivateKey = <generated_key>. Start it: sudo wg-quick up wg0. Test connectivity: ping 10.0.0.2. This establishes a secure link between instances.
Graph Relationships
- Related to cluster: linux
- Connected via tags: networking (direct link), linux (cluster parent), firewall (sub-skill), vpn (dependency), tailscale (specific tool)
- Outgoing edges: integrates with linux-security for broader protection, links to linux-storage for network-mounted volumes
- Incoming edges: depends on linux-basics for core OS commands, referenced by devops-tools for automation workflows
1---2name: linux-networking3description: netplan/ip, ufw/nftables firewall, DNS, VPN Wireguard/Tailscale, inter-instance routing System764---5
6# linux-networking
7
8## Purpose
9This skill handles Linux networking tasks, including IP configuration with Netplan, firewall management via UFW or Nftables, DNS setup, VPN configuration for Wireguard or Tailscale, and inter-instance routing on systems like System76.
10
11## When to Use
12Use this skill for server setup on Ubuntu/Debian systems, securing applications with firewalls, establishing secure remote access via VPN, resolving DNS issues in containerized environments, or optimizing routing between networked instances in data centers or edge devices.
13
14## Key Capabilities
15- Configure static/dynamic IP addresses using Netplan YAML files (e.g., set interface to DHCP or static IP).
16- Manage firewalls with UFW for simple rules (e.g., allow/deny ports) or Nftables for advanced packet filtering via tables and chains.
17- Handle DNS resolution with tools like systemd-resolved or /etc/resolv.conf edits.
18- Set up VPNs: Wireguard for peer-to-peer tunnels using wg-quick, or Tailscale for automatic mesh networks with key authentication.
19- Implement inter-instance routing on System76 hardware, such as setting up OSPF or static routes for multi-device communication.
20
21## Usage Patterns
22Always run commands with sudo for root privileges. For scripts, check if services like NetworkManager or systemd-networkd are active. Use environment variables for sensitive data, e.g., export TAILSCALE_API_KEY=$SERVICE_API_KEY before Tailscale operations. In AI responses, structure tasks as sequential commands: first validate config files, then apply changes, and finally verify with diagnostic tools. For automation, wrap commands in bash scripts with error checks, e.g., use `set -e` to exit on failure.
23
24## Common Commands/API
25- Netplan configuration: Edit /etc/netplan/01-netcfg.yaml with content like `network: version: 2 renderer: networkd ethernets: eno1: dhcp4: true`, then run `sudo netplan apply`.
26- UFW firewall: Enable with `sudo ufw enable`, add rules like `sudo ufw allow 22/tcp`, and check status with `sudo ufw status verbose`.
27- Nftables firewall: Load rules from /etc/nftables.conf (e.g., `table ip filter { chain input { type filter hook input priority 0; policy accept; } }`), then apply with `sudo nft -f /etc/nftables.conf`.
28- DNS management: Edit /etc/resolv.conf (e.g., add `nameserver 8.8.8.8`), or use `systemd-resolve --set-dns=8.8.8.8 eth0`.
29- Wireguard VPN: Generate keys with `wg genkey | tee privatekey | wg pubkey > publickey`, configure /etc/wireguard/wg0.conf with `[Interface] PrivateKey = <key> Address = 10.0.0.1/24`, and start with `sudo wg-quick up wg0`.
30- Tailscale VPN: Authenticate with `tailscale up --authkey $TAILSCALE_API_KEY`, then manage peers via Tailscale API (e.g., GET https://api.tailscale.com/api/v2/devices).
31- Inter-instance routing: Add static routes with `sudo ip route add 192.168.1.0/24 via 10.0.0.1`, or configure OSPF on System76 using `quagga` with commands like `router ospf` in vtysh.
32
33## Integration Notes
34Integrate with orchestration tools like Ansible by using modules such as `ansible.builtin.shell` for running Netplan commands, or `community.general.ufw` for firewall rules. For Tailscale, pass API keys via environment variables (e.g., $TAILSCALE_API_KEY) and use their HTTP API for device management. Wireguard integrates with systemd by enabling services via `sudo systemctl enable wg-quick@wg0`. Ensure compatibility with NetworkManager by disabling it for Netplan (e.g., `sudo systemctl stop NetworkManager`). For DNS, link with systemd-resolved in containers by mounting /etc/resolv.conf. Always validate configs with tools like `nmcli` or `ip a` before applying changes.
35
36## Error Handling
37Check for permission errors by prefixing commands with sudo; if `netplan apply` fails with "Invalid YAML", validate the file with `yamllint /etc/netplan/01-netcfg.yaml`. For UFW/Nftables, use `sudo ufw status` or `sudo nft list ruleset` to debug rules; common issues include port conflicts—resolve by checking with `ss -tuln`. VPN errors: If Wireguard fails to start, verify keys with `wg show` and check logs with `journalctl -u wg-quick@wg0`; for Tailscale, handle authentication failures by re-exporting $TAILSCALE_API_KEY and retrying. Routing problems: Use `ip route show` to diagnose; if routes don't propagate, restart networking with `sudo systemctl restart networking`. Always log outputs in scripts using `>> error.log 2>&1`.
38
39## Concrete Usage Examples
401. Set up a basic firewall on Ubuntu: First, enable UFW with `sudo ufw enable`. Then, allow SSH: `sudo ufw allow 22`. Verify: `sudo ufw status`. This secures the server while permitting remote access.
412. Configure a Wireguard VPN tunnel: Create a config file at /etc/wireguard/wg0.conf with ` [Interface] Address = 10.0.0.1/24 PrivateKey = <generated_key> `. Start it: `sudo wg-quick up wg0`. Test connectivity: `ping 10.0.0.2`. This establishes a secure link between instances.
42
43## Graph Relationships
44- Related to cluster: linux
45- Connected via tags: networking (direct link), linux (cluster parent), firewall (sub-skill), vpn (dependency), tailscale (specific tool)
46- Outgoing edges: integrates with linux-security for broader protection, links to linux-storage for network-mounted volumes
47- Incoming edges: depends on linux-basics for core OS commands, referenced by devops-tools for automation workflows
majiayu000