# Networking > Configures and optimizes Linux networking for cloud virtual networks and on-prem data center infrastructure with performance and security focus. - Skill: `paulpas/networking` (Agent Skill) - Install (CLI): `npx skillmds@latest add paulpas/networking` - Raw SKILL.md: https://api.skillmd.com/api/skills/paulpas/networking/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - License: MIT - Author: paulpas (https://skillmd.com/u/paulpas) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/paulpas/networking --- # Linux Networking Configuration Senior network engineer configuring and optimizing Linux networking for cloud virtual networks and on-prem data center infrastructure, covering bonding, VLANs, bridges, network namespaces, firewalls, and routing. ## TL;DR Checklist - [ ] Verify interface status and IP configuration with `ip addr show` and `ip route show` - [ ] Configure bond interfaces with appropriate mode for redundancy or throughput needs - [ ] Set up VLAN tagging with 802.1Q for network segmentation - [ ] Configure network namespaces for service isolation when needed - [ ] Apply nftables firewall rules with explicit deny-all default policy - [ ] Validate routing tables and forwarding behavior for all workloads - [ ] Test failover and redundancy by simulating link failures - [ ] Document network topology including IPs, subnets, and interface assignments --- ## When to Use Use this skill when: - **Setting up redundant network interfaces** — You need link aggregation or failover for high availability - **Configuring network segmentation** — You need VLANs or network namespaces to isolate traffic between workloads or tenants - **Deploying cloud instances** — You're configuring VPC networking, security groups, and routing for cloud workloads - **Building data center infrastructure** — You're configuring on-prem switches, bridges, and routing between subnets - **Implementing firewall policies** — You need to configure nftables/iptables for network security with explicit deny policies --- ## When NOT to Use Avoid this skill for: - **Simple single-interface setups** — If a system has one network interface with default routing, basic configuration is sufficient - **Cloud-managed networking** — When the cloud provider manages VPC, routing, and security groups (AWS, GCP, Azure), Linux-level config is supplemental only - **Software-defined networking overlay** — For Kubernetes CNI, Calico, or similar SDN solutions, configure the CNI plugin instead of raw interfaces - **DNS configuration** — Use `resolv.conf` or systemd-resolved for DNS, not the networking skill's scope Use `linux-security` for advanced firewall hardening and security policies. Use `kernel-tuning` when network performance tuning (TCP parameters) is the primary concern. --- ## Core Workflow ### 1. Assess Current Network State Document existing interfaces, routes, and configurations. ```bash # Inventory current network state ip addr show ip route show ip link show type bond cat /etc/netplan/*.yaml # Ubuntu/Debian cat /etc/network/interfaces # Debian legacy nmcli device status # NetworkManager ss -tuln # Listening sockets ``` **Checkpoint:** You have a complete picture of interfaces, IP assignments, routing tables, and listening services. ### 2. Configure Bond Interfaces Set up NIC bonding for redundancy or throughput. ```bash # Bond mode selection: # mode=0 (balance-rr) — Round-robin, max throughput # mode=1 (active-backup) — Active/passive, failover # mode=4 (802.3ad) — LACP, requires switch support # mode=6 (balance-tlb) — Adaptive transmit load balancing # Netplan configuration (Ubuntu/Debian) cat > /etc/netplan/01-bond.yaml << 'NETPLAN' network: version: 2 ethernets: ens192: {dhcp4: false} ens224: {dhcp4: false} bonds: bond0: interfaces: [ens192, ens224] parameters: mode: active-backup fail_over_mac: active mii_monitor_interval: 100 addresses: - 10.0.1.50/24 routes: - to: default via: 10.0.1.1 nameservers: addresses: [10.0.0.53, 1.1.1.1] NETPLAN # Apply netplan apply ``` **Checkpoint:** Bond interface is up, all member interfaces are enslaved, and failover mode is active. ### 3. Configure VLAN Tagging Set up VLANs for network segmentation. ```bash # Create VLAN interfaces using netplan cat > /etc/netplan/02-vlan.yaml << 'NETPLAN' network: version: 2 vlans: vlan100: id: 100 link: bond0 addresses: [10.100.0.50/24] vlan200: id: 200 link: bond0 addresses: [10.200.0.50/24] NETPLAN # Apply netplan apply # Verify VLAN interfaces ip addr show vlan100 ip addr show vlan200 ``` **Checkpoint:** VLAN interfaces are created, assigned correct subnets, and traffic is tagged/untagged correctly. ### 4. Configure Network Namespaces Isolate networking for container-like environments or service segregation. ```bash # Create network namespace sudo ip netns add myapp-ns # Create veth pair for namespace connectivity sudo ip link add veth-host type veth peer name veth-ns # Move one end into namespace sudo ip link set veth-ns netns myapp-ns # Configure namespace interfaces sudo ip netns exec myapp-ns ip addr add 10.99.0.2/24 dev veth-ns sudo ip netns exec myapp-ns ip link set veth-ns up sudo ip netns exec myapp-ns ip link set lo up sudo ip netns exec myapp-ns ip route add default via 10.99.0.1 # Configure host side sudo ip addr add 10.99.0.1/24 dev veth-host sudo ip link set veth-host up # Test connectivity sudo ip netns exec myapp-ns ping -c 3 10.99.0.1 ``` **Checkpoint:** Namespace has its own network stack, veth pair provides connectivity to the host network, and routing is correct. ### 5. Configure nftables Firewall Set up firewall rules with explicit deny-all default policy. ```bash # Create nftables configuration cat > /etc/nftables.conf << 'NFTABLES' #!/usr/sbin/nft -f flush ruleset table inet filter { # Default policy: drop everything chain input { type filter hook input priority 0; policy drop; # Allow established/related connections ct state established,related accept # Allow loopback iif "lo" accept # Allow SSH (rate-limited) tcp dport 22 ct state new ct count over 3/minute drop tcp dport 22 accept # Allow HTTP/HTTPS for web servers tcp dport { 80, 443 } accept # Allow ICMP ping (rate-limited) icmp type echo-request ct count over 5/second drop icmp type echo-request accept # Allow DNS udp dport 53 accept tcp dport 53 accept } chain forward { type filter hook forward priority 0; policy drop; # Only forward if explicitly allowed by rules below } chain output { type filter hook output priority 0; policy accept; # Allow all outbound by default; restrict via egress rules if needed } } NFTABLES # Load and enable nftables sudo nft -f /etc/nftables.conf sudo systemctl enable nftables sudo systemctl start nftables ``` **Checkpoint:** Firewall is running with default drop policy, essential services are reachable, and no accidental lockout occurred. ### 6. Configure Routing Set up static routes, policy routing, and forwarding as needed. ```bash # Add static route sudo ip route add 10.200.0.0/24 via 10.0.1.1 dev bond0 # Make route persistent (RHEL/CentOS) cat > /etc/sysconfig/network-scripts/route-bond0 << 'ROUTE' 10.200.0.0/24 via 10.0.1.1 dev bond0 ROUTE # Enable IP forwarding for routing/bridging echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-forwarding.conf sudo sysctl -p /etc/sysctl.d/99-forwarding.conf # Policy-based routing: separate routing table for specific traffic cat > /etc/iproute2/rt_tables << 'RTABLES' 100 web-tier RTABLES # Add rule: traffic from web-tier subnet uses web-tier routing table sudo ip rule add from 10.100.0.0/24 table web-tier sudo ip route add default via 10.100.0.1 table web-tier ``` **Checkpoint:** Routes are correct, forwarding is enabled, and policy-based routing (if used) handles traffic as expected. --- ## Implementation Patterns ### Pattern 1: Bond Interface Modes (BAD vs. GOOD) **BAD — Wrong bonding mode for the use case** ```bash # ❌ BAD: Using balance-rr without switch LACP support # This creates a bond that sends packets on both interfaces # but the switch doesn't understand LACP, causing packet reordering and drops cat > /etc/netplan/01-bond.yaml << 'NETPLAN' network: bonds: bond0: interfaces: [ens192, ens224] parameters: mode: balance-rr # Round-robin — requires switch config! miimon: 100 NETPLAN # ❌ BAD: Using 802.3ad without switch LACP configuration # LACP negotiation will fail, link stays down parameters: mode: 802.3ad # Requires switch port-channel/LACP config lacp_rate: fast ``` **GOOD — Match bonding mode to infrastructure capability** ```bash # ✅ GOOD: Active-backup for cloud environments (no switch dependency) cat > /etc/netplan/01-bond-cloud.yaml << 'NETPLAN' network: bonds: bond0: interfaces: [ens192, ens224] parameters: mode: active-backup # Primary/secondary failover fail_over_mac: active # MAC follows active interface primary_reselect: always # Revert to primary when available mii_monitor_interval: 100 # Check link every 100ms arp_validate: none # Don't validate ARP (cloud limitation) addresses: [10.0.1.50/24] routes: - to: default via: 10.0.1.1 NETPLAN # ✅ GOOD: 802.3ad LACP for on-prem with switch support # NOTE: Requires switch configuration: # switch(config)# port-channel mode active # switch(config-if)# channel-group 10 mode active cat > /etc/netplan/01-bond-datacenter.yaml << 'NETPLAN' network: bonds: bond0: interfaces: [ens192, ens224] parameters: mode: 802.3ad # LACP — requires switch port-channel lacp_rate: fast xmit_hash_policy: layer3+4 # Hash by src/dst IP + port miimon: 100 addresses: [10.0.1.50/24] routes: - to: default via: 10.0.1.1 NETPLAN ``` ### Pattern 2: Cloud vs On-Prem Network Configuration **Cloud VM — Active-backup bonding (no switch dependency)** ```bash # Cloud VM netplan — active-backup for failover without switch config cat > /etc/netplan/01-cloud.yaml << 'NETPLAN' network: version: 2 ethernets: eth0: dhcp4: false addresses: - 10.0.1.50/24 routes: - to: default via: 10.0.1.1 nameservers: addresses: [10.0.0.53, 169.254.169.253] # AWS local DNS bonds: bond0: interfaces: [eth0, eth1] parameters: mode: active-backup # Primary/secondary failover fail_over_mac: active # MAC follows active interface primary_reselect: always # Revert to primary when available mii_monitor_interval: 100 # Check link every 100ms addresses: - 10.0.1.50/24 routes: - to: default via: 10.0.1.1 NETPLAN netplan apply ``` **On-prem server — 802.3ad LACP bonding (requires switch configuration)** ```bash # On-prem netplan — 802.3ad LACP requires switch port-channel config # Switch side (example Cisco): # switch(config)# port-channel mode active # switch(config-if)# channel-group 10 mode active cat > /etc/netplan/01-onprem.yaml << 'NETPLAN' network: version: 2 ethernets: eth0: dhcp4: false eth1: dhcp4: false bonds: bond0: interfaces: [eth0, eth1] parameters: mode: 802.3ad # LACP — requires switch port-channel lacp_rate: fast xmit_hash_policy: layer3+4 # Hash by src/dst IP + port miimon: 100 addresses: - 10.10.1.50/24 routes: - to: default via: 10.10.1.1 nameservers: addresses: [10.10.0.53, 8.8.8.8] NETPLAN netplan apply ``` **Automated cloud instance provisioning with bash** ```bash #!/bin/bash # Generate netplan from cloud metadata or CLI — works on AWS/GCP/Azure # Usage: ./generate-netplan.sh cloud on-prem ENV="${1:-cloud}" TARGET="${2:-cloud}" NAME="${3:-server}" OUTPUT="/etc/netplan/01-${TARGET}-${NAME}.yaml" # Detect cloud provider metadata detect_provider() { # AWS if curl -s -m 2 http://169.254.169.254/latest/meta-data/instance-id 2>/dev/null | grep -q '^i-'; then echo "aws" return fi # GCP if curl -s -m 2 -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/name 2>/dev/null | grep -q '^'; then echo "gcp" return fi # Azure if curl -s -m 2 -H "Metadata-Severity: Interactive" "http://169.254.169.254/metadata/instance?api-version=2021-02-01" 2>/dev/null | grep -q '"compute"'; then echo "azure" return fi echo "bare-metal" } PROVIDER=$(detect_provider) # Generate netplan based on environment generate_netplan() { local target="$1" case "$target" in cloud) cat << 'NETPLAN' network: version: 2 ethernets: eth0: dhcp4: false addresses: [10.0.1.50/24] routes: - to: default via: 10.0.1.1 nameservers: addresses: [10.0.0.53, 169.254.169.253] bonds: bond0: interfaces: [eth0, eth1] parameters: mode: active-backup fail_over_mac: active mii_monitor_interval: 100 addresses: [10.0.1.50/24] routes: - to: default via: 10.0.1.1 NETPLAN ;; on-prem) cat << 'NETPLAN' network: version: 2 ethernets: eth0: {dhcp4: false} eth1: {dhcp4: false} bonds: bond0: interfaces: [eth0, eth1] parameters: mode: 802.3ad lacp_rate: fast xmit_hash_policy: layer3+4 miimon: 100 addresses: [10.10.1.50/24] routes: - to: default via: 10.10.1.1 nameservers: addresses: [10.10.0.53, 8.8.8.8] NETPLAN ;; esac } generate_netplan "$TARGET" > "$OUTPUT" echo "Generated $OUTPUT" echo "Run: netplan apply" ``` ### Pattern 3: nftables Chain for Service Exposure ```nftables # Service-facing nftables rules table inet services { chain input { type filter hook input priority 0; policy drop; # Allow established connections ct state established,related accept iif "lo" accept # SSH with brute-force protection tcp dport 22 ct state new limit rate 3/minute burst 5 packets accept # Web services tcp dport 80 accept tcp dport 443 accept # Application API tcp dport 8443 ip saddr != { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } drop tcp dport 8443 accept # Metrics (internal only) tcp dport 9100 ip saddr 10.0.0.0/8 accept tcp dport 9100 drop # Rate limit all other new connections ct state new limit rate 100/second burst 200 packets accept log prefix "DROPPED: " level warn } } ``` --- ## Constraints ### MUST DO - **MUST** use explicit deny-all default policies in firewall rules — never use accept-all defaults - **MUST** configure bonding mode to match available switch infrastructure — active-backup for cloud/no-switch, 802.3ad for switch-LACP - **MUST** use `nftables` for new firewall configurations — iptables is legacy, nftables is the modern replacement - **MUST** document all network assignments (IPs, subnets, gateways, DNS) in a network topology diagram or config file - **MUST** test network changes from a separate session or console — never lock yourself out of remote management - **MUST** enable connection tracking (`ct state established,related accept`) to allow return traffic through the firewall - **MUST** use VLANs for network segmentation on shared infrastructure to isolate tenant or workload traffic ### MUST NOT DO - **MUST NOT** use `balance-rr` bonding mode without switch-side LACP configuration — causes packet reordering and drops - **MUST NOT** open SSH (port 22) without rate limiting — automated brute-force scanners will target it immediately - **MUST NOT** disable connection tracking in the INPUT chain — it breaks stateful firewall operation - **MUST NOT** use deprecated `iptables-legacy` for new firewall rules — use `nftables` exclusively - **MUST NOT** configure VLANs on cloud VMs without provider support — most clouds don't support 802.1Q tagging on VM interfaces - **MUST NOT** rely on MAC-based firewall rules on cloud VMs — MAC addresses are managed by the hypervisor and can change during live migration - **MUST NOT** configure network namespaces without proper veth pair connectivity — an isolated namespace without routing is unreachable --- ## Related Skills | Skill | Purpose | |-------|---------| | `kernel-tuning` | Tune TCP parameters and network stack kernel settings for performance | | `resource-management` | Allocate network namespaces as isolated resource boundaries | | `hardware-provisioning` | Select network interfaces (1GbE, 10GbE, 25GbE) appropriate for workload | | `linux-security` | Apply security hardening that complements network firewall policies | | `observability` | Monitor network throughput, latency, and packet loss metrics |