Networking - Revision history

Yuannan: /* Virtualization: added more granular advice */

2025-10-22T08:47:10Z

Virtualization: added more granular advice

← Older revision		Revision as of 08:47, 22 October 2025
Line 120:		Line 120:

	=== Virtualization ===		=== Virtualization ===
	Sometimes ~~with~~ complex network configurations ~~such as~~ with VPNs or firewall rules you may need extra configurations in order for your VMs to have network access.<syntaxhighlight lang="nix">		Sometimes complex network configurations with VPNs or firewall rules you may need extra configurations in order for your VMs to have network access. It is recommended to use more granular control over the ports instead of simply allowing the entire interface.<syntaxhighlight lang="nix">networking = {
	networking = {
	firewall = {		firewall = {
	enable = true;		enable = true;

	trustedInterfaces = [		# Allows the entire interface through the firewall.
	"virbr0"		# trustedInterfaces = [
	];		# "virbr0"
			# ];

			# Allows individual ports through the firewall.
			interfaces = {
			virbr0 = {
			allowedUDPPorts = [
			# DNS
			53
			# DHCP
			67
			# You may want to allow more ports such as ipv6 and other services here.
			];
			};
			};
	};		};
	nat = {		nat = {
Line 136:		Line 149:
	];		];
	};		};
	};		};</syntaxhighlight>
	</syntaxhighlight>

	== IPv6 ==		== IPv6 ==

Yuannan: /* Virtualization */

2025-10-20T15:10:21Z

Virtualization

← Older revision		Revision as of 15:10, 20 October 2025
Line 120:		Line 120:

	=== Virtualization ===		=== Virtualization ===
			Sometimes with complex network configurations such as with VPNs or firewall rules you may need extra configurations in order for your VMs to have network access.<syntaxhighlight lang="nix">
	== Sometimes with complex network configurations such as with VPNs or firewall rules you may need extra configurations in order for your VMs to have network access. ==
	<syntaxhighlight lang="nix">
	networking = {		networking = {
	firewall = {		firewall = {

Yuannan: /* Virtualization subheading fix */

2025-10-20T15:09:37Z

Virtualization subheading fix

← Older revision		Revision as of 15:09, 20 October 2025
Line 119:		Line 119:
	</syntaxhighlight>		</syntaxhighlight>

	== Virtualization ==		=== Virtualization ===

	Sometimes with complex network configurations such as with VPNs or firewall rules you may need extra configurations in order for your VMs to have network access.		== Sometimes with complex network configurations such as with VPNs or firewall rules you may need extra configurations in order for your VMs to have network access. ==
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	networking = {		networking = {

Yuannan: Added help for VMs not having network access.

2025-10-20T15:08:52Z

Added help for VMs not having network access.

@@ Line 115: / Line 115: @@
+         }
      '';
    };
 };

FliegendeWurst: /* Configuration */ link to related pages

2025-03-09T16:09:53Z

Configuration: link to related pages

← Older revision		Revision as of 16:09, 9 March 2025
Line 2:		Line 2:

	== Configuration ==		== Configuration ==

			=== Wireless networks ===

			See [[wpa_supplicant]] / [[Iwd]].

	=== Static IP for network adapter ===		=== Static IP for network adapter ===

Axka at 02:01, 26 January 2025

2025-01-26T02:01:38Z

← Older revision		Revision as of 02:01, 26 January 2025
Line 325:		Line 325:
	=== Teaming ===		=== Teaming ===

	Using the teaming driver provides more configuration capabilities since more descision-making is done in userspace <ref>https://~~docs.redhat~~.com/en/~~documentation~~/~~red_hat_enterprise_linux~~/~~7/html/networking_guide/sec~~-~~comparison_of_network_teaming_to_bonding#sec~~-~~Comparison_of_Network_Teaming_to_Bonding~~</ref>.		Using the teaming driver provides more configuration capabilities since more descision-making is done in userspace <ref>https://github.com/jpirko/libteam/wiki/Bonding-vs.-Team-features</ref>.
	{{Expansion\|Missing information about teaming.}}		{{Expansion\|Missing information about teaming.}}

Axka: Update link aggregation section

2025-01-26T01:57:03Z

Update link aggregation section

← Older revision		Revision as of 01:57, 26 January 2025
Line 241:		Line 241:
	! Bonding mode !! Description !! Switch configuration		! Bonding mode !! Description !! Switch configuration
	\|-		\|-
	\| <code>balance-rr</code> \|\| Transmit packets round-robin. \|\| Requires static EtherChannel enabled, not LACP-negotiated.		\| <code>balance-rr</code> \|\| '''Default'''. Transmit packets round-robin. \|\| Requires static EtherChannel enabled, not LACP-negotiated.
	\|-		\|-
	\| <code>active-backup</code> \|\| Only one slave in the bond in active. If it fails, another one is picked to be active. \|\| No configuration required on the switch.		\| <code>active-backup</code> \|\| Recommended for fault tolerance when 802.3ad isn't available. Only one slave in the bond in active. If it fails, another one is picked to be active. \|\| No configuration required on the switch.
	\|-		\|-
	\| <code>balance-xor</code> \|\| Transmit packets based on the selected transmit hash policy. \|\| Requires static EtherChannel enabled, not LACP-negotiated.		\| <code>balance-xor</code> \|\| Transmit packets based on the selected transmit hash policy. \|\| Requires static EtherChannel enabled, not LACP-negotiated.
Line 249:		Line 249:
	\| <code>broadcast</code> \|\| Transmit everything on all slave interfaces. \|\| Requires static EtherChannel enabled, not LACP-negotiated.		\| <code>broadcast</code> \|\| Transmit everything on all slave interfaces. \|\| Requires static EtherChannel enabled, not LACP-negotiated.
	\|-		\|-
	\| <code>802.3ad</code> \|\| IEEE 802.3ad Dynamic link aggregation. Transmits packets based on the selected transmit hash policy. \|\| Requires LACP-negotiated EtherChannel enabled. In simpler terms, dynamic LACP.		\| <code>802.3ad</code> \|\| '''Recommended'''. IEEE 802.3ad Dynamic link aggregation. Transmits packets based on the selected transmit hash policy. \|\| Requires LACP-negotiated EtherChannel enabled. In simpler terms, dynamic LACP.
	\|-		\|-
	\| <code>balance-tlb</code> \|\| Adaptive transmit load balancing \|\| No configuration required on the switch.		\| <code>balance-tlb</code> \|\| Adaptive transmit load balancing \|\| No configuration required on the switch.
Line 260:		Line 260:
	=== NetworkManager ===		=== NetworkManager ===

	{{Warning\|This has not been fully tested.}}		{{Warning\|This has not been fully tested. I'm not sure if all the properties are required.}}

	{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>		{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
Line 266:		Line 266:
	"Bond connection 1" = {		"Bond connection 1" = {
	bond = {		bond = {
	~~downdelay = "0";~~		miimon = "100"; # Monitor MII link every 100ms
	miimon = "1";		mode = "802.3ad";
	mode = "802.3ad"; ~~# dynamic LACP~~		xmit_hash_policy = "layer3+4"; # IP and TCP/UDP hash
	~~updelay~~ = "0";
	};		};
	connection = {		connection = {
Line 290:		Line 289:
	id = "bond0 port 1";		id = "bond0 port 1";
	type = "ethernet";		type = "ethernet";
	interface-name = "~~eth1~~"; ~~# Replace this~~		interface-name = "enp2s0";
	controller = "bond0";		controller = "bond0";
	port-type = "bond";		port-type = "bond";
Line 299:		Line 298:
	id = "bond0 port 2";		id = "bond0 port 2";
	type = "ethernet";		type = "ethernet";
	interface-name = "~~eth2~~"; ~~# Replace this~~		interface-name = "enp3s0";
	controller = "bond0";		controller = "bond0";
	port-type = "bond";		port-type = "bond";
Line 307:		Line 306:
	</nowiki>}}		</nowiki>}}

	=== systemd-networkd ===		=== systemd-networkd and scripted networking ===

	=== ~~legacy scripted networking?~~ ===		See [[Systemd/networkd#Bonding]] for more detailed configuration possibilities.

			{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
			networking.bonds = {
			bond0 = {
			interfaces = [ "enp2s0" "enp3s0" ];
			driverOptions = {
			miimon = "100"; # Monitor MII link every 100ms
			mode = "802.3ad";
			xmit_hash_policy = "layer3+4"; # IP and TCP/UDP hash
			};
			};
			};
			</nowiki>}}

	=== Teaming ===		=== Teaming ===

Axka: Add link aggregation

2025-01-26T01:25:13Z

Add link aggregation

@@ Line 115: / Line 115: @@
 </syntaxhighlight>
-= IPv6 =
+== IPv6 ==
-== Prefix delegation with fixed DUID ==
+=== Prefix delegation with fixed DUID ===
 Sometimes the hosting provider manages IPv6 networks via a so-called ''DUID'' or ''clientid''. This snippet is required to make the network routable:
@@ Line 157: / Line 157: @@
 </syntaxhighlight>
-== IPv6-mostly ==
+=== IPv6-mostly ===
 For IPv6 mostly networks the situation in Linux is a little bit dire.
@@ Line 190: / Line 190: @@
 * https://nlnet.nl/project/IPv6-monostack/
-= VLANs =
+== VLANs ==
 Refer to [https://nixos.org/manual/nixos/stable/options.html#opt-networking.vlans {{ic|networking.vlans}} in the manual].
@@ Line 232: / Line 232: @@
      };
 </syntaxhighlight>
 [[Category:Networking]]

Gileri: /* Port forwarding */ Explain that both sections are the same configuration

2024-12-07T15:26:44Z

Port forwarding: Explain that both sections are the same configuration

← Older revision		Revision as of 15:26, 7 December 2024
Line 46:		Line 46:
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	networking = {		networking = {
	~~nftables = {~~
	~~enable = true;~~
	~~ruleset = ''~~
	~~table ip nat {~~
	~~chain PREROUTING {~~
	~~type nat hook prerouting priority dstnat; policy accept;~~
	~~iifname "ens3" tcp dport 80 dnat to 10.100.0.3:80~~
	}
	}
	~~'';~~
	};
	firewall = {		firewall = {
	enable = true;		enable = true;
Line 73:		Line 62:
	];		];
	};		};
	};		# Previous section is equivalent to :
	~~</syntaxhighlight>~~

	~~For IPv6 port forwarding, the example would look like this. Incoming connections on the address <code>2001:db8::</code> and port <code>80</code> will be forwarded~~ to ~~<code>[fe80::1234:5678:9abc:def0]~~:~~80</code>.~~

	~~<syntaxhighlight lang="nix">~~
	~~networking = {~~
	nftables = {		nftables = {
	enable = true;		enable = true;
	ruleset = ''		ruleset = ''
	table ~~ip6~~ nat {		table ip nat {
	chain PREROUTING {		chain PREROUTING {
	type nat hook prerouting priority dstnat; policy accept;		type nat hook prerouting priority dstnat; policy accept;
	iifname "ens3" ~~ip6 daddr [2001:db8::]~~ tcp dport 80 dnat to ~~[fe80::1234:5678:9abc:def0]~~:80		iifname "ens3" tcp dport 80 dnat to 10.100.0.3:80
	}		}
	}		}
	'';		'';
	};		};
			};
			</syntaxhighlight>

			For IPv6 port forwarding, the example would look like this. Incoming connections on the address <code>2001:db8::</code> and port <code>80</code> will be forwarded to <code>[fe80::1234:5678:9abc:def0]:80</code>.

			<syntaxhighlight lang="nix">
			networking = {
	firewall = {		firewall = {
	enable = true;		enable = true;
Line 109:		Line 99:
	}		}
	];		];
			};
			# Previous section is equivalent to :
			nftables = {
			enable = true;
			ruleset = ''
			table ip6 nat {
			chain PREROUTING {
			type nat hook prerouting priority dstnat; policy accept;
			iifname "ens3" ip6 daddr [2001:db8::] tcp dport 80 dnat to [fe80::1234:5678:9abc:def0]:80
			}
			}
			'';
	};		};
	};		};

0x4A6F: IPv6-mostly

2024-05-22T08:30:05Z

IPv6-mostly

@@ Line 76: / Line 76: @@
 </syntaxhighlight>
-For IPv6 port forwarding, the example would look like this. Icoming connections on the address <code>2001:db8::</code> and port <code>80</code> will be forwarded to <code>[fe80::1234:5678:9abc:def0]:80</code>.
+For IPv6 port forwarding, the example would look like this. Incoming connections on the address <code>2001:db8::</code> and port <code>80</code> will be forwarded to <code>[fe80::1234:5678:9abc:def0]:80</code>.
 <syntaxhighlight lang="nix">
@@ Line 154: / Line 154: @@
 '';
 </syntaxhighlight>
 = VLANs =