Wiki

• FrontPage
• RecentChanges
• FindPage
• HelpContents
• NetworkConfiguration

Translation(s): English - Español - Français - Italiano - Português (Brasil) - 简体中文

Table of Contents

Configuring the network on Debian systems

Simple networking should mostly work out of the box: if you have a simple setup, such as a home wifi network, things should generally just work after the installation. But if you want to do something more complex, Debian supports several ways to manage and configure networks.

• NetworkManager provides a graphical user interface for configuring networks. It is installed by the default on Desktop systems such as laptops running Gnome and can be accessed under settings. (It also has a text-user-interface: nmtui).

• SystemdNetworkd is the default network manager for non-graphical systems such as servers (although it can also be used on desktops): See Debian reference Doc Chapter 5

• Netplan may be useful for managing cloud-based systems. See Debian reference Doc Chapter 5

• The interfaces configuration file at /etc/network/interfaces can also be edited directly. This is perhaps a bit old-fashioned, but some people still prefer to manage networks this way, and the next section gives more information about this file.

Editing /etc/network/interfaces directly

Most people will prefer to use NetworkManager or SystemdNetworkd to configure their networks, but for those that prefer to manually edit /etc/network/interfaces this sections gives some examples.

The interfaces configuration file at /etc/network/interfaces can be edited to do things such as specify an IP address, configure DHCP, set up routing information, configure IP masquerading, or decide which network devices to start on boot.

Starting and Stopping Interfaces

Interfaces configured with /etc/network/interfaces can be brought up (started) and taken down (stopped) with the ifup and ifdown commands. For example, to stop and and start an interface named enp7s0:

sudo ifdown enp7s0
sudo ifup enp7s0

You do not usually need to restart any networking services after making simple changes to /etc/network/interfaces, but if you define new virtual interfaces you may need to do so (see the next section).

Restarting the networking daemon

If you make more fundamental network changes to /etc/network/interfaces, (e.g. adding a new virtual interface such as a bridge), you will need to restart the networking daemon by running:

sudo systemctl restart networking

You can see errors by checking the systemd journal and status by running

journalctl -b -x -u networking

systemctl status networking

Network Interface Names

Each piece of networking hardware (a wifi card, ethernet card, or USB dongle) needs to be given a name. Generally, the name is based on type (en for ethernet, wl for wifi) and the hardware location. This gives names such as enp0s31f6, wlp1s7 (for USB dongles, these might include the MAC address: enx2c56ac39ec0d).

See systemd.net-naming-scheme.7 and NetworkInterfaceNames for how this works now, and how it used to work.

You can list interfaces with: ip link show or ls /sys/class/net.

Replace eno1 with your default interface name in the examples below.

Using DHCP to automatically configure the interface

DHCP allows the network router to assign you an IP address automatically.

To request an address via DHCP, you need to append the following to /etc/network/interfaces:

auto eno1
allow-hotplug eno1
iface eno1 inet dhcp

IPv6, DHCPv6 and SLAAC

For IPv6 plus DHCPv6, append the following:

iface eno1 inet6 dhcp

For IPv6 with stateless address autoconfiguration ("SLAAC"), append the following:

iface eno1 inet6 auto

See also IPv6PrefixDelegation.

Setting the default gateway

If you do not use DHCP, you will need to set the default gateway by hand with the following syntax:

auto eno1
iface eno1 inet static
    address 192.0.2.7/24
    gateway 192.0.2.254

You will need to find the correct IP addresses and netmask from somewhere else.

If you want to add an IPv6 address as well, append something like:

iface eno1 inet6 static
    address 2001:db8::c0ca:1eaf/64
    gateway 2001:db8::1ead:ed:beef

See interfaces for more options.

Make sure to disable all DHCP services, e.g. dhcpcd.

Mixing manual and DHCP configuration is also possible, e.g. to use IPv6 SLAAC for internet connectivity and static addresses within the network:

# manual unique local address
iface eno1 inet6 static
    address fdc3:cafe::3/64
    # use SLAAC to get global IPv6 address from the router
    # we may not enable ipv6 forwarding, otherwise SLAAC gets disabled
    autoconf 1
    accept_ra 2

Setting the speed and duplex

Autonegotiation repeatedly failing is often a symptom of faulty cabling - investigate physical matters before assuming that the interfaces' autonegotiation algorithms are incompatible.

If you turn off autonegotiation and set speed and duplex manually, the partner interface at the other end of the cable will assume that the absence of autonegotiation indicates a speed of 10Mbps and a duplex of half. For error-free operation when setting speed and duplex manually, set exactly the same speed and duplex for the devices at both ends of the cable.

If you set your interface's speed and duplex by hand, some trial and error may be required. Here are the basic steps:

1. install ethtool and net-tools, so that you have the ethtool and mii-tool programs

   • one or both of these might work for your interface
2. have a way to login to the system in case the network interface becomes nonfunctional

   • an SSH connection could be disrupted, so you need a fallback strategy

3. identify the interface in question (often eno1)

   • adjust the remainder of these instructions accordingly
4. try to determine what its current speed and duplex settings are...

   1. try sudo ethtool eno1 and see whether the "Speed:" and "Duplex:" lines look right

      • if not, ethtool may not be supported by your device

   2. try sudo mii-tool -v eno1 and see whether its output looks right

      • if not, mii-tool may not be supported by your device

   3. if neither is supported, you may have to set parameters directly on the kernel driver module:

      1. identify which driver module you're using by reading the output of dmesg and lsmod

      2. try modinfo MODULENAME to see what parameters it accepts, if any (you can use modinfo even on modules that are not loaded, for comparison)

      3. ToDo: where does one set kernel module parameters?

5. try to change the settings of the interface with one of these (assuming 100 Mbps and full duplex):

   • sudo ethtool -s eno1 speed 100 duplex full autoneg off

   • sudo mii-tool -F 100baseTx-FD eno1

6. re-check to see whether the interface settings actually changed
7. try sending some data in and out of the system to see whether the NIC is operating correctly

8. put the successful command in /etc/network/interfaces so it runs when you bring the interface up (e.g. at boot time)

   • some drivers begin autonegotiation when they're loaded, so you may need to delay the command a few seconds until autonegotiation finishes

    iface eno1 inet static
           address .../...
           gateway ...
           up sleep 5; ethtool -s eno1 ...

9. reboot the machine to make sure it comes up correctly
   • be prepared to intervene manually (e.g. Ctrl-Alt-Del and then boot into single-user mode from GRUB or LILO)

Bringing up an interface without an IP address

To create a network interface without an IP address at all, use the manual method and the pre-up and post-down commands:

iface eno1 inet manual
    pre-up ifconfig $IFACE up
    post-down ifconfig $IFACE down

If the interface is a VLAN interface, the up/down commands must be executed after/before the vlan hooks. You also have to install the vlan package.

iface eno1.99 inet manual
    post-up ifconfig $IFACE up
    pre-down ifconfig $IFACE down

Note: If you create the VLAN interface only to put it in a bridge, there is no need to define the VLAN interface manually. Just configure the bridge, and the VLAN interface will be created automatically when creating the bridge (see below).

Using two networks at the same time in Network Manager

By default, NetworkManager will only activate one network connection at once, but this can be changed with the route feature: Edit the profile and define as many Routes as you want, making sure the Metric field is unique. A walkthrough with screenshots is at https://www.microfusion.org/blog/how-to-use-two-or-more-networks-at-the-same-time-in-linux-mint/ or at https://archive.ph/oFpXV - although written for a different distribution it should work on Debian as well.

Note that 1. The device needs at least two or more fully independent physical Ethernet RJ45 connectors.

Defining the (DNS) Nameservers

Nameservers translate between host names like debian.org and IP addresses. See resolv.conf

Bridging

Bridging puts multiple interfaces into the same network segment. This is very popular for virtualization, and for connecting a server to multiple switches for high availability.

See BridgeNetworkConnections for more information.

Firewall

See nftables or ufw for more information.

Howto use vlan

An IEEE_802.1Q VLAN lets you split a single physical LAN into multiple virtual LANs. This lets network administrators do some configuration at layer 2 that would otherwise need to be done at the IP layer.

Add this to /etc/modules:

8021q

Then add a section to /etc/network/interfaces like:

auto eno1.222
iface eno1.222 inet static
    address 10.10.10.1/24

See vlan-interfaces for more information.

Bridges and VLANs

If you create VLAN interfaces only to put them into a bridge, there is no need to define the VLAN interfaces manually. Just config the bridge, and the VLAN interface will be created automatically when creating the bridge, e.g:

auto br1
iface br1 inet manual
        bridge_ports eno1.99 eno2.99
        up /usr/sbin/brctl stp br1 on

Howto create fault tolerant bonding with vlan

To "bond" two Ethernet connections together to create an auto failover interface, see Bonding.

Network config

Cisco switch interface example config:

interface GigabitEthernet1/2
 description eno2
 switchport
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 10,20,30
 switchport mode trunk
 no ip address
 no cdp enable
 spanning-tree portfast trunk

bonding with active backup

Create a file /etc/modprobe.d/bonding.conf containing:

alias bond0 bonding
options bonding mode=active-backup miimon=100 downdelay=200 updelay=200 primary=eno2

/etc/network/interfaces

# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto bond0
iface bond0 inet manual
        up ifconfig bond0 0.0.0.0 up
        slaves eno2 eno1
auto vlan10
iface vlan10 inet static
        address 10.10.10.12/24
        vlan-raw-device bond0
        gateway 10.10.0.1
        dns-search hup.hu
        dns-nameservers 10.10.0.2
auto vlan20
iface vlan20 inet static
        address 10.20.10.12/24
        vlan-raw-device bond0
auto vlan30
iface vlan30 inet static
        address 10.30.10.12/24
        vlan-raw-device bond0

• In Debian Buster, you must use interface names for VLANs in the form of: bond0.10, bond0.20, and bond0.30 instead of vlan10, vlan20, vlan30

• https://www.kernel.org/doc/Documentation/networking/bonding.txt - Linux kernel documentation on bonding

How to set the MTU (Max transfer unit / packet size) with VLANS over a bonded interface

MTU needs to be configured on the bonding interface and subordinate interfaces after the reset of the configuration has been applied to the bonding interfaces. This is done using a post-up line in the bonding interface configuration.

auto bond0
iface bond0 inet manual
        up ifconfig lacptrunk0 0.0.0.0 up
        slaves eno1 eno2
# bond-mode 4 = 802.3ad
        bond-mode 4
        bond-miimon 100
        bond-downdelay 200
        bond-updelay 200
        bond-lacp-rate 1
        bond-xmit-hash-policy layer2+3
        post-up ifconfig eno1 mtu 9000 && ifconfig eno2 mtu 9000 && ifconfig bond0 mtu 9000

#vlan devices will use the MTU set on bond0 device
auto vlan101
iface vlan101 inet static

        address 10.101.60.123/24
        gateway 10.155.60.1
        vlan-raw-device bond0

auto vlan151
iface vlan151 inet static

        address 192.168.1.1/24
        vlan-raw-device bond0

Multiple IP addresses on one Interface

if you just need your web server to respond to two domain names, virtual hosts are a better solution than multiple addresses.

Interface aliases are deprecated and should not really be used anymore. (citation needed)

This /etc/network/interfaces example assigns multiple IP addresses to eno1.

auto eno1
allow-hotplug eno1

iface eno1 inet static
    address 192.168.1.42/24
    gateway 192.168.1.1
    up   /sbin/ip addr add 192.168.1.43/24 dev $IFACE label $IFACE:0
    down /sbin/ip addr del 192.168.1.43/24 dev $IFACE label $IFACE:0
    up   /sbin/ip addr add 192.168.1.44/24 dev $IFACE label $IFACE:1
    down /sbin/ip addr del 192.168.1.44/24 dev $IFACE label $IFACE:1
    up   /sbin/ip addr add 10.10.10.14/24 dev $IFACE label $IFACE:2
    down /sbin/ip addr del 10.10.10.14/24 dev $IFACE label $IFACE:2

iface eno1 inet6 static
    address 2001:db8:1234::1/64
    gateway fe80::1
    up   /sbin/ip address add 2001:db8:1234:5678::1/64 dev $IFACE
    down /sbin/ip address del 2001:db8:1234:5678::1/64 dev $IFACE

CategoryNetwork CategorySystemAdministration