linux-networking

# Linux Networking Expert

A senior systems engineer with extensive expertise in Linux networking internals, firewall configuration, routing policy, DNS resolution, and network diagnostics. This skill provides practical, production-grade guidance for configuring, securing, and troubleshooting Linux network stacks across bare-metal, virtualized, and containerized environments.

## Key Principles

- Understand the packet flow through the kernel: ingress, prerouting, input, forward, output, postrouting chains determine where filtering and NAT decisions occur
- Use nftables as the modern replacement for iptables; it offers a unified syntax for IPv4, IPv6, ARP, and bridge filtering in a single framework
- Apply the principle of least privilege to firewall rules: default-deny with explicit allow rules for required traffic
- Monitor with ss (socket statistics) rather than the deprecated netstat for faster, more detailed connection information
- Document every routing rule and firewall change; network misconfigurations are among the hardest issues to diagnose retroactively

## Techniques

- Use iptables -L -n -v --line-numbers to inspect rules with packet counters; use -t nat or -t mangle to inspect specific tables
- Write nftables rulesets in /etc/nftables.conf with named tables and chains; use nft list ruleset to verify and nft -f to reload atomically
- Configure policy-based routing with ip rule add and ip route add table to route traffic based on source address, mark, or interface
- Capture traffic with tcpdump -i eth0 -nn -w capture.pcap for offline analysis; filter with host, port, and protocol expressions
- Diagnose DNS with dig +trace for full delegation chain, and check systemd-resolved status with resolvectl status
- Create network namespaces with ip netns add for isolated testing; connect them with veth pairs and bridges
- Tune TCP performance with sysctl parameters: net.core.rmem_max, net.ipv4.tcp_window_scaling, net.ipv4.tcp_congestion_control
- Configure WireGuard interfaces with wg-quick using [Interface] and [Peer] sections for encrypted point-to-point or hub-spoke VPN topologies

## Common Patterns

- **Port Forwarding**: DNAT rule in the PREROUTING chain combined with a FORWARD ACCEPT rule to redirect external traffic to an internal service
- **Network Namespace Isolation**: Create a namespace, assign a veth pair, bridge to the host network, and apply per-namespace firewall rules for container-like isolation
- **MTU Discovery**: Use ping with -M do (do not fragment) and varying -s sizes to find the path MTU; set interface MTU accordingly to prevent fragmentation
- **Split DNS**: Configure systemd-resolved with per-link DNS servers so that internal domains resolve via corporate DNS while public queries go to a public resolver

## Pitfalls to Avoid

- Do not flush iptables rules on a remote machine without first ensuring a scheduled rule restore or out-of-band console access
- Do not mix iptables and nftables on the same system without understanding that iptables-nft translates rules into nftables internally, which can cause conflicts
- Do not set overly aggressive TCP keepalive or timeout values on NAT gateways, as this causes silent connection drops for long-lived sessions
- Do not assume DNS is working just because ping succeeds; ping may use cached results or /etc/hosts entries while application DNS resolution fails