Configuring TCP/IP on hosts¶

Practical 3.2 configuring-tcp-ip-on-hosts-annex.pdf · PDF

Your phone joined the school Wi-Fi this morning, and you typed nothing but a password. Yet somebody gave it four pieces of information, and without any one of them something would break. Today nobody gives them: you type them yourself, on a Debian and on a Windows machine, and make the two ping each other.

This is the job of every technician who installs a printer, a server or a camera: devices that must keep the same address every day. It is also the first thing to check when "the Internet does not work".

The four settings of a host¶

The default gateway is the address of the router, inside my own network, that receives every packet for other networks.

A DNS server is a machine that turns names like debian.org into IP addresses. You will meet it properly in DHCP and DNS.

For every packet, a host asks itself one question: is the destination in my network?

flowchart TB
    P["<b>A packet to send</b>"] --> Q{"Destination in<br>my network?<br>(address + prefix)"}
    Q -->|"yes"| N["ARP for the <b>destination</b><br>send it directly"]
    Q -->|"no"| G{"Do I have a<br>default gateway?"}
    G -->|"yes"| R["ARP for the <b>gateway</b><br>send it to the post office"]
    G -->|"no"| U["<b>Network is unreachable</b>"]

That last box is exactly what you saw in IPv4 addressing: pc1 knew no router, so it did not even try.

Temporary or persistent?¶

Two different places hold a network configuration:

It is the RAM and disk of Unit 1 again: ip writes only in memory.

Warm-up: an address by hand¶

In the lan lab, on pc1, take the address away and put everything back by hand:

G=3 containerlab deploy -t lan.clab.yml && docker exec -it clab-lan-pc1 bash
ip addr flush dev eth1                 # pc1 forgets its address
ip addr add 10.G.0.11/24 dev eth1      # give it back
ip route                               # which line appeared by itself?
ping -c 1 1.1.1.1                      # what does it say?
ip route add default via 10.G.0.1
ping -c 1 -W 1 1.1.1.1                 # and now?
ip route add default via 10.9.9.1      # why is this refused?

For group 1 it looks like this:

root@pc1:/# ip route
10.1.0.0/24 dev eth1 proto kernel scope link src 10.1.0.11
root@pc1:/# ping -c 1 1.1.1.1
ping: connect: Network is unreachable
root@pc1:/# ip route add default via 10.1.0.1
root@pc1:/# ip route
default via 10.1.0.1 dev eth1
10.1.0.0/24 dev eth1 proto kernel scope link src 10.1.0.11
root@pc1:/# ip route get 1.1.1.1
1.1.1.1 via 10.1.0.1 dev eth1 src 10.1.0.11 uid 0
root@pc1:/# ip route add default via 10.9.9.1
Error: Nexthop has invalid gateway.

What it teaches:

• The line 10.1.0.0/24 dev eth1 appeared by itself: the kernel works out "my network" from address + prefix.
• With a gateway, the ping no longer says Network is unreachable. Now it waits and loses the packet (100% packet loss): pc1 does send it to 10.G.0.1, but this lab has no router there. A different error means a different layer of the problem.
• 10.9.9.1 is refused: a gateway must be a neighbour, inside one of my own networks.

Making it stay¶

Debian 13: NetworkManager and nmcli¶

On the GNOME desktop of deb-lab, the network is managed by NetworkManager. Its command is nmcli; the Settings app is a window onto the same thing. A saved configuration is called a connection (a profile); a network card is a device.

nmcli device status
nmcli -f NAME,DEVICE connection show         # name of the wired connection
sudo nmcli connection modify "Wired connection 1" ipv4.method manual \
     ipv4.addresses 10.G.0.21/24 ipv4.gateway 10.G.0.1 ipv4.dns 10.G.0.1
sudo nmcli connection up "Wired connection 1"

modify writes the file; up applies it. The quotes are needed because the name has spaces. Check what was saved (group 1):

$ sudo nmcli connection up "Wired connection 1"
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
$ nmcli -g ipv4.method,ipv4.addresses,ipv4.gateway,ipv4.dns connection show "Wired connection 1"
manual
10.1.0.21/24
10.1.0.1
10.1.0.1

The file lives in /etc/NetworkManager/system-connections/ and contains method=manual and address1=10.1.0.21/24. In the GUI it is the same: Settings → Network → the gear next to Wired → tab IPv4 → Manual.

Then check each setting with one command:

(enp1s0 is the usual name of the card in the VM; yours may differ.)

Windows 11: Settings¶

Start → Settings → Network & internet → Ethernet → next to IP assignment choose Edit → Manual → turn on IPv4 → fill IP address, Subnet mask, Gateway, Preferred DNS → Save.

Check it in a terminal:

ipconfig /all

You want DHCP Enabled: No, your IPv4 address, Subnet Mask 255.255.255.0, the gateway and the DNS server. Notice: Windows asks for the mask in dotted decimal (255.255.255.0); Linux asks for the prefix (/24). Same thing.

On a server you will meet other tools: a text file, netplan, systemd-networkd. The four settings are always the same four. Learn the settings, not the buttons.

Practical 3.2: two VMs on an isolated network¶

The Practical 3.2 sheet (the button at the top) walks you through it step by step. The plan, with your group number G:

flowchart LR
    subgraph HOST ["Your Ubuntu PC"]
        direction LR
        subgraph NET ["Virtual network lanG · Isolated · 10.G.0.0/24 · no DHCP"]
            D["<b>deb-lab</b><br>10.G.0.21/24"]
            W["<b>win11</b><br>10.G.0.22/24"]
            H["<b>host</b><br>10.G.0.1"]
        end
    end

1. In virt-manager, create a virtual network lanG: mode Isolated, 10.G.0.0/24, DHCPv4 off. Isolated means it never reaches the school network.
2. Plug both VMs into it. Debian gets no IPv4 address: nobody answers its request for one.
3. Configure Debian with nmcli, as above, and check.
4. Configure Windows with Settings, and check. Before you save, Windows shows 169.254.x.x: its self-given link-local address.
5. Ping each other. Something surprising happens.
6. Let the ping in through the Windows firewall.
7. Break and fix: a neighbour changes one setting in your Debian; you find it with the check commands.
8. Put everything back to automatic. Do not skip it, or your VM has no Internet next week.

The surprise: ARP answers, ping does not¶

From Windows, ping 10.G.0.21 answers. From Debian, ping -c 2 10.G.0.22 gives 100% packet loss. Is the address wrong? Look at ip neigh before changing anything:

10.1.0.22 dev enp1s0 lladdr 52:54:00:… REACHABLE

Windows is there: it answered the ARP question with its MAC. It just drops the echo requests. That is its firewall: a filter that decides which traffic a machine accepts. The fix, in PowerShell as administrator in win11:

New-NetFirewallRule -DisplayName "Allow ping" -Protocol ICMPv4 -IcmpType 8 -Direction Inbound -Action Allow

IcmpType 8 is the echo request you read in Wireshark: first capture.

Break and fix: what each fault looks like¶

Put everything back¶

sudo nmcli connection modify "Wired connection 1" ipv4.method auto ipv4.addresses "" ipv4.gateway "" ipv4.dns ""
sudo nmcli connection up "Wired connection 1"

On Windows: IP assignment → Edit → Automatic (DHCP). Shut both VMs down, set both cards back to the network default, start deb-lab, and check that ping -c 2 debian.org answers.

Hand in your report practical-3.2-surname.md on Google Classroom: a table with the four settings of each machine, the outputs of steps 3 and 4, your explanation of step 5, the story of step 7, and one thing you would do differently.

Key takeaways¶

• A host needs four settings: IP address, prefix / mask, default gateway (the router, inside my network) and DNS server (names to addresses).
• Same network → send directly; other network → send to the gateway; no gateway → Network is unreachable.
• ip changes the running configuration (gone after a reboot). NetworkManager (nmcli connection modify + up) and Windows Settings save a persistent one.
• Check with ip -br addr, ip route, cat /etc/resolv.conf, ping, ip neigh; on Windows, ipconfig /all.
• A neighbour that answers ARP but not ping has a firewall, not a wrong address.

Quick check¶

Next: you typed four settings into two machines. Now imagine three hundred phones. Who types? DHCP and DNS.