forked from server/user-documentation
Align console prompts to style guide (administration)
This commit is contained in:
parent
98bafc4ab9
commit
0d2b2dc28d
3 changed files with 126 additions and 126 deletions
|
|
@ -35,9 +35,9 @@ All the necessary interfaces have been installed and fully configured. This incl
|
|||
+
|
||||
You should get something like
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# firewall-cmd --get-active-zones
|
||||
# firewall-cmd --get-active-zones
|
||||
FedoraServer (default)
|
||||
interfaces: <IF01> ...
|
||||
<MY_ZONE>
|
||||
|
|
@ -46,32 +46,32 @@ FedoraServer (default)
|
|||
+
|
||||
Fix the zone assignments if necessary
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# firewall-cmd --permanent --zone=<zone_name> --change-interface=<interface_name>
|
||||
[…]# firewall-cmd --reload
|
||||
# firewall-cmd --permanent --zone=<zone_name> --change-interface=<interface_name>
|
||||
# firewall-cmd --reload
|
||||
----
|
||||
|
||||
* **Check auto forwarding**
|
||||
+
|
||||
The system should automatically forward between the interfaces. Check the forwarding status and adjust it if necessary.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# cat /proc/sys/net/ipv4/ip_forward
|
||||
[…]# cat /proc/sys/net/ipv6/conf/default/forwarding
|
||||
# cat /proc/sys/net/ipv4/ip_forward
|
||||
# cat /proc/sys/net/ipv6/conf/default/forwarding
|
||||
----
|
||||
+
|
||||
In both cases a value of 1 indicates an active forwarding.
|
||||
+
|
||||
Otherwise, enable it immediately and configure it permanently.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# echo 1 > /proc/sys/net/ipv4/ip_forward
|
||||
[…]# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
|
||||
# echo 1 > /proc/sys/net/ipv4/ip_forward
|
||||
# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
|
||||
|
||||
[…]# vim /etc/sysctl.d/50-enable-forwarding.conf
|
||||
# vim /etc/sysctl.d/50-enable-forwarding.conf
|
||||
# local customizations
|
||||
#
|
||||
# enable forwarding for dual stack
|
||||
|
|
@ -84,9 +84,9 @@ net.ipv6.conf.all.forwarding=1
|
|||
The NetworkManager dnsmasq plugin included by default provides a basic configuration skeleton, but does not install the dnsmasq package. Thus, it avoids to uselessly occupy space and to introduce a superfluous and unused binary in case dnsmasq is not going to be in use on the particular server.
|
||||
|
||||
In case dnsmasq is not already installed
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# dnf install dnsmasq
|
||||
# dnf install dnsmasq
|
||||
----
|
||||
|
||||
[IMPORTANT]
|
||||
|
|
@ -111,9 +111,9 @@ The example here uses 2 interfaces, an external public interface enp1s0 (public.
|
|||
|
||||
1. **Activate the dnsmasq NetworkManager plugin**
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
|
||||
# vim /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
|
||||
|
||||
# /etc/NetworkManager/conf.d/00-use-dnsmasq.conf
|
||||
# This enables the dnsmasq plugin.
|
||||
|
|
@ -123,9 +123,9 @@ The example here uses 2 interfaces, an external public interface enp1s0 (public.
|
|||
|
||||
2. **Configuration of the name resolution (DNS) for the internal private network (internal.lan)**
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /etc/NetworkManager/dnsmasq.d/01-DNS-<INTERNAL>.conf
|
||||
# vim /etc/NetworkManager/dnsmasq.d/01-DNS-<INTERNAL>.conf
|
||||
|
||||
# /etc/NetworkManager/dnsmasq.d/01-DNS-<INTERNAL>.conf
|
||||
# This file sets up DNS for the private local net domain '<INTERNAL>.lan'
|
||||
|
|
@ -153,16 +153,16 @@ The example here uses 2 interfaces, an external public interface enp1s0 (public.
|
|||
+
|
||||
Provide an empty host file
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# touch /etc/dnsmasq-<INTERNAL>.hosts
|
||||
# touch /etc/dnsmasq-<INTERNAL>.hosts
|
||||
----
|
||||
|
||||
3. **Configuration of the DHCP service for the internal private network (<INTERNAL>.lan)**
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /etc/NetworkManager/dnsmasq.d/02-DHCP-<INTERNAL>.conf
|
||||
# vim /etc/NetworkManager/dnsmasq.d/02-DHCP-<INTERNAL>.conf
|
||||
# etc/NetworkManager/dnsmasq.d/02-DHCP-<INTERNAL>.conf
|
||||
# This file sets up DHCP for the private local net domain '<INTERNAL>.lan'
|
||||
|
||||
|
|
@ -196,9 +196,9 @@ Provide an empty host file
|
|||
|
||||
4. **Configuration of the DHCP service for the public network (<PUBLIC.TLD>)**
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /etc/NetworkManager/dnsmasq.d/03-DHCP-<PUBLIC>.conf
|
||||
# vim /etc/NetworkManager/dnsmasq.d/03-DHCP-<PUBLIC>.conf
|
||||
# etc/NetworkManager/dnsmasq.d/03-DHCP-<PUBLIC>.conf
|
||||
# This file sets up DNCP for the public '<PUBLIC.TLD>' domain interface
|
||||
|
||||
|
|
@ -232,30 +232,30 @@ There is no DNS configuration for the external interface following, assuming tha
|
|||
|
||||
5. **Test the dnsmasq configuration**
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# dnsmasq --test
|
||||
# dnsmasq --test
|
||||
----
|
||||
|
||||
6. **Adjusting the firewall**
|
||||
+
|
||||
Allow ports for DHCP and DNS (53) service on the public interface.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# firewall-cmd --get-services
|
||||
[…]# firewall-cmd --zone=<YOUR_ZONE> --permanent --add-service=dhcp
|
||||
[…]# firewall-cmd --zone=<YOUR_ZONE> --permanent --add-service=dns
|
||||
[…]# firewall-cmd --reload
|
||||
[…]# firewall-cmd --list-all --zone=<YOUR_ZONE>
|
||||
# firewall-cmd --get-services
|
||||
# firewall-cmd --zone=<YOUR_ZONE> --permanent --add-service=dhcp
|
||||
# firewall-cmd --zone=<YOUR_ZONE> --permanent --add-service=dns
|
||||
# firewall-cmd --reload
|
||||
# firewall-cmd --list-all --zone=<YOUR_ZONE>
|
||||
----
|
||||
|
||||
7. **Restart NetworkManager to start dnsmasq**
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# systemctl restart NetworkManager
|
||||
[…]# ps -ef | grep dnsmasq
|
||||
# systemctl restart NetworkManager
|
||||
# ps -ef | grep dnsmasq
|
||||
dnsmasq 2114 2072 0 08:33 ? 00:00:00 /usr/sbin/dnsmasq --no-resolv ...
|
||||
----
|
||||
+
|
||||
|
|
@ -264,10 +264,10 @@ command above.
|
|||
|
||||
8. **Restart systemd-resolved**
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# systemctl restart systemd-resolved
|
||||
[…]# resolvectl status
|
||||
# systemctl restart systemd-resolved
|
||||
# resolvectl status
|
||||
----
|
||||
+
|
||||
The systemd-resolved should recognize the dnsmasq nameserver attached to interfaces as configured.
|
||||
|
|
@ -276,21 +276,21 @@ The systemd-resolved should recognize the dnsmasq nameserver attached to interfa
|
|||
|
||||
a. Test DHCP in the public using a machine without IP address
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ip a # no IPv4 address associated with interface
|
||||
[…]# dhclient -4 -1 -v eth0
|
||||
[…]# ip a # expect new IPv4 address associated with interface
|
||||
[…]# dhclient -4 -1 -r -v eth0 # expected: no IPv4 again
|
||||
[…]# ip a # expect no IPv4 address associated with interface again
|
||||
# ip a # no IPv4 address associated with interface
|
||||
# dhclient -4 -1 -v eth0
|
||||
# ip a # expect new IPv4 address associated with interface
|
||||
# dhclient -4 -1 -r -v eth0 # expected: no IPv4 again
|
||||
# ip a # expect no IPv4 address associated with interface again
|
||||
----
|
||||
b. Try on an other server
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# dig app1 @10.10.10.1
|
||||
[…]# nslookup app1 10.10.10.1
|
||||
[…]# dhclient -v -d -s 10.10.10.1 enp6s0
|
||||
# dig app1 @10.10.10.1
|
||||
# nslookup app1 10.10.10.1
|
||||
# dhclient -v -d -s 10.10.10.1 enp6s0
|
||||
----
|
||||
|
||||
|
||||
|
|
@ -300,17 +300,17 @@ If machines in the private network need access to the public network, add masque
|
|||
|
||||
1. Enabling masquerading for the public zone and for the internal (trusted) trusted zone
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# firewall-cmd --zone=FedoraServer --add-masquerade --permanent
|
||||
# firewall-cmd --zone=FedoraServer --add-masquerade --permanent
|
||||
success
|
||||
[…]# firewall-cmd --zone=trusted --add-masquerade --permanent
|
||||
# firewall-cmd --zone=trusted --add-masquerade --permanent
|
||||
success
|
||||
[…]# firewall-cmd --reload
|
||||
# firewall-cmd --reload
|
||||
|
||||
[…]# firewall-cmd --zone=FedoraServer --query-masquerade
|
||||
# firewall-cmd --zone=FedoraServer --query-masquerade
|
||||
yes
|
||||
[…]# firewall-cmd --zone=trusted --query-masquerade
|
||||
# firewall-cmd --zone=trusted --query-masquerade
|
||||
yes
|
||||
----
|
||||
|
||||
|
|
@ -319,39 +319,39 @@ further to the public network.
|
|||
+
|
||||
a. A commonly used way to accomplish this is to set 'rules' in the firewall configuration. Corresponding tutorials are very widespread. And those who are familiar with it may want to continue using it.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# firewall-cmd --get-active-zones
|
||||
# firewall-cmd --get-active-zones
|
||||
FedoraServer
|
||||
interfaces: enp1s0
|
||||
trusted
|
||||
interfaces: vbr2s0 enp2s0
|
||||
[…]# firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -o enp1s0 -j MASQUERADE
|
||||
# firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -o enp1s0 -j MASQUERADE
|
||||
success
|
||||
[…]# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i vbr2s0 -o enp2s0 -j ACCEPT
|
||||
# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i vbr2s0 -o enp2s0 -j ACCEPT
|
||||
success
|
||||
[…]# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i enp1s0 -o vbr2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i enp1s0 -o vbr2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
success
|
||||
----
|
||||
|
||||
b. Fedora's firewall daemon, however, offers with release 35 and beyond a more elegant option, so-called 'policies'. These abstract typical targets previously configured by rules.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# firewall-cmd --get-active-zones
|
||||
# firewall-cmd --get-active-zones
|
||||
FedoraServer
|
||||
interfaces: enp1s0
|
||||
trusted
|
||||
interfaces: vbr2s0 enp2s0
|
||||
[…]# firewall-cmd --permanent --new-policy trustedToExt
|
||||
# firewall-cmd --permanent --new-policy trustedToExt
|
||||
success
|
||||
[…]# firewall-cmd --permanent --policy trustedToExt --add-ingress-zone trusted
|
||||
# firewall-cmd --permanent --policy trustedToExt --add-ingress-zone trusted
|
||||
success
|
||||
[…]# firewall-cmd --permanent --policy trustedToExt --add-egress-zone FedoraServer
|
||||
# firewall-cmd --permanent --policy trustedToExt --add-egress-zone FedoraServer
|
||||
success
|
||||
[…]# firewall-cmd --permanent --policy trustedToExt --set-target ACCEPT
|
||||
# firewall-cmd --permanent --policy trustedToExt --set-target ACCEPT
|
||||
success
|
||||
[…]# firewall-cmd --reload
|
||||
# firewall-cmd --reload
|
||||
success
|
||||
----
|
||||
+
|
||||
|
|
@ -365,9 +365,9 @@ To make it work, just add another configuration file. The example uses libvirt.l
|
|||
|
||||
We just add the name resolution (DNS) for the libvirt virtual network (libvirt.lan), leaving the DHCP functionality untouched.
|
||||
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /etc/NetworkManager/dnsmasq.d/30-DNS-libvirt.conf
|
||||
# vim /etc/NetworkManager/dnsmasq.d/30-DNS-libvirt.conf
|
||||
|
||||
# /etc/NetworkManager/dnsmasq.d/30-DNS-libvirt.conf
|
||||
|
||||
|
|
@ -383,23 +383,23 @@ We just add the name resolution (DNS) for the libvirt virtual network (libvirt.l
|
|||
+
|
||||
The format is the same as /etc/hosts .
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /etc/dnsmasq.hosts
|
||||
# vim /etc/dnsmasq.hosts
|
||||
----
|
||||
|
||||
2. Restart NetworkManager to read the modified file.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# systemctl restart NetworkManager
|
||||
# systemctl restart NetworkManager
|
||||
----
|
||||
|
||||
3. Test the modification
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nslookup {NAME}
|
||||
[…]# nslookup {NAME}.example.lan
|
||||
# nslookup {NAME}
|
||||
# nslookup {NAME}.example.lan
|
||||
----
|
||||
|
||||
|
|
|
|||
|
|
@ -28,17 +28,17 @@ For an IPv6 configuration, it is sufficient to specify the link address of the g
|
|||
== Configuration of current Fedora releases
|
||||
|
||||
Given an interface enp1s0 with IPv4 address of 192.168.133.100 and the gateway 192.168.133.1 you may configure the interface
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod enp1s0 ipv4.method manual ipv4.addresses '192.168.133.100/32' \
|
||||
# nmcli con mod enp1s0 ipv4.method manual ipv4.addresses '192.168.133.100/32' \
|
||||
ipv4.gateway '192.168.133.1' ipv4.dns '192.172.1.1'
|
||||
----
|
||||
|
||||
|
||||
This will result in a configuration file like
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# less /etc/NetworkManager/system-connections/enp1s0.nmconnection
|
||||
# less /etc/NetworkManager/system-connections/enp1s0.nmconnection
|
||||
[connection]
|
||||
id=enp1s0
|
||||
uuid=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
|
||||
|
|
@ -63,7 +63,7 @@ method=manual
|
|||
----
|
||||
|
||||
An alternative notation for the IPv4 part is
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[ipv4]
|
||||
address1=192.168.133.100/32
|
||||
|
|
@ -72,9 +72,9 @@ route1=0.0.0.0/0,192.168.133.1
|
|||
----
|
||||
|
||||
In any case you get a
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ip r
|
||||
# ip r
|
||||
default via 192.168.133.1 dev enp1s0 proto static metric 100
|
||||
192.168.133.1 dev enp1s0 proto static scope link metric 100
|
||||
----
|
||||
|
|
@ -84,9 +84,9 @@ default via 192.168.133.1 dev enp1s0 proto static metric 100
|
|||
These Fedora releases used _ifcfg-IF_NAME_ files in /etc/sysconfig/network-scripts/. This method dates back to the time before NetworkManager was introduced and network connections were managed with a collection of shell scripts. The shell scripts disappeared with the introduction of NetworkManager, but the configuration files if cfg-NAME was retained as the default configuration method in Release 36 for backward compatibility.
|
||||
|
||||
Usually, you configure the interface using a text editor, eg given the above example
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /etc/sysconfig/network-scripts/ifcfg-enp1s0
|
||||
# vim /etc/sysconfig/network-scripts/ifcfg-enp1s0
|
||||
DEVICE=enp1s0
|
||||
ONBOOT=yes
|
||||
BOOTPROTO=none
|
||||
|
|
@ -103,18 +103,18 @@ IPV6_DEFAULTDEV=enp1s0
|
|||
----
|
||||
|
||||
Additionally you need a routing table.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /etc/sysconfig/network-scripts/route-enp1s0
|
||||
# vim /etc/sysconfig/network-scripts/route-enp1s0
|
||||
ADDRESS0=0.0.0.0
|
||||
NETMASK0=0.0.0.0
|
||||
GATEWAY0=192.168.133.1
|
||||
----
|
||||
|
||||
Both variants result again in a
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ip r
|
||||
# ip r
|
||||
default via 192.168.133.1 dev enp1s0 proto static metric 100
|
||||
192.168.133.1 dev enp1s0 proto static scope link metric 100
|
||||
----
|
||||
|
|
@ -122,9 +122,9 @@ default via 192.168.133.1 dev enp1s0 proto static metric 100
|
|||
== Using systemd-networkd
|
||||
|
||||
Some server administrators might prefer systemd-network over NetworkManager. Many of the NetworkManager features are very useful for desktops and laptops, but rather superfluous for servers. The configuration tool is a plain text editor.
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /etc/systemd/network/10-public.network
|
||||
# vim /etc/systemd/network/10-public.network
|
||||
[Match]
|
||||
MACAddress=12:34:56:78:9a:bc # or another identifier
|
||||
|
||||
|
|
|
|||
|
|
@ -35,25 +35,25 @@ This article deals with the latter variant.
|
|||
|
||||
1. Check the forwarding configuration
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# cat /proc/sys/net/ipv4/ip_forward
|
||||
[…]# cat /proc/sys/net/ipv6/conf/default/forwarding
|
||||
# cat /proc/sys/net/ipv4/ip_forward
|
||||
# cat /proc/sys/net/ipv6/conf/default/forwarding
|
||||
----
|
||||
+
|
||||
In both cases a value of 1 must be returned. Libvirt will activate IPv4 forwarding, but probably not IPv6. If necessary, activate forwarding temporarily
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# echo 1 > /proc/sys/net/ipv4/ip_forward
|
||||
[…]# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
|
||||
# echo 1 > /proc/sys/net/ipv4/ip_forward
|
||||
# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
|
||||
----
|
||||
+
|
||||
The following file must be set up for permanent setup.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# vim /etc/sysctl.d/50-enable-forwarding.conf
|
||||
# vim /etc/sysctl.d/50-enable-forwarding.conf
|
||||
# local customizations
|
||||
#
|
||||
# enable forwarding for dual stack
|
||||
|
|
@ -63,9 +63,9 @@ net.ipv6.conf.all.forwarding=1
|
|||
|
||||
2. Checking the existing interfaces
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# ip a
|
||||
# ip a
|
||||
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
|
||||
…
|
||||
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> … state UP group default qlen 1000
|
||||
|
|
@ -81,10 +81,10 @@ net.ipv6.conf.all.forwarding=1
|
|||
+
|
||||
As the listing indicates, the external IPv6 subnet is a common full /64 network. This must be changed to trigger IPv6 forwarding.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod enp2s0 ipv6.addresses '2a01:4f8:210:512d::2/128'
|
||||
[…]# nmcli con up enp2s0
|
||||
# nmcli con mod enp2s0 ipv6.addresses '2a01:4f8:210:512d::2/128'
|
||||
# nmcli con up enp2s0
|
||||
----
|
||||
|
||||
4. Creating a routing bridge
|
||||
|
|
@ -93,9 +93,9 @@ The (public) bridge is named vbr1s0, based on the name of the accompanying (publ
|
|||
+
|
||||
In the listing of interfaces, the IPv4 address is a point-to-point connection. Therefore, the bridge uses a subnet, if any, the range that is also assigned in DNS. If the IPv4 interface is also created as a subnet, the bridge would be created as a p2p connection instead.
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con add con-name vbr1s0 ifname vbr1s0 type bridge stp off \
|
||||
# nmcli con add con-name vbr1s0 ifname vbr1s0 type bridge stp off \
|
||||
ipv4.method manual ipv4.addresses '148.251.152.29/27' \
|
||||
ipv6.method manual ipv6.addresses '2a01:4f8:210:512d::2/64' ipv6.addr-gen-mode eui64
|
||||
----
|
||||
|
|
@ -104,30 +104,30 @@ No zone is specified! Thus the bridge is assigned to the default zone (FedoraSer
|
|||
+
|
||||
Finally, for IPv4, the routes must be created and the public addresses of all VMs must be listed
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.49/32"
|
||||
[…]# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.52/32"
|
||||
[…]# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.56/32"
|
||||
# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.49/32"
|
||||
# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.52/32"
|
||||
# nmcli con mod vbr2s0 +ipv4.routes "148.251.152.56/32"
|
||||
----
|
||||
|
||||
5. Double check your entries, especially the IP addresses, to avoid incorrect configuration and time-consuming troubleshooting.
|
||||
|
||||
6. Activate the routing bridge
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con up vbr1s0
|
||||
# nmcli con up vbr1s0
|
||||
----
|
||||
|
||||
7. Installing a VM
|
||||
+
|
||||
Use Cockpit or the command line
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# cp /var/lib/libvirt/boot/Fedora-Server-KVM-37-custom.qcow2 /var/lib/libvirt/images/vm-01.qcow2
|
||||
[…]# virt-install --name vm-01 --memory 4096 --cpu host --vcpus 4 --graphics none \
|
||||
# cp /var/lib/libvirt/boot/Fedora-Server-KVM-37-custom.qcow2 /var/lib/libvirt/images/vm-01.qcow2
|
||||
# virt-install --name vm-01 --memory 4096 --cpu host --vcpus 4 --graphics none \
|
||||
--os-variant fedora37 --import --disk /var/lib/libvirt/images/vm-01.qcow2,format=qcow2,bus=virtio \
|
||||
--network bridge=vbr1s0,model=virtio --network bridge=virbr0,model=virtio
|
||||
----
|
||||
|
|
@ -136,37 +136,37 @@ Complete the First Boot Sceen. Leave the network configuration as it is. It is e
|
|||
|
||||
8. Login to the VM and configure the public interface
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# nmcli con mod 'Wired connection 1' ipv4.method manual ipv4.addresses '148.251.152.49/32' \
|
||||
# nmcli con mod 'Wired connection 1' ipv4.method manual ipv4.addresses '148.251.152.49/32' \
|
||||
ipv4.gateway '148.251.152.29' ipv4.dns '213.133.98.98' ipv6.method 'manual' \
|
||||
ipv6.addresses '2a01:4f8:210:512d::10/64' ipv6.gateway '2a01:4f8:210:512d::2' connection.id enp1s0
|
||||
[…]# nmcli con up enp1s0
|
||||
# nmcli con up enp1s0
|
||||
----
|
||||
|
||||
9. If exist adjust the internal interface.
|
||||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# nmcli con mod 'Wired connection 2' ipv4.method auto ipv6.method disabled connection.zone 'internal' connection.id enp2s0
|
||||
[…]# nmcli con up enp2s0
|
||||
# nmcli con mod 'Wired connection 2' ipv4.method auto ipv6.method disabled connection.zone 'internal' connection.id enp2s0
|
||||
# nmcli con up enp2s0
|
||||
----
|
||||
|
||||
10. Optionally reboot to reinitialize everything
|
||||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# reboot
|
||||
# reboot
|
||||
----
|
||||
|
||||
=== Testing the configuration
|
||||
|
||||
1. Check the forwarding configuration
|
||||
+
|
||||
[source,]
|
||||
[source,console]
|
||||
----
|
||||
[…]# cat /proc/sys/net/ipv4/ip_forward
|
||||
[…]# cat /proc/sys/net/ipv6/conf/default/forwarding
|
||||
# cat /proc/sys/net/ipv4/ip_forward
|
||||
# cat /proc/sys/net/ipv6/conf/default/forwarding
|
||||
----
|
||||
+
|
||||
In both cases a value of 1 must be returned.
|
||||
|
|
@ -176,9 +176,9 @@ SELinux should be in enforcing mode and firewalld active with zone FedoraServer
|
|||
+
|
||||
[source,bash]
|
||||
----
|
||||
[…]# getenforce
|
||||
[…]# firewall-cmd --list-all
|
||||
[…]# firewall-cmd --get-active-zones
|
||||
# getenforce
|
||||
# firewall-cmd --list-all
|
||||
# firewall-cmd --get-active-zones
|
||||
----
|
||||
|
||||
3. Check IPv6
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue