Networking

Addresses and ports

CIDR prefix lengths:

Netmask	Prefix
255.0.0.0	/8
255.255.0.0	/16
255.255.255.0	/24
255.255.255.255	/32

ip addr show                       # local addresses
curl -4 ifconfig.co                # public IPv4 address

# Ports and listeners (net-tools)
sudo apt install net-tools
netstat -lntp
netstat -tulpn | grep LISTEN
lsof -i -P -n | grep :80

# Which process holds a port (Windows)
netstat -ano | findstr :{port}
taskkill /PID {pid} /F

Static IP and DHCP (netplan)

On Ubuntu 18.04+ the interface is configured through netplan YAML:

sudo vi /etc/netplan/50-cloud-init.yaml

Static address:

network:
    version: 2
    ethernets:
        ens32:
            addresses:
              - 192.168.0.86/24
            routes:
              - to: default
                via: 192.168.0.1
            nameservers:
                addresses: [1.1.1.1, 8.8.8.8]

DHCP:

network:
    version: 2
    ethernets:
        ens32:
            dhcp4: true

Apply:

sudo netplan try       # apply with an automatic rollback if you lose the link
sudo netplan apply

The older gateway4: key is deprecated in favour of the routes: form above, and an empty nameservers: {} leaves the host unable to resolve names — set at least one resolver.

Hostname

hostnamectl status
sudo hostnamectl set-hostname NEW_NAME
sudo vi /etc/hosts     # keep the 127.0.1.1 line in sync with the new name

Firewall (ufw)

sudo ufw default allow
sudo ufw allow 80
sudo ufw allow 6000:6007/tcp
sudo ufw allow from 192.168.11.0/24
sudo ufw deny from 192.168.0.10 to any port 22
sudo ufw status numbered
sudo ufw delete N
sudo ufw enable
sudo ufw disable
sudo ufw reset

Firewall (iptables)

sudo iptables -I INPUT 5 -i ens3 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -L

# Persist across reboots (iptables-persistent)
sudo iptables-save  > /etc/iptables/rules.v4
sudo iptables-restore  < /etc/iptables/rules.v4
sudo ip6tables-restore < /etc/iptables/rules.v6

sudo systemctl restart netfilter-persistent

Fail2ban

Bans hosts that fail authentication repeatedly.

sudo apt install fail2ban

# Work from a local copy so an upgrade cannot overwrite your config
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo vi /etc/fail2ban/jail.local

sudo service fail2ban restart
sudo fail2ban-client status
sudo fail2ban-client status sshd
cat /var/log/auth.log
sudo iptables -L                   # see the active bans

# Unban
sudo fail2ban-client set sshd unbanip 180.217.148.126
sudo fail2ban-client unban --all
sudo fail2ban-client reload

Example SSH jail (jail.local):

[sshd]
enabled  = true          # enable SSH monitoring
mode     = normal
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 5             # ban after 5 failures
# bantime  = 800         # seconds banned
# findtime = 600         # window the failures must occur in

If jails will not start with ('database disk image is malformed'), the state database is corrupt — remove it (or restore a backup) and restart:

rm /var/lib/fail2ban/fail2ban.sqlite3

wget

wget --no-verbose URL      # quieter output

OpenVPN server

# Ubuntu 22.04
wget https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
sudo ./openvpn-install.sh
sudo systemctl status openvpn@server
sudo find / -iname "*.ovpn" -ls

Managing the server unit:

sudo systemctl {start,stop,restart,status} [email protected]

For a client config at /etc/openvpn/client-home.conf, the unit is openvpn@client-home.

Restricting traffic to the tunnel with ufw:

sudo ufw default deny outgoing
sudo ufw allow out on tun0 from any to any
sudo ufw allow out to 140.82.15.76 port 1194 proto udp   # the VPN endpoint

Common connection-failure causes: the VPN server itself, an unreliable link, or a local firewall / antivirus blocking the tunnel.

Remote desktop

Ubuntu 22.04 ships RDP as the default remote desktop. When using it, three things stop the shared password from silently changing: change the login keyring password, create a new keyring, and disable auto-login. For a VNC server instead, see the Tools page.