Networking section

c6aN25 <a href="http://yidkfhyryqca.com/">yidkfhyryqca</a>, [url=http://opdpkuhnsaao.com/]opdpkuhnsaao[/url], [link=http://pmebsurdjoin.com/]pmebsurdjoin[/link], http://hmzatjmibjvg.com/

DNS resolution under Debian

One headache you might encounter when configuring a Debian server is how to let every program know how to resolve DNS names. Before a program can connect to an external network resource (say, for example, a web server), it must have a means of converting DNS names (e.g. www.saruman.biz) into the corresponding IP addresses (e.g. 192.168.67.10). This process is called "name resolution". The need for name resolution means that every program needs to know about the available means by which to do this name resolution.

From the good old days comes the configuration file resolv.conf, normally found in /etc. It contains information about the nameservers to be used by the system, be they actual servers or lookup files. However, more and more programs have the need to dynamically modify the resolv.conf configuration file. This means that frequently they step on each other, and the resolv.conf file can become out-of-sync. The resolvconf program addresses this problem. It acts as an intermediary between programs that supply nameserver information (e.g. DHCP clients) and programs that use nameserver information (e.g. resolver).

When resolvconf is properly installed, the file /etc/resolv.conf is replaced by a symbolic link to /etc/resolvconf/run/resolv.conf, and any resolver thus uses the dynamically generated resolver configuration file at /etc/resolvconf/run/resolv.conf.

The resolvconf program is only necessary when a system has multiple programs that need to dynamically modify the nameserver information. In a simple system where the nameservers do not change often or are only changed by one program, the standard /etc/resolv.conf configuration file is adequate.

VLANs under Debian

Debian can support network traffic over VLANs (ethernet 802.1q) - and we don't mean the normal "untagged" network ports (hey, VLANs are transparent that way, anybody and anything can use untagged network ports). No, we mean that Debian can accept network traffic in from, and send traffic out to, a VLAN tagged switchport.

Suppose you have a layer 2 switch with support for 802.1q VLANs, and want to route traffic from one VLAN to another. For this you can use a Debian router with a single network interface, using VLAN support (this is called "router on a stick" because the routing takes place over only one cable).

First, as root, run

apt-get install vlan
modprobe 8021q

The first line is to install the vlan package, which contains all necessary tools to create and manipulate VLAN-enabled network ports. The second line loads the module that enables VLAN tagging for your ethernet network cards. Note: if you don't have the stock Debian kernel, but compiled your own, then you might have chosen not to compile the 8021q module. In that case, compile the module. Also note, that if you've compiled the 8021q code into the kernel itself, then you don't need to load the module and that second line is unnecessary for you. You'll find this kernel compile option (depending on your kernel version) under Networking -> Networking Options -> "802.1Q VLAN Support". This option has been in the Linux kernel since version 2.4.14.

ifconfig eth0 down
vconfig add eth0 2
vconfig add eth0 3

The first command brings down your network on eth0 (not the thing to do if you're working remote, then :-). The next two commands create two virtual interfaces eth0.2 and eth0.3, which have VLAN tags 2 and 3 (don't use VLAN tag 1 if you can help it; on many devices VLAN1 is a special hardware management VLAN). The virtual interfaces run on top of your eth0 interface.
Now because your VLAN interfaces run on top of eth0, you've got to bring eth0 itself up, even if you don't want to run network traffic over it. Furthermore, you've got to configure the two virtual interfaces you've created. Let's suppose you want to run IP subnet 192.168.1.0/24 on VLAN2, and 192.168.2.0/24 on VLAN3. You can do so with

ifconfig eth0 0.0.0.0 up
ifconfig eth0.2 192.168.1.1 broadcast 192.168.1.255 netmask 255.255.255.0 up
ifconfig eth0.3 192.168.2.1 broadcast 192.168.2.255 netmask 255.255.255.0 up

Now that you've this done, you must still configure one of your switch ports to belong to VLAN 2 and 3 at the same time (tagged port), and connect eth0 from your linux box to that port. This enables your box to run network traffic on both VLANs.

To round things up: if you haven't yet enabled forwarding, you can do so now. Furthermore, you might wish to augment your route table so that the routing engine in your server knows how to handle packets that it needs to forward from one VLAN to the other:

echo 1 > /proc/sys/net/ipv4/ip_forward
route add -net 10.1.1.0 netmask 255.255.255.0 gw eth0.2
route add -net 10.1.2.0 netmask 255.255.255.0 gw eth0.3

This is it; nothing to it, right?

Tunneling under Debian

Being a Linux distribution, Debian gives you all the networking power of that platform. One of the powerful features of Linux networking is the ease with which you can create network tunnels. Many possibilities exist; in this wiki we've documented the following:

• IPsec site-to-site tunnel with which you can connect two networks, so that machines in both networks can reach machines in the other network