I have configured the green network of ipfire with DHCP as follows:
Start address: 10.0.0.20
End address: 10.0.0.200
Primary DNS: 10.0.0.2 → this is the same IP as the web interface of ipfire, is this correct?
Using the web interface of Hetzner I have configured a private network with IP range 10.0.0.0/16
This private network is attached to the ipfire cloud server. Then I have created another linux cloud server (running Ubuntu) and attached same private network to it. Via Hetzners web interface I can see that it got 10.0.0.3 as IP address.
However, there’s no connection between ipfire and the Ubuntu server. Usually, when I ran ipfire on a hardware at home, I just plugged in my clients via a Switch to the Ethernet port of the internal green network. Here, in the case of the cloud config, things seem to be different - the IP address 10.0.0.3 of the Ubuntu cloud server seem to be created by Hetzner, not by ipfire. Am I missing DNS entries, routing entries? Any idea?
The Ubuntu server has a public IP (default gw) as well as the internal network IP 10.0.0.3 on separate interfaces. Hetzner supplies the internal IPs 10.0.0.x and is managed thru their Cloud Console with gateway 10.0.0.1 (no need for IPFire DHCP server).
A) On the IPFire box Add a route (to get back to internal subnet) 10.0.0.0/16 Gateway 10.0.0.1
B) In the Hetzner Cloud Console under Networks, override the default route for the internal network to go to the IPFire Green IP Destination 0.0.0.0 Gateway 10.0.0.2
C) The default config allows the Ubuntu server to get directly to the internet via public IP interface without going through the IPFire box (on the internal network). In the Hetzner Console, check if that is the case on the Ubuntu box (gw should be 10.0.0.1 not the public IP):
ifconfig route -n
You can change the default gateway on the Ubuntu server to use the internal network and route via IPFire (B) above.
sudo ip route del default sudo ip route add default via 10.0.0.1 dev ens10
route -n
The settings on Ubuntu get reset (via Hetzner DHCP server) on reboot so you will need to script or hardcode them. The public facing interface on the Ubuntu server can be disabled
thank you very much for the detailed instructions on how to configure my Ubuntu server in the internal network behind ipfire.
I have followed all steps that you describe successfully . After adding the default route with
sudo ip route add default via 10.0.0.1 dev ens10
I obtain an additional entry
root@ubuntu-2gb-nbg1-1:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0 ens10
So after establishing a connection to ipfire via OpenVPN as described in the installation tutorial I was able to connect from my desktop machine to the Ubuntu server via ssh:
ssh -i keyfile root@10.0.0.3
However, I have two more questions:
How can I check if the DNS entries of the Ubuntu server are correct? To my understanding the domain name resolution of the Ubuntu server should come from ipfire but I am not even sure where/how to configure DNS in ipfire? I would like to use Cloudflare DNS entries in ipfire and these should also be used by the Ubuntu server.
I wonder why there are additional entries including the interface eth0 in the routing table? That is:
During configuration of the server by use of the Hetzner Cloud Console I have disabled IPv4 and IPv6 but there seem to still be public IPs connected to the Ubuntu server?
The IPFire DNS Server settings are configured under Network → DomainNameSystem.
The stock Ubuntu server will use a local resolver for DNS.
You can check by typing dig It will show 127.0.0.1#53
An easy way to point the Ubuntu server at the IPFire DNS resolver is to hardcode the Green IP in Ubuntu’s /etc/resolv.conf
First, rename the link (which points to the dynamically created file /run/resolvconf/resolv.conf) and create a new file (on Ubuntu): sudo mv /etc/resolv.conf /etc/resolv1.conf (later you can rename the file back if you want the default dynamic settings) sudo vi /etc/resolv.conf
insert a line with the IP of the IPFire Green interface nameserver 10.0.0.2
Running dig again should show 10.0.0.2#53 as the (IPFire) DNS SERVER replying to the query and it will be visible in the IPFire UI → Status → Connections
The interface and routing is created automatically for the Ubuntu virtual machine by Hetzner. You can disable the unused public interface by sudo ifconfig eth0 down
I would also setup a ufw firewall ruleset to block all traffic on 172.ZZ.X.X and only allow specific traffic you want on 10.0.0.x.
thank you very much for your explanations! This solves my networking problems and the Ubuntu server is now part of my internal network behind ipfire.
Actually, I have used netplan for the networking definitions in Ubuntu and modified the file /etc/netplan/ 50-cloud-init.yaml; it now looks like this (check indentation of yaml file):
network:
version: 2
ethernets:
ens10:
dhcp4: no
addresses: [10.0.0.3/16]
routes:
- to: default
via: 10.0.0.1
nameservers:
addresses: [10.0.0.2, 1.1.1.1]
. After adding the default route with