# IPFire protecting private network on Hetzner Cloud **URL:** \ **Category:** Network\ **Created:** [27 December 2022 17:26 UTC](https://community.ipfire.org/t/ipfire-protecting-private-network-on-hetzner-cloud/9116 "2022-12-27T17:26:40Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![hm233](https://community.ipfire.org/user_avatar/community.ipfire.org/hm233/32/10813_2.png) [@hm233](https://community.ipfire.org/u/hm233)\ **Post date:** [27 December 2022 17:26 UTC](https://community.ipfire.org/t/ipfire-protecting-private-network-on-hetzner-cloud/9116/1 "2022-12-27T17:26:40Z")
Hi, I have successfully installed ipfire on a cloud server at Hetzner. The installation procedure is explained here: [https://wiki.ipfire.org/installation/hetzner-cloud](https://wiki.ipfire.org/installation/hetzner-cloud) I have configured the green network of ipfire with DHCP as follows: Start address: 10.0.0.20 End address: 10.0.0.200 Primary DNS: 10.0.0.2 → this is the same IP as the web interface of ipfire, is this correct? Using the web interface of Hetzner I have configured a private network with IP range 10.0.0.0/16 This private network is attached to the ipfire cloud server. Then I have created another linux cloud server (running Ubuntu) and attached same private network to it. Via Hetzners web interface I can see that it got 10.0.0.3 as IP address. However, there’s no connection between ipfire and the Ubuntu server. Usually, when I ran ipfire on a hardware at home, I just plugged in my clients via a Switch to the Ethernet port of the internal green network. Here, in the case of the cloud config, things seem to be different - the IP address 10.0.0.3 of the Ubuntu cloud server seem to be created by Hetzner, not by ipfire. Am I missing DNS entries, routing entries? Any idea? ---
**Author:** ![wiztech](https://community.ipfire.org/user_avatar/community.ipfire.org/wiztech/32/16667_2.png) [@wiztech](https://community.ipfire.org/u/wiztech)\ **Post date:** [29 December 2022 02:48 UTC](https://community.ipfire.org/t/ipfire-protecting-private-network-on-hetzner-cloud/9116/2 "2022-12-29T02:48:10Z")
Hi, The Ubuntu server has a public IP (default gw) as well as the internal network IP 10.0.0.3 on separate interfaces. Hetzner supplies the internal IPs 10.0.0.x and is managed thru their Cloud Console with gateway 10.0.0.1 (no need for IPFire DHCP server). A) On the IPFire box Add a route (to get back to internal subnet) **10.0.0.0/16 Gateway 10.0.0.1** B) In the Hetzner Cloud Console under Networks, override the default route for the internal network to go to the IPFire Green IP **Destination 0.0.0.0 Gateway 10.0.0.2** C) The default config allows the Ubuntu server to get directly to the internet via public IP interface without going through the IPFire box (on the internal network). In the Hetzner Console, check if that is the case on the Ubuntu box (gw should be 10.0.0.1 not the public IP): **ifconfig** **route -n** You can change the default gateway on the Ubuntu server to use the internal network and route via IPFire (B) above. **sudo ip route del default** **sudo ip route add default via 10.0.0.1 dev ens10** **route -n** _The settings on Ubuntu get reset (via Hetzner DHCP server) on reboot so you will need to script or hardcode them. The public facing interface on the Ubuntu server can be disabled_ ![image](https://community.ipfire.org/uploads/default/original/2X/0/09a1776fbc7d51fccb6118feb22bfe0b37c4df8d.png) ![image](https://community.ipfire.org/uploads/default/original/2X/d/d83b079dab321415488cf48eb541ea533b0fe6a7.png) ![image](https://community.ipfire.org/uploads/default/original/2X/7/751a620aca53f7ebe7ccfc5da5196557a11ad157.png) ---
**Author:** ![hm233](https://community.ipfire.org/user_avatar/community.ipfire.org/hm233/32/10813_2.png) [@hm233](https://community.ipfire.org/u/hm233)\ **Post date:** [29 December 2022 17:50 UTC](https://community.ipfire.org/t/ipfire-protecting-private-network-on-hetzner-cloud/9116/3 "2022-12-29T17:50:37Z")
Hi Paul, thank you very much for the detailed instructions on how to configure my Ubuntu server in the internal network behind ipfire. I have followed all steps that you describe successfully 🙂 . After adding the default route with **sudo ip route add default via 10.0.0.1 dev ens10** I obtain an additional entry root@ubuntu-2gb-nbg1-1:~# route -n ```auto Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0 ens10 ``` So after establishing a connection to ipfire via OpenVPN as described in the [installation tutorial](https://wiki.ipfire.org/installation/hetzner-cloud) I was able to connect from my desktop machine to the Ubuntu server via ssh: ```auto ssh -i keyfile root@10.0.0.3 ``` However, I have two more questions: 1. How can I check if the DNS entries of the Ubuntu server are correct? To my understanding the domain name resolution of the Ubuntu server should come from ipfire but I am not even sure where/how to configure DNS in ipfire? I would like to use Cloudflare DNS entries in ipfire and these should also be used by the Ubuntu server. 2. I wonder why there are additional entries including the interface eth0 in the routing table? That is: ```auto root@ubuntu-2gb-nbg1-1:~# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0 ens10 10.0.0.0 10.0.0.1 255.255.0.0 UG 0 0 0 ens10 10.0.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 ens10 169.254.XXX.YYY 172.ZZ.X.X 255.255.255.255 UGH 100 0 0 eth0 172.ZZ.X.X 0.0.0.0 255.255.255.255 UH 100 0 0 eth0 ``` During configuration of the server by use of the Hetzner Cloud Console I have disabled IPv4 and IPv6 but there seem to still be public IPs connected to the Ubuntu server? Cheers, Holger ---
**Author:** ![wiztech](https://community.ipfire.org/user_avatar/community.ipfire.org/wiztech/32/16667_2.png) [@wiztech](https://community.ipfire.org/u/wiztech)\ **Post date:** [30 December 2022 10:01 UTC](https://community.ipfire.org/t/ipfire-protecting-private-network-on-hetzner-cloud/9116/4 "2022-12-30T10:01:24Z")
Hi Holger, 1. The IPFire DNS Server settings are configured under Network → DomainNameSystem. The stock Ubuntu server will use a local resolver for DNS. You can check by typing **dig** It will show 127.0.0.1#53 An easy way to point the Ubuntu server at the IPFire DNS resolver is to hardcode the Green IP in Ubuntu’s **/etc/resolv.conf** First, rename the link (which points to the dynamically created file /run/resolvconf/resolv.conf) and create a new file (on Ubuntu): **sudo mv /etc/resolv.conf /etc/resolv1.conf** (later you can rename the file back if you want the default dynamic settings) **sudo vi /etc/resolv.conf** insert a line with the IP of the IPFire Green interface **nameserver 10.0.0.2** Running **dig** again should show 10.0.0.2#53 as the (IPFire) DNS SERVER replying to the query and it will be visible in the IPFire UI → Status → Connections 2. The interface and routing is created automatically for the Ubuntu virtual machine by Hetzner. You can disable the unused public interface by **sudo ifconfig eth0 down** I would also setup a **ufw** firewall ruleset to block all traffic on 172.ZZ.X.X and only allow specific traffic you want on 10.0.0.x. Cheers ---
**Author:** ![hm233](https://community.ipfire.org/user_avatar/community.ipfire.org/hm233/32/10813_2.png) [@hm233](https://community.ipfire.org/u/hm233)\ **Post date:** [31 December 2022 11:20 UTC](https://community.ipfire.org/t/ipfire-protecting-private-network-on-hetzner-cloud/9116/5 "2022-12-31T11:20:02Z")
Hi Paul, thank you very much for your explanations! This solves my networking problems and the Ubuntu server is now part of my internal network behind ipfire. Actually, I have used netplan for the networking definitions in Ubuntu and modified the file /etc/netplan/ 50-cloud-init.yaml; it now looks like this (check indentation of yaml file): ```auto network: version: 2 ethernets: ens10: dhcp4: no addresses: [10.0.0.3/16] routes: - to: default via: 10.0.0.1 nameservers: addresses: [10.0.0.2, 1.1.1.1] ``` I have applied these settings with netplan try Cheers, Holger ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [26 August 2024 03:23 UTC](https://community.ipfire.org/t/ipfire-protecting-private-network-on-hetzner-cloud/9116/6 "2024-08-26T03:23:29Z")
A post was split to a new topic: [Need help with Hetzer console and it’s local network configuration](https://community.ipfire.org/t/need-help-with-hetzer-console-and-it-s-local-network-configuration/12014) ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [26 August 2024 03:23 UTC](https://community.ipfire.org/t/ipfire-protecting-private-network-on-hetzner-cloud/9116/7 "2024-08-26T03:23:43Z")