Network basics: IP addresses, routes, DNS and the ip command

The four settings every server needs

1. IP address: the server's own address, like 192.168.10.25 (IPv4) or 2001:db8::25 (IPv6).
2. Prefix (netmask): how much of the address is the network part. /24 (255.255.255.0) means the first three numbers name the network, so 192.168.10.1 to 192.168.10.254 are neighbours you reach directly.
3. Default gateway: the router that forwards everything that is not local, for example 192.168.10.1.
4. DNS servers: they turn names like repo.example.com into IP addresses.

Prefixes in practice

In each IPv4 network, the first address is the network address and the last is the broadcast address, so usable hosts = addresses minus 2. Private ranges that never appear on the internet are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Most company servers use them.

Looking at the network with ip

$ ip -br addr
lo               UNKNOWN        127.0.0.1/8 ::1/128
enp1s0           UP             192.168.122.50/24 fe80::5054:ff:fe12:3456/64
$ ip addr show enp1s0
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.50/24 brd 192.168.122.255 scope global noprefixroute enp1s0
$ ip route
default via 192.168.122.1 dev enp1s0 proto static metric 100
192.168.122.0/24 dev enp1s0 proto kernel scope link src 192.168.122.50 metric 100
$ ip -s link show enp1s0     # packet counters and errors

Interface names like enp1s0 or ens192 describe where the card sits in the machine, so they stay the same across reboots. lo is the loopback interface: 127.0.0.1 always means "this machine". The old ifconfig and route commands are not installed by default; use ip.

Testing connectivity, step by step

$ ping -c 3 192.168.122.1          # 1. can I reach the gateway?
$ ping -c 3 8.8.8.8                # 2. can I reach outside by IP?
$ getent hosts repo.example.com    # 3. does the name resolve?
192.168.122.10  repo.example.com
$ dig +short repo.example.com      # (from bind-utils) asks DNS directly
$ tracepath 8.8.8.8                # 4. where does the path stop?
$ ss -tlnp                         # 5. which TCP ports are listening here, and by which program?
State  Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*     users:(("sshd",pid=842,fd=3))
LISTEN 0      511                *:80              *:*     users:(("httpd",pid=1301,fd=4))

ss options: -t TCP, -u UDP, -l listening, -n numbers instead of names, -p show the process (needs root for other users' processes). 0.0.0.0:22 means "listening on all IPv4 addresses"; 127.0.0.1:5432 would mean only this machine can connect.

Common mistakes

• Wrong prefix: 192.168.10.25/16 instead of /24 makes the server think far-away addresses are neighbours, so it never sends them to the gateway.
• No default gateway: the server can reach its own subnet but nothing else.
• Blaming the network when only DNS is broken. If ping 8.8.8.8 works but ping google.com does not, look at DNS.
• A service listening only on 127.0.0.1. Other machines cannot connect, no matter what the firewall says. Check with ss -tlnp.