I85PREP
⌘ K
LFCE study materials
LFCE study resources

LFCE: Networking

LFCE · Work through your exam, one topic at a time.

All guide sections

Networking

What this domain covers

The networking domain moves past a single DHCP interface: bonds, bridges, VLANs, static and policy routing, and packet filtering with firewalld or nftables. Grading usually hinges on whether configuration survives a reboot and whether the packet path is actually open end to end.

Core rules

  • NetworkManager is the persistent front end on current distributions. nmcli con add type bond con-name bond0 ifname bond0 mode active-backup then nmcli con add type ethernet con-name bond0-p1 ifname eth1 master bond0. Profiles are stored in /etc/NetworkManager/system-connections.
  • Bridges for virtualization use type bridge with bridge.stp yes and enslaved ports; VLANs use type vlan with vlan.id and a parent device, requiring the 8021q module.
  • iproute2 replaces legacy tools: ip -br a, ip route add 10.20.0.0/16 via 192.0.2.1 dev eth0, and ip rule plus a second routing table for policy routing.
  • Forwarding needs net.ipv4.ip_forward=1 in sysctl.d and a firewall rule allowing the traffic. NAT is nft add rule ip nat postrouting oifname eth0 masquerade or firewalld masquerade on the external zone.
  • firewalld: firewall-cmd --permanent --zone=public --add-service=https then firewall-cmd --reload. Zones bind to interfaces or source networks; rich rules handle logging and rate limiting.

Worked example

Two NICs must carry tagged VLAN 20 with redundancy. Create bond0 in mode 802.3ad (switch LACP must match), then nmcli con add type vlan con-name vlan20 dev bond0 id 20 ip4 10.20.0.5/24. Bring up with nmcli con up vlan20, verify with ip -d link show vlan20 and ping across the tag. Without switch-side LACP the bond stays down - the host config alone cannot prove it.

Traps that cost marks

Applying firewalld changes without --permanent, or adding --permanent and forgetting --reload; mixing iptables and nftables rules on the same host; forgetting ip_forward so NAT silently drops; putting an IP on a bridge port instead of the bridge.