3.2Advanced Network Configuration

Making a server act as a router or gateway, peeking into the middle of a network path, or confirming whether a given port is truly open—these more advanced tasks rely on kernel tuning with sysctl and diagnostic tools like ping, nc, tcpdump, nmap, and ss.

3.2.1sysctl and IP forwarding

• sysctl reads and writes kernel parameters (under /proc/sys) at runtime: sysctl net.ipv4.ip_forward to check, sysctl -w net.ipv4.ip_forward=1 to enable temporarily.
• Persist by writing net.ipv4.ip_forward = 1 to /etc/sysctl.conf (or a file under /etc/sysctl.d/), then apply with sysctl -p. Enabling IP forwarding lets the server act as a router, relaying packets between interfaces.

3.2.2Connectivity, communication, and capture tools

• ping/ping6 send ICMP echo requests to test reachability (IPv4/IPv6). Response time and packet loss hint at routing issues or congestion.
• netcat (nc/ncat) is a general-purpose tool for connecting to or listening on arbitrary TCP/UDP ports: nc -zv host 22 checks whether a port is open, nc -l -p 8080 starts a simple listener.
• tcpdump captures and displays packets on an interface, e.g., tcpdump -i eth0 port 80 (interface + filter). It is the last-resort tool for seeing exactly what is on the wire.
• nmap scans a target host for open ports and running services, e.g., nmap -p 1-1000 host. Used for both security assessment and configuration verification.
• ss/netstat list socket connection state: ss -tuln (TCP/UDP, listening, numeric) is the modern standard; netstat (netstat -tuln) is the legacy tool with equivalent functionality.

When a report comes in that "a client cannot reach a particular service," narrow it down in stages: reachability → port → content. First, ping checks whether the path to the host is alive at all (some environments filter ICMP, so no response does not immediately mean the link is down). Next, nc -zv host 443 or nmap -p 443 host confirms whether the target port is open. If it is closed, suspect the service itself or firewall rules (a later chapter's topic). If the port is open but the traffic looks wrong, capture with a narrowed filter like tcpdump -i eth0 host <client-ip> and port 443 and check the actual packets—did the SYN get answered, was the connection reset partway through? For a quick overview of everything the server is currently listening on, ss -tuln is fastest; netstat -tuln gives the same information but ss scales better under heavy connection counts. On a server meant to act as a router (relaying between multiple NICs, a VPN gateway, etc.), leaving sysctl net.ipv4.ip_forward at 0 is a classic oversight that silently blocks forwarding—remember to enable it and persist it in /etc/sysctl.conf as required.

3.2.3Section summary

• Persist IP forwarding via /etc/sysctl.conf (net.ipv4.ip_forward=1), applied with sysctl -p; sysctl -w alone is temporary
• Diagnose in order: ping (reachability) → nc/nmap (port) → tcpdump (content) → ss (listening sockets); ss is the faster netstat successor