https://lukehebert.com/category/networking/Recent content in Networking on Luke HebertHugoen-usThu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/aws-default-dns-server-ec2/Thu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/aws-default-dns-server-ec2/Explains how the AWS default DNS server works for EC2 instances within a VPC, including the special 169.254.169.253 address and the CIDR-based resolver IP.https://lukehebert.com/post/cni-plugin-binaries-configs/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/cni-plugin-binaries-configs/Catalogs the active Flannel CNI configuration and the full set of 19 available CNI plugin binaries on a Kubernetes node. Provides file sizes, modification dates, and the purpose of each installed plugin.https://lukehebert.com/post/coredns/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/coredns/Set up a dedicated server as a DNS server using CoreDNS, covering binary installation, server startup, and IP-to-hostname mapping via the hosts plugin. CoreDNS also supports extensibility through plugins, including one for Kubernetes.https://lukehebert.com/post/gateway-api/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/gateway-api/Gateway API is a Kubernetes add-on that provides dynamic infrastructure provisioning and advanced traffic routing through an extensible, role-oriented configuration mechanism. It organizes traffic handling around three stable API kinds: GatewayClass, Gateway, and HTTPRoute.https://lukehebert.com/post/ingress-and-ingress-controllers/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/ingress-and-ingress-controllers/An overview of Kubernetes Ingress resources and the controllers that fulfill them, covering terminology, creation, and prerequisites.https://lukehebert.com/post/ingress-annotations-and-rewrite-target/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/ingress-annotations-and-rewrite-target/Explains how the rewrite-target annotation in the NGINX Ingress controller maps user-facing URL paths to backend services, preventing 404 errors. Includes examples of simple and regex-based rewrites.https://lukehebert.com/post/ip-link-show-type/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/ip-link-show-type/A guide to the ip link show type and ip address show type commands in Linux for filtering network interfaces by type. Covers physical, virtual, and tunneling interface types with practical examples.https://lukehebert.com/post/understanding-how-pods-talk-in-kubernetes-networks-dns/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/understanding-how-pods-talk-in-kubernetes-networks-dns/A deep dive into how Kubernetes DNS resolves service names to IP addresses, covering A records, SRV records, search domains, and the full lookup path from pod to CoreDNS. Understanding this lifecycle is essential for debugging connectivity issues and designing resilient microservice architectures.https://lukehebert.com/post/practical-guide-to-gateway-api-2025/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/practical-guide-to-gateway-api-2025/A practical walkthrough of the Kubernetes Gateway API using the NGINX Gateway Controller, covering HTTP routing, TLS termination, traffic splitting, and multi-protocol support. The concepts are implementation-agnostic and apply across any Gateway API-compatible controller.https://lukehebert.com/post/kubernetes-internal-dns-search-base/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-internal-dns-search-base/Kubernetes provides a built-in DNS service that assigns predictable names to Services and Pods within a cluster. By default, pods use cluster.local as their search base for internal DNS resolution, enabling communication through human-readable names rather than ephemeral IP addresses.https://lukehebert.com/post/kubernetes-networking/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-networking/An overview of the ports and protocols required by Kubernetes control plane and worker nodes. Includes guidance on overriding default port configurations in strict network environments.https://lukehebert.com/post/network-namespaces-virtual-network/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/network-namespaces-virtual-network/Network namespaces provide the foundation for container network isolation in Docker and Kubernetes. This guide covers listing, creating, and linking namespaces, bridging, NAT, and how Docker and Kubernetes build on these primitives.https://lukehebert.com/post/nginx-ingress-controller/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/nginx-ingress-controller/A practical guide to installing and configuring the Ingress-Nginx Controller in Kubernetes, covering Helm and kubectl methods, cloud-provider annotations, and local testing workflows.https://lukehebert.com/post/network-policies/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/network-policies/A practical guide to Kubernetes Network Policies, covering how Ingress and Egress rules work, AND/OR logic in rule layout, and the behavior of policyTypes.https://lukehebert.com/post/monitoring-and-tuning-the-linux-networking-stack-receiving-data/Fri, 11 Oct 2024 00:00:00 +0000https://lukehebert.com/post/monitoring-and-tuning-the-linux-networking-stack-receiving-data/A deep dive into how the Linux kernel receives network packets, covering the full path from NIC hardware through NAPI, softirqs, GRO, RPS, and protocol layers. Includes practical monitoring commands and tuning knobs for each stage.https://lukehebert.com/post/linux-network-ring-buffers-trying-to-cover-what-i-dont-know-about/Fri, 11 Oct 2024 00:00:00 +0000https://lukehebert.com/post/linux-network-ring-buffers-trying-to-cover-what-i-dont-know-about/A practical walkthrough of how Linux allocates and manages RX/TX ring buffers for network interfaces, covering DMA, softirq processing, and tuning knobs like netdev_budget.https://lukehebert.com/post/how-to-start-a-sysv-init-script-after-network-starts-in-red-hat-enterprise-linux-7/Tue, 27 Jun 2023 00:00:00 +0000https://lukehebert.com/post/how-to-start-a-sysv-init-script-after-network-starts-in-red-hat-enterprise-linux-7/Configure a legacy SysV init script to wait for network availability in RHEL 7 by adding the Required-Start LSB directive. This guide shows how systemd honors those headers so third-party initscripts start in the correct order.https://lukehebert.com/post/how-to-setup-and-secure-unifi-vlan/Fri, 05 May 2023 00:00:00 +0000https://lukehebert.com/post/how-to-setup-and-secure-unifi-vlan/A step-by-step guide to creating and securing VLANs in the UniFi Network Console, including firewall rules to block inter-VLAN traffic and restrict console access.https://lukehebert.com/post/intro-to-networking-introduction-to-virtual-lans-vlans-and-tagging/Fri, 05 May 2023 00:00:00 +0000https://lukehebert.com/post/intro-to-networking-introduction-to-virtual-lans-vlans-and-tagging/A beginner-friendly overview of Virtual LANs, covering their benefits, typical usage scenarios, and the fundamentals of 802.1Q VLAN tagging.https://lukehebert.com/post/unifi-network-creating-virtual-networks-vlans/Fri, 05 May 2023 00:00:00 +0000https://lukehebert.com/post/unifi-network-creating-virtual-networks-vlans/Learn how to create and configure virtual networks (VLANs) in UniFi Network to segment devices and improve network security. This guide covers wireless and wired client binding, trunk ports, and third-party gateway integration.https://lukehebert.com/post/dns/Tue, 02 May 2023 00:00:00 +0000https://lukehebert.com/post/dns/A practical guide to understanding DNS resolution tiers and troubleshooting name resolution issues in Linux environments. Covers /etc/nsswitch.conf, /etc/resolv.conf, and local caching services.https://lukehebert.com/post/a-parctical-guide-to-trace-route-tracecrt/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/a-parctical-guide-to-trace-route-tracecrt/Traceroute is one of the most misunderstood tools in a network engineer’s toolkit. This guide walks through how traceroute actually works, how to read the output correctly, and how to avoid the common pitfalls that lead to wrong conclusions.https://lukehebert.com/post/additional-kernel-tweaks-for-ipv4-boradband/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/additional-kernel-tweaks-for-ipv4-boradband/A practical guide to tuning Linux TCP/IP kernel parameters for high-speed, high-latency broadband connections, covering buffer sizing, timeout adjustments, SYN flood protection, and congestion control selection.https://lukehebert.com/post/connecting-ip-on-port-80-count-netstat-ss/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/connecting-ip-on-port-80-count-netstat-ss/Two quick one-liners that count how many unique remote IPs are connected to port 80, using either netstat or ss. Handy for spotting unexpected traffic or verifying that only expected clients are hitting your web server.https://lukehebert.com/post/create-a-new-rndc-key-make-sure-the-key-name-is-rndc-key/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/create-a-new-rndc-key-make-sure-the-key-name-is-rndc-key/Generate a fresh rndc.key and wire it into rndc.conf so your BIND name server accepts authenticated remote control commands. Covers the rndc-confgen command and the full rndc.conf structure.https://lukehebert.com/post/dkim-verification-both-must-be-set-to-on/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/dkim-verification-both-must-be-set-to-on/Exim offers two DKIM-related toggles that work together to validate and enforce sender signatures. Setting both to On ensures your mail server actually checks incoming DKIM records and rejects messages that fail validation.https://lukehebert.com/post/dns-amplifcation-attack/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/dns-amplifcation-attack/A DNS amplification attack floods a victim with forged responses by exploiting open resolvers. This post walks through iptables rules and BIND hardening steps to block the attack vector.https://lukehebert.com/post/dns-resolution-and-zone-files/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/dns-resolution-and-zone-files/A practical walkthrough of how DNS resolution works, from the hierarchical name space down to the iterative query process. Includes common zone file syntax mistakes and how to avoid them.https://lukehebert.com/post/https-force-redirect/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/https-force-redirect/A quick Apache mod_rewrite snippet that forces all HTTP traffic to HTTPS, plus context on where to place it and what to watch for.https://lukehebert.com/post/ip-tables-rate-limit-apache/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/ip-tables-rate-limit-apache/A quick way to throttle inbound HTTP traffic to your Apache server using iptables, protecting it from traffic spikes and simple DoS attempts.https://lukehebert.com/post/mod-deflate-rules/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mod-deflate-rules/Apache mod_deflate compresses outgoing responses to reduce bandwidth and speed up page loads. This post covers the AddOutputFilterByType directives needed to enable compression for common content types.https://lukehebert.com/post/mod-remote-ip/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mod-remote-ip/A troubleshooting walkthrough for getting mod_remoteip working correctly under Apache 2.4 and cPanel, including the right LogFormat directives and RemoteIP configuration so that access logs, mod_security, and other modules all see the real client IP.https://lukehebert.com/post/monitor-dns-zone-reload/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/monitor-dns-zone-reload/A quick workflow for triggering a DNS zone reload with rndc and confirming the result in the system log. Covers the two commands you need and what to look for in the output.https://lukehebert.com/post/multi-zone-views-for-bind9-internal-external-etc/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/multi-zone-views-for-bind9-internal-external-etc/Learn how to configure BIND9 views to serve different DNS records to internal and external clients from a single server. This guide walks through zone files, ACLs, recursion control, and the $include directive to keep your setup clean and secure.https://lukehebert.com/post/my-trace-route-mtr-packet-loss-testing/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/my-trace-route-mtr-packet-loss-testing/A quick walkthrough of using mtr in report mode to capture packet loss data across network hops. Learn how to run a 30-cycle test and read the output to isolate where loss is occurring.https://lukehebert.com/post/nginx-load-balancing/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/nginx-load-balancing/A practical walkthrough of setting up Nginx round-robin load balancing, including upstream configuration, weighted distribution, IP hashing, and failover directives.https://lukehebert.com/post/nginx-non-standard-status-silent-connection-close/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/nginx-non-standard-status-silent-connection-close/Nginx status code 444 silently drops a connection without sending any HTTP response to the client. Learn when and how to use it for security and traffic management.https://lukehebert.com/post/reject-with-comment/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/reject-with-comment/A quick iptables one-liner to reject TCP traffic from a specific source IP with a TCP reset, tagged with a human-readable comment for future reference.https://lukehebert.com/post/aws-vpc-structure/Tue, 18 Jan 2022 00:00:00 +0000https://lukehebert.com/post/aws-vpc-structure/A visual walkthrough of the core networking components that make up an Amazon VPC, from subnets and gateways to security groups and route tables. Understanding how these pieces interact is essential for designing secure, well-segmented cloud networks.https://lukehebert.com/post/ptr-records/Tue, 05 Sep 2017 00:00:00 +0000https://lukehebert.com/post/ptr-records/A valid PTR record must resolve to a name that resolves back to the original address. Multiple PTR records for a single address break name resolution and can cause Kerberos ticket verification to fail.https://lukehebert.com/post/handling-multiple-cns-on-a-single-certificate/Fri, 18 Aug 2017 00:00:00 +0000https://lukehebert.com/post/handling-multiple-cns-on-a-single-certificate/Multiple CNs in a certificate Subject field are deprecated and cause compatibility failures. The SAN extension is the correct way to cover multiple names on a single certificate.https://lukehebert.com/post/400-cannot-find-key-of-appropriate-type-to-decrypt-ap-rep/Tue, 18 Jul 2017 00:00:00 +0000https://lukehebert.com/post/400-cannot-find-key-of-appropriate-type-to-decrypt-ap-rep/A practical troubleshooting guide for the Kerberos AP REP decryption error, covering the most common causes from keytab mismatches to encryption type misconfigurations.https://lukehebert.com/post/check-dns-hostname-resolution-forward-and-backward-python-java/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/check-dns-hostname-resolution-forward-and-backward-python-java/Inconsistent forward and reverse DNS lookups can cause a cascade of cluster and security issues. This guide walks through quick Python and Java one-liners to verify that your hostname, IP, and reverse record all line up.https://lukehebert.com/post/checking-host-resolution-using-getent/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/checking-host-resolution-using-getent/A quick reference for using getent to verify how your Linux system resolves hostnames, short names, and IP addresses through the full NSS chain.https://lukehebert.com/post/hostname-and-hostname-f-not-getting-fqdn/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/hostname-and-hostname-f-not-getting-fqdn/When hostname -f returns a short name instead of a fully qualified domain name, the issue usually traces back to the HOSTNAME variable in /etc/sysconfig/network or a misconfigured /etc/hosts entry. Understanding the difference between the gethostname and gethostbyname system calls makes the fix straightforward.