LFCS 165 🐧 LFCS Practice Scenarios — Networking - KandZ

⏱️ Estimated read: 9 min | |

The previous chapter covered the storage practice scenarios. This chapter covers the networking practice: the scenarios that simulate the exam tasks in the networking domain. The LFCS networking domain is weighted at 15% of the total score, and the objectives cover the interface configuration, the routing, the DNS, the hostname, the SSH, the firewall, and the diagnostics . The critical trap is the persistence. The ip addr add is the runtime. The NetworkManager connection is the persistence. The ip route add is the runtime. The nmcli connection is the persistence. The iptables rules are the runtime. The firewall-cmd --permanent is the persistence. The scenarios test the complete workflow, not just the single command.

Key point: The networking scenarios are the end-to-end tasks: the interface configuration, the static address, the route, the DNS, the hostname, the SSH, the firewall, and the diagnostics. The candidate must verify the state with the ip addr, the ip route, the dig, the ss, and the firewall-cmd, and make the change persistent with the NetworkManager, the /etc/hosts, the /etc/resolv.conf (or the resolved.conf), and the firewall-cmd --permanent.

Why the networking practice requires a specific mental model

The persistence problem. The ip addr add, the ip route add, and the iptables -A are the runtime changes. The reboot resets them. The NetworkManager connection profile, the nmcli modification, and the firewall-cmd --permanent are the persistent changes. The exam tests the persistence.

The connectivity problem. The networking changes are the most likely to break the remote connectivity. The ip link set down on the primary interface drops the SSH. The iptables -A INPUT -j DROP without the -A INPUT -p tcp --dport 22 -j ACCEPT before it locks out the administrator. The practice must include the safe changes and the verification before the persistence.

The DNS problem. The resolv.conf is the runtime. The NetworkManager or the systemd-resolved is the persistent. The /etc/hosts is the static override. The nsswitch.conf controls the order. The scenario tests the resolution path, not just the file edit.

The firewall problem. The firewall-cmd is the frontend for the firewalld. The --permanent flag is the persistence. The --reload applies. The ufw is the alternative on Ubuntu. The scenario tests the persistent rule, not the runtime.

The trade-off. The networking scenarios are the most likely to break the connectivity and the most likely to test the persistence. The practice must be on the VM with the console access, not on the remote host.

a. The interface configuration

The scenario: the configure the static IP 192.168.1.100/24 on the ens192 interface, the gateway 192.168.1.1, the DNS 1.1.1.1, and the persistence.

# View the current state
ip addr show ens192
nmcli device status

# Configure via NetworkManager (persistent)
sudo nmcli connection modify "Wired connection 1" \
  ipv4.method manual \
  ipv4.addresses 192.168.1.100/24 \
  ipv4.gateway 192.168.1.1 \
  ipv4.dns 1.1.1.1

# Reactivate
sudo nmcli connection up "Wired connection 1"

# Verify
ip addr show ens192
ip route show

The ipv4.method manual sets the static. The ipv4.addresses sets the IP and the prefix. The ipv4.gateway sets the default. The ipv4.dns sets the resolver. The nmcli connection up applies. The ip addr and the ip route confirm.

The transient alternative.

# Runtime only (lost on reboot)
sudo ip addr add 192.168.1.100/24 dev ens192
sudo ip route add default via 192.168.1.1

The ip addr add is the runtime. The reboot resets it. The exam tests the persistent, but the transient is useful for the testing.

b. The DNS and the hostname

The scenario: the set the hostname to web01.example.com, the /etc/hosts mapping, the DNS resolution, and the verification.

# Set the hostname
sudo hostnamectl set-hostname web01.example.com

# Update the hosts file
echo "127.0.1.1 web01.example.com web01" | sudo tee -a /etc/hosts

# Set the DNS via NetworkManager
sudo nmcli connection modify "Wired connection 1" ipv4.dns "1.1.1.1 8.8.8.8"
sudo nmcli connection up "Wired connection 1"

# Verify the resolution
getent hosts web01
dig +short example.com @1.1.1.1

The hostnamectl set-hostname is the persistent. The /etc/hosts is the local override. The nmcli ipv4.dns is the DNS servers. The getent hosts uses the nsswitch.conf order. The dig @1.1.1.1 bypasses the local resolver and tests the specific server.

The resolved.conf alternative.

# Persistent via systemd-resolved
sudo tee /etc/systemd/resolved.conf <<'EOF'
[Resolve]
DNS=1.1.1.1 8.8.8.8
Domains=example.com
EOF
sudo systemctl restart systemd-resolved
resolvectl status

The resolved.conf is the persistent for the systemd-resolved. The resolvectl status shows the current servers.

c. The SSH, the firewall, and the diagnostics

The scenario: the configure the SSH key auth, the firewall rule for the SSH, and the diagnostics.

# SSH key
ssh-keygen -t ed25519
ssh-copy-id user@server

# Firewall (firewalld)
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

# Firewall (ufw)
sudo ufw allow ssh
sudo ufw allow http
sudo ufw enable

# Diagnostics
ss -tlnp
ping -c 4 8.8.8.8
traceroute 8.8.8.8
dig +short example.com

The ssh-keygen and the ssh-copy-id set the key auth. The firewall-cmd --permanent persists the rule. The --reload applies. The ss -tlnp shows the listening sockets. The ping tests the connectivity. The traceroute tests the path. The dig tests the DNS.

The SSH server config.

# Disable the password auth (after the key test)
sudo sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sshd -t
sudo systemctl reload sshd

The PasswordAuthentication no disables the password. The sshd -t validates the config. The systemctl reload applies. The key auth must be tested before the password disable.

Complete Example Session

# ============================================
# PART 1: STATIC IP
# ============================================

sudo nmcli connection modify "Wired connection 1" ipv4.method manual ipv4.addresses 192.168.1.100/24 ipv4.gateway 192.168.1.1 ipv4.dns 1.1.1.1
sudo nmcli connection up "Wired connection 1"
ip addr show ens192

# ============================================
# PART 2: VERIFY THE ROUTE
# ============================================

ip route show
ip route get 8.8.8.8

# ============================================
# PART 3: HOSTNAME
# ============================================

sudo hostnamectl set-hostname web01.example.com
hostnamectl --static

# ============================================
# PART 4: HOSTS FILE
# ============================================

echo "127.0.1.1 web01.example.com web01" | sudo tee -a /etc/hosts
getent hosts web01

# ============================================
# PART 5: DNS
# ============================================

sudo nmcli connection modify "Wired connection 1" ipv4.dns "1.1.1.1 8.8.8.8"
sudo nmcli connection up "Wired connection 1"
dig +short example.com

# ============================================
# PART 6: SSH KEY
# ============================================

ssh-keygen -t ed25519
ssh-copy-id user@server

# ============================================
# PART 7: FIREWALL
# ============================================

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

# ============================================
# PART 8: SSH HARDENING
# ============================================

sudo sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sshd -t
sudo systemctl reload sshd

# ============================================
# PART 9: DIAGNOSTICS
# ============================================

ss -tlnp
ping -c 4 8.8.8.8
traceroute 8.8.8.8

The nine parts trace the networking scenarios: the static IP, the route, the hostname, the hosts file, the DNS, the SSH key, the firewall, the SSH hardening, and the diagnostics.

Quick Reference

Interface Configuration

Command	Purpose
`nmcli con mod ipv4.method manual`	Static IP
`nmcli con mod ipv4.addresses`	IP and prefix
`nmcli con mod ipv4.gateway`	Default gateway
`nmcli con up`	Apply

Hostname and DNS

Command	Purpose
`hostnamectl set-hostname`	Set the hostname
`/etc/hosts`	Static override
`nmcli con mod ipv4.dns`	DNS servers
`resolvectl status`	Resolved config

Firewall

Command	Purpose
`firewall-cmd --permanent`	Persistent rule
`firewall-cmd --reload`	Apply
`firewall-cmd --list-all`	Verify
`ufw allow`	Ubuntu rule

Diagnostics

Command	Purpose
`ip addr`	IP addresses
`ip route`	Routes
`ss -tlnp`	Listening sockets
`ping`	Reachability
`dig`	DNS query

Best Practices

✅ Do This:

sudo nmcli connection modify ... ipv4.addresses
<!-- Use the NetworkManager for the persistence -->   # ✅

sudo firewall-cmd --permanent --add-service=ssh
<!-- Use the permanent flag -->                       # ✅

sudo sshd -t && sudo systemctl reload sshd
<!-- Test the SSH config before reload -->           # ✅

❌ Don’t Do This:

sudo ip addr add 192.168.1.100/24 dev eth0
<!-- Runtime only, lost on reboot -->                # ❌

sudo iptables -A INPUT -j DROP
# Without allowing SSH first
<!-- Locks out the remote admin -->                  # ❌

# Disable the password auth before testing the key
<!-- Locks out the admin -->                         # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
IP lost on reboot	Used `ip addr add`	Use `nmcli`
DNS not working	Wrong `resolv.conf`	Use `nmcli` or `resolved`
SSH locked out	Wrong `sshd_config`	Test with `sshd -t`
Firewall blocks SSH	No allow rule	Add the rule before the drop
Route missing	No default route	`ip route` or `nmcli gateway`

Real-World Examples

1. Static IP

nmcli con mod "Wired connection 1" ipv4.method manual ipv4.addresses 192.168.1.100/24

2. Gateway

nmcli con mod "Wired connection 1" ipv4.gateway 192.168.1.1

3. DNS

nmcli con mod "Wired connection 1" ipv4.dns "1.1.1.1"

4. Hostname

hostnamectl set-hostname web01.example.com

5. Hosts

echo "127.0.1.1 web01" >> /etc/hosts

6. SSH Key

ssh-copy-id user@server

7. Firewall

firewall-cmd --permanent --add-service=http

8. Reload

firewall-cmd --reload

9. SSH Disable Password

sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config

10. Diagnostics

ss -tlnp; ping -c 4 8.8.8.8

Visual

Networking Scenario Flow

┌──────────────────────────────────────────────┐
│  Identify the interface (ip addr, nmcli)     │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Configure (nmcli connection modify)         │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Apply (nmcli connection up)                 │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Persist (NetworkManager profile)            │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Verify (ip addr, ip route, dig, ss)         │
└──────────────────────────────────────────────┘

Firewall Rule Flow

┌──────────────────────────────────────────────┐
│  firewall-cmd --permanent --add-service=ssh  │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  firewall-cmd --reload                       │
│  → Applies the permanent rules               │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  firewall-cmd --list-all                     │
│  → Verify the rule                           │
└──────────────────────────────────────────────┘

Summary

Item	Value
Interface config	`nmcli connection modify`
Static IP	`ipv4.method manual`
Gateway	`ipv4.gateway`
DNS	`ipv4.dns`
Hostname	`hostnamectl set-hostname`
Hosts override	`/etc/hosts`
Firewall	`firewall-cmd --permanent`
SSH key	`ssh-keygen`, `ssh-copy-id`
Diagnostics	`ip`, `ss`, `ping`, `dig`

Key takeaways:

The NetworkManager is the persistence. The ip addr add is the runtime. The nmcli connection modify is the persistent. The nmcli connection up applies. The reboot preserves the profile.
The firewall is the permanent. The firewall-cmd --permanent writes the rule to the configuration. The --reload applies. The rule without the --permanent is lost on the reload.
The SSH hardening is the key first. The key auth must be tested before the password is disabled. The sshd -t validates the config. The systemctl reload applies the change.
The DNS is the layered. The /etc/hosts is the override, the resolv.conf is the runtime, the NetworkManager or the resolved is the persistent. The getent hosts uses the nsswitch.conf order.
The diagnostics is the verification. The ip addr, the ip route, the ss -tlnp, the ping, the dig. The exam checks the state, not the command. The diagnostics proves the state.

Remember: The networking scenarios are the end-to-end tasks. The interface, the IP, the route, the DNS, the hostname, the SSH, the firewall, the diagnostics. The nmcli is the persistence. The firewall-cmd is the permanent. The sshd -t is the safe. The ss is the listening. The exam tests the complete workflow.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!