Overview
Linux networking is a critical skill for any system administrator, especially those pursuing Red Hat Certified System Administrator (RHCSA) certification. This tutorial covers the modern and legacy tools used to manage network interfaces, diagnose connectivity issues, and implement firewall rules.
What You'll Learn:
- Using the modern ip command for interface configuration
- Monitoring network sockets with ss (replacement for netstat)
- Legacy netstat command for backward compatibility
- Configuring firewalld for secure network access
- Practical troubleshooting techniques for real-world scenarios
Prerequisites: Access to a Red Hat 7+ or CentOS system, basic Linux command-line knowledge, and sudo privileges.
Why This Matters for RHCSA: The exam explicitly tests networking configuration and troubleshooting. You'll encounter scenarios requiring interface setup, service port verification, and firewall rule implementation. Mastery of these tools is essential for passing.
Getting Started
First, verify your system has the necessary tools installed and check your current network configuration.
# Check current IP configuration
ip addr show
# View all network interfaces
ip link show
# Verify firewalld is installed
rpm -qa | grep firewalld
# Check if firewalld service is active
systemctl status firewalld
# Install firewalld if needed (RHEL/CentOS)
sudo dnf install firewalld firewall-config -y
# Start firewalld service
sudo systemctl start firewalld
sudo systemctl enable firewalld
These commands establish your baseline network state and ensure all necessary tools are available on your system.
The ip Command: Modern Network Interface Management
The ip command is the modern replacement for the deprecated ifconfig. It provides comprehensive control over network interfaces, routing, and advanced configurations.
# Display all IP addresses and interface details
ip addr show
# Show specific interface (e.g., eth0)
ip addr show dev eth0
# Add a temporary IP address to an interface
sudo ip addr add 192.168.1.100/24 dev eth0
# Remove an IP address
sudo ip addr del 192.168.1.100/24 dev eth0
# Bring an interface up
sudo ip link set eth0 up
# Bring an interface down
sudo ip link set eth0 down
# Change MAC address
sudo ip link set eth0 address 00:11:22:33:44:55
# View routing table
ip route show
# Add a static route
sudo ip route add 192.168.2.0/24 via 192.168.1.1
# Delete a route
sudo ip route del 192.168.2.0/24 via 192.168.1.1
# Set default gateway
sudo ip route add default via 192.168.1.1
# Display all routes with detailed info
ip route list all
Important Note: Changes made with the ip command are temporary and lost after reboot. For persistent configuration, use NetworkManager or edit files in /etc/sysconfig/network-scripts/.
Socket Statistics: ss and netstat Commands
The ss command displays socket statistics and is faster than the legacy netstat. Both tools reveal listening ports, active connections, and protocol information essential for troubleshooting.
# Display all listening sockets
ss -tunl
# Flags explained: t=TCP, u=UDP, n=numeric, l=listening
# Display all established connections
ss -tune
# Show listening TCP ports only
ss -tln
# Show listening UDP ports only
ss -uln
# Display statistics for all protocols
ss -s
# Show detailed socket information
ss -tunlp
# Filter by specific state
ss -tun state established
# Find which process is listening on port 80
sudo ss -tunlp | grep ':80'
# Legacy netstat commands (for compatibility)
netstat -tunl
# Show netstat statistics
netstat -s
# Display processes using network connections
netstat -tunlp
# Show only TCP connections
netstat -tn
Common Pitfall: Forgetting to use sudo with the -p flag shows only connections owned by your user. Always use sudo to see all processes.
Firewalld: Dynamic Firewall Management
firewalld is the modern firewall management tool in Red Hat systems, replacing iptables. It uses zones and services for cleaner rule management.
# Check firewalld status
sudo systemctl status firewalld
# Get current active zone
sudo firewall-cmd --get-active-zones
# List all available zones
sudo firewall-cmd --get-zones
# View default zone
sudo firewall-cmd --get-default-zone
# Set default zone to public
sudo firewall-cmd --set-default-zone=public
# List all services in a zone
sudo firewall-cmd --zone=public --list-all
# Open port 80 (HTTP) temporarily
sudo firewall-cmd --zone=public --add-port=80/tcp
# Open port permanently
sudo firewall-cmd --zone=public --add-port=80/tcp --permanent
# Close port 80
sudo firewall-cmd --zone=public --remove-port=80/tcp --permanent
# Add service (HTTP) permanently
sudo firewall-cmd --zone=public --add-service=http --permanent
# Remove service
sudo firewall-cmd --zone=public --remove-service=http --permanent
# List all available services
sudo firewall-cmd --get-services
# Reload firewalld (apply permanent changes)
sudo firewall-cmd --reload
# Get all rules in XML format
sudo firewall-cmd --zone=public --list-all
# Add rich rule for specific source IP
sudo firewall-cmd --zone=public --add-rich-rule='rule family=ipv4 source address=192.168.1.0/24 port protocol=tcp port=3306 accept' --permanent
# View permanent rules before reload
sudo firewall-cmd --zone=public --list-all --permanent
# Block incoming traffic from specific IP
sudo firewall-cmd --zone=public --add-rich-rule='rule family=ipv4 source address=203.0.113.5 reject' --permanent
Key Concept: Firewalld uses zones (public, private, trusted) and services (http, https, ssh) for rule organization. Temporary changes don't persist after reload, while --permanent changes require firewall-cmd --reload.
Practical Troubleshooting Scenarios
Real-world networking problems require systematic diagnosis. Here's a workflow combining all tools:
# Scenario 1: Service not accessible from remote host
# Step 1: Verify service is listening
sudo ss -tunlp | grep 8080
# Step 2: Check firewall allows the port
sudo firewall-cmd --zone=public --list-ports
# Step 3: Test local connectivity
curl http://localhost:8080
# Step 4: Check routing table
ip route show
# Step 5: Verify interface is up
ip link show
# Scenario 2: Investigate high network traffic
# Find processes consuming network bandwidth
sudo ss -tunp | head -20
# Check established connections
sudo ss -tune | wc -l
# Scenario 3: Port conflicts - two services on same port
sudo ss -tunlp | grep ':3306'
# Scenario 4: DNS issues
# Check if DNS port is listening
sudo ss -tunl | grep ':53'
# Test DNS resolution
nslookup google.com
# Scenario 5: Verify interface has IP assigned
ip addr show dev eth0
# Add temporary gateway for testing
sudo ip route add default via 192.168.1.1 dev eth0
# Confirm gateway added
ip route show
Exam Tips for Red Hat Certified System Administrator (RHCSA)
Key Exam Concepts:
- Configuring static IP addresses using both nmtui and NetworkManager
- Distinguishing between temporary (ip) and permanent configurations
- Verifying listening ports and service access with ss
- Opening and closing firewall ports with firewall-cmd
- Understanding zones and services in firewalld
Common Exam Scenarios:
- Configure static IP: You'll need to set a permanent IP address. Use nmtui or edit /etc/sysconfig/network-scripts/ifcfg-eth0, then reload with nmcli connection reload.
- Open specific port: Add port to firewall using firewall-cmd --add-port=X/tcp --permanent, then reload.
- Verify service access: Use ss -tunlp to confirm service is listening, and firewall-cmd --list-all to verify firewall rules.
- Troubleshoot connectivity: Check interface status, routing, DNS, and firewall in systematic order.
Quick Reference Commands for Exam:
# Essential one-liners
ip addr show dev eth0
sudo ss -tunlp
sudo firewall-cmd --zone=public --list-all
sudo firewall-cmd --zone=public --add-port=443/tcp --permanent
sudo firewall-cmd --reload
ip route show
sudo systemctl restart NetworkManager
sudo nmtui
Summary
You now understand the complete Linux networking stack for RHCSA:
- ip command provides modern interface and routing management
- ss command reveals listening ports and active connections
- netstat serves as legacy alternative for compatibility
- firewalld implements zone-based dynamic firewall rules
- Systematic troubleshooting combines these tools for diagnosis
Next Steps: Practice configuring network interfaces in a lab environment, experiment with firewall rules, and work through exam-style scenarios. Refer to the RHCSA Certification Guide for additional resources and practice exams.