Network Manager Manual Configuration Using GNOME Network

The GNOME Network configuration is available on GNOME Settings and you can use it to configure all your network connections manually. Automatic wireless and wired connections were covered in Chapter 3. On the GNOME Settings dialog there is a Wi-Fi tab for wireless configuration and a Network tab for wired, VPN, and proxy configurations (see Figure 14-1). On the Wi-Fi tab, an Airplane Mode switch and a list of visible wireless connections are listed to the right. The currently active connection will have a checkmark next to its name. On the top-right bar is a switch for turning wireless on and off. A menu to the right of the switch list entries for connections to hidden networks, turning on your computer's WiFi hotspot capability, and listing previously accessed WiFi networks.

Selecting an entry in the Visible Networks list will create a gear button for it, which you can click to open the network configuration dialog with tabs for Details, Security, Identity, IPv4, IPv6, and Reset. The Details tab shows strength, speed, security methods, IP and hardware addresses, routes, and the DNS server IP address . To edit the connection manually, you use the Security, Identity, and IP tabs. The Security tab displays a menu from which you can choose a security method and a password (see Figure 14-2).

On the Identity tab, you can specify the SSID name (see Figure 14-3).

On the IPv4 Settings tab, a switch allows you to turn the IP connection on or off. There are sections for addresses, the DNS servers, and routes. An Addresses menu lets you choose the type of connection you want. By default, it is set to Automatic. If you change it to Manual, new entries appear for the address, netmask, and gateway (see Figure 14-4). On the IPv6 tab, the netmask is replaced by prefix. You can turn off Automatic switches for the DNS and Routes sections to make them manual. The DNS section has a plus button to let you add more DNS servers.

For a wired connection, click the Network tab on GNOME Settings to display lists for Wired, VPN, and Network Proxy. The Wired list shows your current wired connections with on and off switches for each. A plus button at the top right of the Wired list lets you add more wired connections. Next to a connection's switch a gear button is displayed (see Figure 14-5). Clicking the gear button opens a configuration dialog with tabs for Details, Identity, IPv4, IPv6, and Security (see Figure 14-6). On the Details tab, you can choose to connect automatically and whether to make the connection system-wide.

You can use the Security, Identity, and IP tabs to manually configure the connection. The Security tab lets you turn on 802.1x security and choose an authentication method, as well as provide a username and password (see Figure 14-7).

On the Identity tab, you can set the name, choose the hardware address , set the MTU blocks (see Figure 14-8).

On the IP tab, a switch allows you to turn the connection on or off. The tab has sections for addresses, DNS servers, and routes. DNS and Routes have a switch for automatic. Turning the switch off allows you to manually enter a DNS server address or routing information. From the Method set of options at the top, you can also choose to make the connection automatic, manual, link-local, or to disable it. When the connection is set to manual, new entries appear that let you enter the address, netmask, and gateway (see Figure 14-9). On the IPv6 tab, the netmask entry is replaced with a prefix entry.

For VPN connections, click the plus button at the top right of the VPN list to open an Add VPN dialog. The dialog lists supported VPN connection types, such as Point-to-Point or OpenVPN (see Figure 14-10). The Bond, Bridge, and VLAN entries open the Network Connections dialogs for those connections.

You can then configure the VPN connections from the Add VPN dialog, which shows three tabs: Identity, IPv4, and IPv6 (see Figure 14-11). The IP tabs are the same as for wireless and wired configuration dialogs. On the Identity tab, you can enter the name, gateway, and authentication information. Click the Advanced button for detailed connection configuration.

Several VPN services are available. The PPTP service for Microsoft VPN connections is installed by default. Other popular VPN services include OpenVPN, Cisco Concentrator, and Openswan (IPSec). Network Manager support is installed using the corresponding Network Manager plugin for these services. The plugin packages begin with the name network-manager. To use the openvpn service, first install the openvpn software along with the network-manager-openvpn plugin. For Cisco Concentrator-based VPN, use the network-manager-vpnc plugin. Openswan uses the network-manager-openswan plugin.

Managing Network Connections with nmcli

The nmcli command is NetworkManager command-line interface command. Most network configuration tasks can be performed by nmcli . The nmcli command manages NetworkManager through a set of objects: general (g), networking (n), radio (r), connection (c), device (d), and agent (a). Each can be referenced using the full name or a unique prefix, such as con for connection or dev for device. The unique prefix can be as short as a single character, such as g for general, c for connections, or d for device. See Table 14-2 for a list of the objects and commonly used options. The nmcli man page provides a complete listing with examples.

Network Manager Manual Configuration Using Network Connections

You can also use the older Network Connections utility (nm-connection-editor) to edit any network connection. You may have to run it from a terminal window. It is not installed by default. Established connections are listed, with at toolbar at the bottom for adding, removing, and editing network connections (see Figure 14-12). Your current network connections should already be listed.

When you add a connection, you can choose its type from a drop-down menu. The menu organizes connection types into three categories: Hardware, Virtual, and VPN. Hardware connections cover both wired (Ethernet, DSL, and InfiniBand) and wireless (WiFi, WiMAX, and Mobile Broadband) connections. VPN lists the supported VPN types, such as OpenVPN, PPTP, and Cisco. You can also import a previously configured connection. Virtual supports VLAN and Bond virtual connections.

Configuration editing dialogs display a General tab from which you can make your configuration available to all users and automatically connect when the network connection is available. You can also choose to use a VPN connection and specify a firewall zone.

Editing an Ethernet connection opens an Editing window. The Create button on the Choose a Connection Type dialog is used to add a new connection and opens a similar window, with no settings. The Ethernet tab lists the MAC hardware address and the MTU. The MTU is usually set to automatic. The standard default configuration for a wired Ethernet connection uses DHCP. Connect automatically will set up the connection when the system starts up. There are seven tabs—General, Ethernet, 8.02.1x Security, DCB, Proxy, IPv4 Settings, and IPv6 Settings. The IPv4 Settings tab lets you select the kind of wired connection you have. The manual configuration entries for an IPv4 connection are shown in Figure 14-13. Click the Add button to enter the IP address , network mask, and gateway address. Then enter the address for the DNS servers and your network search domains. The Routes button will open a window in which you can manually enter any network routes.

For a wireless connection, you enter wireless configuration data, such as your ESSID, password, and encryption method. For wireless connections , you choose WiFi or WiMAX as the connection type. The Editing Wi-Fi connection window opens with tabs for general configuration, your wireless information, security, proxy, and IP settings (see Figure 14-14). On the Wi-Fi tab, you specify your SSID, along with your mode and MAC address.

On the Wi-Fi Security tab, you enter your wireless connection security method. The commonly used method, WEP, is supported, along with WPA personal. The WPA personal method only requires a password. More secure connections, such as Dynamic WEP and Enterprise WPA, are also supported. These will require much more configuration information, such as authentication methods, certificates, and keys.

For a new broadband connection, choose the Mobile Broadband entry in the connection type menu. A 3G wizard starts up to help you set up the appropriate configuration for your particular 3G service. Configuration steps are listed on the left pane. If your device is connected, you can select it from the drop-down menu on the right pane.

Once a service is selected, you can further edit the configuration by clicking its entry in the Mobile Broadband tab and clicking the Edit button. The Editing window opens with tabs for Mobile Broadband, PPP, IPv4, and IPv6 settings. On the Mobile Broadband tab, you can enter your number, username, and password. Advanced options include the APN, Network, and PIN. The APN should already be entered.

On the Network Manager panel applet menu , the VPN Connection entry submenu will list configured VPN connections for easy access. The Configure VPN entry will open the Network Connections window to the VPN section, from which you can then add, edit, or delete VPN connections. The Disconnect VPN entry will end the current active VPN connection. To add a VPN connection, choose a VPN connection type from the connection type menu.

The Editing VPN Connection dialog opens with two tabs: VPN and IPv4 Settings. On the VPN tab, you enter VPN connection information, such as the gateway address and any additional VPN information that may be required. For an OpenVPN connection, you will have to provide the authentication type, certificates, and keys . Clicking the Advanced button opens the Advanced Options dialog. An OpenVPN connection will have tabs for General, Security, and TLS Authentication. On the Security tab, you can specify the cipher to use.

Networks are configured and managed with the lower-level tools: ifconfig, route, and netstat. The ifconfig tool operates from your root user desktop and enables you to configure your network interfaces fully, adding new ones and modifying others. The ifconfig and route utilities are lower-level programs that require more specific knowledge of your network to use effectively. The netstat tool provides you with information about the status of your network connections.

FirewallD

Fedora27 uses the FirewallD firewall daemon, instead of the older static system-config-firewall. To configure FirewallD, you can use the firewalld-config graphical interface. You can also use firewalld-cmd command from the command line. To set up your firewall, run firewall-config (Sundry ➤ Firewall; see Figure 14-15). The firewall is configured using zones displayed on the Zones tab. To configure a particular service, use the Services tab.

With firewall-config you can configure either a Runtime configuration or Permanent configuration. Select one from the Configuration drop-down menu. The Runtime configuration shows your current runtime setup, whereas a Permanent configuration does not take effect until you reload or restart. If you want to edit your zones and services, you need to choose the Permanent configuration. This view displays a zone toolbar for editing the zone, at the bottom of the zones scroll box, and edit, add, and remove buttons on the Services tab for managing service protocols, ports, and destination addresses.

Additional tabs can be displayed from the View menu for configuring ICMP types, whitelists, and for adding firewall rules directly (direct configuration).

A firewall configuration is set up for a given zone, such as a home, work, internal, external, or public zone. Zones provide an added level of protection by the firewall. They divide the network protected by the Firewall into separate segments, which can only communicate as permitted by the firewall. In effect, zones separate one part of your network from another. Each zone has its own configuration . Zones are listed in the Zones scroll box on the left side of the firewall-config window (see Figure 14-16). Select the one you want to configure. The firewall-config window opens to the default, Public. You can choose the default zone from the System Default Zone dialog, which you open from the Options menu as Change Default Zone.

If you choose Permanent Configuration from the Configuration menu, a toolbar for zones is displayed below the Zones scroll box, as shown in Figure 14-16. The + button lets you add a zone; the – button removes a zone. The pencil/page button lets you edit a zone. The add and edit buttons open the Base Zone Settings dialog , in which you enter or edit the zone name, version, description, and the target. The default target is ACCEPT. Other options are REJECT and DROP. The Load Zone Defaults button (yellow arrow) loads default settings, removing any you have made.

Each zone, in turn, can have one or more network connections. From the Options menu, choose Change Zones of Connections to open the Network Connections dialog, from which you can add a network connection.

For a given zone, you can configure services, ports, masquerading, port forwarding, interfaces, rich rules, sources, and ICMP filter. The features many users want to change are the services . A Linux system is often used to run servers for a network. If you are creating a strong firewall but still want to run a service such as a web server, an FTP server, or SSH encrypted connections, you must specify it in the Services tab.

For a selected service, you can specify service settings such as the ports and protocols it uses, any modules, and specific network addresses. Default settings, such as port 139 for Samba, are already set up using the TCP protocol. To modify the settings for services, click the Services tab on the Firewall Configuration window to list your services. Choose the service you want to edit from the Service scroll box to the left. For a given service, you can then use the Ports, Protocols, Source Port, Modules, and Destination tabs to specify ports, protocols, modules, and addresses. On the Ports table, click the Add button to open the Port and Protocol dialog, from which you can add a port or port range, and choose a protocol from the Protocol menu (see Figure 14-17). For protocols needed by all hosts and networks, use the Protocols tab. On the Destination tab, you can enter an IPv4 or IPv6 destination address for the service.

The Ports tab lets you specify ports that you may want opened for certain services, such as BitTorrent. Click the Add button to open a dialog in which you can select the port number, along with the protocol to control (TCP or UDP), or enter a specific port number or range.

If your system is being used as gateway to the Internet for your local network, you can implement masquerading to hide your local hosts from outside access from the Internet. This also requires IP forwarding, which is automatically enabled when you choose masquerading. Local hosts will still be able to access the Internet, but they will masquerade as your gateway system. You would select for masquerading the interface that is connected to the Internet. Masquerading is available only for IPv4 networks, not IPv6 networks.

The Port Forwarding tab lets you set up port forwarding, channeling transmissions from one port to another, or to a different port on another system. Click the Add button to add a port, specifying its protocol and destination.

The ICMP Filters tab allows you to block ICMP messages. By default, all ICMP messages are allowed. Blocking ICMP messages makes for a more secure system. Certain types of ICMP messages are often blocked, as they can be used to infiltrate or overload a system, such as the ping and pong ICMP messages.

If you have specific firewall rules to add, use the Direct Configuration tab (displayed from the View ➤ Direct Configuration menu ).

IPtables Firewall

If you wish, you can still use IPtables instead of FirewallD to manage firewalls. Older customized firewall configurations may still want to use the older IPtables static firewall. IPtables systemd unit files manage static IPtables rules, much like System V scripts did in previous releases. The iptables command keeps firewall rules in /etc/sysconfig/iptables, which is checked for (ConditionPathExists). The iptables operation runs an iptables.init script to start and stop the firewall. The script reads runtime configuration from /etc/sysconfig/iptables-config.

To set up your firewall, run system-config-firewall (Sundry ➤ Firewall). It should be the second firewall icon. The top button bar has buttons for a Firewall Wizard, Apply Button to Effect Any Changes, Reload to Restore Your Saved Firewall, and Disable and Enable buttons (see Figure 14-18). You can enable or disable your firewall with the Enable and Disable buttons. If the Firewall is active, only the Disable button can be used, and vice versa.