Linux Networking Basics: IP, Ports & Protocols - Complete 2026 Guide

# Linux Networking Basics: IP, Ports & Protocols - Complete 2026 Guide

Understanding **linux networking** is fundamental for anyone pursuing a career in cybersecurity, penetration testing, or ethical hacking. Whether you're running Kali Linux or any other Linux distribution, mastering network concepts, IP addressing, ports, and protocols is essential for conducting effective security assessments and network reconnaissance.

In this comprehensive guide, we'll explore the core networking concepts every pentester needs to know. By the end of this tutorial, you'll understand how networks function at a fundamental level and be equipped with practical commands to configure, troubleshoot, and analyze network connections in your Kali Linux environment.

## What is Linux Networking?

Linux networking refers to the collection of tools, protocols, and configurations that enable Linux systems to communicate with other devices over local and wide area networks. Unlike Windows, Linux provides powerful command-line utilities that give you granular control over network interfaces, routing tables, firewall rules, and network services.

For penetration testers, understanding linux networking is crucial because:

- **Network reconnaissance** requires knowledge of how IP addresses, ports, and protocols work
- **Exploitation** often involves manipulating network traffic and connections
- **Post-exploitation** activities like lateral movement depend on network awareness
- **Reporting** requires documenting network architecture and vulnerabilities

As you progress through the [Kali Linux Configuration Essential Settings & Updates 2026 Guide](/tutorials/kali-linux-configuration-essential-settings-updates-2026-guide), you'll find that network configuration is one of the first critical steps in setting up your penetration testing environment.

## Understanding IP Addresses: IPv4 and IPv6

### IPv4 Addresses

Internet Protocol version 4 (IPv4) remains the most widely used addressing system. An IPv4 address consists of four octets (8-bit numbers) separated by dots, ranging from 0 to 255.

**Example:** `192.168.1.100`

#### IPv4 Address Classes

| Class | Range | Default Subnet Mask | Purpose |
|-------|-------|---------------------|----------|
| A | 1.0.0.0 - 126.255.255.255 | 255.0.0.0 (/8) | Large networks |
| B | 128.0.0.0 - 191.255.255.255 | 255.255.0.0 (/16) | Medium networks |
| C | 192.0.0.0 - 223.255.255.255 | 255.255.255.0 (/24) | Small networks |
| D | 224.0.0.0 - 239.255.255.255 | N/A | Multicast |
| E | 240.0.0.0 - 255.255.255.255 | N/A | Experimental |

### IPv6 Addresses

IPv6 was developed to address the IPv4 address exhaustion problem. An IPv6 address is 128 bits long, written as eight groups of four hexadecimal digits separated by colons.

**Example:** `2001:0db8:85a3:0000:0000:8a2e:0370:7334`

IPv6 addresses can be shortened by:
- Omitting leading zeros: `2001:db8:85a3:0:0:8a2e:370:7334`
- Replacing consecutive zeros with `::`: `2001:db8:85a3::8a2e:370:7334`

### CIDR Notation

Classless Inter-Domain Routing (CIDR) notation expresses IP addresses with their subnet mask using a slash followed by the number of network bits.

**Examples:**
- `192.168.1.0/24` = 256 addresses (last octet variable)
- `10.0.0.0/8` = 16,777,216 addresses
- `172.16.0.0/16` = 65,536 addresses

Understanding CIDR is essential when using tools like [Nmap for network scanning](/articles/nmap-cheat-sheet-complete-command-reference-2026).

## Public vs Private IP Addresses

### Private IP Address Ranges

These addresses are reserved for internal networks and are not routable on the public internet:

- **10.0.0.0 - 10.255.255.255** (10.0.0.0/8) - Class A
- **172.16.0.0 - 172.31.255.255** (172.16.0.0/12) - Class B
- **192.168.0.0 - 192.168.255.255** (192.168.0.0/16) - Class C
- **127.0.0.0 - 127.255.255.255** (127.0.0.0/8) - Loopback

### Public IP Addresses

Public IP addresses are globally unique and routable on the internet. Your ISP assigns these addresses, and they're used to identify devices on the public network.

**Key Differences:**

| Feature | Private IP | Public IP |
|---------|-----------|----------|
| **Uniqueness** | Reusable across networks | Globally unique |
| **Internet Routing** | Not routable | Routable |
| **Assignment** | Manual or DHCP (local) | ISP assigned |
| **NAT Required** | Yes | No |
| **Cost** | Free | May require fee |

### Network Address Translation (NAT)

NAT allows multiple devices with private IPs to share a single public IP address. This is crucial for penetration testing because:

- You need to understand how traffic flows through NAT devices
- Port forwarding rules can expose internal services
- NAT can complicate reverse shell connections during exploitation

## Network Interfaces in Linux

Linux identifies network interfaces with specific naming conventions. Understanding these interfaces is fundamental to linux networking.

### Common Interface Names

#### Legacy Naming (still used in some systems)

- **eth0, eth1, eth2...** - Ethernet interfaces
- **wlan0, wlan1...** - Wireless interfaces
- **lo** - Loopback interface (127.0.0.1)
- **ppp0** - Point-to-Point Protocol connections

#### Predictable Network Interface Names

Modern Linux distributions use predictable naming:

- **enp0s3** - Ethernet (en), PCI bus (p), slot 0 (0), function 3 (s3)
- **eno1** - Ethernet, onboard device 1
- **wlp3s0** - Wireless (wl), PCI bus 3, slot 0
- **lo** - Loopback (unchanged)

### Loopback Interface

The loopback interface (`lo`) with address `127.0.0.1` (or `::1` for IPv6) allows a system to communicate with itself. This is critical for:

- Testing network applications locally
- Inter-process communication
- Troubleshooting network stack issues

As covered in the [50 Essential Linux Commands for Cybersecurity and Ethical Hacking 2026 Guide](/tutorials/50-essential-linux-commands-for-cybersecurity-and-ethical-hacking-2026-guide), understanding network interfaces helps you navigate your system more effectively.

## Viewing Network Configuration

Linux provides several commands to view and manage network configuration. Let's explore the most important tools for linux networking.

### Using `ip` Command (Modern Method)

The `ip` command is the modern replacement for older tools like `ifconfig`. It's part of the `iproute2` package.

#### View All Network Interfaces

```bash
ip addr show
# Or shorthand
ip a
```

**Sample Output:**
```
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 08:00:27:3f:4a:5b brd ff:ff:ff:ff:ff:ff
inet 192.168.1.100/24 brd 192.168.1.255 scope global eth0
inet6 fe80::a00:27ff:fe3f:4a5b/64 scope link
```

#### View Specific Interface

```bash
ip addr show eth0
# Or
ip a s eth0
```

#### View Routing Table

```bash
ip route show
# Or shorthand
ip r
```

**Sample Output:**
```
default via 192.168.1.1 dev eth0 proto dhcp metric 100
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100 metric 100
```

This shows:
- Default gateway: `192.168.1.1`
- Local network: `192.168.1.0/24`
- Interface: `eth0`

#### View Network Statistics

```bash
ip -s link
```

This displays packet statistics including transmitted/received packets, errors, and dropped packets.

### Using `ifconfig` (Legacy Method)

While deprecated, `ifconfig` is still available and used in many scripts:

```bash
ifconfig
# View specific interface
ifconfig eth0
```

**Note:** On minimal installations, you may need to install `net-tools`:

```bash
sudo apt update && sudo apt install net-tools
```

### Viewing Network Connections

#### Check Link Status

```bash
ip link show
```

This shows whether interfaces are UP or DOWN, along with MAC addresses.

#### Display Only IPv4 Addresses

```bash
ip -4 addr
```

#### Display Only IPv6 Addresses

```bash
ip -6 addr
```

## Configuring a Static IP Address

While DHCP automatically assigns IP addresses, penetration testing often requires static IP configuration for consistency and network control.

### Method 1: Using `ip` Command (Temporary)

These changes are lost after reboot:

```bash
# Bring interface down
sudo ip link set eth0 down

# Assign static IP
sudo ip addr add 192.168.1.150/24 dev eth0

# Set default gateway
sudo ip route add default via 192.168.1.1

# Bring interface up
sudo ip link set eth0 up
```

### Method 2: NetworkManager (Desktop Systems)

For systems with NetworkManager:

```bash
# Using nmcli (NetworkManager CLI)
nmcli connection show

# Configure static IP
sudo nmcli connection modify "Wired connection 1" \
ipv4.method manual \
ipv4.addresses 192.168.1.150/24 \
ipv4.gateway 192.168.1.1 \
ipv4.dns "8.8.8.8 8.8.4.4"

# Restart connection
sudo nmcli connection down "Wired connection 1"
sudo nmcli connection up "Wired connection 1"
```

### Method 3: Netplan (Ubuntu/Debian Modern)

Edit `/etc/netplan/01-netcfg.yaml`:

```yaml
network:
version: 2
renderer: networkd
ethernets:
eth0:
dhcp4: no
addresses:
- 192.168.1.150/24
gateway4: 192.168.1.1
nameservers:
addresses:
- 8.8.8.8
- 8.8.4.4
```

Apply configuration:

```bash
sudo netplan apply
```

### Method 4: /etc/network/interfaces (Debian/Kali)

Edit `/etc/network/interfaces`:

```bash
auto eth0
iface eth0 inet static
address 192.168.1.150
netmask 255.255.255.0
gateway 192.168.1.1
dns-nameservers 8.8.8.8 8.8.4.4
```

Restart networking:

```bash
sudo systemctl restart networking
# Or
sudo /etc/init.d/networking restart
```

## DNS Configuration in Linux

Domain Name System (DNS) translates human-readable domain names to IP addresses. Proper DNS configuration is essential for linux networking and penetration testing.

### The `/etc/resolv.conf` File

This file contains DNS server information:

```bash
cat /etc/resolv.conf
```

**Sample Content:**
```
nameserver 8.8.8.8
nameserver 8.8.4.4
nameserver 192.168.1.1
search localdomain
```

#### Key Directives

- **nameserver** - DNS server IP (up to 3 can be listed)
- **search** - Domain suffix for hostname lookups
- **domain** - Local domain name
- **options** - Various resolver options

### Manually Editing DNS Settings

```bash
sudo nano /etc/resolv.conf
```

Add nameservers:
```
nameserver 1.1.1.1
nameserver 1.0.0.1
```

**Common DNS Servers:**

| Provider | Primary | Secondary | Features |
|----------|---------|-----------|----------|
| Google | 8.8.8.8 | 8.8.4.4 | Fast, reliable |
| Cloudflare | 1.1.1.1 | 1.0.0.1 | Privacy-focused |
| Quad9 | 9.9.9.9 | 149.112.112.112 | Security filtering |
| OpenDNS | 208.67.222.222 | 208.67.220.220 | Content filtering |

### Making DNS Changes Persistent

On systems with NetworkManager, `/etc/resolv.conf` is often auto-generated. To make permanent changes:

```bash
# Prevent automatic overwriting
sudo chattr +i /etc/resolv.conf

# To allow changes again later
sudo chattr -i /etc/resolv.conf
```

Or configure via NetworkManager:

```bash
sudo nmcli connection modify "Wired connection 1" ipv4.dns "1.1.1.1 1.0.0.1"
sudo nmcli connection down "Wired connection 1" && nmcli connection up "Wired connection 1"
```

### Testing DNS Resolution

```bash
# Simple lookup
nslookup kali.org

# Detailed DNS query
dig kali.org

# Query specific DNS server
dig @8.8.8.8 kali.org

# Reverse DNS lookup
dig -x 192.168.1.1
```

## Understanding Ports and Services

### What are Ports?

Ports are virtual endpoints for network communication, ranging from 0 to 65535. They allow multiple services to run on a single IP address.

#### Port Ranges

- **Well-Known Ports (0-1023)** - Reserved for system services (requires root)
- **Registered Ports (1024-49151)** - Assigned to user processes
- **Dynamic/Private Ports (49152-65535)** - Temporary ports for client connections

### The `/etc/services` File

This file maps service names to port numbers:

```bash
cat /etc/services | grep -E "^(ssh|http|https)"
```

**Sample Output:**
```
http 80/tcp www # WorldWideWeb HTTP
https 443/tcp # http protocol over TLS/SSL
ssh 22/tcp # SSH Remote Login Protocol
```

### Common Ports Reference Table

Every penetration tester must memorize these essential ports:

| Port | Protocol | Service | Description |
|------|----------|---------|-------------|
| **20/21** | TCP | FTP | File Transfer Protocol (data/control) |
| **22** | TCP | SSH | Secure Shell - Remote administration |
| **23** | TCP | Telnet | Unencrypted remote access |
| **25** | TCP | SMTP | Simple Mail Transfer Protocol |
| **53** | TCP/UDP | DNS | Domain Name System |
| **67/68** | UDP | DHCP | Dynamic Host Configuration |
| **69** | UDP | TFTP | Trivial File Transfer Protocol |
| **80** | TCP | HTTP | Hypertext Transfer Protocol |
| **110** | TCP | POP3 | Post Office Protocol v3 |
| **123** | UDP | NTP | Network Time Protocol |
| **135** | TCP | RPC | Remote Procedure Call (Windows) |
| **137-139** | TCP/UDP | NetBIOS | Network Basic Input/Output System |
| **143** | TCP | IMAP | Internet Message Access Protocol |
| **161/162** | UDP | SNMP | Simple Network Management Protocol |
| **389** | TCP | LDAP | Lightweight Directory Access Protocol |
| **443** | TCP | HTTPS | HTTP over SSL/TLS |
| **445** | TCP | SMB | Server Message Block (Windows shares) |
| **465/587** | TCP | SMTPS | SMTP over SSL/Submission |
| **514** | UDP | Syslog | System logging |
| **636** | TCP | LDAPS | LDAP over SSL |
| **993** | TCP | IMAPS | IMAP over SSL |
| **995** | TCP | POP3S | POP3 over SSL |
| **1433** | TCP | MSSQL | Microsoft SQL Server |
| **1521** | TCP | Oracle | Oracle Database |
| **3306** | TCP | MySQL | MySQL/MariaDB Database |
| **3389** | TCP | RDP | Remote Desktop Protocol (Windows) |
| **5432** | TCP | PostgreSQL | PostgreSQL Database |
| **5900** | TCP | VNC | Virtual Network Computing |
| **8080** | TCP | HTTP-Alt | Alternative HTTP port |
| **8443** | TCP | HTTPS-Alt | Alternative HTTPS port |

Knowing these ports is crucial when analyzing [Nmap scan results](/articles/nmap-cheat-sheet-complete-command-reference-2026) and conducting vulnerability assessments.

### Viewing Active Ports

Several commands show which ports are listening on your system:

#### Using `ss` (Socket Statistics - Modern)

```bash
# Show all listening TCP ports
sudo ss -tlnp

# Show all listening UDP ports
sudo ss -ulnp

# Show all connections
sudo ss -tunap
```

**Flags Explained:**
- `-t` = TCP
- `-u` = UDP
- `-l` = Listening sockets
- `-n` = Numeric (don't resolve names)
- `-p` = Show process
- `-a` = All sockets

#### Using `netstat` (Legacy but Common)

```bash
# Show all listening ports with process info
sudo netstat -tulnp

# Show active connections
netstat -tunap

# Show routing table
netstat -r
```

#### Using `lsof`

```bash
# List all network connections
sudo lsof -i

# List specific port
sudo lsof -i :80

# List by protocol
sudo lsof -i tcp
sudo lsof -i udp
```

## TCP vs UDP: Key Protocol Differences

Understanding the differences between Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) is fundamental to linux networking and penetration testing.

### TCP (Transmission Control Protocol)

**Characteristics:**
- **Connection-oriented** - Establishes connection via three-way handshake
- **Reliable** - Guarantees packet delivery and order
- **Error checking** - Retransmits lost packets
- **Flow control** - Prevents overwhelming receivers
- **Slower** - Due to overhead

**TCP Three-Way Handshake:**

1. **SYN** - Client sends synchronize packet
2. **SYN-ACK** - Server acknowledges and sends its own SYN
3. **ACK** - Client acknowledges server's SYN

**Use Cases:**
- Web browsing (HTTP/HTTPS)
- Email (SMTP, POP3, IMAP)
- File transfers (FTP, SSH)
- Remote administration (SSH, RDP)

### UDP (User Datagram Protocol)

**Characteristics:**
- **Connectionless** - No handshake or session
- **Unreliable** - No delivery guarantee
- **No error checking** - Sender doesn't know if packets arrive
- **No flow control** - Sends at maximum rate
- **Faster** - Minimal overhead

**Use Cases:**
- DNS queries
- Video streaming
- Online gaming
- VoIP calls
- DHCP
- SNMP

### Comparison Table

| Feature | TCP | UDP |
|---------|-----|-----|
| **Connection** | Required | Not required |
| **Reliability** | Guaranteed delivery | Best effort |
| **Ordering** | Maintains order | No ordering |
| **Speed** | Slower | Faster |
| **Header Size** | 20-60 bytes | 8 bytes |
| **Error Checking** | Extensive | Basic checksum |
| **Use Case** | Accuracy critical | Speed critical |

### Why This Matters for Pentesting

Understanding TCP vs UDP is critical when:

- **Port scanning** - Different scan techniques for each protocol
- **Firewall evasion** - UDP packets may bypass TCP-focused filters
- **Packet crafting** - Creating custom packets requires protocol knowledge
- **Traffic analysis** - Identifying suspicious patterns
- **Exploit development** - Protocol-specific vulnerabilities

When following a structured [Pentest Methodology: The Complete Guide for 2026](/articles/pentest-methodology-the-complete-guide-for-2026), understanding these protocols helps in reconnaissance and exploitation phases.

## Network Troubleshooting Tools

Mastering these linux networking troubleshooting tools is essential for diagnosing connectivity issues and conducting reconnaissance.

### 1. ping - Test Connectivity

Tests reachability and measures round-trip time:

```bash
# Basic ping
ping google.com

# Send specific number of packets
ping -c 4 192.168.1.1

# Ping with larger packet size
ping -s 1000 192.168.1.1

# Set interval (seconds)
ping -i 2 kali.org

# Ping without DNS resolution
ping -n 8.8.8.8
```

**Understanding Output:**
```
PING google.com (142.250.185.46) 56(84) bytes of data.
64 bytes from 142.250.185.46: icmp_seq=1 ttl=117 time=12.3 ms
```

- **ttl** (Time To Live) - Hops remaining (decreased by each router)
- **time** - Round-trip time in milliseconds
- **icmp_seq** - Sequence number

### 2. traceroute - Trace Network Path

Shows the route packets take to reach a destination:

```bash
# Basic traceroute
traceroute google.com

# Use UDP (default)
traceroute -U google.com

# Use ICMP
traceroute -I google.com

# Use TCP
traceroute -T -p 443 google.com

# Set max hops
traceroute -m 20 google.com
```

**Sample Output:**
```
traceroute to google.com (142.250.185.46), 30 hops max
1 192.168.1.1 (192.168.1.1) 1.234 ms
2 10.0.0.1 (10.0.0.1) 8.567 ms
3 * * *
4 142.250.185.46 (142.250.185.46) 12.345 ms
```

Asterisks (*) indicate timeouts or filtered responses.

### 3. dig - DNS Lookup Tool

Powerful DNS interrogation tool:

```bash
# Basic query
dig kali.org

# Query specific record type
dig kali.org A # IPv4 address
dig kali.org AAAA # IPv6 address
dig kali.org MX # Mail servers
dig kali.org NS # Name servers
dig kali.org TXT # Text records
dig kali.org SOA # Start of Authority

# Query specific DNS server
dig @8.8.8.8 kali.org

# Short answer only
dig +short kali.org

# Reverse DNS lookup
dig -x 8.8.8.8

# Trace DNS delegation path
dig +trace kali.org
```

### 4. nslookup - DNS Query Tool

Simpler DNS lookup utility:

```bash
# Basic lookup
nslookup kali.org

# Query specific server
nslookup kali.org 8.8.8.8

# Interactive mode
nslookup
> server 1.1.1.1
> set type=MX
> kali.org
> exit
```

### 5. host - Simple DNS Lookup

```bash
# Basic lookup
host kali.org

# All record types
host -a kali.org

# Specific type
host -t MX kali.org

# Reverse lookup
host 8.8.8.8
```

### 6. ss - Socket Statistics

```bash
# All TCP connections
ss -ta

# All UDP connections
ss -ua

# Listening sockets only
ss -tl

# Show process information
ss -tlnp

# Display summary statistics
ss -s

# Filter by state
ss state established
ss state listening
```

### 7. netstat - Network Statistics

```bash
# All connections
netstat -a

# Listening ports
netstat -l

# Routing table
netstat -r

# Interface statistics
netstat -i

# Protocol statistics
netstat -s

# Continuous monitoring
netstat -c
```

### 8. ip - Multi-Purpose Network Tool

```bash
# Show neighbors (ARP table)
ip neighbor show

# Show routing table
ip route show

# Monitor real-time changes
ip monitor

# Get route to destination
ip route get 8.8.8.8
```

### 9. tcpdump - Packet Capture

Capture and analyze network traffic:

```bash
# Capture on specific interface
sudo tcpdump -i eth0

# Capture specific host
sudo tcpdump host 192.168.1.100

# Capture specific port
sudo tcpdump port 80

# Capture and save to file
sudo tcpdump -i eth0 -w capture.pcap

# Read from file
tcpdump -r capture.pcap

# Capture HTTP traffic
sudo tcpdump -i eth0 'tcp port 80'
```

### 10. nmap - Network Scanner

While detailed in our [Nmap Cheat Sheet](/articles/nmap-cheat-sheet-complete-command-reference-2026), basic usage:

```bash
# Ping scan (discover hosts)
sudo nmap -sn 192.168.1.0/24

# Port scan
sudo nmap 192.168.1.100

# Service detection
sudo nmap -sV 192.168.1.100

# OS detection
sudo nmap -O 192.168.1.100
```

## Firewall Basics in Linux

Firewalls control incoming and outgoing network traffic based on predetermined security rules. Understanding linux networking means understanding firewall configuration.

### iptables - Legacy Firewall

`iptables` is the traditional Linux firewall using netfilter kernel module.

#### Basic iptables Concepts

**Tables:**
- **filter** - Default table for packet filtering (INPUT, FORWARD, OUTPUT)
- **nat** - Network Address Translation
- **mangle** - Packet alteration
- **raw** - Connection tracking exemptions

**Chains:**
- **INPUT** - Incoming packets destined for local system
- **OUTPUT** - Outgoing packets from local system
- **FORWARD** - Packets routed through the system

#### Common iptables Commands

```bash
# List all rules
sudo iptables -L -v -n

# List rules with line numbers
sudo iptables -L --line-numbers

# Allow incoming SSH
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow incoming HTTP/HTTPS
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Drop all other incoming
sudo iptables -A INPUT -j DROP

# Delete specific rule (by number)
sudo iptables -D INPUT 3

# Flush all rules
sudo iptables -F

# Save rules (Debian/Ubuntu)
sudo iptables-save > /etc/iptables/rules.v4

# Restore rules
sudo iptables-restore < /etc/iptables/rules.v4
```

#### Block Specific IP

```bash
sudo iptables -A INPUT -s 192.168.1.50 -j DROP
```

#### Allow Traffic from Specific Network

```bash
sudo iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
```

### UFW - Uncomplicated Firewall

UFW provides a user-friendly interface to iptables, making firewall management much simpler.

#### Basic UFW Commands

```bash
# Install UFW
sudo apt install ufw

# Enable UFW
sudo ufw enable

# Disable UFW
sudo ufw disable

# Check status
sudo ufw status
sudo ufw status verbose
sudo ufw status numbered

# Default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing
```

#### Allow/Deny Rules

```bash
# Allow specific port
sudo ufw allow 22
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Allow service by name
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https

# Allow port range
sudo ufw allow 6000:6007/tcp

# Allow from specific IP
sudo ufw allow from 192.168.1.100

# Allow from subnet
sudo ufw allow from 192.168.1.0/24

# Allow specific IP to specific port
sudo ufw allow from 192.168.1.100 to any port 22

# Deny traffic
sudo ufw deny 23
sudo ufw deny from 192.168.1.50
```

#### Delete Rules

```bash
# Delete by rule specification
sudo ufw delete allow 80

# Delete by rule number
sudo ufw status numbered
sudo ufw delete 2
```

#### Advanced UFW

```bash
# Enable logging
sudo ufw logging on
sudo ufw logging medium # low, medium, high, full

# Reset to defaults
sudo ufw reset

# Allow specific application
sudo ufw app list
sudo ufw allow "Apache Full"
```

### nftables - Modern Firewall

`nftables` is the modern replacement for iptables, offering better performance and syntax.

```bash
# List all rules
sudo nft list ruleset

# Add simple rule
sudo nft add rule ip filter input tcp dport 22 accept

# Save configuration
sudo nft list ruleset > /etc/nftables.conf
```

## VPN and Proxy Concepts for Penetration Testing

Virtual Private Networks (VPNs) and proxies are essential for maintaining anonymity and bypassing restrictions during penetration testing engagements.

### VPN (Virtual Private Network)

A VPN creates an encrypted tunnel between your device and a VPN server, routing all traffic through that server.

**Benefits for Pentesting:**
- **Anonymity** - Hides your real IP address
- **Encryption** - Protects data in transit
- **Bypass restrictions** - Access geo-restricted resources
- **Secure communication** - Essential when using public WiFi

#### OpenVPN in Kali Linux

```bash
# Connect to VPN
sudo openvpn config.ovpn

# Run in background
sudo openvpn --config config.ovpn --daemon

# Verify VPN connection
ip addr show tun0
ip route | grep tun0

# Check your public IP
curl ifconfig.me
```

#### Common VPN Issues

**DNS Leaks:**
```bash
# Check for DNS leaks
dig +short myip.opendns.com @resolver1.opendns.com

# Force DNS through VPN
sudo nano /etc/resolv.conf
# Add VPN DNS servers
```

**Kill Switch:**

Prevent traffic if VPN disconnects:

```bash
sudo ufw default deny outgoing
sudo ufw allow out on tun0
sudo ufw enable
```

### Proxy Servers

Proxies act as intermediaries between your system and the internet, forwarding requests on your behalf.

#### Proxy Types

**HTTP/HTTPS Proxy:**
- Only handles web traffic
- Can inspect/modify HTTP requests
- Common in corporate environments

**SOCKS Proxy:**
- Supports any protocol (TCP/UDP)
- More versatile than HTTP proxies
- SOCKS5 supports authentication

**Transparent Proxy:**
- Intercepts traffic without client configuration
- Often used for content filtering

#### Using Proxychains

ProxyChains forces TCP connections through proxy servers:

```bash
# Install proxychains
sudo apt install proxychains

# Configure
sudo nano /etc/proxychains.conf
```

**Sample Configuration:**
```
# Dynamic chain (tries proxies in order)
dynamic_chain

# Proxy DNS requests
proxy_dns

# Define proxies
[ProxyList]
socks5 127.0.0.1 9050
http 192.168.1.100 8080
```

**Usage:**
```bash
# Run command through proxy
proxychains firefox
proxychains nmap -sT target.com
proxychains wget http://example.com
```

#### SSH Tunneling (SOCKS Proxy)

Create a SOCKS proxy via SSH:

```bash
# Create local SOCKS proxy on port 9050
ssh -D 9050 -N user@remote_server

# Use with proxychains
proxychains curl ifconfig.me
```

**Flags explained:**
- `-D` - Dynamic port forwarding (SOCKS)
- `-N` - Don't execute remote command
- `-f` - Background the connection

### Tor Network

The Onion Router provides anonymity through multiple relay layers:

```bash
# Install Tor
sudo apt install tor

# Start Tor service
sudo systemctl start tor
sudo systemctl enable tor

# Verify Tor is running
sudo systemctl status tor

# Tor creates SOCKS proxy on 127.0.0.1:9050

# Use with proxychains
proxychains curl https://check.torproject.org
```

#### Tor Browser in Kali

```bash
# Launch Tor Browser
torbrowser-launcher
```

### Combining VPN + Proxy + Tor

For maximum anonymity, layer protection:

1. **VPN** - First layer (ISP only sees VPN traffic)
2. **Tor** - Second layer (VPN provider doesn't see destination)
3. **Proxy** - Third layer (Additional obfuscation)

**Note:** This significantly reduces speed but maximizes anonymity.

### When to Use What

| Scenario | Recommended |
|----------|-------------|
| **General penetration testing** | VPN |
| **Web app testing** | HTTP proxy (Burp Suite) |
| **Anonymous reconnaissance** | Tor |
| **Bypassing application firewall** | SOCKS proxy |
| **Maximum anonymity** | VPN → Tor → Proxy |
| **Client network testing** | No VPN/proxy |

Understanding linux networking fundamentals makes working with VPNs and proxies much more effective. For more guidance on professional pentesting workflows, see our [official Kali documentation resources](https://www.kali.org/docs/).

## Best Practices for Linux Networking in Pentesting

As you develop your linux networking skills, keep these best practices in mind:

### 1. Document Network Configuration

Always document:
- IP addresses assigned
- Network ranges being tested
- Gateway and DNS servers
- VPN/proxy configuration

### 2. Verify Connectivity Before Testing

```bash
# Check interface is up
ip link show

# Verify IP configuration
ip addr show

# Test gateway reachability
ping -c 3 $(ip route | grep default | awk '{print $3}')

# Test DNS resolution
nslookup kali.org

# Test internet connectivity
ping -c 3 8.8.8.8
```

### 3. Use Static IPs for Important Systems

Static IPs ensure:
- Consistent access to pentesting tools
- Reliable log correlation
- Easier troubleshooting

### 4. Understand Your Network Topology

Before testing, diagram:
- Network segments
- Firewall locations
- Gateway/router positions
- Client network architecture

### 5. Monitor Network Traffic

Use `tcpdump` or Wireshark to:
- Verify traffic routes correctly
- Debug connectivity issues
- Analyze responses
- Detect anomalies

### 6. Secure Your Testing System

```bash
# Enable firewall
sudo ufw enable

# Allow only necessary ports
sudo ufw allow 22/tcp

# Enable automatic updates
sudo apt install unattended-upgrades
```

### 7. Practice on Safe Networks

Before engaging real targets:
- Set up home lab networks
- Use virtual networks (VirtualBox/VMware)
- Practice with intentionally vulnerable machines
- Study network behavior in controlled environments

For more comprehensive guidance on setting up your pentesting environment, refer to the [Linux.org documentation](https://www.linux.org/docs/).

## Conclusion

Mastering **linux networking** is non-negotiable for anyone serious about penetration testing, cybersecurity, or ethical hacking. In this comprehensive guide, we've covered:

✓ **IP addressing** - IPv4, IPv6, CIDR notation, public vs private addresses
✓ **Network interfaces** - eth0, wlan0, lo, and modern naming conventions
✓ **Configuration tools** - ip, ifconfig, ip route, NetworkManager
✓ **Static IP setup** - Multiple methods for different distributions
✓ **DNS configuration** - /etc/resolv.conf management and troubleshooting
✓ **Ports and protocols** - Essential ports table, TCP vs UDP
✓ **Troubleshooting tools** - ping, traceroute, dig, nslookup, ss, netstat
✓ **Firewall management** - iptables and UFW configuration
✓ **VPN and proxy** - Anonymity and security for pentesting

The commands and concepts covered here form the foundation of network reconnaissance, exploitation, and post-exploitation activities. Whether you're following the full [50 Essential Linux Commands](/tutorials/50-essential-linux-commands-for-cybersecurity-and-ethical-hacking-2026-guide) or diving into [Nmap scanning techniques](/articles/nmap-cheat-sheet-complete-command-reference-2026), solid networking knowledge accelerates your progress.

As you continue your journey through Kali Linux and penetration testing, these networking fundamentals will be referenced constantly. Practice these commands regularly, experiment with different configurations, and always test in controlled environments before applying to real engagements.

Next in this series, we'll explore process management, system monitoring, and automation—essential skills that build on your networking foundation.

**Continue Learning:**
- Practice these commands daily
- Set up a home lab network
- Capture and analyze traffic with tcpdump/Wireshark
- Configure VPN connections for anonymous testing
- Study the [complete pentesting methodology](/articles/pentest-methodology-the-complete-guide-for-2026)

## Frequently Asked Questions (FAQ)

### 1. What is the difference between ifconfig and ip command?

`ifconfig` is the legacy command from the `net-tools` package, while `ip` is the modern replacement from `iproute2`. The `ip` command offers more features, better performance, and is actively maintained. While `ifconfig` is still available on most systems for backwards compatibility, it's deprecated and may not be present on minimal installations.

**Key differences:**
- `ip` supports newer network features (VLANs, VPNs, tunnels)
- `ip` has better syntax for complex operations
- `ifconfig` is limited to basic interface management
- `ip` is the future-proof choice

For modern linux networking, always use `ip` commands unless working with legacy scripts that require `ifconfig`.

### 2. How do I find my public IP address from the Linux terminal?

There are several methods to find your public IP address from the command line:

```bash
# Using curl
curl ifconfig.me
curl icanhazip.com
curl ipinfo.io/ip
curl api.ipify.org

# Using wget
wget -qO- ifconfig.me

# Using dig
dig +short myip.opendns.com @resolver1.opendns.com

# Using host
host myip.opendns.com resolver1.opendns.com
```

All these methods query external services to return your public-facing IP address. This is especially useful when testing VPN connections—compare the IP before and after connecting to verify the VPN is working.

### 3. What's the best way to permanently configure DNS servers in Kali Linux?

Permanent DNS configuration depends on your network management system:

**Method 1: NetworkManager (most common):**
```bash
sudo nmcli connection modify "Wired connection 1" ipv4.dns "1.1.1.1 1.0.0.1"
sudo nmcli connection down "Wired connection 1"
sudo nmcli connection up "Wired connection 1"
```

**Method 2: Make /etc/resolv.conf immutable:**
```bash
sudo nano /etc/resolv.conf # Edit DNS servers
sudo chattr +i /etc/resolv.conf # Prevent overwriting
```

**Method 3: Configure in /etc/network/interfaces:**
```bash
auto eth0
iface eth0 inet static
address 192.168.1.100
netmask 255.255.255.0
gateway 192.168.1.1
dns-nameservers 1.1.1.1 1.0.0.1
```

For pentesting, I recommend using Cloudflare DNS (1.1.1.1) or Google DNS (8.8.8.8) for reliability and speed.

### 4. How can I test if a specific port is open on a remote server?

There are multiple ways to test port connectivity:

**Using telnet:**
```bash
telnet 192.168.1.100 80
```
If it connects, the port is open. Press `Ctrl+]` then type `quit` to exit.

**Using nc (netcat):**
```bash
nc -zv 192.168.1.100 80
nc -zv 192.168.1.100 1-1000 # Scan port range
```

**Using nmap:**
```bash
nmap -p 80 192.168.1.100
nmap -p 1-65535 192.168.1.100 # Full port scan
```

**Using bash (no tools needed):**
```bash
timeout 2 bash -c '</dev/tcp/192.168.1.100/80' && echo "Open" || echo "Closed"
```

**Using curl (for HTTP/HTTPS):**
```bash
curl -I http://192.168.1.100:80
curl -I https://192.168.1.100:443
```

For comprehensive port scanning during penetration testing, always use `nmap` as detailed in our [Nmap Cheat Sheet](/articles/nmap-cheat-sheet-complete-command-reference-2026).

### 5. Should I use TCP or UDP for port scanning, and what's the difference?

The choice between TCP and UDP scanning depends on your objectives:

**TCP scanning:**
- **More reliable** - Establishes full connection
- **Easier to detect** - Leaves logs on target systems
- **Finds TCP services** - Web servers, SSH, FTP, databases
- **Default for most scans** - nmap defaults to TCP

**UDP scanning:**
- **Slower** - Requires timeouts for closed ports
- **Less reliable** - No acknowledgment mechanism
- **Finds UDP services** - DNS, DHCP, SNMP, VoIP
- **Often overlooked** - Many pentesters skip UDP

**Best practice for pentesting:**

1. **Start with TCP scan:**
```bash
sudo nmap -sS 192.168.1.100 # TCP SYN scan (stealth)
```

2. **Follow with UDP scan on key ports:**
```bash
sudo nmap -sU --top-ports 100 192.168.1.100
```

3. **Combine for complete coverage:**
```bash
sudo nmap -sS -sU -p 1-1000 192.168.1.100
```

UDP scanning takes significantly longer because:
- Open UDP ports may not respond (silent)
- Closed ports may be rate-limited by firewall
- Requires waiting for ICMP "port unreachable" responses

In professional penetration testing, always scan both TCP and UDP to achieve comprehensive coverage, as UDP vulnerabilities are frequently missed but can be critical (such as SNMP misconfigurations or DNS cache poisoning vectors).

---

*Written by Andrax Pentester / Syed Abrar | Last updated: 2026 | Part of Kali Linux Tutorial Series*