0:00–0:15
Recap
0:15–1:50
Lab 1B
1:50–2:00
Debrief
0:00 – 0:15
Recap · 15 min
Verify Day 1 work and set up NAT theory before touching the VMs
- Quick verification: S1 installed and booting? All three vSwitches present? Anyone who doesn't have S1 running — get the installer finished now while the recap continues. S2 and S3 do not need to be installed yet.
- Ask: "Right now, if I boot S2 and try to ping 8.8.8.8, what happens?" — nothing. S2 is on LAN1, an internal-only network. There's no route to the internet from LAN1 because S1 hasn't been configured as a gateway yet. Today we fix that.
- Walk through NAT theory on the board: S2 sends a packet with source IP 192.168.50.2 destined for 8.8.8.8. S1 receives it on eth1 (LAN1). S1 forwards it out eth0 (External) but rewrites the source IP to S1's external IP — this is masquerade. The reply comes back to S1's external IP, S1 rewrites the destination back to 192.168.50.2, and forwards it back to S2. S2 never knows it went through S1.
- Two things S1 needs: kernel IP forwarding enabled (turned off by default), and an iptables rule to masquerade. Both are done today.
0:15 – 1:50
Lab 1B · 95 min
Install S2 and S3, configure static IPs on all servers, enable NAT on S1
Task 1 — Install Ubuntu Server on S2 and S3 (30 min)
- If not already done: start S2, complete Ubuntu Server install. Same settings as S1: hostname
S2, username student, password Room225, OpenSSH server enabled. Repeat for S3 with hostname S3.
- While S2 and S3 install, proceed with configuring S1's static IPs on Tasks 2 and 3. The installs run in parallel — no need to wait.
Task 2 — Configure static IPs on S1 using Netplan (25 min)
- Ubuntu Server 24.04 uses Netplan for network configuration. Config files live in
/etc/netplan/. The default file is named something like 00-installer-config.yaml. Always back it up before editing: sudo cp /etc/netplan/00-installer-config.yaml /etc/netplan/00-installer-config.yaml.bak
- S1 needs three interfaces configured. eth0 (External) stays as DHCP — the classroom network provides this address. eth1 (LAN1) and eth2 (LAN2) need static IPs. A working Netplan YAML for S1:
network:
version: 2
ethernets:
eth0:
dhcp4: true
eth1:
dhcp4: false
addresses: [192.168.50.1/24]
eth2:
dhcp4: false
addresses: [192.168.51.1/24]
- YAML is whitespace-sensitive — indentation errors cause silent failures. Use spaces, never tabs. Apply:
sudo netplan apply. Verify: ip addr show — all three interfaces should show their addresses. ip route show — verify routes exist for both LAN subnets.
- Ask: "What interface name does your system actually use?" Ubuntu Server names NICs based on hardware order. On Hyper-V, they appear as
eth0, eth1, eth2 — but confirm with ip link show before editing the Netplan file. The name in the YAML must match exactly.
Instructor note: Netplan YAML indentation errors are the most common cause of failed network config. If a student's netplan apply produces errors, show them how to read the error message — it always includes the line number. A quick netplan try (which reverts after 120 seconds if not confirmed) is safer than netplan apply when experimenting.
Task 3 — Configure static IPs on S2 and S3 (15 min)
- Once S2 and S3 are installed, configure their Netplan files. S2 has one interface (eth0 on LAN1): static IP
192.168.50.2/24, gateway 192.168.50.1 (S1's LAN1 address). S3 has one interface (eth0 on LAN2): static IP 192.168.51.2/24, gateway 192.168.51.1.
- Verify: from S1, ping 192.168.50.2 (should work). From S2, ping 192.168.50.1 (should work). From S2, ping 8.8.8.8 — this should fail at this point, because NAT is not yet configured. This is expected.
Task 4 — Enable IP forwarding on S1 (10 min)
- By default, Linux discards packets not destined for its own IP addresses — it does not forward them. To make S1 act as a router, kernel IP forwarding must be enabled.
- Edit
/etc/sysctl.conf on S1. Find the line #net.ipv4.ip_forward=1 and uncomment it (remove the #). Save and apply: sudo sysctl -p. Verify: cat /proc/sys/net/ipv4/ip_forward — should return 1.
- Ask: "If we enable IP forwarding but don't add a NAT rule, what happens when S2 pings 8.8.8.8?" — The packet leaves S1 with S2's source IP (192.168.50.2). The internet has no route back to that private address — the reply is dropped. IP forwarding alone is not enough; masquerade is needed.
Task 5 — Configure iptables MASQUERADE on S1 (15 min)
- Add the NAT rule to S1's iptables. Replace
eth0 with S1's actual External interface name if different:
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
- This rule says: for any packet leaving via eth0 (the External interface), rewrite the source IP to S1's external IP. Replies follow the conntrack table back to the correct internal host.
- Test immediately: from S2, ping 8.8.8.8. The moment it works is satisfying — celebrate it. Then ping from S3 via S1's LAN2 interface. Both should now have internet access through S1.
- Make the iptables rule persistent across reboots:
sudo apt install iptables-persistent. When prompted, save current rules. Rules are stored in /etc/iptables/rules.v4 and loaded automatically at boot.
Lab 1B complete when: All three VMs are installed and running. S1 has correct static IPs on LAN1 and LAN2. S2 pings S1 (192.168.50.1) successfully. S3 pings S1 (192.168.51.1) successfully. Both S2 and S3 can ping 8.8.8.8 through S1's NAT. iptables-persistent is installed.
1:50 – 2:00
Debrief · 10 min
NAT verification and preview of Day 3
- Ask: "From the classroom network's perspective, which IP address do S2 and S3 appear to use when they access the internet?" — S1's external IP. This is NAT in action. Run
curl ifconfig.me from both S2 and S3 — confirm they both show S1's external IP.
- Ask: "Is the iptables MASQUERADE rule a firewall rule or a NAT rule?" — NAT, specifically in the
nat table's POSTROUTING chain. In Week 2 we will work extensively with the filter table for actual packet filtering and firewall rules.
- Preview Wednesday: the infrastructure is working. Now we secure access to it. SSH is already installed on all three servers. Wednesday we replace password authentication with key-based authentication — a meaningful security improvement that every production Linux server should have.
Learning outcomes — by end of Day 2, students can…
Configure Netplan static IPsWrite a valid Netplan YAML with multiple interfaces, apply it with netplan apply, and verify with ip addr and ip route
Enable kernel IP forwardingLocate and uncomment the ip_forward setting in sysctl.conf and verify it took effect
Configure NAT masqueradeAdd an iptables MASQUERADE rule on the correct outbound interface and verify internet access from internal VMs
Persist iptables rulesInstall iptables-persistent and confirm rules survive a reboot
Common issues and fixes
| Issue | Likely cause | Fix |
|---|
| netplan apply fails with YAML error | Tab characters used instead of spaces, or wrong indentation depth | Use cat -A /etc/netplan/*.yaml to reveal tabs (shown as ^I). Replace all tabs with spaces. Indentation must be consistent — 2 spaces per level |
| Interface name not eth0/eth1/eth2 | Ubuntu uses predictable interface naming on some hardware | Run ip link show to find actual names (may be enp2s0, ens3, etc.). Update Netplan YAML with correct names |
| S2 pings S1 but cannot ping 8.8.8.8 | IP forwarding not enabled, or MASQUERADE rule on wrong interface | Check cat /proc/sys/net/ipv4/ip_forward returns 1. Check sudo iptables -t nat -L -n — MASQUERADE rule should show with the correct interface |
| NAT works but stops after reboot | iptables-persistent not installed, or rules not saved | Install iptables-persistent: sudo apt install iptables-persistent. Save rules: sudo netfilter-persistent save |
| S3 can ping S1's LAN2 IP but not internet | MASQUERADE rule only covers LAN1 subnet, not LAN2 | The MASQUERADE rule covers all outbound traffic on eth0 regardless of source — this should work for both subnets. Verify with iptables -t nat -L POSTROUTING -n -v |