Chapter 7: Networking and Services

Chapter 7: Networking and Services

The Linux networking stack is the backbone of global cloud routing, content distribution, and microservice communication.

In Ubuntu 26.04 LTS, networking combines kernel-level performance optimizations with hardened, production-ready server daemons: systemd-resolved for DNS caching and DNSSEC validation, Nginx and Apache2 for web delivery, Samba 4.23 for cross-platform storage, Squid 7.2 for forward proxy caching, and HAProxy 3.2 for high-availability load balancing.

This chapter details the configuration and operational management of foundational network infrastructure services on Ubuntu 26.04 LTS.

---

Network Stack Fundamentals

When an incoming packet hits a physical network interface, it traverses the Linux kernel network pipeline:

┌────────────────────────────────────────────────────────────────────────┐
│                   LINUX NETWORK PACKET PROCESSING                      │
│                                                                        │
│   [ Network Interface (NIC) ]                                          │
│        │                                                               │
│        ▼ (Ring Buffer DMA)                                             │
│   [ eBPF / XDP Filter ] ──► (Early packet drop / Fast routing)         │
│        │                                                               │
│        ▼ (sk_buff Allocation)                                          │
│   [ Netfilter / nftables ] ──► (PREROUTING / NAT / State Tracking)     │
│        │                                                               │
│        ▼                                                               │
│   [ IP Routing Decision ] ──► [ Local Delivery / Forwarding ]         │
│        │                                                               │
│        ▼                                                               │
│   [ TCP/UDP Transport Layer ] (Socket Buffers / Congestion Control)    │
│        │                                                               │
│        ▼                                                               │
│   [ Application Socket ] (Nginx / HAProxy / Postfix via epoll)         │
└────────────────────────────────────────────────────────────────────────┘

---

DNS with systemd-resolved

Ubuntu 26.04 LTS uses systemd-resolved as the default local DNS resolver and caching proxy.

# Query active DNS server status and search domains
resolvectl status

# Query a domain name and display resolution latency
resolvectl query api.example.com

Configure /etc/systemd/resolved.conf to enable DNS-over-TLS (DoT) and DNSSEC validation:

[Resolve]
DNS=1.1.1.1#cloudflare-dns.com 8.8.8.8#dns.google
FallbackDNS=9.9.9.9
DNSSEC=allow-downgrade
DNSOverTLS=opportunistic
Cache=yes

Restart the resolver:

sudo systemctl restart systemd-resolved

---

DHCP Server Configuration with Kea

Ubuntu 26.04 LTS features ISC Kea, the modern, modular successor to legacy ISC DHCPd:

sudo apt install -y kea-dhcp4-server

Configure /etc/kea/kea-dhcp4.conf:

{
  "Dhcp4": {
    "interfaces-config": {
      "interfaces": [ "enp3s0" ]
    },
    "lease-database": {
      "type": "memfile",
      "persist": true,
      "name": "/var/lib/kea/dhcp4.leases"
    },
    "valid-lifetime": 43200,
    "subnet4": [
      {
        "subnet": "192.168.10.0/24",
        "pools": [ { "pool": "192.168.10.100 - 192.168.10.200" } ],
        "option-data": [
          { "name": "routers", "data": "192.168.10.1" },
          { "name": "domain-name-servers", "data": "192.168.10.1, 1.1.1.1" }
        ]
      }
    ]
  }
}

Enable and start the service:

sudo systemctl enable --now kea-dhcp4-server

---

High-Performance Web Delivery: Nginx and Apache2

1. Nginx Reverse Proxy with HTTP/3 & TLS 1.3

Nginx provides event-driven HTTP request routing:

sudo apt install -y nginx

Create /etc/nginx/sites-available/app.conf:

server {
    listen 80;
    server_name app.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name app.example.com;

    ssl_certificate /etc/letsencrypt/live/app.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
    ssl_protocols TLSv1.3 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Link and activate:

sudo ln -s /etc/nginx/sites-available/app.conf /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

2. Apache HTTPD (Apache2)

For environments requiring .htaccess overrides or legacy PHP modules:

sudo apt install -y apache2
sudo a2enmod ssl rewrite headers proxy proxy_http
sudo systemctl restart apache2

---

Enterprise Mail Infrastructure: Postfix and Dovecot

Deploying a mail transfer agent (MTA) and IMAP storage daemon:

sudo apt install -y postfix dovecot-imapd

Configure /etc/postfix/main.cf for TLS submission:

myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
inet_interfaces = all
inet_protocols = ipv4
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
home_mailbox = Maildir/
smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/ssl/certs/mail.pem
smtpd_tls_key_file = /etc/ssl/private/mail.key

Configure /etc/dovecot/conf.d/10-mail.conf:

mail_location = maildir:~/Maildir

Restart mail services:

sudo systemctl restart postfix dovecot

---

Cross-Platform File Sharing with Samba 4.23

Samba provides SMB3 file and print sharing for Windows, macOS, and Linux clients:

sudo apt install -y samba

Configure /etc/samba/smb.conf:

[global]
   workgroup = WORKGROUP
   server string = Ubuntu 26.04 Storage Server
   server role = standalone server
   security = user
   map to guest = Bad User
   min protocol = SMB3

[Engineering]
   comment = Engineering Team Shared Folder
   path = /srv/samba/engineering
   browseable = yes
   read only = no
   guest ok = no
   valid users = @engineers
   create mask = 0660
   directory mask = 0770

Add users and restart:

sudo groupadd engineers
sudo usermod -aG engineers alice
sudo smbpasswd -a alice
sudo systemctl restart smbd nmbd

---

Caching Proxy with Squid 7.2

Squid accelerates web access and inspects outbound HTTP/HTTPS egress:

sudo apt install -y squid

Configure /etc/squid/squid.conf:

acl localnet src 192.168.10.0/24
http_access allow localnet
http_access deny all
http_port 3128
cache_dir ufs /var/spool/squid 10000 16 256
maximum_object_size 1024 MB

Restart:

sudo systemctl restart squid

---

Load Balancing with HAProxy 3.2

HAProxy handles high-concurrency layer 4 (TCP) and layer 7 (HTTP) load balancing:

sudo apt install -y haproxy

Configure /etc/haproxy/haproxy.cfg:

global
    log /dev/log local0
    user haproxy
    group haproxy
    maxconn 50000

defaults
    log     global
    mode    http
    option  httplog
    timeout connect 5000ms
    timeout client  50000ms
    timeout server  50000ms

frontend http_front
    bind *:80
    default_backend web_cluster

backend web_cluster
    balance roundrobin
    cookie SERVERID insert indirect nocache
    server web01 192.168.10.11:80 check cookie web01
    server web02 192.168.10.12:80 check cookie web02

Validate and restart:

sudo haproxy -c -f /etc/haproxy/haproxy.cfg
sudo systemctl restart haproxy

---

Chapter Summary

• The Linux networking stack supports microsecond packet processing via eBPF/XDP and Netfilter.
• systemd-resolved delivers secure DNS resolution with DNS-over-TLS (DoT) and DNSSEC validation.
• Kea replaces legacy DHCP servers with a modular, high-throughput IP allocation daemon.
• Nginx and Apache2 provide robust, TLS-encrypted web delivery and reverse proxying.
• Samba 4.23 connects heterogenous Windows, macOS, and Linux storage clients securely over SMB3.
• Squid 7.2 and HAProxy 3.2 provide caching and resilient multi-node traffic balancing.