Configuring Networking with Netplan

This guide covers the core configuration patterns for Netplan, the network configuration tool used by Ubuntu and many of its derivatives. We’ll walk through a solid baseline setup, how to add extra IP addresses, and how to use them in a virtualized environment.

There are several approaches available:

• Assign multiple IP addresses directly to the HOST without involving virtualization
• Use Layer 2 bridging to hand out IP addresses to your VMs
• Use Layer 3 routing to hand out IP addresses to your VMs
• Combine routing and bridging into a hybrid setup using two or more network bridges

Sample values used throughout this guide

2001:db8:1234::   # Stand-in for the server's public IPv6 network
10.0.0.168        # Stand-in for the primary IPv4 address
10.0.10.135       # Stand-in for an extra standalone IPv4 address
10.10.10.128/29   # Stand-in for an extra IPv4 subnet
AA:BB:CC:DD:EE:FF # Stand-in for the MAC address of the physical interface / primary IPv4
00:50:56:00:11:22 # Stand-in for the virtual MAC tied to the extra standalone IP

Default configuration after a fresh Ubuntu 24 install

nano /etc/netplan/01-netcfg.yaml

network:
  version: 2
  renderer: networkd
  ethernets:
    enp7s0:
      addresses:
        - 10.0.0.1               # Main IPv4 for the HOST
        - 2001:db8:1234::1       # Main IPv6/64 subnet for the HOST
      routes:
        - on-link: true
          to: 0.0.0.0/0
          via: 10.0.0.129        # Gateway IPv4 of the main IPv4 address
        - to: default
          via: fe80::1           # Default IPv6 gateway
      nameservers:
        addresses:
          - 185.12.64.2          # Nameservers from installimage process
          - 2a01:4ff:ff00::add:1 # Nameservers from installimage process
          - 185.12.64.1          # Nameservers from installimage process
          - 2a01:4ff:ff00::add:2 # Nameservers from installimage process

Setting up extra standalone IPv4 addresses and IPv4 subnets (no virtualization)

What you need beforehand:

• The server has one physical uplink interface — enp7s0 with MAC address AA:BB:CC:DD:EE:FF
• The server already has its primary IPv4 (on enp7s0)
• The server has one extra standalone IPv4 (its virtual MAC was disabled through the hosting control panel)
• The server has one extra IPv4 subnet
• The server has a /64 IPv6 block assigned to the HOST

What we’re aiming for:

The server should be reachable over:

• The primary IPv4
• The extra standalone IPv4
• Every usable address in the IPv4 subnet (including the network address itself)
• IPv6::2/64
• IPv6::3/64

How it’s done:

All IP addresses and routes are configured directly on the main interface.

Set up Netplan on the HOST

nano /etc/netplan/01-netcfg.yaml

network:
  version: 2
  renderer: networkd
  ethernets:
    enp7s0:
      addresses:
        - 10.0.0.168/32           # Main IPv4 for the HOST

        - 10.0.10.135/32          # The single IPv4 Address for the GUEST

        - 10.10.10.128/32         # Net-IP of the IPv4 Subnet (Net IP can be used in this case)
        - 10.10.10.129/32         # IP of the IPv4 Subnet
        - 10.10.10.130/32         # IP of the IPv4 Subnet
        - 10.10.10.131/32         # IP of the IPv4 Subnet
        - 10.10.10.132/32         # IP of the IPv4 Subnet
        - 10.10.10.133/32         # IP of the IPv4 Subnet
        - 10.10.10.134/32         # Last usable IP of the IPv4 Subnet (.135 is reserved for broadcast)

        - 2001:db8:1234::2/128    # Main IPv6/64 subnet for the HOST
        - 2001:db8:1234::3/128    # Main IPv6/64 subnet for the HOST
      routes:
        - on-link: true
          to: 0.0.0.0/0
          via: 10.0.0.129         # Gateway IPv4 of the main IPv4 address
        - to: default
          via: fe80::1            # Default IPv6 gateway
      nameservers:
        addresses:
          - 185.12.64.2           # Nameservers from installimage process
          - 2a01:4ff:ff00::add:1  # Nameservers from installimage process
          - 185.12.64.1           # Nameservers from installimage process
          - 2a01:4ff:ff00::add:2  # Nameservers from installimage process

Why this works:

The kernel doesn’t route traffic for local extra IPs even when routes are defined for them — traffic to any extra IP never goes through the primary IPv4, so you won’t see an extra hop for it. That said, this setup won’t trigger abuse flags. As with any IP, the MAC address being used is still the approved MAC of the primary IPv4.

The network will correctly deliver traffic to your extra IPs, and the server will correctly send return traffic back out.

A note on Full Disk Encryption

If your drives are encrypted and unlocked through dropbear, you might still end up relying on DHCP inside your initramfs. You can avoid this by statically configuring network settings using the kernel’s IP boot parameter. This can be set either through your bootloader or your initramfs configuration. We recommend setting this option in /etc/initramfs-tools/initramfs.conf:

[...]
#
# DEVICE: ...
#
# Specify a specific network interface, like eth0
# Overridden by optional ip= or BOOTIF= bootarg
#

#DEVICE=
IP=10.0.0.168::10.0.0.129:255.255.255.255::enp7s0:none:185.12.64.1:185.12.64.2:213.239.239.164
[...]

Full syntax details for the IP parameter are documented here: https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt

To stop this generated configuration from carrying over into the running system, it’s worth clearing it out once dropbear exits. Add a line to the dropbear-initramfs config:

echo -e "rm /run/net-*.conf\nrm /run/netplan/*.yaml" >> /etc/dropbear-initramfs/config

(this approach is documented in Launchpad Bug #1813394)

Afterward, regenerate the initramfs: update-initramfs -u — this also improves boot times, since it removes the wait for a response.