The Ultimate Guide to Dedicated Servers

Network Configuration for Debian / Ubuntu

Posted by
Updated 30/06/2026
Comments Off on Network Configuration for Debian / Ubuntu
Table of Contents

Primary IP Address

IPv4

The primary IP of a dedicated server is typically located within a /26 or /27 subnet. To prevent accidental use of another server’s IP address, the infrastructure blocks any Ethernet frames not directed at the gateway. To communicate with a server in the same subnet, a point-to-point network setup is required. Pre-installed system images already include this configuration, ensuring all traffic is routed through the gateway.

This is achieved by establishing a point-to-point link between the primary IP and the gateway. The primary IP is assigned a netmask of 255.255.255.255 (/32), which makes the server treat itself as isolated and prevents it from sending packets directly. To reach other servers and the Internet, an explicit host route to the gateway must be added alongside the default route.

/etc/network/interfaces

When the network is managed through /etc/network/interfaces, simply add the pointopoint <gateway IP> directive to the interface configuration block.

## /etc/network/interfaces — dedicated server example
# Loopback-Adapter
auto lo
iface lo inet loopback
#
# LAN interface
auto eth0
iface eth0 inet static
  # Main IP address of the server
  address 192.168.0.250
  # Netmask 255.255.255.255 (/32) independent from the
  # real subnet size (e.g. /27)
  netmask 255.255.255.255
  # explicit host route to the gateway
  gateway 192.168.0.1
  pointopoint 192.168.0.1

netplan

With netplan, the same result is achieved using the on-link keyword:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      addresses:
      - 192.168.0.250/32
      routes:
      - to: 0.0.0.0/0
        via: 192.168.0.1
        on-link: true

IPv6

Along with the primary IPv4 address, each server receives a /64 IPv6 subnet. This subnet is routed to the link-local IPv6 address derived from the server’s MAC address. Unlike IPv4, no point-to-point setup is needed for IPv6.

The gateway is always: fe80::1

## /etc/network/interfaces — dedicated server example
# Loopback-Adapter
auto lo
iface lo inet loopback
#
# IPv6 LAN
auto eth0
iface eth0 inet6 static
  # One IPv6 address out of the /64 subnet
  address 2001:db8:1234::1
  netmask 64
  gateway fe80::1

IPv4 + IPv6

It is expected that both IPv4 and IPv6 will operate side by side for the foreseeable future. To enable dual-stack, merge both configuration blocks and remove any duplicate entries.

/etc/network/interfaces

## /etc/network/interfaces — dedicated server example
# Loopback-Adapter
auto lo
iface lo inet loopback
#
# LAN interface
auto eth0
iface eth0 inet static
  # Main IP address of the server
  address 192.168.0.250
  # Netmask 255.255.255.255 (/32) independent from the
  # real subnet size (e.g. /27)
  netmask 255.255.255.255
  # explicit host route to the gateway
  gateway 192.168.0.1
  pointopoint 192.168.0.1
#
iface eth0 inet6 static
  # one IPv6 address from assigned subnet
  address 2001:db8:1234::1
  netmask 64
  gateway fe80::1

netplan

Netplan configuration for Ubuntu 22.04 and later or netplan 1.03+:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      addresses:
      - 192.168.0.250/32
      - 2001:db8:1234::1/64
      routes:
      - to: default
        via: 192.168.0.1
        on-link: true
      - to: default
        via: fe80::1

Configuration for Ubuntu 21.04 and earlier:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      addresses:
      - 192.168.0.250/32
      - 2001:db8:1234::1/64
      routes:
      - to: 0.0.0.0/0
        via: 192.168.0.1
        on-link: true
      gateway6: fe80::1

Additional IP Addresses (Host)

Up to 6 extra single IP addresses can be ordered for dedicated servers. The network setup is similar in both scenarios.

To use the additional addresses directly on the server (without virtualization), the iproute2 package and the ip utility are required. Configuring through alias interfaces (e.g. eth0:1, eth0:2, etc.) is deprecated and should no longer be used. To add an address, run:

ip addr add 10.4.2.1/32 dev eth0

The ip addr command displays currently active IP addresses. Since the server occupies the entire subnet, it is advisable to add addresses with a /32 prefix (netmask 255.255.255.255).

/etc/network/interfaces

In /etc/network/interfaces, insert the following two lines under the relevant interface (e.g. eth0):

up ip addr add 10.4.2.1/32 dev eth0
down ip addr del 10.4.2.1/32 dev eth0

The up and down directives each accept a single line of shell code and can be repeated for multiple addresses. The downside is that the interface name and address must be specified twice. With many IPs, the configuration file becomes unwieldy and error-prone. Any data change requires updating all related entries.

netplan

With netplan, simply append the additional IP addresses as /32 entries to the addresses section.

Additional IP Addresses (Virtualization)

In a virtualized environment, additional IP addresses are assigned to guest systems. To make them reachable from the Internet, packet forwarding must be configured on the host. For single additional IPs there are two approaches: routed and bridged.

Routed (brouter)

In this setup, packets are routed. You need to create an additional bridge with nearly the same configuration (without a gateway) as eth0.

Host:

auto eth0
iface eth0 inet static
   address (Main IP)
   netmask 255.255.255.255
   pointopoint (Gateway IP)
   gateway (Gateway IP)
#
iface eth0 inet6 static
  address 2001:db8:1234::1
  netmask 128
  gateway fe80::1
#
auto virbr1
iface virbr1 inet static
   address (Main IP)
   netmask 255.255.255.255
   bridge_ports none
   bridge_stp off
   bridge_fd 0
   pre-up brctl addbr virbr1
   up ip route add (Additional IP)/32 dev virbr1
   down ip route del (Additional IP)/32 dev virbr1
 #
 iface virbr1 inet6 static
   address 2a01:4f8:XX:YY::1
   netmask 64

A corresponding host route must be created for every additional IP address. For IPv4, the eth0 configuration stays the same. For IPv6, the prefix must be reduced from /64 to /128.

Guest:

auto eth0
iface eth0 inet static
   address (Additional IP)
   netmask 255.255.255.255
   pointopoint (Main IP)
   gateway (Main IP)
#
iface eth0 inet6 static
  address 2a01:4f8:XX:YY::4
  netmask 64
  gateway 2a01:4f8:XX:YY::1

Bridged

With a bridged setup, packets are forwarded directly. The guest system appears as an independent machine on the network. Because the guest’s MAC addresses become visible externally, a virtual MAC address must be requested for each single IP. The address can be generated automatically in the control panel by navigating to the server and clicking the icon next to the additional IP. Then assign the virtual MAC address to the guest’s network adapter. The bridge receives the same configuration as eth0.

# remove or disable configuration for eth0
#auto eth0
#iface eth0 inet static
#
auto  br0
iface br0 inet static
 address (Main IP)
 netmask (like eth0, e.g: 255.255.255.254)
 gateway (same as that for the main IP)
 bridge_hw eth0 (required as of Debian 11 'bulleye')
 bridge_ports eth0
 bridge_stp off
 bridge_fd 1
 bridge_hello 2
 bridge_maxage 12

The eth0 configuration is removed entirely.

Notes on Full Disk Encryption

This section applies to systems that rely on initramfs-tools and use dropbear-initramfs for remote unlocking of full disk encryption.

If DHCP is still active during the initramfs stage, it can be prevented by specifying a static network configuration through the ip= kernel parameter. This parameter can be set directly in the bootloader or stored permanently in the initramfs configuration.

The recommended approach is to set it in /etc/initramfs-tools/initramfs.conf:

[...]
#
# DEVICE: ...
#
# Specify static network configuration for initramfs
# This maps to the kernel ip= parameter
#

#DEVICE=
IP=10.0.0.168::10.0.0.129:255.255.255.255::enp7s0:none:185.12.64.1:185.12.64.2:213.239.239.164

The complete syntax for the IP parameter is documented here: https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt

Any unused fields must be represented by empty placeholders.

To prevent the generated configuration from being carried over into the running system, it is advisable to clean it up when dropbear exits. This can be done by appending a line to the dropbear-initramfs config:

echo -e "rm /run/net-*.conf\nrm /run/netplan/*.yaml" >> /etc/dropbear-initramfs/config

(as referenced in Launchpad Bug #1813394).

Afterwards, the initramfs must be rebuilt:

update-initramfs -u

This also speeds up boot time by eliminating the wait for DHCP responses.

Newer Windows Server: Switching from DHCP to static IP
Back to list
Older Network configuration using systemd-networkd