Surviving a reboot
A router that only works until the next power cut isn't finished. Everything here is in files that systemd reads at boot, and the services are enabled, so a reboot should bring the office back with no one logged in.
The lab restarts the router's container, which is the closest a container gets to a power cycle: every process starts again from systemd, and the interfaces are created again. After the restart, systemd-networkd and nftables started at boot, every VLAN is configured with its address, the nftables tables are loaded, staff reach the internet and the guest is still kept off the server.
One thing the lab can't prove: forwarding is back on (ip_forward = 1), but Docker Desktop would have turned it on anyway. On real hardware, it's the sysctl.d file you saw applied in Forwarding that does it, through systemd-sysctl.service early in boot.
(The lab also pins the router's MAC addresses. Without that, Docker gave the restarted container new ones, and the office PCs kept sending to the old MAC address until their ARP entries expired, which a real router's network cards never cause.)
Changing the configuration later
| Change | Apply it with |
|---|---|
A .network or .netdev file | networkctl reload (new and changed files); networkctl reconfigure eth0 to force one link |
/etc/nftables.conf | nft -c -f /etc/nftables.conf && systemctl reload nftables |
/etc/sysctl.d/*.conf | sysctl --system |
A VLAN removed from the files isn't deleted from the running system by a reload; networkctl delete <name> removes it.
root@router:~# systemctl status systemd-networkd nftables --no-pager | grep -E "●|Active:"
● systemd-networkd.service - Network Configuration
Active: active (running) since Wed 2026-11-04 21:59:49 UTC; 11s ago
TriggeredBy: ● systemd-networkd.socket
● nftables.service - nftables
Active: active (exited) since Wed 2026-11-04 21:59:49 UTC; 12s ago
root@router:~# networkctl list eth0 staff guest servers; ip -4 -br addr show
IDX LINK TYPE OPERATIONAL SETUP
12 eth0 ether routable configured
13 staff vlan routable configured
14 guest vlan routable configured
15 servers vlan routable configured
4 links listed.
lo UNKNOWN 127.0.0.1/8
eth0@if5289 UP 203.0.113.2/24
staff@eth1 UP 10.10.10.1/24
guest@eth1 UP 10.10.20.1/24
servers@eth1 UP 10.10.30.1/24
root@router:~# nft list tables; sysctl net.ipv4.ip_forward
table inet filter
table ip nat
net.ipv4.ip_forward = 1
root@staff:~# curl -s -o /dev/null -w "%{http_code}\n" -m 3 http://198.51.100.10/
200
root@guest:~# curl -s -o /dev/null -w "%{http_code}\n" -m 3 http://10.10.30.10/
000- Lines 1–6: networkd and nftables started by themselves at boot.
- Lines 8–20: Every VLAN configured again, with its address.
- Lines 22–25: The firewall is loaded. Forwarding is on (see the note about Docker).
- Lines 27–31: Staff reach the internet; a guest is still kept off the server.