Learning path
Build a router in a box with Debian
One Debian machine that becomes the office router, step by step: firewall, VLANs, DHCP and DNS, IPv6, two ISPs, high availability, VPNs, DNS servers and BGP.
- Linux Network ConnectivityBeginner · 80 min
Find out why a Linux machine can't reach something, layer by layer: interfaces and addresses, routes and ip route get, ARP and the neighbour table, ping and traceroute, DNS, and listening sockets — with real output from a three-host lab.
- nftables and iptables on Debian: host and router firewallsIntermediate · 60 min
Build a Debian firewall with nftables, from a host firewall to an office router with NAT and port forwards: safe changes with a timed rollback, sets and maps, logging and packet tracing, and what iptables really is on Debian 13.
- Debian as an office router: interfaces, VLANs and a firewallIntermediate · 45 min
Turn a fresh Debian 13 install into an office router: systemd-networkd for the WAN and three VLANs on one trunk, IP forwarding, an nftables policy between VLANs with NAT, protecting the router itself, and a configuration that survives a reboot.
- DHCP and DNS on the Debian routerIntermediate · 35 min
Add DHCP and DNS to a Debian router with dnsmasq: a range and lease time per VLAN, a reservation, local names from DHCP, a caching forwarder, blocking a domain, the firewall rules it needs, and reading its log when a VLAN gets no address.
- IPv6 on the Debian routerIntermediate · 40 min
Add IPv6 to a Debian router with systemd-networkd: ask the ISP for a /56 by DHCPv6 prefix delegation, give each VLAN a /64 and announce it with router advertisements, firewall it with nftables (including the ICMPv6 IPv6 can't work without), and see what happens when the ISP changes the prefix.
- Two internet connections on DebianIntermediate · 45 min
Give a Debian office router a second ISP: a routing table per ISP, source rules and connection marks so replies leave the way they came, per-ISP NAT, and a systemd health check that fails over and back, measured with a real outage.
- Two Debian routers: VRRP and connection syncIntermediate · 45 min
Pair two Debian 13 routers so the office survives one failing: keepalived VRRP for the gateway and public addresses, conntrackd so open connections survive, NAT to a shared address, health checks, and split brain, all measured in a lab.
- Traffic shaping with CAKE on DebianIntermediate · 40 min
Measure bufferbloat on an office line, then fix it on a Debian 13 router with CAKE: shaping uploads on the WAN and downloads through an IFB, fair shares between hosts, making it permanent with systemd-networkd, and tuning it for your line.
- WireGuard on Debian: users, routing and keysIntermediate · 50 min
Run a WireGuard server on Debian for several users, an office LAN and a branch: keys, wg-quick and systemd, AllowedIPs as routing and access control, split and full tunnels, roaming and keepalives, adding and removing users live, and the silent failures.
- OpenVPN on Debian: users, routing and revocationIntermediate · 60 min
Install and run an OpenVPN server on Debian with your own certificate authority: one certificate per user, fixed addresses, routing to an office and a branch LAN, split and full tunnels, tls-crypt, revoking users, and the mistakes that lock everyone out.
- PowerDNS on Debian: authoritative, secondary, DNSSEC and recursorIntermediate · 60 min
Build a complete DNS service on Debian with PowerDNS: authoritative primary and secondary servers with NOTIFY and AXFR, zones by pdnsutil and the HTTP API, DNSSEC signed all the way from a lab root, and a validating recursor for the office.
- FRR on Debian: a BGP and OSPF routerIntermediate · 55 min
Turn a Debian 13 server into a BGP edge router with FRR from apt: two upstream ISPs, import filters and prepending, OSPF to the office core, routes in the Linux kernel, an nftables firewall for the router itself, measured failover, and the reload and write memory traps.