44Net Connect/Routed Subnet/Fedora RHEL Rocky CentOS

This guide is for Fedora, Red Hat Enterprise Linux, Rocky, and CentOS Stream devices. For brevity, the rest of this article will just say Fedora.

Prerequisites

Set up a single-device tunnel to your Fedora device. Note the IP and name of your WireGuard interface. The name of your WireGuard interface is the same as the name of your config file. For example, if your config file is /etc/wireguard/wg0.conf, then your interface name is wg0. The IP of your WireGuard interface can be obtained from running ifconfig <interface> and finding the IP listed under the interface in the inet field.

Below is some example output of ifconfig wg0.

wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP>  mtu 1380
    inet 44.27.133.190  netmask 255.255.255.255  destination 44.27.133.190
    inet6 fe80::f728:a0b0:3af5:b5c6  prefixlen 128  scopeid 0x20<link>
    unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
    RX packets 17331  bytes 5865364 (5.5 MiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 13389  bytes 2146828 (2.0 MiB)
    TX errors 0  dropped 1 overruns 0  carrier 0  collisions 0

Request a Subnet

Go to the Network tab of 44Net Connect, and request a network. Requests up to a /28 (16 IPs) are automatically approved. It's recommended to request at least a /29 (8 IPs), since at least 3 of your IPs must be set aside for network address, broadcast address, and the address of the subnet's interface on your router. That way, you have at least 6 usable addresses for your hosts.

Setting Up The Network Interface

The recommended way to set up a Linux device as the router for your subnet is with two ethernet interfaces. The second can be provided by a USB ethernet adapter if your router's motherboard doesn't have multiple ports on its NIC or via a PCIe card. This section has the steps that are required regardless of whether you're using ethernet or WiFi. If you're using WiFi, you'll also need the steps in the following section. Otherwise, you can skip them.

Step 1: Create a new connection in nmcli

nmcli is the CLI interface for NetworkManager, which is the high level network configuration tool included in Fedora and many other Linux distributions. These configuration steps can be completed using the NetworkManager GUI, but many people operate their devices in "headless" mode (without a screen or keyboard) and use SSH to remotely configure it. Thus, this tutorial uses a CLI tool to accommodate that use case. An nmcli "connection" is an abstraction representing a network configuration attached to a device. Create a new connection by running

sudo nmcli con add con-name <name> ifname <interface name> type <type>.

You can name the connection whatever you like, but it's recommended to name it something descriptive. For example, if you're configuring a 44net routed subnet for eth1, you might name it 44net-eth1. The interface name is the name of the interface you're using, as described by ifconfig. The type is either wifi or ethernet. For a WiFi interface, you must also specify the BSSID (network name) by adding the parameter ssid <BSSID> at the end.

Step 2: Configure the IP

Set the IPv4 method to manual using the following command:

sudo nmcli con modify <name> ipv4.method manual

Next, set the IP range for this interface.

sudo nmcli con modify <name> ipv4.address <subnet>

Your subnet should be specified in CIDR notation. At this point, if you're configuring an ethernet interface, you're ready to start it up. If you're configuring a WiFi interface, don't start your interface yet, and move on to the next section for additional configuration.

Step 3: Starting the Interface

First, disable the existing connection, which is likely named netplan-<interface>. If you're using eth1 for your 44net clients, it may look like netplan-eth1. If you are configuring your Fedora machine over SSH, be careful not to deactivate the connection over which your SSH is traveling.

sudo nmcli con down <name of existing connection>

After deactivating the regular connection, activate your new connection. If this succeeds, you're good to go.

sudo nmcli con up <name of new connection>

Firewall Configuration

Fedora comes with firewalld installed and enabled by default. firewalld uses zones to determine the trust level of a connection. On Fedora, all interfaces start in the FedoraWorkstation zone, which is has a default target. The default target drops all traffic except ICMP packets, so it's recommended to move it to another zone that permits your desired traffic or modify the FedoraWorkstation zone. Additionally, the FedoraWorkstation zone blocks traffic on ports below 1024, with the exception of SSH and Samba. Hosting a web server on either of the traditional ports (80 or 443) will require adding services to the FedoraWorkstation zone, or moving the subnet interface to a zone that permits traffic on those ports.