Linux Network Configuration — ip, ifconfig, iptables: Essential Commands for Sysadmins

You have a Linux server and you find yourself typing ifconfig to see the IP, but everyone says it's deprecated. Or you need to open a port for an application and iptables looks like a puzzle. We see this often from people starting with Linux server management: a few commands, lots of confusion. At Meteora Web, we have configured dozens of servers for clients in production – from e-commerce to management software – and we know that a network error can be costly. In this guide we go straight to the point: what to use, how to do it, and why.

What is the difference between ifconfig and ip and why should you switch to ip?

ifconfig was the standard tool for configuring network interfaces on Linux for decades, but it is considered deprecated by many modern distributions. Its successor is the ip command, part of the iproute2 package. The main difference? ip unifies the management of interfaces, routing, tunnels, and more in a single tool, with a more consistent syntax and advanced features.

Concrete advantages of ip over ifconfig

• Built-in support for IPv6, VLANs, bridges, network namespaces.
• More readable and structured output (colors, JSON with -json).
• Included by default on modern systems (Ubuntu, Debian, CentOS).

We switched from ifconfig years ago on our servers: fewer commands to remember, fewer errors. If you still use it, it's time to change.

Operative example:

# Show all interfaces (equivalent to ifconfig -a)
ip addr show

# Show only active interfaces
ip link show up

# Show default route
ip route show default

How to configure a static IP address with the ip command?

Suppose you need to assign a static IP to interface eth0 on a server. With ip the command is immediate, but note: changes are temporary until you make them persistent. We'll cover both steps.

Temporary configuration with ip

# Assign IP 192.168.1.100/24 to interface eth0
sudo ip addr add 192.168.1.100/24 dev eth0

# Bring interface up (if down)
sudo ip link set eth0 up

# Add default route (gateway)
sudo ip route add default via 192.168.1.1

# Verify
ip addr show eth0
ip route show

Persistent configuration (varies by distribution)

On Ubuntu/Debian with Netplan (yaml):

# /etc/netplan/01-netcfg.yaml
network:
  version: 2
  ethernets:
    eth0:
      addresses:
        - 192.168.1.100/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses: [8.8.8.8, 1.1.1.1]

Then apply with sudo netplan apply.

On CentOS/RHEL with ifcfg:

# /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
BOOTPROTO=static
IPADDR=192.168.1.100
NETMASK=255.255.255.0
GATEWAY=192.168.1.1
DNS1=8.8.8.8
ONBOOT=yes

We recommend testing the temporary configuration first, then making it persistent. A mistake can drop your server if you are connected via SSH.

How to manage firewall rules with iptables in a simple way?

iptables is the classic Linux firewall. It may seem complex, but for common operations – opening ports, blocking IPs – a few rules are enough. Note: rules are volatile until you save them. Here's how.

Basic rules

# Default policy: drop all incoming, allow all outgoing
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# Allow established traffic (connections already initiated)
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow SSH (port 22)
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP (80) and HTTPS (443) for a web server
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Block a specific IP
sudo iptables -A INPUT -s 203.0.113.5 -j DROP

# Save rules (on Debian/Ubuntu)
sudo apt install iptables-persistent
sudo netfilter-persistent save

Common mistake to avoid: do not forget the rule for established traffic, otherwise you'll also block responses to your own connections. And remember: after saving, reboot to test.

Which commands to use for diagnosing network problems on Linux?

When the network is not working, you don't need to configure – you need to diagnose. Here are the commands we always use for quick troubleshooting.

Troubleshooting checklist

1. Check interfaces: ip addr show – verify the interface is UP and has an IP address.
2. Test local connectivity: ping -c 4 192.168.1.1 (gateway). If no reply, link or IP configuration issue.
3. Check routes: ip route show – there must be a default route.
4. Test DNS resolution: nslookup google.com or dig google.com.
5. Check listening sockets: ss -tlnp (shows TCP listening ports) – useful to see if a service is listening on the right port.
6. Trace the path: traceroute 8.8.8.8 – find where packets are lost.

A trick we often use: if ping works to the gateway but not to the outside, it is almost always the firewall or DNS. If it doesn't work even to the gateway, the problem is physical or IP configuration.

What to do next

Here are three concrete actions to put what you learned into practice:

1. Replace ifconfig with ip – right now type ip addr show to see your interface. Memorize ip addr add, ip link set, and ip route add.
2. Configure a persistent static IP – choose your distribution method (Netplan or ifcfg) and set a fixed IP. Test by rebooting.
3. Set up basic iptables rules – open only the port of the service you need and block everything else. Save rules with netfilter-persistent save.

If you want to dive into full Linux server management, check out our general guide: Linux for developers and sysadmins. For official details on ip, see the ip man page.