Understanding Network Fundamentals

Network problems usually result from a lack of understanding of the underlying concepts rather than from faulty tools. Containers cannot reach each other because port mapping and network namespaces are not fully understood. UFW blocks Docker containers because iptables chains and interface binding are unfamiliar. DNS resolution fails because the interaction between /etc/resolv.conf and systemd-resolved is unclear.

This article series explains the technical fundamentals without distribution-specific details. IP addresses work the same way on Debian as they do on OpenBSD—only the configuration tools differ. SSH keys use identical cryptography regardless of the operating system. Firewall concepts remain the same whether you use iptables, ufw, or pf.

What Does Understanding Networking Mean?

Every network service listens on specific ports bound to defined IP addresses. A web server on 192.168.1.100:80 accepts HTTP connections only from clients that can reach that exact combination. Routing tables determine which network path is used for outgoing packets. DNS translates human-readable names into numeric IP addresses—a translation service and nothing more.

The TCP/IP stack operates in layers. Ethernet frames transport IP packets, which in turn contain TCP segments or UDP datagrams. Each layer adds its own headers and removes them again on the receiving side. This encapsulation makes it possible for HTTP requests to travel across different physical media—from Ethernet to Wi-Fi to fiber optics.

Modern Linux systems use Netfilter for packet filtering. Every network packet passes through defined hooks: PREROUTING, INPUT, FORWARD, OUTPUT, and POSTROUTING. Tools such as iptables, ufw, and firewalld are simply different interfaces to the same kernel infrastructure. Docker modifies these rules automatically—without understanding the Netfilter architecture, container networking problems remain difficult to solve.

The Systematic Structure

Network namespaces (isolated networking environments) separate network stacks from one another. Every Docker container runs in its own namespace with a separate routing table, its own interfaces, and independent firewall rules. Bridge networks connect these namespaces through virtual Ethernet pairs (veth). This explains why containerized services are sometimes reachable from the host but not from other containers.

SSH connections are based on public-key cryptography. The client proves its identity with a digital signature created using its private key—the server verifies it with the corresponding public key. This process works without transmitting passwords and remains secure even across compromised network connections. SSH Agent stores decrypted private keys in memory, allowing convenient use without repeatedly entering a passphrase.

Reverse proxies terminate incoming connections and establish new connections to backend services. Nginx receives HTTPS requests on port 443, decrypts them, and forwards HTTP requests to local services listening on other ports. This architecture enables SSL termination, load balancing, and domain-based routing through a single public IP address.

Who Is This Series For?

These articles are intended for technically interested readers who want to understand networking fundamentals. Previous Linux experience is helpful but not required.

Docker users who want to understand container networking challenges. Why does port mapping sometimes fail? Why can’t services reach each other? How can UFW and Docker conflicts be resolved systematically?

System administrators who want to understand different networking configurations. Which configuration files take precedence? How does DNS resolution work in different environments? What distinguishes systemd-networkd from traditional approaches?

Business owners who want to build secure network infrastructures. How do you configure secure access? Which firewall strategies protect services without reducing usability? How do you monitor network traffic systematically?

Security-conscious users who want to understand different firewall concepts. Packet Filter (pf) works differently from iptables—but the underlying networking principles remain identical.

Overview of the 6 Articles

Fundamental Concepts

IP Addresses and Ports: The Foundation of Self-Hosting

IPv4/IPv6 addressing, port ranges, subnet calculations, and routing fundamentals. The foundation for all network services.

Read Article

DNS and Domains: Name Resolution and Local Servers

Name resolution, resolver configuration, local DNS servers, and alternative DNS strategies for greater independence.

Read Article

Secure Connections

SSH Keys: Secure Connections Without Passwords

Public-key cryptography, SSH Agent, key management, and secure authentication using cryptographic keys.

Read Article

SSH for Multiple Servers: Efficient Administration

SSH configuration management, ProxyJump, bastion hosts, and efficient administration of larger infrastructures.

Read Article

Filtering and Forwarding

Firewall Principles: Packet Filtering and Connection Tracking

Packet filtering, stateful filtering, Netfilter and pf design philosophies, Docker integration, and firewall concepts.

Read Article

Understanding Reverse Proxies: Fundamentals of Service Consolidation

SSL termination, domain-based routing, and backend communication for service consolidation and secure self-hosting architectures.

Read Article

Technical Focus and Scope

This series focuses on networking concepts that apply across operating systems. These fundamentals apply equally to Debian, OpenBSD, Arch Linux, and other Unix-like systems.

Core topics covered:

• TCP/IP stack and the OSI layer model
• IPv4/IPv6 addressing and subnetting
• DNS hierarchy and resolver mechanisms
• SSH protocol and public-key infrastructure
• Netfilter framework and packet filtering
• HTTP proxy concepts and SSL/TLS termination

Related fundamental series:

These networking fundamentals provide the foundation for more specialized topics:

• Container Networks: Docker Bridge, overlay networks, and service discovery (planned)
• VPN Technologies: Secure connections, tunneling protocols, and site-to-site networking (planned)
• Monitoring Strategies: Network metrics, traffic analysis, and performance monitoring (planned)

Operating system-specific implementations:

• Debian: /etc/network/interfaces, systemd-networkd, and UFW configuration (planned)
• OpenBSD: hostname.if, pf.conf, and rcctl integration (planned)
• Arch: netctl, systemd-networkd, and iptables management (planned)

Typical Service Integration

These networking fundamentals enable systematic service configuration. A typical self-hosting setup uses:

• Port 22: SSH for secure server administration
• Ports 80/443: HTTP/HTTPS through a reverse proxy for public services
• Ports 25/587: SMTP for sending email (Listmonk)
• Port 8448: Matrix federation for decentralized communication
• Internal ports: PostgreSQL (5432) and Redis (6379) accessible only from localhost

Nginx terminates SSL on port 443 and forwards requests to backend services based on the domain name: plausible.example.com → port 8000, matrix.example.com → port 8008. Firewall rules block direct external access to backend ports.

Structured Progression and Reference Function

Each article builds systematically on the previous ones while also serving as a standalone reference. Later service installation guides refer directly to the relevant foundational articles:

“The IP address and port fundamentals from Article 1 explain why this service listens on 127.0.0.1:8080.”

“The SSH key management concepts from Article 3 explain how secure server access works without passwords.”

“The reverse proxy concepts from Article 6 enable SSL termination for all self-hosting services.”

This structure avoids redundancy between the foundational articles and the service-specific guides. The networking concepts provide a solid foundation for solving problems independently.