Illustrated Guide To Setting Up IPs For Singapore Servers, Completing Network Segment Routing And Firewall Configuration

Answer: When setting an IP on a cloud host or bare metal in a Singapore data center, first confirm the operating system type and network management tool. Common examples include Ubuntu (using netplan or legacy /etc/network/interfaces) and CentOS (using ifcfg scripts or NetworkManager). Here are some common examples:

Edit /etc/netplan/01-netcfg.yaml:

network: version: 2 renderer: networkd ethernets: eth0: addresses: [203.0.113.25/24] gateway4: 203.0.113.1 nameservers: addresses: [8.8.8.8,8.8.4.4]

After saving, run sudo netplan apply and verify with ip addr and ip route.

Edit /etc/sysconfig/network-scripts/ifcfg-eth0:

DEVICE=eth0 BOOTPROTO=none ONBOOT=yes IPADDR=203.0.113.25 PREFIX=24 GATEWAY=203.0.113.1 DNS1=8.8.8.8

Restart the network: systemctl restart network or use NetworkManager. If the cloud provider provides console IP configuration, please follow the vendor's requirements (such as floating IP binding).

Answer: When the server needs to handle interconnection between multiple network segments or external forwarding, static routing needs to be added. Common scenario: Specifying routing when a machine acts as a router or connects with a host/virtual switch.

Command example: sudo ip route add 198.51.100.0/24 via 203.0.113.2 dev eth1, used to take effect immediately but fail upon restart.

In Ubuntu (netplan), you can add routes: entries under the corresponding network card; CentOS can add: 198.51.100.0/24 via 203.0.113.2 dev eth1 at /etc/sysconfig/network-scripts/route-eth1. Cloud services (such as by bandwidth or security groups) may require static routing or BGP policies in the console.

Make sure kernel forwarding is enabled: sudo sysctl -w net.ipv4.ip_forward=1, and write /etc/sysctl.conf to persist.

Answer: The firewall configuration should be coordinated with network segment routing to prevent unauthorized access and allow legitimate traffic on the network segment. Depending on your system and preferences, you can use iptables, nftables, or ufw.

Allow intranet segments to access specific services while blocking other sources:

sudo iptables -A INPUT -s 198.51.100.0/24 -p tcp --dport 22 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 22 -j DROP

Save rules (Debian:iptables-save > /etc/iptables/rules.v4; CentOS: uses iptables-service or firewalld).

Enable and allow the internal network: sudo ufw allow from 198.51.100.0/24 to any port 80,443, then sudo ufw enable.

Example rule file /etc/nftables.conf:

table inet filter { chain input { type filter hook input priority 0; policy drop; iif "eth1" ip saddr 198.51.100.0/24 tcp dport {22,80,443} accept; ct state established,related accept; } }

Use the sudo nft -f /etc/nftables.conf app.

Answer: Verification and troubleshooting are key steps. It is recommended to follow the slave link > routing > firewall > application for step-by-step inspection.

- Link and IP: ip addr show, ethtool eth0;

- Routing table: ip route show;

- Connectivity testing: ping, traceroute, or tracepath;

- Port listening: ss -tlnp or netstat -tulpn;

- Firewall rule viewing: iptables -L -n -v, nft list ruleset, ufw status verbose;

Use tcpdump to locate packet capture: sudo tcpdump -i eth1 host 198.51.100.5 and port 80 -w /tmp/capture.pcap, then analyze with Wireshark. Check /var/log/syslog, /var/log/messages, or firewall logs to obtain rejected packet information.

Answer: When deploying to Singapore or any overseas data center, pay attention to carrier policies, IP allocation, and security boundaries.

1) Cloud providers may restrict native routing via switches or security groups; be sure to check the console's network topology and routing requirements;

2) Public IP/floating IP binding usually needs to be done in the console, not just at the operating system layer;

3) MTU and link types (such as VLAN, tunnel) affect transmission; adjusting MTUs (such as ip link set dev eth0 mtu 1400) can resolve sharding issues;

4) For production environments, it is recommended to use automation tools (Ansible, Terraform) to manage IP settings, routing, and firewalls, and to incorporate configuration into version control;

5) Security Policy: Enable the minimum required ports, enable logging, and conduct regular audits to prevent conflicts between security groups and local firewall policies.

Before modifying the network and firewall, save the current configuration and prepare the console (remote KVM/console) in case the network is disconnected and remote login is impossible. Configuration changes should be made in the maintenance window and the rollback steps recorded.