Converting a Debian ifupdown network configuration to netplan

The network configuration system on Debian has always been ifupdown. For some time now Netplan has appeared and seems to be used more and more. I know many people regret this forced change, but that is not the point of this note.

Keep a way back in

A network configuration mistake cuts your SSH access. Before starting, know how to reboot the server in rescue mode: it is the only way to take back control afterwards.

1. Install Netplan first

bash

apt update
apt install netplan.io

2. Then prepare the Netplan configuration

Get the name and the MAC address of the interfaces:

bash

ip link

Here is an example at OVHcloud, with an instance connected to a VRACK on top of the external network. Put in the assigned IPv6 if there is one, the MAC addresses and the right network interface names:

/etc/netplan/50-cloud-init.yaml:

yaml

network:
    version: 2
    ethernets:
        ens3:
            accept-ra: false
            addresses:
            - 2001:xxx/56
            dhcp4: true
            match:
                macaddress: xxx1
            mtu: 1500
            nameservers:
                addresses:
                - 213.186.33.99
                search: []
            routes:
            -   to: ::/0
                via: 2001:xxx::1
            set-name: ens3
        ens7:
            dhcp4: true
            dhcp4-overrides:
                use-routes: false
            match:
                macaddress: xxx2
            set-name: ens7

3. File permissions, enabling networkd and testing

Fix the permissions of the yaml file (netplan refuses a world readable file):

bash

chmod 0600 /etc/netplan/50-cloud-init.yaml

Validate the syntax and generate the networkd configuration (without applying anything):

bash

netplan generate

Enable systemd-networkd before the test. Otherwise netplan try warns that networkd is not started, falls back to a "hard restart", and its automatic rollback is not reliable:

bash

systemctl enable --now systemd-networkd

Important

On a remote server, keep a console / rescue access (OVHcloud) open before switching over: a network mistake can cut your SSH session.

Test the configuration:

bash

netplan try

It offers to apply it: confirm if you have not lost the connection. Otherwise touch nothing, it reverts to the old configuration on its own once the timer runs out.

4. Check the configuration

First check that networkd is indeed enabled at boot (otherwise the network will not come back on the next reboot):

bash

systemctl is-enabled systemd-networkd   # must answer: enabled

Then the state of the interfaces:

bash

netplan status --all

     Online state: offline
    DNS Addresses: 213.186.33.99
                   xxx
                   xxx
       DNS Search: openstacklocal

●  1: lo ethernet UNKNOWN/UP (unmanaged)
      MAC Address: 00:00:00:00:00:00
        Addresses: 127.0.0.1/8
                   ::1/128

●  2: ens3 ethernet UP (networkd: ens3)
      MAC Address: xxx
        Addresses: xxx/32 (dynamic, dhcp)
                   2001:xxx/56
                   fe80::xxx/64 (link)
           Routes: default via xxx from xxx metric 100 (dhcp)
                   xxx from xxx metric 100 (dhcp, link)
                   213.186.33.99 via xxx from xxx metric 100 (dhcp)
                   2001:xxx::/56 metric 256
                   fe80::/64 metric 256
                   default via 2001:xxx::1 metric 1024 (static)

●  3: ens7 ethernet UP (networkd: ens7)
      MAC Address: xxx
        Addresses: xxx/16 (dynamic, dhcp)
                   fe80::xxx/64 (link)
           Routes: xxx/16 from xxx metric 100 (link)
                   xxx from xxx metric 100 (dhcp, link)
                   xxx from xxx metric 100 (dhcp, link)
                   fe80::/64 metric 256

5. Purge the old configuration

bash

apt purge ifupdown
apt purge resolvconf

Important

apt purge resolvconf stops the updates of /etc/resolv.conf. Move on to step 6 immediately (either a static resolv.conf or systemd-resolved), otherwise you have no DNS in between.

6. (optional) Install support for the resolvers known to systemd-networkd

If systemd-networkd is not installed, the /etc/resolv.conf file is a normal file that must contain the right DNS to use, for example:

nameserver 213.186.33.99

That file will therefore not be updated from whatever the netplan says, because we had to remove resolvconf, which is of no use any more.

So we install the new systemd-resolved package, which takes care of pointing resolv.conf at itself and uses the DNS servers it received on its side:

bash

apt install systemd-resolved

To look at the DNS configuration:

bash

networkctl status

● Interfaces: 1, 2, 3
       State: routable
Online state: online
     Address: xxx on ens3
              xxx on ens7
              2001:xxx on ens3
              fe80::xxx on ens3
              fe80::xxx on ens7
     Gateway: xxx on ens3
              2001:xxx::1 on ens3
         DNS: 213.186.33.99
              xxx
              xxx