CresignSys Learn

CresignSys Learn — Lesson 047

Written by

cresignsys

in

Linux Networking From the Absolute Basics

We now move underneath Nginx.

So far you understand:

Browser
 ↓
DNS
 ↓
IP
 ↓
TCP
 ↓
TLS
 ↓
HTTP
 ↓
Nginx
 ↓
PHP-FPM
 ↓
WordPress
 ↓
MySQL

But an important question remains:

How does the Internet actually reach your Ubuntu VPS?

The answer involves:

Network Interface
IP Address
MAC Address
Subnet
Gateway
Routing
Ports
Sockets
TCP
UDP
Firewall
VNIC
Cloud Security Rules

1. Start With the Simplest Idea

A network allows computers to communicate.

For example:

Computer A
    │
    │ network
    ▼
Computer B

On the Internet:

Your Browser
     │
     ▼
Internet
     │
     ▼
Your VPS

2. Your VPS Is a Computer

Your Oracle Cloud VM is simply a computer running remotely.

Conceptually:

Oracle Cloud VM
│
├── CPU
├── RAM
├── Disk
├── Network interface
└── Ubuntu

The network interface connects the VM to the network.

3. Network Interface

A network interface is the component through which the operating system communicates over a network.

On Linux you may see interfaces such as:

ens3
eth0
lo

The exact name depends on the system.

4. lo

You will commonly see:

lo

This means:

Loopback

It represents the local machine itself.

Its common IPv4 address is:

127.0.0.1

5. What Is 127.0.0.1?

When a program connects to:

127.0.0.1

it is communicating with the same machine.

For example:

Nginx
 ↓
127.0.0.1
 ↓
local service

No external Internet connection is required.

6. Why This Matters to Your Server

Your server may have:

Nginx
PHP-FPM
MySQL

all running on the same VM.

They can communicate locally.

For example:

WordPress
 ↓
MySQL

may use:

localhost

instead of going through the public Internet.

7. IP Address

An IP address identifies a network endpoint.

Example IPv4:

203.0.113.25

IPv4 has four numeric sections.

Conceptually:

203 . 0 . 113 . 25

Each section is an octet.

8. Private vs Public IP

An IP can be:

Public

or:

Private

A public IP is reachable through the public Internet subject to routing and firewall rules.

A private IP is intended for private network communication.

9. Private IPv4 Ranges

Common private IPv4 ranges include:

10.0.0.0/8

172.16.0.0/12

192.168.0.0/16

For example:

10.0.0.15

is a private address.

10. Your Cloud VM

A cloud VM commonly has a private address inside the cloud network.

It may also have a public IP associated with its networking configuration.

Conceptually:

Internet
   ↓
Public IP
   ↓
Cloud networking
   ↓
Private IP
   ↓
Ubuntu VM

The exact Oracle Cloud networking configuration determines the details.

11. VNIC

In Oracle Cloud, a VM uses a:

VNIC

Virtual Network Interface Card.

Think of it as the VM’s virtual network adapter.

Conceptually:

Oracle Cloud VM
      │
      ▼
     VNIC
      │
      ▼
Virtual Cloud Network

12. VCN

Oracle Cloud uses:

VCN — Virtual Cloud Network

It provides the networking environment for your cloud resources.

Conceptually:

VCN
│
├── Subnet
├── Route table
├── Security rules
└── Network resources

13. Subnet

A subnet is a logical portion of an IP network.

Imagine:

VCN
│
└── Subnet
      │
      ├── VM A
      ├── VM B
      └── VM C

Each resource gets an IP address appropriate to that subnet.

14. CIDR

You will frequently see something like:

10.0.0.0/24

This is CIDR notation.

CIDR means:

Classless Inter-Domain Routing

15. Understanding /24

For:

10.0.0.0/24

the /24 means the first 24 bits represent the network portion.

The remaining 8 bits represent host addresses.

A /24 contains:

256 total IPv4 addresses

although not every address is necessarily assignable to a host depending on the networking environment.

16. /16

For example:

10.0.0.0/16

has:

65,536 total IPv4 addresses

Again, usable host allocation depends on the network platform and reserved addresses.

17. Why CIDR Matters

Suppose your VM has:

10.0.0.25

and the subnet is:

10.0.0.0/24

The system knows that:

10.0.0.x

belongs to the local subnet.

18. Network and Host

For:

10.0.0.25/24

conceptually:

Network:
10.0.0.0

Host:
25

The actual binary calculation is what determines this.

19. Binary

Computers ultimately work with bits.

An IPv4 address is:

32 bits

For example:

10.0.0.25

is represented internally as four 8-bit values.

20. Why Learn Binary?

You don’t need to convert every address manually.

But understanding binary helps explain:

subnets
CIDR
routing
network masks
IP ranges

21. Subnet Mask

The /24 corresponds to:

255.255.255.0

So:

10.0.0.25/24

can also be represented as:

10.0.0.25
255.255.255.0

22. Default Gateway

Suppose your VM wants to communicate outside its local subnet.

It needs a route toward the outside network.

This commonly involves a:

Default Gateway

Conceptually:

VM
 ↓
Default Gateway
 ↓
Internet

23. Routing

Routing answers:

Where should this packet go next?

Imagine:

VM
 ↓
Router A
 ↓
Router B
 ↓
Router C
 ↓
Destination

Each router makes forwarding decisions.

24. Routing Table

Linux maintains a routing table.

Check it with:

ip route

You might see something conceptually like:

default via 10.0.0.1 dev ens3
10.0.0.0/24 dev ens3

The exact output on your VM will differ.

25. Meaning of default

A route such as:

default via 10.0.0.1

means approximately:

For destinations that don’t match a more specific route, send traffic through this gateway.

26. More Specific Routes Win

Suppose:

10.0.0.0/24

and:

default

both exist.

For destination:

10.0.0.50

the /24 route is more specific.

So Linux uses it instead of the default route.

27. Routing Example

Imagine:

Destination:
10.0.0.50

Linux checks:

Do I have a route for 10.0.0.0/24?

Yes.

So:

send through local interface

28. Internet Destination

Now:

Destination:
8.8.8.8

If there isn’t a more specific route:

8.8.8.8
 ↓
default route
 ↓
gateway

29. ip addr

To inspect network interfaces:

ip addr

or:

ip a

You’ll see:

lo
ens3

and IP addresses associated with them.

30. Example

Conceptually:

2: ens3:
    inet 10.0.0.25/24

This means the interface has:

IP:
10.0.0.25

Prefix:
24

31. ip link

To inspect interfaces:

ip link

This shows information about network links.

32. Interface State

You might see:

state UP

or:

state DOWN

If the interface is down, networking through that interface won’t work normally.

33. MAC Address

Network interfaces have a:

MAC address

Example format:

02:42:ac:11:00:02

A MAC address operates at the data-link layer.

It is different from an IP address.

34. IP vs MAC

Think:

IP
=
logical network addressing
MAC
=
link-layer interface address

Simplified:

IP
 ↓
Where is the destination?

MAC
 ↓
Which local network interface?

35. Ethernet

On traditional local networks, devices communicate using Ethernet frames.

Conceptually:

Application
 ↓
TCP
 ↓
IP
 ↓
Ethernet
 ↓
Network interface

36. Packets vs Frames

A useful distinction:

IP
=
packet
Ethernet
=
frame

The terminology changes by networking layer.

37. ARP

For IPv4 local networks, a system may need to discover:

Which MAC address corresponds to this local IP?

This involves:

ARP

Address Resolution Protocol.

Conceptually:

IP address
 ↓
ARP
 ↓
MAC address

38. Example

Suppose your machine needs to communicate with:

10.0.0.1

It may ask:

Who has 10.0.0.1?

The device using that IP can respond with its MAC address.

39. Cloud Networking Is More Abstract

In Oracle Cloud, you don’t manually manage physical Ethernet switches.

OCI provides virtualized networking.

So you should think:

Physical infrastructure
       ↓
OCI virtualization
       ↓
VNIC
       ↓
VCN
       ↓
Subnet
       ↓
VM

40. Port

An IP address identifies a network endpoint.

A:

Port

identifies a service endpoint on that host.

For example:

203.0.113.25:443

means:

IP:
203.0.113.25

Port:
443

41. Why Ports Exist

One server can run many services.

For example:

Server
│
├── SSH :22
├── HTTP :80
├── HTTPS :443
├── MySQL :3306
└── Other services

The port tells the operating system which application should receive the connection.

42. Port 22

Usually:

22
=
SSH

You use SSH to administer your server.

43. Port 80

Usually:

80
=
HTTP

Your web server listens here for ordinary HTTP traffic.

44. Port 443

Usually:

443
=
HTTPS

Your HTTPS websites normally use this port.

45. Port 3306

Conventionally:

3306
=
MySQL

But MySQL can be configured to use another port.

For security, a database usually should not be exposed publicly unless there is a specific reason and appropriate controls.

46. Socket

A socket is an endpoint for network communication.

Conceptually:

IP + Port + Protocol

identifies a network communication endpoint.

For example:

10.0.0.25:443

47. Server Listening

When Nginx is configured for HTTPS:

Nginx
 ↓
listen
 ↓
443

It opens a listening socket.

Conceptually:

0.0.0.0:443

means listening on port 443 on all suitable IPv4 interfaces.

48. ss

A very useful Linux networking command is:

ss -tulpn

It can show listening TCP/UDP sockets and associated processes, subject to permissions.

49. Example

You may see:

LISTEN
0.0.0.0:22

meaning SSH is listening on IPv4 port 22.

And:

LISTEN
0.0.0.0:80

meaning something such as Nginx is listening on port 80.

50. Check Web Ports

You can use:

sudo ss -ltnp

This focuses on TCP listening sockets.

Look for:

:80
:443

51. If Nginx Is Running But Port 443 Is Missing

Suppose:

systemctl status nginx

says:

active (running)

but:

sudo ss -ltnp

doesn’t show:

:443

Then HTTPS may not actually be configured/listening.

This illustrates:

Service running ≠ desired port listening.

52. Firewall

Now we reach another major layer.

A firewall controls network traffic according to rules.

Conceptually:

Internet
   ↓
Firewall
   ↓
Server

53. Firewall Rule

A firewall might allow:

TCP 22
TCP 80
TCP 443

and block:

TCP 3306

from the public Internet.

54. Why Multiple Firewall Layers Exist in Cloud Hosting

Your traffic may encounter several security boundaries.

Conceptually:

Internet
 ↓
OCI network security
 ↓
VM network
 ↓
Ubuntu firewall
 ↓
Nginx

So opening a port in only one layer may not be enough.

55. Oracle Cloud Security Rules

OCI networking can use security controls such as:

Security Lists

and:

Network Security Groups

These determine which traffic can reach resources according to the configured rules.

The exact setup depends on your VCN/subnet design.

56. Example HTTPS Rule

You might configure an inbound rule allowing:

Protocol:
TCP

Destination port:
443

Source:
0.0.0.0/0

Conceptually:

Internet
 ↓
TCP 443
 ↓
allowed
 ↓
VM

57. What Does 0.0.0.0/0 Mean?

It means:

all IPv4 addresses

So:

Source = 0.0.0.0/0

means the rule can apply to traffic originating from anywhere on IPv4, subject to the rest of the rule.

58. Why SSH Should Be Treated Differently

A common rule:

TCP 22
Source: 0.0.0.0/0

allows SSH from anywhere on the Internet.

That may be convenient, but it increases exposure.

A stronger approach is to restrict SSH to trusted source IPs or use other controlled access mechanisms where practical.

59. Web Ports Are Different

For a public website:

80
443

normally need to be reachable by Internet users.

So:

TCP 443
Source:
Internet

is normal for a public HTTPS website.

60. MySQL Should Usually Stay Private

For a single-server WordPress installation:

Internet
     X
     ↓
MySQL :3306

Instead:

WordPress
 ↓
localhost
 ↓
MySQL

There is usually no reason for the public Internet to connect directly to MySQL.

61. Network Exposure

Think about every listening service:

SSH
HTTP
HTTPS
MySQL
PHP-FPM

Ask:

Does this service actually need to be reachable from the Internet?

Usually:

HTTP → yes
HTTPS → yes
SSH → controlled access
MySQL → no
PHP-FPM → no

62. PHP-FPM Exposure

If PHP-FPM uses:

/run/php/php8.3-fpm.sock

it isn’t exposed as a TCP Internet service.

That’s good.

If PHP-FPM were listening on a public interface unnecessarily, that would create additional exposure.

63. Localhost Binding

A service can sometimes be bound to:

127.0.0.1

rather than:

0.0.0.0

This means it only accepts local connections.

For example:

127.0.0.1:9000

is not directly reachable from remote machines through the normal network path.

64. 0.0.0.0

When a service listens on:

0.0.0.0:80

it generally means it is listening on all IPv4 interfaces on port 80.

That can include the public interface.

65. 127.0.0.1

When a service listens on:

127.0.0.1:9000

it is restricted to local IPv4 connections.

This is an important security concept.

66. IPv6

Not all Internet traffic uses IPv4.

There is also:

IPv6

An IPv6 address might look like:

2001:db8::1234

IPv6 addresses are 128 bits.

67. Why IPv6 Matters

A server may have:

IPv4
+
IPv6

If DNS publishes both:

A record
AAAA record

some clients may connect using IPv6.

68. A Record

DNS:

A

maps a hostname to an IPv4 address.

Example conceptually:

example.com
 ↓
A
 ↓
203.0.113.25

69. AAAA Record

DNS:

AAAA

maps a hostname to an IPv6 address.

Conceptually:

example.com
 ↓
AAAA
 ↓
2001:db8::1234

70. A Common IPv6 Mistake

Suppose:

A
 ↓
correct IPv4

but:

AAAA
 ↓
incorrect IPv6

Some users may experience failures even though IPv4 works correctly.

This is why IPv6 configuration should be deliberate.

71. DNS vs Networking

This distinction is extremely important.

DNS answers:

What IP address corresponds to this hostname?

Networking answers:

Can I actually reach that IP and service?

So:

DNS working

does not guarantee:

website working

72. Example

Suppose:

example.com
 ↓
203.0.113.25

DNS is correct.

But:

TCP 443
 ↓
blocked

The website still won’t load.

73. Another Example

Suppose:

TCP 443
 ↓
allowed

but:

Nginx
 ↓
not listening

Still no working HTTPS website.

74. Another Example

Suppose:

Nginx
 ↓
443 listening

but:

TLS certificate/configuration
 ↓
broken

HTTPS can still fail.

75. Another Example

Suppose:

HTTPS
 ↓
Nginx
 ↓
PHP-FPM
 ↓
broken

The browser may receive:

502

So each layer must work.

76. Full Connectivity Chain

For:

https://example.com

you can think:

1. DNS
2. IP routing
3. Cloud security rules
4. Ubuntu networking/firewall
5. TCP 443
6. Nginx listening
7. TLS
8. HTTP
9. Application

77. Diagnostic Tool: ping

You may know:

ping example.com

It tests ICMP reachability, not TCP/HTTPS specifically.

A server can block ICMP and still serve HTTPS perfectly.

Therefore:

Ping failure does not automatically mean the website is down.

78. curl

For web testing, curl is much more useful.

Example:

curl -I https://example.com

This asks for HTTP headers.

You might receive:

HTTP/2 200

or:

HTTP/2 301

or:

HTTP/2 502

79. HTTP Status Codes

Some important ones:

200
=
Success

301
=
Permanent redirect

302
=
Temporary redirect

403
=
Forbidden

404
=
Not found

500
=
Application/server error

502
=
Bad gateway

503
=
Service unavailable

80. Test HTTP

curl -I http://example.com

Test HTTPS:

curl -I https://example.com

This lets you test from the server or another machine without relying on the browser UI.

81. Test DNS

dig example.com

or:

nslookup example.com

You previously used:

nslookup domain 8.8.8.8

This checks DNS resolution through Google’s DNS resolver.

82. Test Port Connectivity

From another machine:

nc -vz example.com 443

This can test whether TCP port 443 is reachable.

Alternatively:

nc -vz example.com 80

83. ss vs nc

Remember:

ss
=
what is listening locally?
nc
=
can I connect to this remote port?

So:

Local diagnosis
 ↓
ss

and:

Remote connectivity
 ↓
nc

84. curl vs nc

nc tests TCP connectivity.

curl goes further and tests the HTTP protocol.

So:

nc
=
Can I establish TCP?

curl
=
Can I communicate using HTTP/HTTPS?

85. A Practical Website Diagnostic

Suppose:

https://example.com

doesn’t load.

Use this order:

DNS
 ↓
TCP
 ↓
TLS
 ↓
HTTP
 ↓
Nginx
 ↓
PHP
 ↓
WordPress
 ↓
MySQL

86. Step 1 — DNS

dig +short example.com

Confirm the expected IP.

87. Step 2 — Local Port

On the VPS:

sudo ss -ltnp | grep ':443'

Confirm something is listening.

88. Step 3 — Local HTTP Test

From the server:

curl -I https://example.com

If this works locally but not externally, suspect:

cloud firewall
routing
security rules
public IP
DNS

89. Step 4 — Nginx

sudo systemctl status nginx

Then:

sudo nginx -t

90. Step 5 — Logs

sudo tail -f /var/log/nginx/error.log

Then make a request.

91. Step 6 — PHP-FPM

systemctl status php8.3-fpm

Replace the version appropriately.

92. Step 7 — MySQL

sudo systemctl status mysql

Then verify database connectivity if necessary.

93. This Is Layered Troubleshooting

Never immediately change five configuration files.

Instead:

Question
 ↓
Test
 ↓
Evidence
 ↓
Next layer

For example:

Does DNS resolve?
     ↓
YES
     ↓
Does TCP 443 connect?
     ↓
YES
     ↓
Does TLS work?
     ↓
YES
     ↓
Does Nginx respond?
     ↓
YES
     ↓
Does PHP work?

This prevents random troubleshooting.

94. Oracle Cloud Architecture

Your environment can be visualized as:

                         INTERNET
                            │
                            ▼
                     Public IP / DNS
                            │
                            ▼
                    Oracle Cloud VCN
                            │
                            ▼
                         Subnet
                            │
                            ▼
                          VNIC
                            │
                            ▼
                      Ubuntu VM
                            │
              ┌─────────────┼─────────────┐
              ▼             ▼             ▼
             SSH           Nginx        Other
             :22           :80/:443     services
                            │
                            ▼
                       PHP-FPM
                            │
                            ▼
                         MySQL

The actual OCI topology can be more detailed, but this is the foundational model.

95. Cloud Security Layer

Think:

Internet
 ↓
OCI security rules
 ↓
VNIC
 ↓
Ubuntu
 ↓
local firewall
 ↓
service

A connection can be blocked before it reaches Nginx.

96. Ubuntu Firewall

Ubuntu systems may use:

UFW

Uncomplicated Firewall.

Check:

sudo ufw status

You might see rules such as:

22/tcp
80/tcp
443/tcp

97. Important: UFW May Not Be Your Only Firewall

Cloud security rules and UFW are separate layers.

For example:

OCI allows 443

but:

UFW blocks 443

The connection can still fail.

Likewise:

UFW allows 443

but:

OCI blocks 443

It can still fail.

98. Two-Gate Model

Think:

Internet
   ↓
[ OCI security ]
   ↓
[ Ubuntu firewall ]
   ↓
[ Nginx ]

Traffic must pass all applicable controls.

99. Why This Explains Many Hosting Problems

Suppose you install Nginx correctly.

Nginx ✓

But forget cloud ingress:

OCI security ✗

Result:

Website inaccessible

You might incorrectly think:

Nginx is broken.

It isn’t.

The packet never reached it.

100. Another Example

Suppose:

OCI ✓
UFW ✓
Nginx ✗

Then:

TCP connection
 ↓
Nginx unavailable

The service layer is the problem.

101. Another Example

Suppose:

OCI ✓
UFW ✓
Nginx ✓
PHP-FPM ✗

Then:

Static files
 ↓
may work

PHP
 ↓
502/error

102. Another Example

Suppose:

Everything above works
 ↓
MySQL ✗

Then:

WordPress
 ↓
database error

103. The Layer Model

You should now start thinking like a server administrator:

Layer 1
DNS

Layer 2
Network routing

Layer 3
Cloud security

Layer 4
TCP/UDP

Layer 5
Ubuntu firewall

Layer 6
Nginx

Layer 7
TLS/HTTP

Layer 8
PHP-FPM

Layer 9
WordPress

Layer 10
MySQL

This is a simplified operational model, not a strict OSI-layer mapping.

104. Important Commands

Start memorizing these:

Network interfaces

ip addr

Routes

ip route

Listening services

sudo ss -ltnp

DNS

dig example.com

HTTP test

curl -I https://example.com

Firewall

sudo ufw status

Nginx

sudo systemctl status nginx

Nginx configuration

sudo nginx -t

105. One Powerful Mental Model

When a user says:

“My website is not opening.”

Don’t immediately think:

WordPress problem

Think:

                    Website unavailable
                           │
             ┌─────────────┼─────────────┐
             ▼             ▼             ▼
            DNS          Network       Application
             │             │             │
             ▼             ▼             ▼
          IP correct?    Port 443?     Nginx?
                                       PHP?
                                       WordPress?
                                       MySQL?

Then test each layer.

106. The Full Journey

A user types:

https://learn.cresignsys.com

The request travels conceptually:

Browser
   │
   ▼
DNS Resolver
   │
   ▼
DNS authoritative infrastructure
   │
   ▼
IP address
   │
   ▼
Internet routers
   │
   ▼
OCI network
   │
   ▼
VCN
   │
   ▼
Subnet
   │
   ▼
VNIC
   │
   ▼
Ubuntu
   │
   ▼
TCP :443
   │
   ▼
Nginx
   │
   ▼
TLS
   │
   ▼
HTTP
   │
   ▼
PHP-FPM
   │
   ▼
WordPress
   │
   ▼
MySQL

107. What You Have Learned So Far

Your learning path has now reached:

BASIC COMPUTER
      ↓
Linux
      ↓
Filesystem
      ↓
Permissions
      ↓
Networking
      ↓
DNS
      ↓
TCP/IP
      ↓
TLS
      ↓
HTTP
      ↓
Nginx
      ↓
PHP-FPM
      ↓
WordPress
      ↓
MySQL
      ↓
InnoDB

This is the foundation of your web-hosting server.

108. Next Level

The next major topic is:

TCP/IP in Depth

We have used TCP repeatedly, but haven’t yet studied what TCP actually does.

We will go deeper into:

TCP
│
├── Connection
├── SYN
├── SYN-ACK
├── ACK
├── Sequence numbers
├── Acknowledgements
├── Retransmission
├── Flow control
├── Congestion control
├── Connection termination
└── TIME_WAIT

Then:

TCP
 ↓
443
 ↓
TLS
 ↓
HTTP

will become completely understandable.

Lesson 047 Summary

The most important concepts:

VNIC
=
virtual network interface

VCN
=
virtual cloud network

Subnet
=
logical IP network segment

Gateway
=
next-hop router for traffic

Routing table
=
rules determining where packets go

IP
=
network-layer addressing

MAC
=
link-layer addressing

Port
=
service endpoint

Socket
=
communication endpoint

Firewall
=
traffic filtering

UFW
=
Ubuntu firewall management tool

A record
=
hostname → IPv4

AAAA record
=
hostname → IPv6

And the most important troubleshooting chain is:

DNS
 ↓
IP
 ↓
Route
 ↓
Cloud security
 ↓
TCP port
 ↓
Ubuntu firewall
 ↓
Nginx
 ↓
TLS
 ↓
HTTP
 ↓
PHP-FPM
 ↓
WordPress
 ↓
MySQL

That chain is the foundation for diagnosing almost every web-hosting problem.

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts