Linux Networking — From Internet to Nginx

We now move from storage and permissions into the networking layer.

The goal is to understand exactly what happens when someone opens:

https://learn.cresignsys.com

1. The Complete Journey

At a high level:

Browser
   ↓
DNS
   ↓
Public IP
   ↓
Internet
   ↓
Oracle Cloud network
   ↓
VNIC
   ↓
Ubuntu network interface
   ↓
TCP port 443
   ↓
Nginx
   ↓
HTTPS
   ↓
Website

Each layer can fail independently.

2. What Is a Network?

A network allows computers to exchange data.

For example:

Your computer
      │
      │ Internet
      │
      ▼
Oracle VPS

Data travels between the two systems.

3. IP Address

An IP address identifies a network endpoint.

IPv4 example:

203.0.113.25

IPv6 example:

2001:db8::25

Your VPS has network addresses assigned to its interfaces.

4. Private vs Public IP

A server can have:

Private IP

and:

Public IP

The private address is used inside a private network.

The public address is reachable through the Internet, subject to routing and security controls.

5. Example

Conceptually:

Internet
   │
   ▼
Public IP
203.0.113.25
   │
   ▼
Private IP
10.x.x.x
   │
   ▼
Ubuntu

The exact addressing depends on your Oracle Cloud network configuration.

6. Your VNIC

In Oracle Cloud, your VM uses a:

VNIC

Virtual Network Interface Card.

Think of it as the VM’s virtual network adapter.

Conceptually:

Internet
   ↓
OCI Network
   ↓
VNIC
   ↓
Ubuntu

7. Physical NIC vs VNIC

A physical computer may have:

Ethernet card

A cloud VM generally sees a virtual network interface:

VNIC

The cloud provider manages the underlying physical networking.

8. Linux Sees a Network Interface

Inside Ubuntu, you can inspect interfaces with:

ip addr

or:

ip a

You may see something similar to:

lo
ens3

The exact interface name can differ.

9. Loopback

One interface you will usually see is:

lo

This is:

Loopback

It represents the computer talking to itself.

Common address:

127.0.0.1

10. Why 127.0.0.1 Matters

Suppose Nginx listens on:

127.0.0.1:8080

That means it is accessible through the local machine’s loopback interface.

It does not necessarily mean it is directly reachable from the Internet.

11. `0.0.0.0`

You may also see a service listening on:

0.0.0.0:80

This means it is listening on IPv4 interfaces generally, subject to other networking controls.

For example:

0.0.0.0:80

can allow connections arriving through the server’s network interfaces.

12. IPv6 Equivalent

For IPv6, you may see:

[::]:80

This represents listening on IPv6 addresses broadly, subject to configuration.

13. Check Interfaces

Run:

ip addr

Look for:

inet

and:

inet6

Example:

inet 10.0.0.10/24

14. CIDR

The:

/24

is part of:

CIDR notation

CIDR describes the network prefix length.

Example:

10.0.0.10/24

means:

IP = 10.0.0.10
prefix length = 24 bits

15. IPv4 Structure

IPv4 has:

32 bits

Example:

192.168.1.10

It contains four octets:

Each octet is 8 bits.

16. `/24`

A /24 means:

24 bits = network portion
8 bits  = host portion

Conceptually:

192.168.1 | .10
network   | host

17. Don’t Memorize Subnet Math Yet

For now remember:

IP address
+
prefix length
=
network addressing information

We will study subnetting separately.

18. Default Gateway

Your server needs to know where to send traffic that isn’t on its local network.

That is the job of the:

Default Gateway

Check:

ip route

You may see:

default via 10.0.0.1 dev ens3

Conceptually:

Ubuntu
 ↓
default gateway
 ↓
outside network

19. Routing Table

Linux maintains a:

Routing Table

It decides where packets should go.

Check it:

ip route

Example:

10.0.0.0/24 dev ens3
default via 10.0.0.1 dev ens3

20. What Does `default` Mean?

It means:

If no more specific route matches the destination, use this route.

Conceptually:

Destination known locally?
       │
   yes │ no
       ▼
 local route
       │
       └──── no ────► default route

21. Packet

When your browser sends data, it is broken into network packets.

Conceptually:

Message
 ↓
Network data
 ↓
Packets
 ↓
Internet

Each packet contains addressing information needed for delivery.

22. IP Layer

The IP protocol handles addressing and routing between networks.

Conceptually:

Source IP
     ↓
Packet
     ↓
Destination IP

23. TCP

For a typical HTTPS connection, TCP is involved.

TCP provides a reliable, ordered byte stream.

The simplified hierarchy is:

HTTP
 ↓
TLS
 ↓
TCP
 ↓
IP
 ↓
Network interface

24. Port

An IP address identifies a network endpoint.

Port

helps identify the service/application endpoint on that host.

For example:

203.0.113.25:443

means:

IP   = 203.0.113.25
Port = 443

25. Common Ports

You should know:

22   SSH
80   HTTP
443  HTTPS
25   SMTP
53   DNS
3306 MySQL

These are conventional defaults, not laws.

Services can be configured to use other ports.

26. Why Ports Exist

Imagine your VPS has:

Nginx
SSH
MySQL

all running on the same server.

They need different network endpoints.

Conceptually:

VPS
│
├── :22   SSH
├── :80   HTTP
├── :443  HTTPS
└── :3306 MySQL

27. Socket

A network connection is associated with a:

Socket

A simplified endpoint can be thought of as:

IP + protocol + port

For example:

TCP
203.0.113.25
443

28. Listening Socket

When Nginx waits for connections:

Nginx
 ↓
listen
 ↓
TCP :443

It is listening on a socket.

Check:

sudo ss -ltnp

29. Understand `ss`

Example:

LISTEN
0
128
0.0.0.0:443

The important part:

0.0.0.0:443

means something is listening on TCP port 443 on IPv4 interfaces generally.

30. Find Port 80

sudo ss -ltnp | grep ':80'

Find HTTPS:

sudo ss -ltnp | grep ':443'

31. Example

Suppose you see:

LISTEN 0 511 0.0.0.0:443

This suggests:

something
 ↓
listening
 ↓
TCP
 ↓
port 443

Now identify the process using the -p information.

32. Nginx

If the process is:

nginx

then:

Nginx
 ↓
TCP 443

is listening.

That is a good sign.

But it doesn’t prove Internet connectivity yet.

33. Local vs External Testing

Suppose:

curl https://localhost

works.

But:

curl https://your-domain.com

fails.

That means the problem may be somewhere between:

Internet
 ↓
DNS
 ↓
cloud network
 ↓
firewall
 ↓
server

34. Local Test

Run:

curl -I http://127.0.0.1

This tests locally.

If Nginx is listening on port 80, you may receive an HTTP response.

35. HTTPS Local Test

You might use:

curl -kI https://127.0.0.1

The -k option tells curl not to reject an invalid/untrusted certificate during this test.

This is a diagnostic technique, not a recommendation to ignore certificate validation in normal use.

36. Test the Domain

From a client:

curl -I https://learn.cresignsys.com

This tests much more of the actual path.

37. DNS Check

Before network troubleshooting:

dig +short learn.cresignsys.com

You want to confirm it resolves to the expected public IP.

38. DNS Correct but Website Fails

Suppose:

DNS
✓

but:

Website
✗

Then investigate:

port
firewall
Nginx
TLS
application

39. Connection Refused

Suppose:

Connection refused

This often means the destination was reachable at the network level, but no service accepted the connection on that endpoint, or an active firewall/reject rule rejected it.

Common causes include:

Nginx not running
nothing listening on the port
wrong bind address
firewall reject

40. Connection Timed Out

A timeout often indicates that packets or responses aren’t getting through as expected.

Possible causes include:

cloud security rules
firewall
routing
wrong IP
service unreachable
network path issue

The exact cause must be tested.

41. Refused vs Timeout

A useful first approximation:

refused
=
you reached something, but connection wasn't accepted

timeout
=
you didn't receive the expected response in time

These are clues, not definitive diagnoses.

42. Oracle Cloud Security

Your Oracle Cloud environment has network security controls.

For a web server, you normally need appropriate inbound access for:

TCP 80
TCP 443

For SSH:

TCP 22

But exposure should be limited to what is actually required.

43. Cloud Firewall vs Linux Firewall

There can be multiple security layers.

For example:

Internet
 ↓
OCI network security
 ↓
Ubuntu firewall
 ↓
Nginx

A connection can be blocked before it ever reaches Nginx.

44. OCI Network Layer

At the Oracle Cloud level, your VM can be associated with:

VCN
Subnet
VNIC
Route Table
Security List
Network Security Group
Public IP

These components work together to determine network reachability.

45. VCN

VCN means:

Virtual Cloud Network

Think of it as your virtual private network environment in Oracle Cloud.

Conceptually:

OCI
 ↓
VCN
 ↓
Subnet
 ↓
VNIC
 ↓
VM

46. Subnet

A subnet is a logical IP network within the VCN.

For example:

VCN
│
├── Public subnet
│
└── Private subnet

The exact design depends on your architecture.

47. Public Subnet

A public subnet can be configured so that resources can have paths to/from the Internet through appropriate routing and public IP configuration.

It does not mean:

Every resource is automatically exposed to every Internet connection.

Security rules still matter.

48. Private Subnet

A private subnet is typically designed without direct public Internet exposure for its resources.

For example:

Internet
   │
   ▼
Web server
   │
   ▼
Private database

This is a common architecture.

49. Public IP

A public IP provides an Internet-facing address for the VM/network interface when appropriately configured.

Your domain’s A record can point to it.

Conceptually:

learn.cresignsys.com
        ↓
public IP
        ↓
VPS

50. Private IP

Inside the VCN, the VNIC has a private IP.

For example:

10.0.0.10

The Internet does not normally directly route to this RFC1918 private address.

51. NAT

NAT means:

Network Address Translation

It allows traffic to be translated between addressing domains.

For example, private systems may access the Internet through a NAT gateway without receiving public IP addresses.

This becomes important in more advanced cloud architectures.

52. Internet Gateway

A VCN can use an:

Internet Gateway

to provide Internet connectivity for appropriately routed resources.

Conceptually:

VM
 ↓
VCN
 ↓
Internet Gateway
 ↓
Internet

Routing and security rules must also permit the traffic.

53. Route Table

A route table tells the VCN where traffic should go.

Conceptually:

Destination
0.0.0.0/0
       ↓
Internet Gateway

means traffic destined for addresses outside the local network can be routed toward the Internet gateway, assuming the rest of the configuration permits it.

54. Security List

Oracle Cloud can use security lists associated with subnets.

They define allowed traffic rules.

For a web server you might allow:

TCP 80
TCP 443

and SSH:

TCP 22

from an appropriate source range.

55. Network Security Group

OCI also supports:

NSG

Network Security Group.

NSGs allow security rules to be associated with VNICs/resources rather than simply treating the whole subnet as one security boundary.

This can provide more granular architecture.

56. Security Rule Concept

Think:

Source
 ↓
Protocol
 ↓
Destination port
 ↓
Allow / deny

Example concept:

Internet
 ↓
TCP
 ↓
443
 ↓
ALLOW
 ↓
web server

57. Don’t Open Everything

Avoid:

0.0.0.0/0

for every possible port.

For example, exposing MySQL:

to the entire Internet is generally unnecessary for a typical single-server WordPress setup.

58. MySQL Should Usually Be Private

If:

Nginx
PHP-FPM
MySQL

are all on the same VPS, WordPress can communicate with MySQL locally.

There is usually no reason to expose:

to the Internet.

59. SSH

SSH uses:

TCP 22

by default.

If you expose SSH publicly:

Internet
 ↓
TCP 22
 ↓
SSH

you should secure it appropriately.

60. Web Ports

For normal websites:

HTTP
TCP 80

and:

HTTPS
TCP 443

are the common public ports.

61. HTTP Redirect

Many websites use:

Port 80
 ↓
redirect
 ↓
HTTPS 443

So both ports can be needed.

62. HTTPS Flow

When the user enters:

https://learn.cresignsys.com

the simplified path is:

DNS
 ↓
Public IP
 ↓
TCP 443
 ↓
TLS handshake
 ↓
HTTP request
 ↓
Nginx

63. TCP Three-Way Handshake

TCP connection establishment traditionally begins with:

Client → SYN
Server → SYN-ACK
Client → ACK

Conceptually:

Client                    Server

  SYN  -------------------->

       <-------------------- SYN-ACK

  ACK  -------------------->

Now the TCP connection is established.

64. Why TCP Handshake Matters

If you cannot establish TCP:

TLS

cannot proceed normally.

Therefore:

TCP failure
 ↓
HTTPS failure

65. TLS Comes After TCP

The simplified order:

DNS
 ↓
IP routing
 ↓
TCP connection
 ↓
TLS handshake
 ↓
HTTP

This is important for troubleshooting.

66. Test TCP Port

From another machine, you can use:

nc -vz example.com 443

or:

nc -vz example.com 80

If nc is installed.

67. What Does `nc -vz` Do?

It attempts to connect to the specified host and port.

Example:

example.com:443

This helps answer:

Can I establish a TCP connection to port 443?

68. `curl` Tests More

Compare:

nc -vz example.com 443

with:

curl -I https://example.com

nc focuses on connectivity.

curl can test higher-level HTTP/HTTPS behavior.

69. `ping`

You may also know:

ping example.com

But:

Ping is not a reliable test of whether a website works.

Why?

Because ping uses:

ICMP

while websites use:

TCP 80/443

70. Ping Can Fail While Website Works

A server may block ICMP.

So:

ping
✗

doesn’t necessarily mean:

website
✗

71. Website Can Fail While Ping Works

Conversely:

ping
✓

only tells you that ICMP communication worked.

It doesn’t prove:

TCP 443
✓

72. Better Website Test

Use:

curl -I https://learn.cresignsys.com

This tests the actual HTTP/HTTPS service.

73. Check Nginx

On the VPS:

sudo systemctl status nginx

Then:

sudo ss -ltnp | grep ':443'

You want to establish:

Nginx
✓ running

Port 443
✓ listening

74. Check Firewall

On Ubuntu, you may use:

sudo ufw status

If UFW is active, check whether the required ports are allowed.

For example, you may see rules for:

80/tcp
443/tcp

75. Important: UFW May Not Be Your Only Firewall

Even if:

ufw

looks correct, Oracle Cloud network security may still block traffic.

Therefore:

OCI security
+
Ubuntu firewall
+
service listener

all need to align.

76. Complete Port 443 Troubleshooting

If HTTPS doesn’t work:

1. DNS
   ↓
2. Public IP
   ↓
3. OCI routing
   ↓
4. OCI security rules
   ↓
5. Ubuntu firewall
   ↓
6. Nginx listening
   ↓
7. TCP 443
   ↓
8. TLS certificate
   ↓
9. Nginx server_name
   ↓
10. WordPress

77. Example Failure

DNS

learn.cresignsys.com
 ↓
correct IP

Nginx

running

Port

443
not listening

Result:

HTTPS fails

The problem is not DNS.

78. Another Failure

Everything:

DNS ✓
Nginx ✓
443 ✓

but OCI security rules:

443 blocked

Result:

Internet
 ↓
blocked
 ↓
Nginx never receives connection

79. Another Failure

Everything:

DNS ✓
443 ✓
Nginx ✓
TLS ✓

but:

server_name

is wrong.

You may receive the wrong website or default server.

80. Another Failure

Everything reaches Nginx:

DNS ✓
network ✓
TCP ✓
TLS ✓
Nginx ✓

but PHP-FPM is down.

Then a dynamic WordPress request may produce:

502 Bad Gateway

Now you move to the application layer.

81. This Is the Layered Troubleshooting Method

Never randomly change everything.

Move from outside to inside:

DNS
 ↓
IP
 ↓
route
 ↓
cloud firewall
 ↓
Linux firewall
 ↓
TCP
 ↓
Nginx
 ↓
TLS
 ↓
PHP-FPM
 ↓
WordPress
 ↓
MySQL

82. Essential Networking Commands

Interfaces

ip addr

Routes

ip route

Listening ports

sudo ss -ltnp

DNS

dig +short example.com

HTTP/HTTPS

curl -I https://example.com

TCP test

nc -vz example.com 443

Firewall

sudo ufw status

83. Three Commands to Memorize First

If you remember only three:

ip addr

ip route

sudo ss -ltnp

They tell you:

What interfaces do I have?
        ↓
Where does traffic go?
        ↓
What services are listening?

84. Your Oracle VPS Mental Model

Think of your VPS as:

                  INTERNET
                      │
                      ▼
                PUBLIC IP
                      │
                      ▼
                     VCN
                      │
                      ▼
                   SUBNET
                      │
                      ▼
                    VNIC
                      │
                      ▼
                UBUNTU NETWORK
                      │
             ┌────────┴────────┐
             ▼                 ▼
          TCP 80            TCP 443
             │                 │
             ▼                 ▼
          NGINX              NGINX
                               │
                               ▼
                              TLS
                               │
                               ▼
                           WORDPRESS

85. The Deepest Concept

A domain name is not directly connected to WordPress.

The actual chain is:

Domain
 ↓
DNS
 ↓
IP
 ↓
Network routing
 ↓
VNIC
 ↓
Linux interface
 ↓
TCP port
 ↓
Listening socket
 ↓
Nginx process
 ↓
Website configuration
 ↓
PHP-FPM
 ↓
WordPress

Each arrow represents another technical layer.

86. Lesson 055 Core Principle

Remember:

A server being online does not mean a website is reachable.

For the website to work:

DNS
✓

Routing
✓

Cloud security
✓

Linux firewall
✓

TCP port
✓

Nginx
✓

TLS
✓

PHP-FPM
✓

WordPress
✓

MySQL
✓

All required layers must work together.

Next Lesson — 056

Linux Networking Deeper — IP, Subnet, Gateway, NAT & Routing

We will now go below the port level and understand:

IPv4
 ↓
Binary
 ↓
Subnet mask
 ↓
CIDR
 ↓
Network address
 ↓
Broadcast
 ↓
Host address
 ↓
Gateway
 ↓
ARP
 ↓
Routing table
 ↓
NAT
 ↓
Public ↔ Private IP

Then we will apply it directly to your Oracle Cloud VCN, subnet, VNIC and public IP, so you understand exactly how a packet travels from a user’s laptop in Kerala to your VPS.

CresignSys Learn — Lesson 055

Linux Networking — From Internet to Nginx

1. The Complete Journey

2. What Is a Network?

3. IP Address

4. Private vs Public IP

5. Example

6. Your VNIC

VNIC

7. Physical NIC vs VNIC

8. Linux Sees a Network Interface

9. Loopback

Loopback

10. Why 127.0.0.1 Matters

11. 0.0.0.0

12. IPv6 Equivalent

13. Check Interfaces

14. CIDR

CIDR notation

15. IPv4 Structure

16. /24

17. Don’t Memorize Subnet Math Yet

18. Default Gateway

Default Gateway

19. Routing Table

Routing Table

20. What Does default Mean?

21. Packet

22. IP Layer

23. TCP

24. Port

Port

25. Common Ports

26. Why Ports Exist

27. Socket

Socket

28. Listening Socket

29. Understand ss

30. Find Port 80

31. Example

32. Nginx

33. Local vs External Testing

34. Local Test

35. HTTPS Local Test

36. Test the Domain

37. DNS Check

38. DNS Correct but Website Fails

39. Connection Refused

40. Connection Timed Out

41. Refused vs Timeout

42. Oracle Cloud Security

43. Cloud Firewall vs Linux Firewall

44. OCI Network Layer

45. VCN

Virtual Cloud Network

46. Subnet

47. Public Subnet

48. Private Subnet

49. Public IP

50. Private IP

51. NAT

Network Address Translation

52. Internet Gateway

Internet Gateway

53. Route Table

54. Security List

55. Network Security Group

NSG

56. Security Rule Concept

57. Don’t Open Everything

58. MySQL Should Usually Be Private

59. SSH

60. Web Ports

61. HTTP Redirect

62. HTTPS Flow

63. TCP Three-Way Handshake

64. Why TCP Handshake Matters

65. TLS Comes After TCP

66. Test TCP Port

67. What Does nc -vz Do?

11. `0.0.0.0`

16. `/24`

20. What Does `default` Mean?

29. Understand `ss`

67. What Does `nc -vz` Do?

68. `curl` Tests More

69. `ping`