fogserv.cloud fogserv.cloud

Networking - TCP/IP, DNS, Reverse Proxies & Firewalls

Status: Active
Last Updated: 2026-08-26 Category: Networking Fundamentals
Prerequisites: kb/basics/
Tags: networking, tcp-ip, dns, reverse-proxy, traefik, firewall, load-balancing, self-hosted

Summary

Complete networking knowledge from TCP/IP fundamentals through production reverse proxy setups. Learn how data flows, DNS resolution, SSL/TLS, and modern service routing using self-hosted tools like Traefik v3. Updated for Traefik v3, nftables, and current best practices.

🎯 Learning Philosophy

Packets Don't Lie:

Physical → Data Link → Network → Transport → Application
(Wires)    (Frames)     (IP)      (TCP/UDP)   (HTTP/DNS)

This directory teaches networking from "what happens when you ping?" through production-ready reverse proxy configurations. Progressive understanding from OSI layers through service mesh concepts.

📚 Learning Path


Prerequisites: Basic Linux, SSH understanding
         ↓
┌────────────────────────────────────────┐
│  PHASE 1: Network Fundamentals         │
│  ├─ OSI model and TCP/IP               │
│  ├─ IP addressing and subnets          │
│  ├─ Routing basics                     │
│  ├─ DNS fundamentals                   │
│  └─ Network troubleshooting tools      │
└────────────────────────────────────────┘
         ↓
┌────────────────────────────────────────┐
│  PHASE 2: Service Networking           │
│  ├─ Ports and protocols                │
│  ├─ Firewalls (iptables/nftables)      │
│  ├─ NAT and port forwarding            │
│  ├─ Load balancing concepts            │
│  └─ SSL/TLS fundamentals               │
└────────────────────────────────────────┘
         ↓
┌────────────────────────────────────────┐
│  PHASE 3: Reverse Proxies              │
│  ├─ What is a reverse proxy            │
│  ├─ Traefik v3 setup (modern choice)   │
│  ├─ Automatic SSL with Let's Encrypt   │
│  ├─ Docker labels routing              │
│  └─ Middleware (auth, rate limit)      │
└────────────────────────────────────────┘
         ↓
┌────────────────────────────────────────┐
│  PHASE 4: DNS & Certificates           │
│  ├─ Running your own DNS (PiHole)      │
│  ├─ Split-horizon DNS                  │
│  ├─ Let's Encrypt automation           │
│  ├─ Wildcard certificates              │
│  └─ Certificate management             │
└────────────────────────────────────────┘
         ↓
┌────────────────────────────────────────┐
│  PHASE 5: Advanced & Production        │
│  ├─ Load balancing algorithms          │
│  ├─ Service mesh concepts              │
│  ├─ Zero-trust networking              │
│  ├─ VPN integration                    │
│  └─ Performance optimization           │
└────────────────────────────────────────┘

📖 Articles in This Directory

✅ Recently Created (2026-08-26 headless-browser research session)

🟢 Phase 1: Network Fundamentals (Start Here)

The Basics - How Networks Work:

  1. tcp-ip-fundamentals - How the internet works

    • OSI model layers
    • TCP vs UDP
    • IP addressing (IPv4/IPv6)
    • Subnetting basics
    • Default gateway, routing
    • Prerequisites: None
    • Time: 3-4 hours
    • Resources: [███░░░░░░░] 30% - Conceptual

  2. ip-addressing-subnets - Understanding IP addresses

    • CIDR notation
    • Public vs private IPs
    • Subnet masks
    • Network calculations
    • IPv6 addressing
    • Prerequisites: TCP/IP basics
    • Time: 3-4 hours
    • Resources: [███░░░░░░░] 30%

  3. dns-fundamentals - Domain Name System

    • What is DNS
    • DNS record types (A, AAAA, CNAME, MX, TXT)
    • DNS resolution flow
    • Authoritative vs recursive
    • DNS propagation
    • Prerequisites: Networking basics
    • Time: 2-3 hours
    • Resources: [███░░░░░░░] 30%

  4. network-troubleshooting - Debug connectivity

    • ping, traceroute, mtr
    • dig, nslookup, host
    • netstat, ss, lsof
    • tcpdump, wireshark
    • Common issues and fixes
    • Prerequisites: Linux CLI
    • Time: 4-5 hours
    • Resources: [████░░░░░░] 40%

🟡 Phase 2: Service Networking (Security & Routing)

  1. ports-and-protocols - Well-known ports

    • Port numbers (22, 80, 443, 3306...)
    • TCP vs UDP services
    • Service identification
    • Port scanning (nmap)
    • Prerequisites: TCP/IP understanding
    • Time: 2 hours
    • Resources: [██░░░░░░░░] 20%

  2. firewall-basics - iptables/nftables

    • Firewall concepts
    • iptables chains (INPUT, OUTPUT, FORWARD)
    • Basic rules
    • Allow/deny patterns
    • Stateful firewalls
    • Prerequisites: Linux basics
    • Time: 3-4 hours
    • Resources: [█████░░░░░] 50%

  3. firewall-advanced - Production firewall configs

    • nftables (modern replacement)
    • Rate limiting
    • GeoIP blocking
    • DDoS protection basics
    • Fail2ban integration
    • Prerequisites: Firewall basics
    • Time: 4-5 hours
    • Resources: [██████░░░░] 60%

  4. nat-port-forwarding - Routing external traffic

    • What is NAT
    • Port forwarding setup
    • DMZ configuration
    • Double NAT issues
    • Prerequisites: Routing understanding
    • Time: 2-3 hours
    • Resources: [████░░░░░░] 40%

  5. ssl-tls-fundamentals - Encrypted connections

    • Public key cryptography
    • Certificates and CAs
    • TLS handshake
    • Certificate chains
    • Self-signed vs CA-signed
    • Prerequisites: Basic security
    • Time: 3-4 hours
    • Resources: [█████░░░░░] 50%

🟠 Phase 3: Reverse Proxies (Modern Service Routing)

  1. reverse-proxy-introduction - What is a reverse proxy

    • Forward vs reverse proxy
    • Use cases
    • SSL termination
    • Load balancing
    • Architecture patterns
    • Prerequisites: Web basics
    • Time: 2 hours
    • Resources: [███░░░░░░░] 30%

  2. traefik-setup - Modern cloud-native proxy (v3)

    • Why Traefik v3 vs Nginx
    • Docker installation
    • Static vs dynamic config
    • Provider setup
    • Dashboard access
    • Prerequisites: Docker basics
    • Time: 2-3 hours
    • Resources: [████░░░░░░] 40% - 512MB RAM

  3. traefik-docker-routing - Auto service discovery

    • Docker provider
    • Labels-based routing
    • Dynamic service discovery
    • Multiple domains
    • Path-based routing
    • Prerequisites: Traefik basics
    • Time: 3-4 hours
    • Resources: [█████░░░░░] 50%

  4. traefik-ssl-automation - Let's Encrypt integration

    • ACME protocol
    • HTTP-01 challenge
    • DNS-01 challenge (wildcard)
    • Certificate storage
    • Auto-renewal
    • Prerequisites: Traefik routing
    • Time: 2-3 hours
    • Resources: [█████░░░░░] 50%

  5. traefik-middleware - Request processing

    • Basic auth
    • Forward auth (SSO)
    • Rate limiting
    • IP whitelisting
    • Headers manipulation
    • Redirect schemes
    • Prerequisites: Traefik proficiency
    • Time: 3-4 hours
    • Resources: [██████░░░░] 60%

  6. nginx-alternative - Traditional reverse proxy

    • Nginx setup
    • Virtual hosts
    • SSL configuration
    • Load balancing
    • Caching
    • Prerequisites: Web basics
    • Time: 4-5 hours
    • Resources: [█████░░░░░] 50%

🔴 Phase 4: DNS & Certificates (Infrastructure Services)

  1. pihole-setup - Network-wide ad blocking DNS

    • Pi-hole installation
    • DNS server configuration
    • Adblock lists
    • Local DNS records
    • DHCP integration
    • Prerequisites: DNS basics
    • Time: 2-3 hours
    • Resources: [███░░░░░░░] 30% - 512MB RAM

  2. local-dns-records - Internal DNS management

    • Split-horizon DNS
    • Local domain setup
    • Internal service discovery
    • DNS-based service routing
    • Prerequisites: DNS understanding
    • Time: 2 hours
    • Resources: [███░░░░░░░] 30%

  3. letsencrypt-automation - Free SSL certificates

    • Certbot setup
    • Manual certificate generation
    • Automatic renewal
    • DNS plugins
    • Wildcard certificates
    • Prerequisites: SSL understanding
    • Time: 3-4 hours
    • Resources: [████░░░░░░] 40%

  4. certificate-management - Production cert handling

    • Certificate lifecycle
    • Monitoring expiration
    • Rotation strategies
    • Certificate pinning
    • Prerequisites: Cert experience
    • Time: 2-3 hours
    • Resources: [█████░░░░░] 50%

⚫ Phase 5: Advanced & Production (High Availability)

  1. load-balancing-algorithms - Distribution strategies

    • Round-robin
    • Least connections
    • IP hash
    • Weighted algorithms
    • Health checks
    • Prerequisites: Proxy experience
    • Time: 3 hours
    • Resources: [██████░░░░] 60%

  2. haproxy-setup - Enterprise load balancer

    • HAProxy installation
    • Frontend/backend config
    • ACLs and routing
    • SSL termination
    • Statistics dashboard
    • Prerequisites: Load balancing concepts
    • Time: 4-5 hours
    • Resources: [███████░░░] 70%

  3. service-mesh-concepts - Modern microservices networking

    • What is a service mesh
    • Sidecar pattern
    • mTLS between services
    • Traffic management
    • Observability integration
    • Prerequisites: k8s basics
    • Time: 3-4 hours
    • Resources: [████████░░] 80%

  4. vpn-integration - Private network access

    • VPN for homelab access
    • WireGuard integration
    • Split tunneling
    • VPN + reverse proxy
    • Prerequisites: VPN basics (security section)
    • Time: 3-4 hours
    • Resources: [██████░░░░] 60%

  5. network-performance - Optimization

    • Bandwidth testing
    • Latency optimization
    • TCP tuning
    • Connection pooling
    • CDN concepts
    • Prerequisites: Production experience
    • Time: 4-5 hours
    • Resources: [███████░░░] 70%

🔗 What Comes Next?

After mastering networking:

For Containers:

For Security:

For Observability:

For Cloud:

📊 Resource Requirements

Traefik (v3+):

Pi-hole:

HAProxy:

Complete Networking Stack (Traefik + Pi-hole + Monitoring):

Learning Time Investment:

🛠️ Recommended Tool Stack

Reverse Proxy (Pick ONE):

DNS:

Firewall:

SSL Certificates:

Monitoring:

💡 Pro Tips for Networking

  1. Document Your Network: IP ranges, VLANs, firewall rules
  2. DNS is Critical: Local DNS makes everything easier
  3. Let's Encrypt is Free: No excuse for self-signed certs
  4. Reverse Proxy Everything: Single entry point, easier management
  5. Monitor Network: Know your baseline, detect anomalies
  6. Test Firewall Rules: Block everything, open incrementally
  7. Use VLANs: Segment IoT, servers, management
  8. Plan IP Addressing: Leave room for growth
  9. Automate Certificate Renewal: Never let certs expire
  10. Keep It Simple: Complexity is the enemy of security

🔄 Common Networking Pitfalls

Pitfall 1: No Firewall

Pitfall 2: Expired Certificates

Pitfall 3: DNS Misconfiguration

Pitfall 4: Port Confusion

Pitfall 5: Single Point of Failure

Pitfall 6: No Network Segmentation

Pitfall 7: Overcomplicating

Pitfall 8: Ignoring IPv6

Pitfall 9: Using iptables directly on modern Ubuntu

Pitfall 10: Manual cert renewal with Let's Encrypt

🔗 Related KB Sections

📝 Change Log

2026-01-30

2026-08-15

Change Log

Choose Theme

Your selection is saved locally.

Neural Cacophony
Aperture v2
Flux v1
Mosaic Chaos
Nexus v1
Nexus Zest
Prism v2
Synapse