Advanced networking

The initial setup during the system preparation may be sufficient for the basic configuration tasks. However, time synchronization¹ and enhanced privacy requires a more advanced setup:

1. Switch to a #Network Manager with:
   1. #IPv6 privacy
   2. MAC address randomization
2. Use chrony for #Time synchronization
3. #Securing DNS via:
   1. #DNSSEC for validating DNS queries
   2. #DNS over TLS for encrypting DNS traffic
4. Traffic rerouting via:
   1. a Proxy server (e.g., the Tor network)
   2. a Virtual private network
5. Network analysis

Network manager

First of all an utility for controlling network related tasks is desirable. The NetworkManager can easily, yet extensively manage wireless and wired ethernet² interfaces. I install the networkmanager package:

sudo pacman -S networkmanager

The DHCP client, which is integrated in the NetworkManager can cause issues in big wireless networks such as eduroam. For this reason, I install the dhclient as an alternative:

sudo pacman -S dhclient

For switching, I create a /etc/NetworkManager/conf.d/dhcp-client.conf file:

[main]
dhcp=dhclient

IPv6 privacy

To prevent MAC address leakage of my interfaces, I enable the IPv6 Privacy Extensions for NetworkManager. I create the file /etc/NetworkManager/conf.d/ipv6-privacy.conf containing:

[connection]
ipv6.ip6-privacy=2

MAC address randomization

Additionally, with MAC address randomization enabled my physical MAC address is never leaked during layer 2 communication. I create the file /etc/NetworkManager/conf.d/rand-mac-address.conf:

[device-mac-randomization]
# "yes" is already default, but let's be safe
wifi.scan-rand-mac-address=yes

[connection-mac-randomization]
# randomize MAC for each connection
ethernet.cloned-mac-address=random
wifi.cloned-mac-address=random

Starting NetworkManager

I disable and stop the Systemd-networkd service which has been configured in the #Networking section of system preparation:

sudo systemctl stop systemd-networkd.service
sudo systemctl disable systemd-networkd.service

Afterwards I enable and start the NetworkManager to take over control:

sudo systemctl enable NetworkManager.service
sudo systemctl start NetworkManager.service

The existing wired configuration of the system preparation should be detected and connect automatically. I remove the configuration file afterwards to ensure that Systemd-networkd cannot interfere with the NetworkManager:

sudo rm /etc/systemd/network/20-wired.network

Time synchronization

Synchronizing the system clock can happen via internet by using the Network Time Protocol³ (NTP). The chrony NTP client is a roaming friendly alternative to the reference implementation ntp. I install the chrony package via:

sudo pacman -S chrony

NTS

The time synchronization can apply Transport Layer Security⁴ (TLS) by using NTS servers. I edit the /etc/chrony.conf file to use a nearby NTS server and a fallback:

server ptbtime1.ptb.de offline nts
server nts1.time.nl offline nts

Starting chrony

I disable and stop Systemd-timesyncd to prevent any conflicts:

sudo systemctl disable systemd-timesyncd.service
sudo systemctl stop systemd-timesyncd.service

Afterwards I enable and start the chronyd.service using these commands:

sudo systemctl enable chronyd.service
sudo systemctl start chronyd.service

And I check the configured NTP servers via:

chronyc -N 'sources -a -v'

NetworkManager dispatcher

Additionally, chrony can automatically go into online/offline mode depending on the connection state when using a NetworkManager dispatcher script. Install the networkmanager-dispatcher-chrony package from the AUR:

yay -Sy networkmanager-dispatcher-chrony

I enable and start the NetworkManager-dispatcher.service afterwards:

sudo systemctl enable NetworkManager-dispatcher.service
sudo systemctl start NetworkManager-dispatcher.service

Securing DNS

The DNS⁵ is used to map IP addresses to domain names. DNS traffic from and to your computer is unencrypted by default and leaks information about the sites you visit in your web browser or can be used to identify which operating system you are running, for example. Read more background information on this topic in the Privacy and security section in the Arch Wiki article about Domain name resolution.

DNSSEC

I create /etc/systemd/resolved.conf.d/dnssec.conf with the following content to enable DNSSEC for DNS query validation in Systemd-resolved:

[Resolve]
DNSSEC=true

DNS over TLS

Additionally, to use TLS for encrypting the DNS traffic between my host and the DNS server I create /etc/systemd/resolved.conf.d/dns_over_tls.conf to enable DNS over TLS (DoT) for Systemd-resolved by containing:

[Resolve]
DNS=176.9.93.198#dnsforge.de
DNSOverTLS=yes

Afterwards I restart the systemd-resolved.service to activate the changes:

sudo systemctl restart systemd-resolved.service

I check if the new DNS server is used and +DNSoverTLS is listed in Protocols in the output of the following command:

resolvectl status

Known bugs

Some applications (such as Firefox or LibreWolf, Thunderbird and other) read the file /etc/hosts instead of using Systemd’s resolver⁶. To prevent resolving localhost over the network I add the following lines to /etc/hosts:

127.0.0.1        localhost
::1              localhost
127.0.1.1        arch-studio24

Remember to change arch-studio24 to your hostname!

Traffic rerouting

For enhanced identity protection (e.g., hiding your IP address) it’s necessary to reroute your traffic through a proxy server (proxies) or other networks, such as the Tor network.

Proxy server

A proxy server⁷ can be used to protect your identity by acting as an intermediary network device to forward traffic and hide the originating IP address. With a running Tor Browser, I can redirect the traffic of an application through the Tor network via ProxyChains-NG. I install the proxychains-ng package through:

sudo pacman -S proxychains-ng

Per default ProxyChains-NG connects via the Tor client on Port 9050. As I like to use it via a running Tor Browser, the port number in /etc/proxychains.conf needs to be changed to 9150 like this:

socks4		127.0.0.1 9150

To redirect network traffic through proxychains, I append it in front of the command. For exmaple, to watch a YouTube video directly in mpv using yt-dlp for streaming (covered in media player):

proxychains mpv https://youtu.be/0ZAtn3SNQDw

Virtual private network

Another method for redirecting network traffic is a virtual provate network⁸ (VPN). VPNs are typically used to connect to an institutional or corporate network in order to access internal resources, such as mail or file servers. There are different protocols and implementations available. Most common is OpenVPN and Wireguard. I use OpenVPN to connect to my institution. For this reason, I install the networkmanager-vpn-plugin-openvpn and openvpn packages:

sudo pacman -S networkmanager-vpn-plugin-openvpn openvpn

After installation I can import OpenVPN configurations or create connection profiles in NetworkManager. Wireguard connections can be created and imported out-of-the-box, as the protocol is included in the Linux kernel since version 5.6. For post-quantum-secure VPNs have a look at Rosenpass.

For legacy reasons I also use openconnect once in a while to connect to an AnyConnect VPN endpoint via the terminal:

sudo openconnect --protocol=anyconnect -u <username> <IP-address>

Network analysis

If you are troubleshooting or just curious about how network traffic looks like, you might want to analyze or even intercept it. Wireshark is a comprehensive and mature network protocol analyzer⁹ and sniffer, and mitmproxy can intercept, inspect, and modify SSL/TLS encrypted web traffic. I use both tools for technical investigations, such as telemetry¹⁰ monitoring, protocol inspection, and general traffic analysis. The packages mitmproxy and wireshark-qt are available in the offical repositories and can be installed via:

sudo pacman -S mitmproxy wireshark-qt

In order to allow Wireshark to use the network interface card for capturing traffic, I need to join the wireshark group, which has been created during package installation:

sudo usermod -aG wireshark thisven

Next up is the Xfce desktop guide describing how to install and setup a desktop environment.