Ubuntu Network Troubleshooting

By Kokil Thapa | Last reviewed: September 2026

Ubuntu network troubleshooting on a production VPS usually starts with a simple symptom: SSH drops, a Laravel site returns 502, or ping fails after a reboot. The fix is rarely mystical. You verify link state, IP assignment, routing, DNS, and firewall rules in that order. I've used this sequence on shared EC2 hosts running Linux system administration workloads and on client sites deployed with Deployer 7. This guide walks through the same checks I run before touching application code or blaming the ISP.

How do you check if Ubuntu has a network connection?

Start at Layer 2 and Layer 3. A common mistake is jumping straight to DNS or nginx when the interface itself is down. On Ubuntu 22.04 and 24.04 servers, Netplan hands configuration to systemd-networkd or NetworkManager. Desktop installs typically use NetworkManager. Server images often use Netplan plus systemd-networkd.

Run these four commands first. They tell you whether the problem is local, upstream, or beyond your host.

ip link show
ip addr show
ip route show
ping -c 4 1.1.1.1

Interpret the output carefully. state DOWN on your primary NIC means the cable, virtual interface, or cloud ENI is not active. A missing inet line means DHCP failed or static config is wrong. No default route in ip route explains why public traffic dies even when local ping works.

Verify the interface is administratively up

If the link shows DOWN, bring it up manually to test:

sudo ip link set ens33 up
ip link show ens33

Replace ens33 with your interface name from ip link. On cloud VMs the name is often ens5, eth0, or enp0s3. If the link flaps back to DOWN, check hypervisor networking, security groups, or a bad Netplan stanza before chasing DNS.

If ping 1.1.1.1 works but ping google.com fails, you have a DNS problem—not a dead NIC. If both fail, keep working downward. Our Ubuntu network configuration guide covers baseline setup before you troubleshoot failures.

What commands should you run first for Ubuntu network troubleshooting?

Build a repeatable toolkit. I keep this ordered list in my notes for remote SSH sessions when a client's site goes dark after a deploy.

1. Link and address: ip -br link and ip -br addr for a compact view.
2. Routing: ip route get 8.8.8.8 shows which interface and gateway the kernel picks.
3. Listening ports: sudo ss -tulpn confirms Apache, nginx, or PHP-FPM is bound correctly.
4. DNS resolution: resolvectl status and dig example.com.
5. Recent logs: journalctl -u systemd-networkd -n 50 --no-pager or NetworkManager equivalent.
6. Firewall: sudo ufw status verbose and sudo nft list ruleset if UFW is inactive but rules exist.

The ip command replaced ifconfig and route years ago. On current Ubuntu LTS releases it is the canonical interface for diagnostics. For a wider command reference, see our essential Ubuntu terminal commands cheat sheet.

Test outbound HTTP and TLS separately

ICMP ping can succeed while HTTPS fails due to proxy settings, MTU black holes, or outbound port 443 blocks. Run:

curl -4 -I --connect-timeout 5 https://cloudflare.com
curl -4 -I --connect-timeout 5 http://169.254.169.254/

The first checks general internet egress. The second is useful on AWS EC2 to confirm link-local metadata access when IAM roles break. A timeout on both usually means routing or security group misconfiguration, not application bugs.

Capture packets when logs lie

When symptoms are intermittent, a short tcpdump often beats guessing:

sudo tcpdump -i any -n host 8.8.8.8 and port 53 -c 20

Run this in one SSH session while you dig google.com in another. No packets on port 53 means DNS traffic never leaves the box. Packets without replies point to upstream filtering. Use our regex tester to parse saved tcpdump output when you script post-mortems.

How do you fix Ubuntu Netplan network configuration errors?

Most Ubuntu server network outages I see trace back to Netplan YAML mistakes. A trailing space, wrong indentation, or duplicate addresses keys can leave systemd-networkd with no usable config. Netplan validates syntax separately from semantic correctness.

Always dry-run before apply:

sudo netplan try
sudo netplan apply
sudo netplan --debug apply

netplan try rolls back after 120 seconds unless you confirm. That single feature has saved many remote sessions. Official Netplan reference lives at netplan.io.

Example static config for a web server

This pattern works on a typical VPS with one public NIC. Adjust names and addresses for your provider:

network:
  version: 2
  renderer: networkd
  ethernets:
    ens33:
      dhcp4: false
      addresses:
        - 203.0.113.10/24
      routes:
        - to: default
          via: 203.0.113.1
      nameservers:
        addresses:
          - 1.1.1.1
          - 8.8.8.8

Files live under /etc/netplan/. Only one active file should define an interface. Multiple files applying conflicting stanzas produce flaky behaviour that looks like random packet loss.

For deeper YAML examples and Wi-Fi edge cases, read the Ubuntu Netplan tutorial. On production Laravel hosts I prefer static IPs or provider DHCP with reserved addresses. Predictable IPs simplify firewall allowlists and database replica peering.

DHCP leases that never renew

When a DHCP server address pool is exhausted, Ubuntu may keep a stale lease or get none at all. Check with:

networkctl status ens33
journalctl -u systemd-networkd | grep -i dhcp

Release and renew manually:

sudo dhclient -r ens33
sudo dhclient ens33

On NetworkManager systems, use nmcli device reapply ens33 instead. Mixing dhclient with Netplan-managed interfaces can cause duplicate address conflicts. Pick one management path and stick to it.

How do you troubleshoot DNS and firewall issues on Ubuntu?

DNS failures account for a large share of "the server is down" reports on otherwise healthy boxes. Payment gateway callbacks, Composer installs, and Let's Encrypt renewals all need working outbound DNS and often inbound port 80/443.

systemd-resolved on modern Ubuntu

Ubuntu 22.04 and 24.04 use systemd-resolved by default. Check status:

resolvectl status
resolvectl query kokil.com.np
systemd-resolve --status 2>/dev/null || true

If /etc/resolv.conf is a stub pointing to 127.0.0.53, that is normal. Do not replace it with public DNS until you understand whether Netplan or NetworkManager owns upstream servers. The Ubuntu DNS guide at documentation.ubuntu.com documents the split between stub resolver and upstream forwarders.

Our dedicated walkthrough is here: Ubuntu DNS configuration guide.

UFW and cloud security groups

Local firewall rules block traffic even when cloud console security groups are open. After hardening a web server, SSH or HTTP may disappear:

sudo ufw status numbered
sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw reload

Always confirm cloud-level rules too. AWS security groups, DigitalOcean firewalls, and Hetzner cloud firewalls sit outside the VM. A correct UFW config cannot fix a provider rule denying port 443. See configure a firewall with UFW on Ubuntu for baseline policies.

fail2ban can also block legitimate IPs after brute-force attempts. If one office loses SSH while others connect, check Ubuntu fail2ban configuration jails before reimaging the server.

Why does Ubuntu lose network connectivity after reboot or update?

Post-reboot outages usually come from three places: Netplan not applied, a package replacing /etc/netplan, or a conflicting network daemon. Kernel updates rarely break drivers on cloud VMs. Config drift is the usual suspect.

Service conflicts to eliminate

Running NetworkManager and systemd-networkd on the same interface causes race conditions. Pick one renderer in Netplan:

network:
  version: 2
  renderer: networkd

Then ensure services match:

sudo systemctl enable systemd-networkd
sudo systemctl disable --now NetworkManager 2>/dev/null || true

Desktop Ubuntu needs NetworkManager. Do not disable it on a laptop. Server images should stay on networkd unless you have a specific reason to switch.

Cloud-init overwriting Netplan

On first boot, cloud-init may write /etc/netplan/50-cloud-init.yaml. A manual edit gets overwritten on the next rebuild. For persistent changes, use provider networking panels or cloud-init user-data. I've hit this on EC2 hosts running sister legal-tech sites that share a Deployer pipeline—network looked fine until an AMI rebuild wiped custom routes.

After kernel or systemd updates, verify the stack:

sudo apt update
sudo needrestart -b
systemctl is-active systemd-networkd
systemctl is-active systemd-resolved

Our Ubuntu installation troubleshooting guide covers first-boot issues that overlap with network setup. For ongoing patch cycles, see Ubuntu server security best practices.

How do you troubleshoot network issues affecting web applications on Ubuntu?

Application symptoms often masquerade as network problems, and the reverse is also true. A Laravel queue worker that cannot reach Redis on 127.0.0.1:6379 is local networking. An API that times out calling eSewa or Khalti is outbound HTTPS and DNS.

Local stack checks for PHP and nginx

On production Laravel 12 or 13 hosts running PHP 8.3+ behind nginx:

sudo ss -tulpn | grep -E ':80|:443|:6379|:3306'
curl -I http://127.0.0.1
curl -I --resolve example.com:443:127.0.0.1 https://example.com

If local curl succeeds but public access fails, look outward: DNS A record, CDN proxy, TLS certificate, or edge firewall. If local curl fails, inspect nginx and PHP-FPM sockets first. Installation references: install nginx on Ubuntu and install PHP on Ubuntu.

On booking platforms like Adventure Third Pole Trek, webhook failures from payment gateways often trace to outbound DNS or blocked port 443 after a UFW hardening pass—not broken Livewire code.

MTU and VPN gotchas

Site-to-site VPNs and WireGuard tunnels often need a lower MTU. Symptoms include small HTTP requests succeeding while large API payloads hang. Test with:

ping -M do -s 1472 8.8.8.8
ip link show wg0

If large pings fragment or fail, set mtu: 1420 in Netplan or the VPN config. This shows up on Symfony deployment on Ubuntu VPS projects when database dumps over SSH tunnel stall mid-transfer.

Monitoring to catch regressions early

Do not wait for clients to report downtime. Basic uptime checks from an external monitor plus on-host scripts catch drift fast. Log metrics from networkctl and disk space—full disks break logging and mask network errors. Read Ubuntu server monitoring guide for cron-friendly patterns.

When you need hands-on recovery, support and maintenance covers production Laravel and WordPress stacks on Ubuntu. Server hardening guides like server hardening for Ubuntu web servers explain why tightened firewalls cause follow-up network tickets.

Key Takeaways

• Run ip link, ip addr, ip route, and ping 1.1.1.1 before touching DNS or application configs.
• Use netplan try on every YAML change so a bad edit does not lock you out of SSH.
• Separate DNS failures (IP ping OK, hostname fails) from firewall blocks (port closed externally) using the symptom table above.
• Check both UFW and cloud provider security groups—either layer can drop traffic independently.
• After reboot or package updates, confirm systemd-networkd and systemd-resolved are active and not fighting NetworkManager.
• For web apps, test localhost with curl and ss before blaming ISP routing or Laravel code.

People Also Ask

How do I restart networking on Ubuntu without rebooting?

On Netplan-managed servers run sudo netplan apply or sudo systemctl restart systemd-networkd. On desktop systems with NetworkManager, use sudo systemctl restart NetworkManager. Avoid /etc/init.d/networking restart on modern releases—it is deprecated and can leave resolved in a broken state.

Why does Ubuntu show "Network is unreachable"?

The kernel has no route to the destination. Check ip route for a default gateway. Verify the gateway IP matches your subnet. On cloud VMs, confirm the provider assigned the correct VPC or VLAN. A missing or wrong gateway is the most common cause of this exact error string.

Can I use ifconfig instead of ip on Ubuntu?

ifconfig lives in the net-tools package and is not installed by default on minimal server images. Install it with sudo apt install net-tools if you prefer, but ip from iproute2 is the supported tool. Scripts and docs for Ubuntu 22.04 and 24.04 assume ip, not ifconfig.

How do I test if a port is open on my Ubuntu server?

From the server itself, run sudo ss -tulpn | grep :443. From another machine, use nc -zv your.server.ip 443 or an external port scanner. If local listening shows OK but external tests fail, the block is almost always firewall or security group related—not nginx configuration.

Fix Ubuntu network issues with a methodical checklist

Ubuntu network troubleshooting rewards discipline over guesswork. Work from link state upward, validate Netplan with netplan try, and map symptoms to DNS, routing, or firewall layers before restarting services at random. That checklist has recovered production hosts for me within minutes—often while a deploy pipeline was waiting. If your team runs business-critical apps on Ubuntu and wants the network layer documented and monitored properly, contact us for server setup, hardening, and ongoing support. For baseline configuration before problems appear, start with the Ubuntu server setup guide and keep this page bookmarked for the day ping stops replying.