Standard tools (ping, telnet, wget, curl, …) obey “Name Service Switch” configured in (/etc/nsswitch.conf). On my machine, the line about hosts reads:

cat /etc/nsswitch.conf | grep hosts
hosts:          files mdns4_minimal [NOTFOUND=return] dns

So host name resolution will be:

• Use local files (/etc/hotsts)
• Then mDNS but only for host names ending in .local.
• Then DNS server (from /etc/resolv.conf) (only for host names not ending in .local)

This file may also use LDAP or NIS for host name resolution.

/etc/hosts

Here is the /etc/hosts documentation.

:point_up: You may experience problems if localhost and the local machine host name is not defined in that file.

mDNS

mDNS, (Linux: Avahi, Apple: Bonjour) is used by local machine to announce there services. You may have to install umdns on OpenWRT.

DNS (and /etc/resolv.conf)

• Most modern Linux distributions uses systemd-resolve and/or NetworkManager, so /etc/resolve.conf contains 127.0.0.1 as nameserver.

  resolvectl status will show how host name are resolved.

Web browsers

Web browsers uses DNS caching and modifying /etc/hosts won’t affect name resolution unless the cache is cleared by a restart or an action.

• Firefox : Open about:networking#dns and click on “Clear DNS cache”.
• Chrome : Open chrome://net-internals/#dns and click on “Clear host cache”

While you can find many places on the Internet explaining how to do a network bridge using NetworkManager, I’ve never seen it work.

You can switch your entire desktop workstation to networkd but you will lose the adantages of NetworkManager (WiFi, GUI support, …).

But you may have missed that both networkd and NetworkManager can be used together.

Network bridge on the server (/etc/netplan/01-config.yaml)

network:
  version: 2
  renderer: networkd
  ethernets:
    enp3s0:
      dhcp4: false
  bridges:
    br0:
      macaddress: XX:XX:XX:XX:XX:XX
      dhcp4: false
      interfaces:
        - enp3s0
      addresses:
        - XXX.YYY.ZZZ.10/16
      routes:
        - to: default
          via: XXX.YYY.ZZZ.1
      nameservers:
        search:
          - "lan"
        addresses: [XXX.YYY.ZZZ.1]

Network bridge on the desktop (/etc/netplan/01-config.yaml)

network:
  version: 2
  ethernets:
    eno1:
      renderer: networkd
      dhcp4: false
  bridges:
    br0:
      renderer: networkd
      macaddress: YY:YY:YY:YY:YY:YY
      dhcp4: false
      addresses: [ "XXX.YYY.ZZZ.20/24" ]
      nameservers:
        addresses: [XXX.YYY.ZZZ.1]
        search: [lan]
      routes:
        - to: default
          via: XXX.YYY.ZZZ.1
      interfaces:
        - eno1
      parameters:
        forward-delay: 0
        stp: false

You may need to reboot to force NetworkManager to ignore br0 and eno1.

Install libvirt on all machines

sudo apt-get install libvirt-daemon-system libvirt-clients
sudo usermod -aG kvm,libvirt $USER
sudo -i -u $user # or logout+login to enable groups

# remove the default (NAT network)
virsh net-undefine default
virsh net-define /dev/stdin <<EOF
<network>
  <name>host-br0</name>
  <bridge name='br0'/>
  <forward mode="bridge"/>
</network>
EOF

virsh net-autostart host-br0
virsh net-start host-br0

# define a boot pool
sudo mkdir -p /var/lib/libvirt/boot
sudo wget -P /var/lib/libvirt/boot https://cdimage.ubuntu.com/ubuntu-mini-iso/noble/daily-live/current/noble-mini-iso-amd64.iso
sudo chown libvirt-qemu:kvm /var/lib/libvirt/boot -R

virsh pool-define /dev/stdin <<EOF
<pool type='dir'>
  <name>boot</name>
  <target>
    <path>/var/lib/libvirt/boot</path>
  </target>
</pool>
EOF

virsh pool-autostart boot
virsh pool-start boot

On the desktop:

sudo apt-get install virt-manager

virt-manager will automatically connect to the local libvirt, but can be used to connect to a remote libvirt over ssh: `File -> Add Connection.. -> Connect

:x: Well, it looks cool, but the PTP part is currently not working!

TL ; DR

HW

• Raspberry Pi CM5 (CM5102016 - 2GB RAM, 16 GB eMMC, Wifi)
  • The SYNC input for the PTP is only available on CM4 and CM5 (i.e. not available on the RPi 4 and 5).
  • N.B. Wifi is not necessary, but this will become my router in the near future
• Mainboard: SupTronics X1501
  • Dual ethernet, did I already tell this board will become my router?
• GPS: Waveshare MAX-M8Q GNSS HAT for Raspberry Pi
  • Because it has a PPS output
  • Can be replaced by the NEO-M8T HAT, which is especially designed for timing applications, but is 3.5x more expensive.
• Battery: ML1220 to store settings on the NEO-M8T HAT
• Case: SupTronics X15-C1
• Passive cooler: SC1752
• PSU: USB-C (27W recommended by SupTronics)

:warning: I may have ordered the hardware too fast, the CM5 needs kernel > 6.12 info from here, and OpenWRT ships with kernel 6.6…

So, the PTP functionality will be tested using ubuntu 25.10 sever

SW - OS and basic settings

1. OpenWRT 24.10.5 setup.

It may be possible to use rpiboot to flash the eMMC as a USB mass device, but since I can’t find any documentation on the mainboard manufacturer’s site, I used a USB drive to flash the OpenWRT image on /dev/mmcblk0. And since rpi-eeprom-config does not work on OpenWRT, I used Raspberry Pi OS Lite on the USB drive.

• Write the Raspberry Pi OS Lite image on the USB drive, and boot on it. If you don’t have an official power supply, you may need usb_max_current_enable=1 in your config.txt.

• Configure BOOT_ORDER (see the doc).

  The factory settings is 0xf2461 (SD (eMMC) -> NVMe -> USB -> Network). Since the eMMC is soldered (not removable like a SD card), the there is no way to boot on something else, once it is configured.

  So let’s configure BOOT_ORDER to USB -> NVMe -> SD.

    # Configure BOOT_ORDER to USB -> NVMe -> SD and disable other factory settings
    cat <<EOF >boot.conf
    [all]
    BOOT_UART=0
    POWER_OFF_ON_HALT=0
  
    # USB -> NVMe -> SD
    BOOT_ORDER=0xf164
    EOF
  
    sudo rpi-eeprom-config --apply boot.conf
  
    sudo reboot # Rebooting in the same OS is necessary to write the eeprom
  

• Now install OpenWRT on the eMMC

  :point_up: I find the squashfs more stable than the ext4 one, and will cause less wear on the flash. Feel free to use another image.

   # download OpenWRT
   wget https://downloads.openwrt.org/releases/24.10.5/targets/bcm27xx/bcm2712/openwrt-24.10.5-bcm27xx-bcm2712-rpi-5-squashfs-factory.img.gz
  
   # verify the dowload
   echo "a3356a692ccc4e22896b9fb57a001d949f7c967d924c534732272fa1745bb00d  openwrt-24.10.5-bcm27xx-bcm2712-rpi-5-squashfs-factory.img.gz" | shasum -c -
  
   # flash it
   zcat openwrt-24.10.5-bcm27xx-bcm2712-rpi-5-squashfs-factory.img.gz | sudo dd bs=4M of=/dev/mmcblk0
  
  
   # edit eMMC/boot/config.txt and eMMC/boot/cmdline.txt
   mkdir /tmp/boot
   sudo mount /dev/mmcblk0p1 /tmp/boot/ -o noatime
  
   # config.txt setup
   cat <<EOF | sudo tee -a /tmp/boot/config.txt
   [all]
   dtparam=pciex1                # for X1501 ssd
   dtoverlay=pps-gpio,gpiopin=18 # PPS on GPIO 18
   dtparam=uart0=on              # enable /dev/ttyAMA0 for the GPS
   dtparam=watchdog=off          # disable watchdog
   usb_max_current_enable=1
   EOF
  
   # The GNSS will need the serial port, so don't put a console on it
   sudo sed -i 's/ .*115200//' /tmp/boot/cmdline.txt
   sudo umount /tmp/boot
  

• Remove the USB drive and reboot OpenWRT on the eMMC

1. The raspberry will have the 192.168.1.1 address, but I prefer it to DHCP.

   uci set network.lan.proto=dhcp
   uci commit
   /etc/init.d/network restart
   

2. Since this machine is not a router :

   /etc/init.d/firewall disable
   /etc/init.d/odhcpd disable
   /etc/init.d/dnsmasq disable
   reboot
   

3. Setup a root password

   root@OpenWrt:~# passwd
   Changing password for root
   New password:
   Bad password: too weak
   Retype password:
   passwd: password for root changed by root
   

4. Setup authorized_keys and disable root password login

5. Configure hostname

   uci set system.@system[0].hostname=pim-ptp
   uci set system.@system[0].timezone='CET-1CEST,M3.5.0,M10.5.0/3'
   uci set system.@system[0].zonename='Europe/Zurich'
   uci commit
   echo pim-ptp > /proc/sys/kernel/hostname
   

6. Install the tools

   opkg update
   uci set system.ntp.enable='0'
   uci commit
   /etc/init.d/sysntpd disable
   /etc/init.d/sysntpd stop
   /etc/init.d/ntpd disable
   /etc/init.d/ntpd stop
   opkg install chrony kmod-pps-gpio gpsd gpsd-clients \
   nano rsync umdns coreutils-who zabbix-agentd python3-light kmod-usb-net-rtl8152
   /etc/init.d/chronyd enable
   

SW - GPSD, chrony and PPS

1. Configure gpsd

   uci set gpsd.core.device='/dev/ttyAMA0'
   uci set gpsd.core.enabled='1'
   uci commit
   /etc/init.d/gpsd enable
   /etc/init.d/gpsd start
   

2. Check GPS connectivity : cgps -s -u m should show Status 3D FIX
3. Configure chronyd for using country specific servers in /etc/config/chrony:

   config pool
           option hostname '0.ch.pool.ntp.org'
           option iburst 'yes'
   config systemclock 'systemclock'
   ...
   

4. Add the GNSS and PPS sources at the end of : /etc/chrony/chrony.conf

   refclock PPS /dev/pps0 refid PPS poll 0

   local stratum 10 orphan …

5. (Re-) Start chronyd

   # Restarting network after chrony configuration will get the NTP servers
   # from the DHCP server
   /etc/init.d/network restart
   /etc/init.d/chronyd restart
   

6. Check GPS and PPS functionality :

   chronyc sources
   

   MS Name/IP address         Stratum Poll Reach LastRx Last sample               
   ===============================================================================
   #- GNSS                         0   2   377     6    +43ms[  +43ms] +/-  100ms
   #* PPS                          0   1   377     2   -343ns[ -716ns] +/- 2600ns
   ^- redacted1.example.com        1   6   377    22  -3130us[-3128us] +/-   10ms
   ^- redacted2.example.com        1   6   377    22  -3188us[-3187us] +/- 7391us
   ^- redacted3.example.com        2   6   377    21  -5598us[-5597us] +/-   18ms
   ^- redacted4.example.com        2   6   377    20  -3383us[-3382us] +/-   36ms
   ^- router.lan                   2   6   377    15  -3231us[-3231us] +/-   41ms
   ^- pim-ntp.lan                  1   6   377    14    -12us[  -12us] +/-  290us
   ^? pim-ptp.lan                  0   8   377     -     +0ns[   +0ns] +/-    0ns
   
   

Configure NTP pool DNS and DHCP on a OpenWRT router

1. Setup all your NTP servers in a DNS pool (/etc/config/dhc)

   ...
   config domain
       option name 'ntp'
       option ip 'XXX.XXX.XXX.XXX' # address of the router with a NTP server
   
   config domain
       option name 'ntp'
       option ip 'XXX.XXX.XXX.YYY' # address of the ntp server (from our older post)
   
   config domain
       option name 'ntp'
       option ip 'XXX.XXX.XXX.YYY' # address of the ntp+ptp server (from this post)
   ...
   

2. Setup the DHCP to announce NTP servers:

   uci add_list dhcp.lan.dhcp_option='42,XXX.XXX.XXX.XXX,XXX.XXX.XXX.YYY,XXX.XXX.XXX.ZZZ'
   uci commit
   

3. Restart dnsmasq

   /etc/init.d/dnsmasq restart
   

(Optional) Optimisation for timing

:point_up: The backup battery on the Waveshare MAX-M8Q GNSS HAT is mandatory. Whitout it, the module will lose it’s configuration every power loss. The symptom will be NO FIX, since the module will go back to 9600 bauds.

• set jumpers on A
• connect to your favorite Linux host using the USB cable
• start gpsd on the usb port

   ubxtool -s 9600 -S 115200
   ubxtool -p MODEL,2
   ubxtool -p CFG-PMS,0
   ubxtool -p SAVE
   ubxtool -p COLDBOOT # validate the settings are OK
  

• re-set jumpers on B
• configure 11500 bauds using -s 115200 in /etc/init.d/gpsd: ```bash … [ “$enabled” = “0” ] && return 1

  ...
  ```

:x: ptp (using ubuntu server 25.10) :x:

:x: the PTP server does not work at this time :x:

The complete install will be documented once the required drivers reach OpenWRT.

In brief:

• install ubuntu server 25.10
• add the config.txt lines into /boot/firmware/config.txt
• remove the serial console from /boot/firmware/current/cmdline.txt.
• reboot
• install and configure gpsd (in /etc/default/gpsd)

   # Devices gpsd should collect to at boot time.
   # They need to be read/writeable, either by user gpsd or the group dialout.
   DEVICES="/dev/ttyAMA0"
  
   # Other options you want to pass to gpsd
   GPSD_OPTIONS="-n -s 115200"
  
   # Automatically hot add/remove USB GPS devices via gpsdctl
   USBAUTO="true"
  

• install and configure chrony

  sudo rm /etc/chrony/sources.d/ubuntu-ntp-pools.sources
  echo "pool 0.ch.pool.ntp.org iburst" | sudo tee /etc/chrony/sources.d/pim.sources
  echo "pool ntp.lan iburst" | sudo tee -a /etc/chrony/sources.d/pim.sources
  echo "refclock PPS /dev/pps0 refid PPS poll 0" | sudo tee -a /etc/chrony/conf.d/pim.conf
  echo "local stratum 10 orphan" | sudo tee -a /etc/chrony/conf.d/pim.conf
  sudo systemctl restart chrony
  

• connect GNSS module PPS pin (GPIO8 or dedicated output) to Ethernet_SYNC_OUT (J2 pin 6)
• configure Ethernet_SYNC_OUT as a PPS input

   # Configure the pin as input, 1 means input, 0 is the ptp channel 0 (from ethtool -T eth0 | grep 'Hardware timestamp provider index:')
   echo 1 0 | sudo tee /sys/class/ptp/ptp0/pins/SYNC_OUT
  
   # Enable timestamping (0 is the ptp channel number and 1 is enable
   echo 0 1 | sudo tee /sys/class/ptp/ptp0/extts_enable
  
   # should display 1 timestamp per second
   # disconnect the cable and the timestamps will stop
  
   while true; do cat /sys/class/ptp/ptp0/fifo ; done
  

• configure ptp timemaster

   sudo apt install linuxptp
   sudo systemctl disable timemaster.service
  

• Sync PTP hardware clock to PPS

   # we don't use nmea for time of day (gpsd uses the gps data), so sync
   # PTP with the system clock. TAI is 37 seonds ahead of TAI
   sudo phc_ctl eth0 "set;" adj 37 # fixme get it from leap-seconds.list
   # ubuntu is not up to date
   sudo wget -P /etc/linuxptp https://data.iana.org/time-zones/tzdb-2026a/leap-seconds.list
   cat <<EOF | sudo tee -a /etc/linuxptp/ts2phc.conf
   [global]
   leapfile /etc/linuxptp/leap-seconds.list
   step_threshold 0.1
   ts2phc.tod_source generic
   logging_level 7
  
   [eth0]
   ts2phc.pin_index 0
   EOF
  
   ts2phc -f /etc/linuxptp/ts2phc.conf -m -q -l 7
  

• Sync chrony with the the PTP hardware clock

   echo "refclock SHM 0 refid GNSS precision 1e-1 offset 0.044 poll 0 filter 8" | sudo tee /etc/chrony/conf.d/pim.conf
   echo "refclock PPS /dev/pps0 refid PPS lock GNSS poll 2" | sudo tee -a /etc/chrony/conf.d/pim.conf
   echo "refclock SHM 2 refid PPSp tai lock GNSS poll 2" | sudo tee -a /etc/chrony/conf.d/pim.conf
   sudo systemctl restart chrony
  
   # -M2 -> write to SHM 2
   # offset is zero, since it is configured as TAI in chrony
   phc2sys -s eth0 -E ntpshm -O 0 -M 2
  

• ptp master :warning: work in progress

  At this time ptp4l --serverOnly 1 -i eth0 -l 7 --tx_timestamp_timeout 500 fails with this error:

  timed out while polling for tx timestamp
  increasing tx_timestamp_timeout or increasing kworker priority may correct this issue, but a driver bug likely causes it
  port 1 (eth0): send sync failed
  port 1 (eth0): MASTER to FAULTY on FAULT_DETECTED (FT_UNSPECIFIED)
  

Displaying the keyboard map

gkbd-keyboard-display -l "ch(fr)"

• Raspberry Pi 3
• SD card (200MB will do, yes, 200MB!)
• Waveshare MAX-M8Q GNSS HAT for Raspberry Pi
• Raspberry Pi official case for 3B+

SW - OS and basic settings

1. Download OpenWRT 24.10.5 openwrt-24.10.5-bcm27xx-bcm2710-rpi-3-squashfs-factory.img.gz, flash it on the flash.

   :point_up: I find the squashfs more stable than the ext4 one, and it will cause less wear on the SD card.

2. Modify the /boot/config.txt (config.txt in the boot partition):

   ...
   [all]
   # Place your custom settings here.
   dtoverlay=pps-gpio,gpiopin=18
   ...
   

3. Disable the serial console (we need the serial port for the GPS) in /boot/dline.txt

   console=tty1 root=PARTUUID=c8dca970-02 rootfstype=squashfs,ext4 rootwait
   

4. Assemble all the HW, and boot. The raspberry will have the 192.168.1.1 address, t I prefer it to DHCP.

   uci set network.lan.proto=dhcp
   uci commit
   /etc/init.d/network restart
   

5. Since this machine is not a router :

   /etc/init.d/firewall disable
   /etc/init.d/odhcpd disable
   /etc/init.d/dnsmasq disable
   reboot
   

6. Setup a root password

   root@OpenWrt:~# passwd
   Changing password for root
   New password:
   Bad password: too weak
   Retype password:
   passwd: password for root changed by root
   

7. Setup authorized_keys and disable root password login
8. Configure hostname

    uci set system.@system[0].hostname=pim-ntp
    uci commit
    echo pim-ntp > /proc/sys/kernel/hostname
   

9. Install the tools

   opkg update
   uci set system.ntp.enable='0'
   uci commit
   /etc/init.d/sysntpd disable
   /etc/init.d/sysntpd stop
   /etc/init.d/ntpd disable
   /etc/init.d/ntpd stop
   opkg install chrony kmod-pps-gpio gpsd gpsd-clients \
   nano rsync umdns coreutils-who zabbix-agentd python3-light kmod-usb-net-rtl8152
   /etc/init.d/chronyd enable
   

   SW - GPSD, chrony and PPS

10. Configure gpsd

    uci set gpsd.core.device='/dev/ttyAMA0'
    uci set gpsd.core.enabled='1'
    uci commit
    /etc/init.d/gpsd enable
    /etc/init.d/gpsd start
    

11. Check GPS connectivity : cgps -s -u m should show Status 3D FIX
12. Configure chronyd for using country specific servers in /etc/config/chrony:

    config pool
    	       option hostname '0.ch.pool.ntp.org'
            option iburst 'yes'
    ...
    

13. Add the GPS and PPS sources at the end of : /etc/chrony/chrony.conf

    refclock PPS /dev/pps0 refid PPS poll 0

    local stratum 10 orphan …

14. (Re-) Start chronyd

    /etc/init.d/chronyd restart
    

15. Check GPS and PPS functionality :

    chronyc sources
    

    MS Name/IP address         Stratum Poll Reach LastRx Last sample               
    ===============================================================================
    #- GPS                           0   2   377     4  +1157us[+1157us] +/-  100ms
    #* PPS                           0   1   377     1   -114ns[ -209ns] +/-  669ns
    ^- redacted1.example.com         3  10   377  1028  -9345us[-9381us] +/-   52ms
    ^- redacted2.example.com         2  10   377   824  -4990us[-5019us] +/-   11ms
    ^- redacted3.example.com         2  10   377   174  -3748us[-3755us] +/-   35ms
    ^- redacted4.example.com         1  10   377  1023  -3986us[-4022us] +/- 8996us
    ^- router.lan                    2   6   377    33  -3157us[-3157us] +/-   40ms
    ^? pim-ntp.lan                   0   8     0     -     +0ns[   +0ns] +/-    0ns
    

    Configure NTP pool DNS and DHCP on a OpenWRT router

16. Setup all your NTP servers in a DNS pool (/etc/config/dhc)

    ...
    config domain
        option name 'ntp'
        option ip 'XXX.XXX.XXX.XXX' # address of the router with a NTP server
    
    config domain
        option name 'ntp'
        option ip 'XXX.XXX.XXX.YYY' # address of the ntp server (from this post)
    ...
    

17. Setup the DHCP to announce NTP servers:

    uci add_list dhcp.lan.dhcp_option='42,XXX.XXX.XXX.XXX,XXX.XXX.XXX.YYY'
    uci commit
    

18. Restart dnsmasq

    /etc/init.d/dnsmasq restart
    

    Result

    A small animation : watch chronyc sources (opkg install procps-ng-watch)

1. (Optional) Optimisation for timing

   :point_up: The backup battery on the Waveshare MAX-M8Q GNSS HAT is mandatory. Whitout it, the module will lose it’s configuration every power loss. The symptom will be NO FIX, since the module will go back to 9600 bauds.

   • set jumpers on A
   • connect to your favorite Linux host using the USB cable
   • start gpsd on the usb port

      ubxtool -s 9600 -S 115200
      ubxtool -p MODEL,2
      ubxtool -p CFG-PMS,0
      ubxtool -p SAVE
      ubxtool -p COLDBOOT # validate the settings are OK
     

   • re-set jumpers on B
   • configure 11500 bauds using -s 115200 in /etc/init.d/gpsd:

      ...
      [ "$enabled" = "0" ] && return 1
     
       	    procd_open_instance
       	    procd_set_param command "$PROG" -N -n -s 115200
     
       	    [ "$listen_globally" -ne 0 ] && procd_append_param command -G
       	    procd_append_param command -S "$port"
      ...
     

Add the user to the nonet group

# create the nonet group
sudo groupadd -g FREE_GID nonet # If you don't care about the GID : sudo groupadd nonet

# add the user THE_USER to the group
sudo usermod -a -G nonet THE_USER

Create the service file /etc/systemd/system/nonet-for-group-nonet.service

[Unit]
Description=Disable network for group nonet

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=iptables -A OUTPUT -o lo -p all -m owner --gid-owner nonet --suppl-groups -j ACCEPT
ExecStart=iptables -A OUTPUT -p all -m owner --gid-owner nonet --suppl-groups -j REJECT
ExecStart=ip6tables -A OUTPUT -o lo -p all -m owner --gid-owner nonet --suppl-groups -j ACCEPT
ExecStart=ip6tables -A OUTPUT -p all -m owner --gid-owner nonet --suppl-groups -j REJECT

ExecStop=iptables -D OUTPUT -o lo -p all -m owner --gid-owner nonet --suppl-groups -j ACCEPT
ExecStop=iptables -D OUTPUT -p all -m owner --gid-owner nonet --suppl-groups -j REJECT
ExecStop=ip6tables -D OUTPUT -o lo -p all -m owner --gid-owner nonet --suppl-groups -j ACCEPT
ExecStop=ip6tables -D OUTPUT -p all -m owner --gid-owner nonet --suppl-groups -j REJECT

[Install]
WantedBy=multi-user.target

Reload services

sudo systemctl daemon-reload

Test network for user THE_USER (SHOULD work fine):

sudo -u THE_USER curl -I https://cli.pignat.org/pages/ubuntu-disable-network-for-a-gid.html
HTTP/2 200 OK
...

Start the service

• sudo systemctl start to disable network access for
• sudo systemctl enable to disable network access at boot
• sudo systemctl stop to allow network access

Test network for user THE_USER (SHOULD NOT work):

sudo -u THE_USER curl -I https://cli.pignat.org/pages/ubuntu-disable-network-for-a-gid.html
curl: (7) Failed to connect to cli.pignat.org port 443 after 2 ms: Couldn't connect to server

:warning: ping will still work because it is installed with setuid root on Debian-based distributions.

* The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in RFC 2119.

Disable automatic upgrades

# list of systemd services/timers to disable
declare -a svc=(
  "unattended-upgrades.service"
  "apt-daily-upgrade.service"
  "apt-daily-upgrade.timer"
  "apt-daily.service"
  "apt-daily.timer"
  "apt-news.service"
  "fwupd-offline-update.service"
  "fwupd-refresh.service"
  "fwupd-refresh.timer"
  "fwupd.service"
)

for i in "${svc[@]}"
do
   sudo systemctl disable "$i"
   sudo systemctl stop "$i"
   sudo systemctl mask "$i"
done

# disable snap updates
sudo snap refresh --hold=forever

# disable update-notifier (so it won't trigger when we do a manual update)
sudo sed -i 's/DPkg::Post-Invoke/#DPkg::Post-Invoke/' /etc/apt/apt.conf.d/99update-notifier

# disable periodic apt updates
sudo sed -i 's/APT::Periodic::Update-Package-Lists "1"/APT::Periodic::Update-Package-Lists "0"/' /etc/apt/apt.conf.d/10periodic


# forget new packages in aptitude
echo 'Aptitude::Forget-New-On-Update "true";' | sudo tee /etc/apt/apt.conf.d/99aptitude-forget-new

Use the_hosname.local as URI, exemple:

user@host:/anywhere$ ping -c1 pim-checker.local
PING pim-checker.local (X.X.X.95) 56(84) bytes of data.
64 bytes from X.X.X.95: icmp_seq=1 ttl=64 time=1.57 ms

--- pim-checker.local ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.568/1.568/1.568/0.000 ms
user@host:/anywhere$

Avahi uses zeroconf (also called Bonjour by Apple) to discover hosts. On a minimal setup, it may not be installed (sudo apt-get install avahi-daemon).

or the good old method

Here is how to find a device IP address on a DHCP network, knowing only it’s MAC address, an open TCP port and our own IP on the network.

• Look at the device MAC address, here I’m searching for a raspberry PI, so I know it will start with 88:a2:9e*.
• Put the empty file named ssh on the boot partition of the raspberry PI to enable ssh.
• Detect a host running ssh on the network:

  nmap -p 22 --open X.X.X.0/24
  

• Search the know host in the ARP table:

  arp -a | grep 88:a2:9e
  ? (X.X.X.95) at 88:a2:9e:YY:YY:YY [ether] on br0
  

Known Rapberry Pi OUIs (Organizationally Unique Identifiers)

Did you say MAC address? Here is how to find all possible

user@host:/anywhere$ sudo update-ieee-data
...
user@host:/anywhere$ cat /var/lib/ieee-data/oui.txt | grep -i hex | grep -i "Raspberry Pi"
D8-3A-DD   (hex)		Raspberry Pi Trading Ltd
DC-A6-32   (hex)		Raspberry Pi Trading Ltd
E4-5F-01   (hex)		Raspberry Pi Trading Ltd
88-A2-9E   (hex)		Raspberry Pi (Trading) Ltd
28-CD-C1   (hex)		Raspberry Pi Trading Ltd
B8-27-EB   (hex)		Raspberry Pi Foundation
2C-CF-67   (hex)		Raspberry Pi (Trading) Ltd
user@host:/anywhere$

You’re using docker with namespace isolation (userns-remap) and portainer can’t access /var/run/docker.sock?

Here is the solution, please note the --userns host:

docker run --userns host -d --name portainer --restart=unless-stopped -v /var/run/docker.sock:/var/run/docker.sock:z -v portainer_data:/data portainer/portainer-ce:lts

No published ports, since nginx, runs on the same host.

Here is the nginx config:

server {
	server_name portainer.example.com;

	include snippets/my_ssl_config.conf;
	listen 443 ssl;
	listen [::]:443 ssl;

	location / {
		proxy_set_header Host $host;
		proxy_pass http://PORTAINER_IP:9000/;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "upgrade";
		proxy_http_version 1.1;
	}
}

This page is about 24.04, here is the page about motd in 18.04.

My current ubuntu server greets me like this :

Welcome to Ubuntu 24.04.3 LTS (GNU/Linux 6.8.0-88-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Thu Dec  4 01:02:03 UTC 2025

  System load:           0.0
  Usage of /:            16.5% of 23.17GB
  Memory usage:          6%
  Swap usage:            0%
  Processes:             126
  Users logged in:       0
  IPv4 address for enX0: 23.75.345.200
  IPv6 address for enX0: 0:0:0:0:0:ffff:174b:159c8

 * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
   just raised the bar for easy, resilient and secure K8s cluster deployment.

   https://ubuntu.com/engage/secure-kubernetes-at-the-edge

Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status


Last login: Wed Dec  3 01:02:03 2025 from 75.748.86.91
user@machine:~$

Make it less verbose

# I know where to find help
sudo chmod -x /etc/update-motd.d/10-help-text

# The state of my system is fine (otherwise zabbix, monit or OnlineBot would have told me).
sudo chmod -x /etc/update-motd.d/50-landscape-sysinfo

# I know about meltdown and spectre, since I'm a grumpy reader of https://lwn.net
sudo chmod -x /etc/update-motd.d/50-motd-news

# I won't buy support for my home server:
sudo chmod -x /etc/update-motd.d/91-contract-ua-esm-status

# I manage updates myself
sudo chmod -x /etc/update-motd.d/85-fwupd
sudo chmod -x /etc/update-motd.d/92-unattended-upgrades
sudo chmod -x /etc/update-motd.d/90-updates-available

# LTS releases are every 2 years
sudo chmod -x /etc/update-motd.d/91-release-upgrade

Result

Welcome to Ubuntu 24.04.3 LTS (GNU/Linux 6.8.0-88-generic x86_64)

Last login: Thu Dec  4 02:03:04 2025 from 75.748.86.91

Veni, vidi, vici.