Static IP and routes with netplan on Ubuntu

You’ll work on ubu01 as student with sudo. Keep the VirtualBox console window of ubu01 open next to your SSH session: if the network change goes wrong, you log in there and fix it. Take a snapshot first (VBoxManage snapshot ubu01 take before-l32 on the laptop).

The address stays 10.10.10.21, so the rest of the course still works when you finish.

1Read what the installer wrote

Run this:

ls -l /etc/netplan/
sudo cat /etc/netplan/50-cloud-init.yaml
ip -br addr show enp0s3

You should see something like this:

total 4
-rw------- 1 root root 249 Oct 21 10:14 50-cloud-init.yaml
network:
  version: 2
  ethernets:
    enp0s3:
      addresses:
      - "10.10.10.21/24"
      nameservers:
        addresses:
        - 10.10.10.1
        search:
        - saatlab.test
      routes:
      - to: "default"
        via: "10.10.10.1"
enp0s3           UP             10.10.10.21/24 fe80::a00:27ff:fe5e:7d21/64

The installer turned your answers from Lesson 2 into YAML: one address, DNS 10.10.10.1 with the search domain saatlab.test, and a default route. The file is mode 600 (root only), which is what netplan expects. Some installs name it 00-installer-config.yaml instead; use whatever name ls shows in every command below.

✅ Checkpoint: You can point at the address, the gateway and the DNS server in the file, and ip shows the same address on enp0s3.

2Find out who owns the file

Run this:

grep -r "config: disabled" /etc/cloud/cloud.cfg.d/
networkctl list

You should see something like this:

/etc/cloud/cloud.cfg.d/subiquity-disable-cloudinit-networking.cfg:network: {config: disabled}
IDX LINK   TYPE     OPERATIONAL SETUP
  1 lo     loopback carrier     unmanaged
  2 enp0s3 ether    routable    configured

2 links listed.

The first line says cloud-init won’t touch networking on this server, so editing 50-cloud-init.yaml is safe. If grep prints nothing (common on cloud images and VM templates), create the switch yourself before you edit anything:

echo 'network: {config: disabled}' | sudo tee /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg

networkctl answers the second question: enp0s3 is “configured” by systemd-networkd, so networkd is the renderer here.

✅ Checkpoint: You know whether cloud-init can rewrite your netplan file, and networkctl shows enp0s3 as routable and configured.

3Back up and write the new file

Paste this whole block:

sudo cp /etc/netplan/50-cloud-init.yaml /root/50-cloud-init.yaml.$(date +%Y%m%d).bak
sudo tee /etc/netplan/50-cloud-init.yaml >/dev/null <<'EOF'
network:
  version: 2
  ethernets:
    enp0s3:
      dhcp4: false
      addresses:
        - 10.10.10.21/24
      routes:
        - to: default
          via: 10.10.10.1
        - to: 10.50.0.0/16
          via: 10.10.10.1
      nameservers:
        search: [saatlab.test]
        addresses: [10.10.10.1]
EOF
sudo chmod 600 /etc/netplan/50-cloud-init.yaml
sudo ls -l /root/*.bak /etc/netplan/

You should see something like this:

-rw------- 1 root root 249 Oct 27 11:02 /root/50-cloud-init.yaml.20261027.bak

/etc/netplan/:
total 4
-rw------- 1 root root 307 Oct 27 11:02 50-cloud-init.yaml

The backup goes to /root, not /etc/netplan, because netplan reads every .yaml file in that folder and a copy named 50-cloud-init.yaml.bak is harmless but a copy named old.yaml would be applied too. The new file adds dhcp4: false to make the intent clear, and a second route: traffic for 10.50.0.0/16 (say, the office network) goes via 10.10.10.1. In a real data centre that would be a different router; the lab only has one, but the route still shows up and gets used.

Try it yourself: build this netplan file for your own interface and addresses in the Command Builder.

✅ Checkpoint: The backup exists in /root and the new file is mode 600.

4Check it with netplan generate

Run this:

sudo netplan generate && echo "YAML OK"
sudo cat /run/systemd/network/10-netplan-enp0s3.network

You should see this:

YAML OK
[Match]
Name=enp0s3

[Network]
LinkLocalAddressing=ipv6
Address=10.10.10.21/24
DNS=10.10.10.1
Domains=saatlab.test

[Route]
Destination=0.0.0.0/0
Gateway=10.10.10.1

[Route]
Destination=10.50.0.0/16
Gateway=10.10.10.1

No warnings and “YAML OK” means the file parsed cleanly. The second command shows the translation: each YAML route became a [Route] section for networkd, and the search domain became Domains. This is the file networkd will read, which is useful when you want to know what netplan asked networkd to do.

✅ Checkpoint: generate prints nothing before “YAML OK”, and the .network file has two [Route] sections.

5Apply safely with netplan try

Run this, then press Enter when the countdown starts:

sudo netplan try

You should see something like this:

Do you want to keep these settings?


Press ENTER before the timeout to accept the new configuration


Changes will revert in 108 seconds
Configuration accepted.

try applied the config and started the 120-second countdown. Your SSH session kept working, so you pressed Enter and netplan kept the new settings. Had the session frozen, you’d do nothing: after two minutes netplan prints “Reverting.” and puts the old config back, and your SSH session comes back on its own.

On a remote server this is the command to use every time.

✅ Checkpoint: netplan printed “Configuration accepted.” and your SSH session is still alive.

6Read the live routes and DNS

Run this:

ip route
ip route get 10.50.1.10
resolvectl status enp0s3 | head -n 6

You should see something like this:

default via 10.10.10.1 dev enp0s3 proto static
10.10.10.0/24 dev enp0s3 proto kernel scope link src 10.10.10.21
10.50.0.0/16 via 10.10.10.1 dev enp0s3 proto static
10.50.1.10 via 10.10.10.1 dev enp0s3 src 10.10.10.21 uid 1000
    cache
Link 2 (enp0s3)
    Current Scopes: DNS
         Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 10.10.10.1
       DNS Servers: 10.10.10.1
        DNS Domain: saatlab.test

Both routes are in the kernel with proto static, which means networkd added them from your file. ip route get asks the kernel “which way would you send this packet?” and the answer is via 10.10.10.1, out of enp0s3, from 10.10.10.21. resolvectl shows DNS 10.10.10.1 and the search domain on this link, so ping rocky01 would try rocky01.saatlab.test too.

✅ Checkpoint: ip route shows the default route and 10.50.0.0/16, both proto static.

7Ask netplan what it thinks is live

Run this:

sudo netplan get ethernets.enp0s3.routes
netplan status enp0s3

You should see something like this:

- to: "default"
  via: "10.10.10.1"
- to: "10.50.0.0/16"
  via: "10.10.10.1"
     Online state: online
    DNS Addresses: 127.0.0.53 (stub)
       DNS Search: saatlab.test

●  2: enp0s3 ethernet UP (networkd: enp0s3)
      MAC Address: 08:00:27:5e:7d:21 (Intel Corporation)
        Addresses: 10.10.10.21/24
                   fe80::a00:27ff:fe5e:7d21/64 (link)
    DNS Addresses: 10.10.10.1
       DNS Search: saatlab.test
           Routes: default via 10.10.10.1 (static)
                   10.10.10.0/24 from 10.10.10.21 (link)
                   10.50.0.0/16 via 10.10.10.1 (static)
                   fe80::/64 metric 256

netplan get reads the merged YAML (all files together), which is how you check what a stack of files adds up to. netplan status reads the live state from networkd and the kernel and shows it next to what netplan manages. The 127.0.0.53 at the top is systemd-resolved’s local stub, which forwards to 10.10.10.1.

✅ Checkpoint: Both routes appear in netplan get and in the Routes lines of netplan status.

8Prove the change survives a reboot

Run this:

sudo reboot
# log in again after about 30 seconds, then:
ip -br addr show enp0s3; ip route | grep 10.50

You should see something like this:

enp0s3           UP             10.10.10.21/24 fe80::a00:27ff:fe5e:7d21/64
10.50.0.0/16 via 10.10.10.1 dev enp0s3 proto static

Same address and the extra route is back, so the file is what the server boots with and cloud-init left it alone. Most “the IP changed after the patch reboot” tickets come from skipping this step.

✅ Checkpoint: After the reboot ubu01 is still 10.10.10.21 with the 10.50.0.0/16 route.