Setup Network boot for installing OS using PXE server

Network configuration of server

In this section, we will look into the concept of booting from a network, which solely stands on computer networkng. That is why, the server must be configured correctly. Follow the process carefully for the network configuration of server.

Assign static IP address

We need to assign a static IP address to the server in order to improve reliability and prevent unexpected connectivity issues for the client systems. Another possible reason is that dynamically allocated IP address changes over time which will lead to connectivity issues.

In order to modify the network connection, first you need to find the name of active network connection. Use the following command in the terminal:

nmcli --fields NAME con show --active|tail -n 1

This command will output the name of active network connection. You will get the result somewhat similar to this image:

Now that we have the connection name, we can modify the connection to assign static IP address and DNS nameservers. Use the following command to do this:

sudo nmcli con mod "Wired connection 1" ipv4.method manual ipv4.address 192.168.1.221/24 ipv4.gateway 192.168.1.2 ipv4.dns 1.1.1.1,8.8.8.8

• In this command, "Wired connection 1" is my connection name (you must replace it with your connection name that you find out using the previous command).
• 192.168.1.221 is the static IP address that I'm assigning, replace it with the IP address available on your network.
• /24 represents 255.255.255.0 subnet in CIDR notation, you should also change it according to your network.
• 192.168.1.2 is my internet gateway address, replace it with the internet gateway address of your network.
• 1.1.1.1,8.8.8.8 are the DNS servers that I'll be using. Assigning DNS servers manually is necessary. You can use also use these DNS servers or you can use custom servers if you want.

After setting the static IP, use sudo nmcli con reload and sudo systemctl restart NetworkManager commands to restart the network service. Now use the below command to check IP address:

ip add

Here you can see that my IP address has been changed. If your system still reflects the old IP address, you may need to use sudo reboot command to reboot your system.

After verifying IP change, test that your configuration is correct by pinging a public domain. Use the below command:

ping -c 3 google.com

If you got the same output from ping command as the image above, then your static IP configuration is correct. You can also use sudo nmtui command for configuring static IP if you prefer GUI mode.

Configuring dnsmasq on iPXE server

In the previous section, we talked about DHCP where the iPXE client will be assigned an IP address for booting from the network. This is where dnsmasq comes to play. Aside from It's feature of DNS server, it can also act as a lightweight DHCP server. dnsmasq is crucial for the process because iPXE clients need IP addresses to perform any kind of communication such as locating boot server.

dnsmasq can also act as tftp server because iPXE is usually dependent on it for fetching It's scripts and configuration files. To install dnsmasq, first we need to stop and disable systemd-resolved.service. Because both dnsmasq and systemd-resolved.service utilize port 53 and two services cannot use the same port at a time.

Use the following commands where first command will stop and disable the systemd-resolved.service, the second command will unlink Its configuration file, and third command will create a new file resolv.conf that will be used to specify DNS server that system should use for domain name resolution.

sudo systemctl stop --now systemd-resolved.service

sudo unlink /etc/resolv.conf

sudo nano /etc/resolv.conf

nameserver 127.0.0.1
nameserver 8.8.8.8
nameserver 8.8.4.4

Here I'm using 8.8.8.8 & 8.8.4.4 as my primary & secondary nameserver by Google but you can replace them other DNS nameservers if you want.

sudo apt install dnsmasq

If you had stopped the systemd-resolved.service as described above, dnsmasq will be installed and start listening on port 53 successfully. Otherwise, you will get port is use error which means systemd-resolved.service is still active. Make sure to disable it first.

Now create a new dnsmasq configuration file but first keep the backup of original configuration file. Use the following command:

sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf-backup && sudo nano /etc/dnsmasq.conf

A new blank file will be opened. Copy and paste the following lines in it:

# Debug logging
log-debug

# server NIC name
interface=ens33 
bind-interfaces

# This range(s) is for the public interface, where dnsmasq functions
# as a proxy DHCP server providing boot information but no IP leases.
# Any ip in the subnet will do, so you may just put your server NIC ip here.
dhcp-range=ens33,192.168.1.180,192.168.1.200,255.255.255.0,8h
dhcp-option=option:router,192.168.1.1   # Router IP address
dhcp-option=option:dns-server,8.8.8.8   # primary DNS server
dhcp-option=option:dns-server,8.8.4.4   # Secondary DNS server

To use dnsmasq internal TFTP server
enable-tftp
tftp-root=/pxe_netboot

# BIOS configuration
dhcp-match=set:bios-x86,option:client-arch,0
dhcp-boot=tag:bios-x86,firmware/ipxe.pxe

# UEFI configuration
dhcp-match=set:efi-x86_64,option:client-arch,7
dhcp-match=set:efi-x86_64,option:client-arch,9
dhcp-boot=tag:efi-x86_64,firmware/ipxe.efi

Lets break it down, understand what each line means, and what you might need to change according to your system.

• In interface=ens33, ens33 is my NIC (Network Interface Card) name. You must replace it with your interface card name. Use ls /sys/class/net | head -1 command in terminal to find the name of your active NIC.
• Also specify your NIC name in dhcp-range= attribute. This attribute defines the range of IP addresses that are available for allocating to iPXE clients. You must select the same subnet and IP range as your iPXE server.
• Option dhcp-option=option:router,192.168.1.1 specify the router IP address. Most of the routers are configured to work on 192.168.1.1 by default but you must check your router IP and replace it here if different. Use ip route | grep default command to know your router IP address. (I'm assuming your router IP is same as your internet gateway, which in most cases is true if not changed manually.)

Press Ctrl + x and then y to save and close the file. Your dnsmasq configuration is finished here. Use below command to restart dnsmasq service

sudo systemctl restart dnsmasq

Configuring NFS on iPXE server

In this section, we'll configure NFS (Network File System) on iPXE server for serving operating system files to iPXE clients over network boot. The package used for this process is nfs-kernel-server which we have already installed in prerequisites section. Use the below command to define export settings for /pxe_netboot directory:

echo "/pxe_netboot        *(ro,sync,no_wdelay,insecure_locks,no_root_squash,insecure,no_subtree_check)" | sudo tee -a /etc/exports

This command will append a new line in NFS exports file that will allow /pxe_netboot directory to be served on network boot with appropriate access rights.

We also need to assign a port to mountd service. mountd is an essential component of NFS that is responsible for NFS clients to mount NFS shared directories. If you are not utilizing any firewall (UFW or Firewalld) then you can skip this part. This method is for the UFW firewall to allow mountd. Firewalld may not need this.

sudo nano /etc/nfs.conf

In this configuration file, go to mountd block and add port=13025 in new line. Now press Ctrl + x and then y to save and close the file. Your NFS configuration file should look like this:

NFS configuration is completed with this part. Use below command to restart NFS service:

sudo systemctl restart nfs-server.service

Managing UFW firewall for iPXE network boot

If you are not using any firewall, then you can probably skip this section though It's not a good idea to use network boot without a firewall. We are using multiple services in this process and all these services use different ports on system that need access through the firewall. Use the following commands to all firewall files in UFS:

sudo ufw allow bootps

sudo ufw allow 69/udp

sudo ufw allow 111

sudo ufw allow nsf

sudo ufw allow 13025

sudo ufw reload

• sudo ufw allow bootps allows bootps (Bootstrap protocol service) service that assigns new IP address to network devices on boot process.
• sudo ufw allow 69/udp allows UDP port 69 which is used by TFTP to transfer boot configuration and bootloader binaries to iPXE clients.
• sudo ufw allow 111 allows port 111 which is used by rpcbind service. This service must be allowed in firewall to establish a connection over NFS.
• sudo ufw allow nfs allows NFS service through firewall.
• sudo ufw allow 13025 allows port 13025 through the firewall. This is the port we assign to mountd in the previous part. It is responsible for NFS clients mounting the NFS shared directory.
• sudo ufw reload reloads the firewall to make the changes effective.

Now that all the services and components of iPXE network boot server are configured, It's time to test the server from client system.

Testing

Now go the any other system that is connected to the same network as your iPXE server is and boot your computer in network boot mode. Usually you can access boot menu by pressing F12 or F8 button while booting the system. You will see options something like this:

Based on your system, you might have different layouts and options in the boot menu, but the main thing is to select Network boot option from menu. Here, my network boot is under EFI Network option. Selecting it initializes the iPXE server as shown in below image:

In iPXE server initialization, IP address is assigned to the client system and bootloader binaries are loaded. Then you will be presented with the OS menu where you can select the available operating systems to boot from. Check the image below:

As in our case, we only have Ubuntu in OS menu. Selecting this operating system will start the booting process for Ubuntu and installation process of Ubuntu 22.04.3 LTS will be started. This way you can install OS on client systems using network boot mode.