Network considerations

Review the most notable changes to networking between RHEL 9 and RHEL 10.

Network team driver was removed

The teamd service and the libteam library were removed in Red Hat Enterprise Linux 10. As a replacement, configure a bond instead of a network team.

Red Hat focuses its efforts on kernel-based bonding to avoid maintaining two features, bonds and teams, that have similar functions. The bonding code has a high customer adoption, is robust, and has an active community development. As a result, the bonding code receives enhancements and updates.

If you use RHEL 9 with a network team and plan to upgrade to RHEL 10, migrate the network team configuration to network bond before you upgrade.

Removed support for network configuration files in the ifcfg format
Starting with RHEL 9.0, RHEL stored newly created network configurations in a key file format in the /etc/NetworkManager/system-connections/ directory. The connections, for which the configurations had already been stored from previous times in the /etc/sysconfig/network-scripts/ directory in the old ifcfg format still worked uninterrupted. However, with the RHEL 10 release, the support for the ifcfg format based network configuration files was removed.
The dhclient utility was removed
The dhclient utility is a client program used to obtain IP addresses, network configuration, and other information from a DHCP server. Since dhclient is no longer developed as of early 2022, the utility was removed in Red Hat Enterprise Linux 10. As a consequence of the removal, you can no longer set dhcp=dhclient in /etc/NetworkManager.conf. As a replacement, use the dhcp=internal (default) in your NetworkManager configuration.
Removed NIC device drivers related to iPXE

Internet Preboot eXecution Environment (iPXE) firmware provides a range of boot options over a network often used in environments, where machines need to boot remotely. Among others, it contains a large number of device drivers. With the RHEL 10 release, the following will be removed:

  • The complete ipxe-roms sub-RPM package
  • Binary files containing device drivers from ipxe-bootimgs-x86 sub-RPM package:
    • /usr/share/ipxe/ipxe-i386.efi
    • /usr/share/ipxe/ipxe-x86_64.efi
    • /usr/share/ipxe/ipxe.dsk
    • /usr/share/ipxe/ipxe.iso
    • /usr/share/ipxe/ipxe.lkrn
    • /usr/share/ipxe/ipxe.usb

Instead, iPXE now depends on the platform firmware to provide a NIC driver for the network boot. The /usr/share/ipxe/ipxe-snponly-x86_64.efi and /usr/share/ipxe/undionly.kpxe iPXE binary files are the part of the ipxe-bootimgs package and use the NIC driver provided by the platform firmware.

NetworkManager-initscripts-updown is not available
The NetworkManager-initscripts-updown sub-package is removed in RHEL 10 because the related network-scripts package had already been removed in RHEL 9.
Moving some kernel modules to kernel-modules-extra

All kernel modules related to the following utilities have been moved to the kernel-modules-extra package:

  • iptables
  • ip6tables
  • ipset
  • ebtables
  • arptables
ATM encapsulation has been removed
Asynchronous Transfer Mode (ATM) encapsulation enables Layer-2 (Point-to-Point Protocol, Ethernet) or Layer-3 (IP) connectivity for the ATM Adaptation Layer 5 (AAL-5). In RHEL 9, the ATM implementation was unsupported and deprecated. In RHEL 10, the kernel feature has been disabled in the kernel, and ATM is no longer available.
The PF_KEYv2 kernel API has been removed
In earlier RHEL versions, applications could configure the kernel’s IPsec implementation by using the deprecated PV_KEYv2 and the newer netlink API. PV_KEYv2 has not been actively maintained upstream and is missing important security features, such as modern ciphers, offload, and extended sequence number support. As a result, the PV_KEYv2 API has been removed in RHEL 10. If you used this kernel API in applications, migrate your applications to use the modern netlink API as an alternative.
The firewalld lockdown feature has been removed
The firewalld lockdown feature could not prevent processes that are running as root from adding themselves to the allow list. In RHEL 10, this feature has been removed.
The firewalld service supports policy sets

This enhancements adds support for policy sets to the firewalld service. Policy sets are collections of pre-defined policies that you can use as a starting point for certain configurations. For example, the gateway policy set is a set of configurations that enable masquerading, connection tracking helpers, and forwarding between zones.

For further details, see Using firewalld policy sets to configure a router.

The nftables framework supports name-based netdev hooks with wildcards

This enhancement introduces name-based netdev hooks with wildcard support to the nftables kernel component. This ensures defined rule sets remain stable regardless of interface presence. Previously, nftables would bind to each specified interface immediately upon adding a flowtable or netdev-family chain. Consequently, the transaction failed due to a non-existing interface, and removing an interface deleted the matching interface specifications or entire bound chains.

With this update, hooks for non-existing interfaces are accepted in an inactive state and bind to matching interfaces at the time they appear in the system. This dynamic registration also provides the possibility to accept simple interface (suffix) wildcards to bind a flowtable or netdev-family chain to any matching interface. You can inspect currently active hooks by using the nft list hooks command.

Threaded NAPI busy polling support added

In RHEL 10.2 and later, you can enable threaded NAPI busy polling to significantly reduce the network latency. This feature uses dedicated kernel threads to continuously check for incoming packets, rather than waiting for hardware interrupts.

By design, threaded NAPI busy polling consumes more CPU cycles to achieve higher performance and lower latency, as the CPU remains active to process data immediately. Threaded NAPI busy polling is beneficial for high-performance, low latency applications, for example applications that use the AF_XDP socket. Use this enhancement for workloads where predictable, sub-microsecond response times are critical.

NetworkManager supports IPv6-mostly networks and CLAT

With support for IPv6-mostly networks and customer-side translation (CLAT) in RHEL 10.3 and later, you can transition more easily to IPv6-only environments. This transition helps you save IPv4 addresses while keeping connections active for older applications that still require IPv4.

By setting the ipv4.clat connection property to auto, NetworkManager automatically detects when a network supports IPv6-mostly operations. When detected, NetworkManager disables native IPv4 addressing and activates CLAT to translate local IPv4 traffic over the IPv6 network.

The firewalld service detects config file changes and logs corrective actions

The firewalld service monitors its configuration files for external changes, such as manual edits by an administrator or updates made by Ansible. In previous releases, invalid external modifications could silently cause a service reload or restart to fail. With this update, firewalld detects config file changes and logs suggested corrective actions to help prevent service failures.