---
title: "NIOS-X Bare-Metal"
canonical: "https://docs.infoblox.com/space/BloxOneInfrastructure/204538556/NIOS-X%20Bare-Metal"
format: markdown
---
> ❌ ### Important Note
> ❌ 
> ❌ The minimum system requirements specified for NIOS-X servers must be dedicated to the server you plan to deploy. They cannot be shared with or used for other non-Infoblox applications. Doing so will negatively affect the performance of your Infoblox Platform services. For information about the minimum system requirements and port usage, see the following:
> ❌ 
> ❌ - *[Firewall Requirements for Infoblox Cloud Services](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneInfrastructure/pages/873660456)*
> ❌ - *[Minimum System Requirements for NIOS-X Servers](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneInfrastructure/pages/873758806)*
> ❌ - *[Supported Platforms for NIOS-X Servers](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneInfrastructure/pages/873693279)*
> ❌ - *[Port Usage for Bare-Metal NIOS-X Servers](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneInfrastructure/pages/873758860)*

## Prerequisites for Bare-Metal Deployment

Before you start the deployment, complete the following:

- Ensure that your Docker or containerd environment meets the minimum deployment requirements.
- Open all required ports on the NIOS-X servers, as listed in Port Usage for Bare-Metal NIOS-X Servers, in addition to the ports required for firewalls.
- Ensure that there are no other processes using port 53 on the server system on which your NIOS-X server will be deployed. For example, some Ubuntu systems running local DNS cache (system-resolved) might occupy port 53, and your server might not function properly in this case.
- Dind (Docker-in-Docker) configuration is not supported for NIOS-X server deployments.
- Avoid K3s CIDR overlapping with the default CIDR.
- No K3s binary should be placed in this directory: `/usr/local/bin/`.
- SELinux policy is properly set up.
- AWS Xen-based instances are not supported (because they create interface names with capital letters) for NIOS-X deployments on Ubuntu 24.04.
  - **General purpose**: M1, M2, M3, M4, T1, T2
  - **Compute optimized**: C1, C3, C4
  - **Memory optimized**: R3, R4, X1, X1e
  - **Storage optimized**: D2, H1, I2, I3
  - **Accelerated computing**: F1, G3, P2, P3

## RHEL Setup

### 1. Install Required Packages

**Note:** Do not install Docker on Red Hat. Only install containerd. For information, see [http://containerd.io](http://containerd.io) .

## Install Yum and ContainerD

```
sudo dnf install -y yum-utils device-mapper-persistent-data lvm2
sudo dnf config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
sudo dnf install -y containerd.io
```

# Install dig utility and net-tools

```
sudo yum install -y bind-utils net-tools
```

# Install SELinux packages

```
# Install SELinux packages
sudo yum install -y container-selinux selinux-policy-base
```

#### For RHEL 8.x or 9.x:

```
# Replace OS with your RHEL version (el8 or el9)
OS=$(cat /etc/redhat-release | grep -oE '[0-9]+\.[0-9]+' | cut -d '.' -f1)
sudo yum install -y https://github.com/k3s-io/k3s-selinux/releases/download/v1.6.latest.1/k3s-selinux-1.6-1.el${OS}.noarch.rpm
```

This command automatically detects your RHEL major version (8 or 9) and installs the appropriate package.

### 2. Configuration

#### Container Runtime Setup

```
sudo mkdir -p /etc/containerd
sudo containerd config default > /etc/containerd/config.toml

# If /etc/systemd/system/containerd.service.d folder does not exist, create it:
mkdir -p /etc/systemd/system/containerd.service.d

# Open or create the file /etc/systemd/system/containerd.service.d/override.conf and add "LimitNOFILE=1024:1048576" in the [Service] section:
echo "[Service]" > /etc/systemd/system/containerd.service.d/override.conf
echo "LimitNOFILE=1024:1048576" >> /etc/systemd/system/containerd.service.d/override.conf
systemctl daemon-reload
sudo systemctl enable containerd
sudo systemctl restart containerd

# Disable cloud setup service
sudo systemctl disable nm-cloud-setup.service
```

#### Firewall Configuration

```
sudo systemctl stop firewalld.service
sudo systemctl disable firewalld.service
sudo systemctl mask firewalld.service
sudo systemctl status firewalld.service
sudo dnf install iptables-services
sudo systemctl enable iptables
sudo modprobe ipv6
sudo modprobe ip6_tables
sudo systemctl start iptables
sudo systemctl status iptables
```

> 📝 To allow traffic forwarding, remove the line `-A FORWARD -j REJECT --reject-with icmp-host-prohibited` from the `/etc/sysconfig/iptables` file and then restart the iptables service using the command:
> 📝 
> 📝 ```
> 📝 sudo systemctl restart iptables
> 📝 ```

#### Disk Space Requirements

Ensure the /var partition has at least 20 GB of free disk space. For Azure instances, use the command below to increase disk space (commands may vary depending on the instance type):

```
sudo lvextend -L+12G /dev/rootvg/varlv
sudo xfs_growfs /dev/mapper/rootvg-varlv
```

#### For RHEL 9.4 and 9.5 Network Configuration:

Red Hat NetworkManager has transitioned from using the old ifcfg-formatted interface files located in `/etc/sysconfig/network-scripts/` to the new keyfiles format found in `/etc/NetworkManager/system-connections/` for RHEL 9 networking.

1. Migrate network configurations if needed:
2. Check and remove duplicate connections:
3. Check interface default route settings:
4. Remove any GATEWAY from */etc/sysconfig/network* if present.
5. Configure interfaces for proper routing:
6. Restart networking:

### 3. Reboot

After completing all the above configurations, reboot the system to ensure all changes take effect.

```
sudo reboot
```

After rebooting, verify your network configuration:

```
sudo nmcli conn show ens192 | grep never-default
sudo ip route | grep default
```

## Ubuntu Setup

### 1. Install Required Packages

> 📝 If the script checking for the 'dig' utility is not installed, the following error will occur:  
> 📝 `[ec2-user@ip-10-0-5-xx ~]$ sudo ./bloxone.sh -j xxxxxx`  
> 📝 `Error: The following utilities are not installed: dig. Please install them before running the script.`

```
# Install required utilities in a single command
sudo apt-get install -y net-tools dnsutils
sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
# Add the repository to Apt sources:
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get install containerd
```

Ensure that containerd is installed and running on your system.

### 2. Configuration

#### DNS Configuration

```
# Stop systemd-resolved and remove the corresponding resolv.conf
sudo systemctl disable systemd-resolved.service
sudo systemctl stop systemd-resolved
sudo rm -f /etc/resolv.conf

# Set up resolver
sudo tee /etc/resolv.conf << END
nameserver 8.8.8.8
END
```

If you encounter a similar error after configuring DNS, and assuming your system hostname is `niosx-hostname`, run the following commands to fix the issue:

```
sudo: unable to resolve host <niosx-hostname>: Temporary failure in name resolution nameserver 8.8.8.8
# Add the following line /etc/hosts (if not already present), this is just a reference and can be modified based on your hostname
127.0.1.1 <niosx-hostname>
echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf
ping google.com
```

#### Network Manager Configuration

```
# Check if NetworkManager exists
sudo systemctl status NetworkManager

# If it exists, stop and disable related services
sudo systemctl stop NetworkManager-wait-online.service
sudo systemctl disable NetworkManager-wait-online.service
sudo systemctl stop NetworkManager-dispatcher.service
sudo systemctl disable NetworkManager-dispatcher.service
sudo systemctl stop network-manager.service
sudo systemctl disable network-manager.service
```

#### Disable Unattended Upgrades

The unattended upgrades feature is enabled by default and runs at system boot without user permission. This can cause all containers to be terminated and new ones created, leaving the NIOS-X server in an unrecoverable state.

```
sudo dpkg-reconfigure unattended-upgrades
```

#### For Ubuntu 22.04  and Ubuntu 24.04:

Run the following commands to switch `iptables` to `iptables-legacy` and `ip6tables` to `ip6tables-legacy`:

```
sudo update-alternatives --set iptables /usr/sbin/iptables-legacy
sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
sudo reboot
```

## Running the NIOS-X Install Script

> 📝 Before running the NIOS-X install script, if you want to configure custom CIDR values, you need to edit the `/var/bootstrap/k3s_net.json` file and add the appropriate custom values `{"cluster_cidr": "10.xx.xx.0/24","service_cidr": "10.xx.xx.0/24"}`
> 📝 
> 📝 In case, if you do not have `k3s_net.json` created, create the file by executing `vi/vim touch k3s_net.json` in the path `/var/bootstrap/`.

### Download the Installation Script

1. Log in to the **Infoblox Portal**.
2. Navigate to **System > Downloads**.
3. Go to the **NIOS-X** section, click **NIOS-X Servers **drop-down and select **Download NIOS-X install script**.

### Execute the Installation

1. Make the downloaded file executable:
2. Run the script with your join token:

#### Additional Options

| Option | Description |
| --- | --- |
| `-p, --proxy` | Specify a proxy in the format `http://<proxy_host>:<proxy_port>` |
| `-r, --remove` | Remove Infoblox from the server |

### After Configuration Changes

If you make changes to the host network or DNS configuration, reconfigure the network:

```
sudo ./niosx.sh -n
```

or

```
sudo ./niosx.sh --reconfigure-network
```

> 📝 **Important:** Always verify connectivity to the Infoblox Portal after installation or reconfiguration.

### Enabling Dual Stack

For new deployments, if the host network is configured with dual stack (IPv4 + IPv6), dual stack k3s networking will be applied by default.

For existing deployments, you must reinstall the k3s cluster to enable dual stack k3s networking support. Run the following command using the appropriate join token:

> ⚠️ **Disclaimer:** This action will clean and re-create the entire setup from scratch.

```
sudo ./niosx.sh -j <jointoken> --reinstall
```

### Accessing Device UI 

For new or existing deployments on RHEL or Ubuntu, you must create a system user with a password to access the Device UI. The Device UI reuses these credentials for authentication.  
On Ubuntu, you must also modify the `common-password` configuration to change the encryption method from `yescrypt` to `sha`.

```
# Verify the password
cat  /etc/pam.d/common-password
password       [success=1 default=ignore]      pam_unix.so obscure yescrypt
# Change it to SHA512 
password       [success=1 default=ignore]      pam_unix.so obscure sha512
[ESC]+[:wq!]
# Save the file
vim /etc/pam.d/common-password
```