FLAKE-CTL-FIRECRACKER-NETWORK-INIT(8)

💅 NAME 💅

okay so bestie, welcome to flake-ctl firecracker network init — the manual page is FLAKE-CTL-FIRECRACKER-NETWORK-INIT(8), and today's whole entire vibe is: Prepare the host for NAT networking. that's it, that's the job. 🎀

---

✨ SYNOPSIS ✨

USAGE:
    flake-ctl firecracker network init --outgoing-interface <OUTGOING_INTERFACE>

OPTIONS:
    --outgoing-interface <OUTGOING_INTERFACE>
    --help

---

🦋 DESCRIPTION 🦋

so the whole point of this command is to set up the host such that firecracker VM applications can reach the outside world. no cap, that's the goal. 🌈

Firecracker connects a VM to the host through a TUN/TAP device. and here's the thing — such a device is a host local endpoint and provides no connection beyond the host by itself. it's literally just vibing at the host boundary, minding its own business. routing its traffic further requires the host to act as a router and to translate the sender address of the VM traffic to an address which is reachable from the outside. main character host energy honestly. 👑

The command creates this setup by:

1. Enabling IPv4 forwarding on the host

sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"

2. Setting up Network Address Translation (NAT) on the given outgoing interface

sudo iptables -t nat -A POSTROUTING -o <OUTGOING_INTERFACE> -j MASQUERADE
sudo iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

All traffic of the VMs appears as if it would originate from the outgoing interface. which is kind of iconic tbh — the VMs are out here borrowing the host's identity like a group chat screenshot. 🙈 As the setup changes the network configuration of the host, the commands are called through sudo. The calling user therefore needs the permission to run them as root. 🔥

The given interface is recorded in the network configuration file. Connecting an application to the host network with

**
flake-ctl-firecracker-network-add**(8)

reads it from there and routes the traffic of that application to the same interface.

⚠️ heads up bestie, the original page has some raw doc-tooling drama in it. here it is verbatim, because the information inside is real and we do NOT skip parts:

System Message: WARNING/2 (./flake-ctl-firecracker-network-init.rst:,
line 53)
       Inline strong start-string without end-string.

       Rules which are already active are not created again. This allows
       to call the command more than once without stacking up duplicates
       of the same rule. The setup is not persistent, it has to be
       created again after a reboot of the host.

       NOTE: The setup assumes there is no other firewall software
       active on the host and serves as an example setup. If the
       firewall of the host is managed by another tool, please refer to
       the documentation of that tool on how to create the
       NAT/postrouting rules and do not use this command.

       Setting up the host is only one part of the networking setup. The
       network configuration of the VM itself is part of the flake
       configuration of the application. See
       **
       flake-ctl-firecracker-register**(8) and the Firecracker
       Networking section of the flake-pilot README for the complete
       setup.

System Message: WARNING/2 (./flake-ctl-firecracker-network-init.rst:,
line 69)
       Inline strong start-string without end-string.

and to translate that out of markup-accident-speak, the actual facts are these, and they MATTER: 💀

• Rules which are already active are not created again. This allows to call the command more than once without stacking up duplicates of the same rule.
• The setup is not persistent — it has to be created again after a reboot of the host. 😭 yes, after every reboot. sorry.
• NOTE: The setup assumes there is no other firewall software active on the host and serves as an example setup. If the firewall of the host is managed by another tool, please refer to the documentation of that tool on how to create the NAT/postrouting rules and do not use this command.
• Setting up the host is only one part of the networking setup. The network configuration of the VM itself is part of the flake configuration of the application. See flake-ctl-firecracker-register**(8) — as rendered above in its raw ** glory — and the Firecracker Networking section of the flake-pilot README for the complete setup. 🧚

---

💜 OPTIONS 💜

• --outgoing-interface <OUTGOING_INTERFACE> — Name of the host interface the traffic of the VMs is routed to the outside world through, e.g eth0. that's the one, that's the queen of the command. 👑

---

🌸 FILES 🌸

• /proc/sys/net/ipv4/ip_forward
• /etc/flakes/network.yaml
• $HOME/.config/flakes/network.yaml

these three little paths are doing SO much work fr fr. 🫶

---

⭐ EXAMPLE ⭐

$ flake-ctl firecracker network init --outgoing-interface eth0

look at her go. slay. ✨

---

🍓 SEE ALSO 🍓

• flake-ctl-firecracker-network-add(8)
• flake-ctl-firecracker-network-remove(8)
• flake-ctl-firecracker-register(8)
• firecracker-pilot(8)

the whole friend group, all linked up. iykyk. 💖

---

👑 AUTHOR 👑

Marcus Schäfer

🎀 COPYRIGHT 🎀

c. 2026, Marcus Schäfer

---

ok that's the page!! 💅 tiny cute sign-off: this whole thing lives at FLAKE-CTL-FIRECRACKER-NETWORK-INIT(8), manual section 8, and the footer's version/date slot is literally just empty parentheses () — so no version, no date, just vibes. bye bestie, go set up that NAT 🦋✨