Document Static IP Workaround for Dropbear in Hetzner Full‑Disk Encryption Guide

[MaximilianWenzel]

Problem

When following the Hetzner full‑disk encryption guide with Dropbear for remote unlock (https://community.hetzner.com/tutorials/install-ubuntu-2004-with-full-disk-encryption) on a host using a static IP, networking in initramfs is not configured correctly. As a result, Dropbear on port 2222 is unreachable during early boot, so the LUKS volume cannot be unlocked remotely.

This appears to be due to initramfs DHCP not handling the static addressing (/32 or off‑subnet gateways). The same issue is discussed here:
https://serverfault.com/questions/915118/ubuntu-full-disc-encryption-on-hetzner-cloud-adding-add-static-route-in-initramf

The issue with static IPs in the initramfs environment is not mentioned in the current Hetzner full‑disk encryption guide. In our case, it took several hours of debugging (including booking a KVM session) to identify the root cause. Adding a note about this scenario to the guide would save others significant troubleshooting time.

---

Suggested Fix

Inject a small initramfs hook that configures a static route before Dropbear starts. The following manual steps (performed from Rescue, then chrooting into the installed system) resolved the issue for us:

• Gather the interface/IP/gateway in Rescue:

ip link
ip addr show dev <YOUR_IFACE>
ip route show

# Example values:
# IFACE="enp6s0"
# IPADDR="192.0.2.10"
# CIDR_PREFIX_LEN="26"
# GATEWAY="192.0.2.1"

• Unlock and mount the installed system, bind system dirs, chroot:

cryptsetup luksOpen /dev/<ROOT_PARTITION> cryptroot
mount /dev/mapper/cryptroot /mnt
mount /dev/<BOOT_PART> /mnt/boot
mount /dev/<EFI_PART>  /mnt/boot/efi

mount --bind /dev  /mnt/dev
mount --bind /proc /mnt/proc
mount --bind /sys  /mnt/sys

chroot /mnt

• Create the static‑routes hook inside the chroot (adjust variables to your values):

cat > /etc/initramfs-tools/scripts/init-premount/static-routes <<'EOF'
#!/bin/sh
PREREQ=""
prereqs() { echo "$PREREQ"; }
case $1 in
  prereqs) prereqs; exit 0 ;;
esac

GATEWAY="192.0.2.1"
IFACE="enp6s0"
CIDR_PREFIX_LEN=26

. /scripts/functions
configure_networking

ip route add ${GATEWAY}/${CIDR_PREFIX_LEN} dev ${IFACE}
ip route add default via ${GATEWAY} dev ${IFACE}

exit 0
EOF

chmod 755 /etc/initramfs-tools/scripts/init-premount/static-routes

• Rebuild initramfs and exit:

update-initramfs -u
exit
umount /mnt/dev /mnt/proc /mnt/sys
umount /mnt/boot/efi /mnt/boot
umount /mnt
reboot

After reboot, Dropbear was reachable on port 2222 and cryptroot-unlock worked as expected. After unlocking, SSH on the normal port (22) also worked with SSH keys.

Note: This is a minimal, manual workaround that we confirmed on our system. If desired, the guide could also mention adding this hook during post‑install (before the first reboot), but we have not tested an automated variant. Please test these steps in your own setup to ensure they work before integrating them into the official guide.

[salemaljebaly]

The tutorial link in this issue returns 404. I think the tutorial was updated for Ubuntu 24.04 and the new URL is: https://community.hetzner.com/tutorials/install-ubuntu-2404-with-full-disk-encryption