Lines Matching +full:add +full:- +full:device
1 .. SPDX-License-Identifier: GPL-2.0
7 The VRF Device
10 The VRF device combined with ip rules provides the ability to create virtual
11 routing and forwarding domains (aka VRFs, VRF-lite to be specific) in the
12 Linux network stack. One use case is the multi-tenancy problem where each
16 Processes can be "VRF aware" by binding a socket to the VRF device. Packets
18 device. An important feature of the VRF device implementation is that it
22 precedence over the VRF device rules directing specific traffic as desired.
26 device layer, VLANs on the interfaces within a namespace provide L2 separation
30 ------
31 A VRF device is created with an associated route table. Network interfaces
32 are then enslaved to a VRF device::
34 +-----------------------------+
35 | vrf-blue | ===> route table 10
36 +-----------------------------+
38 +------+ +------+ +-------------+
40 +------+ +------+ +-------------+
42 +------+ +------+
44 +------+ +------+
46 Packets received on an enslaved device and are switched to the VRF device
48 flow through the VRF device. Similarly on egress routing rules are used to
49 send packets to the VRF device driver before getting sent out the actual
50 interface. This allows tcpdump on a VRF device to capture all packets into
52 can be applied using the VRF device to specify rules that apply to the VRF
55 .. [1] Packets in the forwarded state do not flow through the device, so those
59 .. [2] Iptables on ingress supports PREROUTING with skb->dev set to the real
60 ingress device and both INPUT and PREROUTING rules with skb->dev set to
61 the VRF device. For egress POSTROUTING and OUTPUT rules can be written
62 using either the VRF device or real egress device.
65 -----
66 1. VRF device is created with an association to a FIB table.
69 ip link add vrf-blue type vrf table 10
70 ip link set dev vrf-blue up
72 2. An l3mdev FIB rule directs lookups to the table associated with the device.
73 A single l3mdev rule is sufficient for all VRFs. The VRF device adds the
74 l3mdev rule for IPv4 and IPv6 when the first device is created with a
75 default preference of 1000. Users may delete the rule if desired and add
76 with a different priority or install per-VRF rules.
78 Prior to the v4.8 kernel iif and oif rules are needed for each VRF device::
80 ip ru add oif vrf-blue table 10
81 ip ru add iif vrf-blue table 10
85 ip route add table 10 unreachable default metric 4278198272
92 4. Enslave L3 interfaces to a VRF device::
94 ip link set dev eth1 master vrf-blue
97 the table associated with VRF device. Any additional routes depending on
98 the enslaved device are dropped and will need to be reinserted to the VRF
104 sysctl -w net.ipv6.conf.all.keep_addr_on_down=1
108 ip route add table 10 ...
112 ------------
114 VRF device::
118 or to specify the output device using cmsg and IP_PKTINFO.
126 to any VRF device) can work across all VRF domains by enabling the
129 sysctl -w net.ipv4.tcp_l3mdev_accept=1
130 sysctl -w net.ipv4.udp_l3mdev_accept=1
135 This is so as to specify the output device with cmsg and IP_PKTINFO, but
137 implementations to be run with specifying the device but without executing it
142 sysctl -w net.ipv4.raw_l3mdev_accept=0
144 netfilter rules on the VRF device can be used to limit access to services
147 Using VRF-aware applications (applications which simultaneously create sockets
160 --------------------------------------------------------------------------------
165 section lists both commands where appropriate -- with the vrf keyword and the
170 To instantiate a VRF device and associate it with a table::
172 $ ip link add dev NAME type vrf table ID
176 device create.
182 $ ip [-d] link show type vrf
183 NOTE: The -d option is needed to show the table id
187 $ ip -d link show type vrf
204 $ ip -br link show type vrf
214 VRF device::
219 table associated with the VRF device.
228 To show devices that have been assigned to a specific VRF add the master
247 $ ip -br link show vrf red
255 To list neighbor entries associated with devices enslaved to a VRF device
256 add the master option to the ip command::
258 $ ip [-6] neigh show vrf NAME
259 $ ip [-6] neigh show master NAME
267 $ ip -6 neigh show vrf red
273 To show addresses for interfaces associated with a VRF add the master
303 $ ip -br addr show vrf red
312 with the VRF device::
314 $ ip [-6] route show vrf NAME
315 $ ip [-6] route show table ID
330 $ ip -6 route show vrf red
346 unreachable default dev lo metric 4278198272 error -101 pref medium
352 $ ip [-6] route get vrf NAME ADDRESS
353 $ ip [-6] route get oif NAME ADDRESS
361 $ ip -6 route get 2002:1::32 vrf red
368 the VRF device::
379 --------------------------------------------------------------------------------
395 # create VRF device
396 ip link add ${VRF} type vrf table ${TBID}
399 ip route add table ${TBID} unreachable default metric 4278198272