Lines Matching +full:vrf +full:- +full:lite

1 .. SPDX-License-Identifier: GPL-2.0
4 Virtual Routing and Forwarding (VRF)
7 The VRF Device
10 The VRF device combined with ip rules provides the ability to create virtual
11 routing and forwarding domains (aka VRFs, VRF-lite to be specific) in the
12 Linux network stack. One use case is the multi-tenancy problem where each
16 Processes can be "VRF aware" by binding a socket to the VRF device. Packets
17 through the socket then use the routing table associated with the VRF
18 device. An important feature of the VRF device implementation is that it
20 (ie., they do not need to be run in each VRF). The design also allows
22 precedence over the VRF device rules directing specific traffic as desired.
24 In addition, VRF devices allow VRFs to be nested within namespaces. For
27 and then VRF devices provide L3 separation.
30 ------
31 A VRF device is created with an associated route table. Network interfaces
32 are then enslaved to a VRF device::
34 +-----------------------------+
35 | vrf-blue | ===> route table 10
36 +-----------------------------+
38 +------+ +------+ +-------------+
40 +------+ +------+ +-------------+
42 +------+ +------+
44 +------+ +------+
46 Packets received on an enslaved device and are switched to the VRF device
48 flow through the VRF device. Similarly on egress routing rules are used to
49 send packets to the VRF device driver before getting sent out the actual
50 interface. This allows tcpdump on a VRF device to capture all packets into
51 and out of the VRF as a whole\ [1]_. Similarly, netfilter\ [2]_ and tc rules
52 can be applied using the VRF device to specify rules that apply to the VRF
59 .. [2] Iptables on ingress supports PREROUTING with skb->dev set to the real
60 ingress device and both INPUT and PREROUTING rules with skb->dev set to
61 the VRF device. For egress POSTROUTING and OUTPUT rules can be written
62 using either the VRF device or real egress device.
65 -----
66 1. VRF device is created with an association to a FIB table.
69 ip link add vrf-blue type vrf table 10
70 ip link set dev vrf-blue up
73 A single l3mdev rule is sufficient for all VRFs. The VRF device adds the
76 with a different priority or install per-VRF rules.
78 Prior to the v4.8 kernel iif and oif rules are needed for each VRF device::
80 ip ru add oif vrf-blue table 10
81 ip ru add iif vrf-blue table 10
83 3. Set the default route for the table (and hence default route for the VRF)::
92 4. Enslave L3 interfaces to a VRF device::
94 ip link set dev eth1 master vrf-blue
97 the table associated with VRF device. Any additional routes depending on
98 the enslaved device are dropped and will need to be reinserted to the VRF
102 addresses as VRF enslavement changes::
104 sysctl -w net.ipv6.conf.all.keep_addr_on_down=1
106 5. Additional VRF routes are added to associated table::
112 ------------
113 Applications that are to work within a VRF need to bind their socket to the
114 VRF device::
121 limited to the default VRF. That is, it will not be matched by packets
125 TCP & UDP services running in the default VRF context (ie., not bound
126 to any VRF device) can work across all VRF domains by enabling the
129 sysctl -w net.ipv4.tcp_l3mdev_accept=1
130 sysctl -w net.ipv4.udp_l3mdev_accept=1
132 These options are disabled by default so that a socket in a VRF is only
133 selected for packets in that VRF. There is a similar option for RAW
136 using a socket not bound to the corresponding VRF. This allows e.g. older ping
138 in the VRF. This option can be disabled so that packets received in a VRF
139 context are only handled by a raw socket bound to the VRF, and packets in the
140 default VRF are only handled by a socket not bound to any VRF::
142 sysctl -w net.ipv4.raw_l3mdev_accept=0
144 netfilter rules on the VRF device can be used to limit access to services
145 running in the default VRF context as well.
147 Using VRF-aware applications (applications which simultaneously create sockets
151 connections for VRF traffic; ie. either a socket bound to the VRF or an unbound
152 socket may be used to accept new connections from a VRF. This somewhat
154 options (ex. TCP MD5 keys) with the expectation that VRF traffic will
158 VRF based on the ingress interface, as documented earlier.
160 --------------------------------------------------------------------------------
164 iproute2 supports the vrf keyword as of v4.7. For backwards compatibility this
165 section lists both commands where appropriate -- with the vrf keyword and the
168 1. Create a VRF
170 To instantiate a VRF device and associate it with a table::
172 $ ip link add dev NAME type vrf table ID
182 $ ip [-d] link show type vrf
183 NOTE: The -d option is needed to show the table id
187 $ ip -d link show type vrf
190 vrf table 1 addrgenmode eui64
193 vrf table 10 addrgenmode eui64
196 vrf table 66 addrgenmode eui64
199 vrf table 81 addrgenmode eui64
204 $ ip -br link show type vrf
211 3. Assign a Network Interface to a VRF
213 Network interfaces are assigned to a VRF by enslaving the netdevice to a
214 VRF device::
219 table associated with the VRF device.
226 4. Show Devices Assigned to a VRF
228 To show devices that have been assigned to a specific VRF add the master
231 $ ip link show vrf NAME
236 $ ip link show vrf red
247 $ ip -br link show vrf red
253 5. Show Neighbor Entries for a VRF
255 To list neighbor entries associated with devices enslaved to a VRF device
258 $ ip [-6] neigh show vrf NAME
259 $ ip [-6] neigh show master NAME
263 $ ip neigh show vrf red
267 $ ip -6 neigh show vrf red
271 6. Show Addresses for a VRF
273 To show addresses for interfaces associated with a VRF add the master
276 $ ip addr show vrf NAME
281 $ ip addr show vrf red
303 $ ip -br addr show vrf red
309 7. Show Routes for a VRF
311 To show routes for a VRF use the ip command to display the table associated
312 with the VRF device::
314 $ ip [-6] route show vrf NAME
315 $ ip [-6] route show table ID
319 $ ip route show vrf red
330 $ ip -6 route show vrf red
346 unreachable default dev lo metric 4278198272 error -101 pref medium
348 8. Route Lookup for a VRF
350 A test route lookup can be done for a VRF::
352 $ ip [-6] route get vrf NAME ADDRESS
353 $ ip [-6] route get oif NAME ADDRESS
357 $ ip route get 10.2.1.40 vrf red
361 $ ip -6 route get 2002:1::32 vrf red
365 9. Removing Network Interface from a VRF
367 Network interfaces are removed from a VRF by breaking the enslavement to
368 the VRF device::
379 --------------------------------------------------------------------------------
383 cat >> /etc/iproute2/rt_tables.d/vrf.conf <<EOF
392 VRF=$1
395 # create VRF device
396 ip link add ${VRF} type vrf table ${TBID}
398 if [ "${VRF}" != "mgmt" ]; then
401 ip link set dev ${VRF} up