Lines Matching +full:up +full:- +full:to
1 .. SPDX-License-Identifier: GPL-2.0
10 The VRF device combined with ip rules provides the ability to create virtual
11 routing and forwarding domains (aka VRFs, VRF-lite to be specific) in the
12 Linux network stack. One use case is the multi-tenancy problem where each
16 Processes can be "VRF aware" by binding a socket to the VRF device. Packets
20 (ie., they do not need to be run in each VRF). The design also allows
21 the use of higher priority ip rules (Policy Based Routing, PBR) to take
24 In addition, VRF devices allow VRFs to be nested within namespaces. For
30 ------
32 are then enslaved to a VRF device::
34 +-----------------------------+
35 | vrf-blue | ===> route table 10
36 +-----------------------------+
38 +------+ +------+ +-------------+
40 +------+ +------+ +-------------+
42 +------+ +------+
44 +------+ +------+
46 Packets received on an enslaved device and are switched to the VRF device
48 flow through the VRF device. Similarly on egress routing rules are used to
49 send packets to the VRF device driver before getting sent out the actual
50 interface. This allows tcpdump on a VRF device to capture all packets into
52 can be applied using the VRF device to specify rules that apply to the VRF
59 .. [2] Iptables on ingress supports PREROUTING with skb->dev set to the real
60 ingress device and both INPUT and PREROUTING rules with skb->dev set to
65 -----
66 1. VRF device is created with an association to a FIB table.
69 ip link add vrf-blue type vrf table 10
70 ip link set dev vrf-blue up
72 2. An l3mdev FIB rule directs lookups to the table associated with the device.
76 with a different priority or install per-VRF rules.
78 Prior to the v4.8 kernel iif and oif rules are needed for each VRF device::
80 ip ru add oif vrf-blue table 10
81 ip ru add iif vrf-blue table 10
90 (lower 3 bytes). Thus the above metric translates to [255/8192].
92 4. Enslave L3 interfaces to a VRF device::
94 ip link set dev eth1 master vrf-blue
96 Local and connected routes for enslaved devices are automatically moved to
98 the enslaved device are dropped and will need to be reinserted to the VRF
101 The IPv6 sysctl option keep_addr_on_down can be enabled to keep IPv6 global
104 sysctl -w net.ipv6.conf.all.keep_addr_on_down=1
106 5. Additional VRF routes are added to associated table::
112 ------------
113 Applications that are to work within a VRF need to bind their socket to the
118 or to specify the output device using cmsg and IP_PKTINFO.
121 limited to the default VRF. That is, it will not be matched by packets
122 arriving on interfaces enslaved to an l3mdev and processes may bind to
123 the same port if they bind to an l3mdev.
126 to any VRF device) can work across all VRF domains by enabling the
129 sysctl -w net.ipv4.tcp_l3mdev_accept=1
130 sysctl -w net.ipv4.udp_l3mdev_accept=1
135 This is so as to specify the output device with cmsg and IP_PKTINFO, but
136 using a socket not bound to the corresponding VRF. This allows e.g. older ping
137 implementations to be run with specifying the device but without executing it
139 context are only handled by a raw socket bound to the VRF, and packets in the
140 default VRF are only handled by a socket not bound to any VRF::
142 sysctl -w net.ipv4.raw_l3mdev_accept=0
144 netfilter rules on the VRF device can be used to limit access to services
147 Using VRF-aware applications (applications which simultaneously create sockets
149 is possible but may lead to problems in some situations. With that sysctl
150 value, it is unspecified which listening socket will be selected to handle
151 connections for VRF traffic; ie. either a socket bound to the VRF or an unbound
152 socket may be used to accept new connections from a VRF. This somewhat
153 unexpected behavior can lead to problems if sockets are configured with extra
155 exclusively be handled by sockets bound to VRFs, as would be the case with
160 --------------------------------------------------------------------------------
165 section lists both commands where appropriate -- with the vrf keyword and the
170 To instantiate a VRF device and associate it with a table::
180 To list VRFs that have been created::
182 $ ip [-d] link show type vrf
183 NOTE: The -d option is needed to show the table id
187 $ ip -d link show type vrf
188 …11: mgmt: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default…
191 …12: red: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default …
194 …13: blue: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default…
197 …14: green: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group defaul…
204 $ ip -br link show type vrf
205 mgmt UP 72:b3:ba:91:e2:24 <NOARP,MASTER,UP,LOWER_UP>
206 red UP b6:6f:6e:f6:da:73 <NOARP,MASTER,UP,LOWER_UP>
207 blue UP 36:62:e8:7d:bb:8c <NOARP,MASTER,UP,LOWER_UP>
208 green UP e6:28:b8:63:70:bb <NOARP,MASTER,UP,LOWER_UP>
211 3. Assign a Network Interface to a VRF
213 Network interfaces are assigned to a VRF by enslaving the netdevice to a
218 On enslavement connected and local routes are automatically moved to the
226 4. Show Devices Assigned to a VRF
228 To show devices that have been assigned to a specific VRF add the master
229 option to the ip command::
237 …3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFA…
239 …4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFA…
247 $ ip -br link show vrf red
248 eth1 UP 02:00:00:00:02:02 <BROADCAST,MULTICAST,UP,LOWER_UP>
249 eth2 UP 02:00:00:00:02:03 <BROADCAST,MULTICAST,UP,LOWER_UP>
255 To list neighbor entries associated with devices enslaved to a VRF device
256 add the master option to the ip command::
258 $ ip [-6] neigh show vrf NAME
259 $ ip [-6] neigh show master NAME
267 $ ip -6 neigh show vrf red
273 To show addresses for interfaces associated with a VRF add the master
274 option to the ip command::
282 …3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group def…
290 …4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group def…
303 $ ip -br addr show vrf red
304 eth1 UP 10.2.1.2/24 2002:1::2/120 fe80::ff:fe00:202/64
305 eth2 UP 10.2.2.2/24 2002:2::2/120 fe80::ff:fe00:203/64
311 To show routes for a VRF use the ip command to display the table associated
314 $ ip [-6] route show vrf NAME
315 $ ip [-6] route show table ID
330 $ ip -6 route show vrf red
346 unreachable default dev lo metric 4278198272 error -101 pref medium
352 $ ip [-6] route get vrf NAME ADDRESS
353 $ ip [-6] route get oif NAME ADDRESS
361 $ ip -6 route get 2002:1::32 vrf red
367 Network interfaces are removed from a VRF by breaking the enslavement to
372 Connected routes are moved back to the default table and local entries are
373 moved to the local table.
379 --------------------------------------------------------------------------------
401 ip link set dev ${VRF} up