__ __ __ __ _____ _ _ _____ _ _ _ | \/ | \ \ / / | __ \ (_) | | / ____| | | | | | \ / |_ __\ V / | |__) | __ ___ ____ _| |_ ___ | (___ | |__ ___| | | | |\/| | '__|> < | ___/ '__| \ \ / / _` | __/ _ \ \___ \| '_ \ / _ \ | | | | | | |_ / . \ | | | | | |\ V / (_| | || __/ ____) | | | | __/ | | |_| |_|_(_)_/ \_\ |_| |_| |_| \_/ \__,_|\__\___| |_____/|_| |_|\___V 2.1 if you need WebShell for Seo everyday contact me on Telegram Telegram Address : @jackleetFor_More_Tools:
<!DOCTYPE html>
<html lang="en" data-content_root="../">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Virtual Routing and Forwarding (VRF) — The Linux Kernel documentation</title>
<link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=fa44fd50" />
<link rel="stylesheet" type="text/css" href="../_static/alabaster.css?v=3918102e" />
<script src="../_static/documentation_options.js?v=5929fcd5"></script>
<script src="../_static/doctools.js?v=9bcbadda"></script>
<script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
<link rel="index" title="Index" href="../genindex.html" />
<link rel="search" title="Search" href="../search.html" />
<link rel="next" title="Virtual eXtensible Local Area Networking documentation" href="vxlan.html" />
<link rel="prev" title="The UDP-Lite protocol (RFC 3828)" href="udplite.html" />
<link rel="stylesheet" href="../_static/custom.css" type="text/css" />
</head><body>
<div class="document">
<div class="sphinxsidebar" role="navigation" aria-label="Main">
<div class="sphinxsidebarwrapper">
<p class="logo"><a href="../index.html">
<img class="logo" src="../_static/logo.svg" alt="Logo of The Linux Kernel"/>
</a></p>
<h1 class="logo"><a href="../index.html">The Linux Kernel</a></h1>
<p class="blurb">6.18.50</p>
<search id="searchbox" style="display: none" role="search">
<h3 id="searchlabel">Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="../search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
<input type="submit" value="Go" />
</form>
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script>
<p>
<h3 class="kernel-toc-contents">Contents</h3>
<input type="checkbox" class="kernel-toc-toggle" id = "kernel-toc-toggle" checked>
<label class="kernel-toc-title" for="kernel-toc-toggle"></label>
<div class="kerneltoc" id="kerneltoc">
<ul>
<li class="toctree-l1"><a class="reference internal" href="../process/development-process.html">Development process</a></li>
<li class="toctree-l1"><a class="reference internal" href="../process/submitting-patches.html">Submitting patches</a></li>
<li class="toctree-l1"><a class="reference internal" href="../process/code-of-conduct.html">Code of conduct</a></li>
<li class="toctree-l1"><a class="reference internal" href="../maintainer/index.html">Maintainer handbook</a></li>
<li class="toctree-l1"><a class="reference internal" href="../process/index.html">All development-process docs</a></li>
</ul>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../core-api/index.html">Core API</a></li>
<li class="toctree-l1"><a class="reference internal" href="../driver-api/index.html">Driver APIs</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="../subsystem-apis.html">Subsystems</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="../subsystem-apis.html#core-subsystems">Core subsystems</a></li>
<li class="toctree-l2"><a class="reference internal" href="../subsystem-apis.html#human-interfaces">Human interfaces</a></li>
<li class="toctree-l2 current"><a class="reference internal" href="../subsystem-apis.html#networking-interfaces">Networking interfaces</a><ul class="current">
<li class="toctree-l3 current"><a class="reference internal" href="index.html">Networking</a></li>
<li class="toctree-l3"><a class="reference internal" href="../netlabel/index.html">NetLabel</a></li>
<li class="toctree-l3"><a class="reference internal" href="../infiniband/index.html">InfiniBand</a></li>
<li class="toctree-l3"><a class="reference internal" href="../isdn/index.html">ISDN</a></li>
<li class="toctree-l3"><a class="reference internal" href="../mhi/index.html">MHI</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../subsystem-apis.html#storage-interfaces">Storage interfaces</a></li>
<li class="toctree-l2"><a class="reference internal" href="../subsystem-apis.html#other-subsystems">Other subsystems</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../locking/index.html">Locking</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../process/license-rules.html">Licensing rules</a></li>
<li class="toctree-l1"><a class="reference internal" href="../doc-guide/index.html">Writing documentation</a></li>
<li class="toctree-l1"><a class="reference internal" href="../dev-tools/index.html">Development tools</a></li>
<li class="toctree-l1"><a class="reference internal" href="../dev-tools/testing-overview.html">Testing guide</a></li>
<li class="toctree-l1"><a class="reference internal" href="../kernel-hacking/index.html">Hacking guide</a></li>
<li class="toctree-l1"><a class="reference internal" href="../trace/index.html">Tracing</a></li>
<li class="toctree-l1"><a class="reference internal" href="../fault-injection/index.html">Fault injection</a></li>
<li class="toctree-l1"><a class="reference internal" href="../livepatch/index.html">Livepatching</a></li>
<li class="toctree-l1"><a class="reference internal" href="../rust/index.html">Rust</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../admin-guide/index.html">Administration</a></li>
<li class="toctree-l1"><a class="reference internal" href="../kbuild/index.html">Build system</a></li>
<li class="toctree-l1"><a class="reference internal" href="../admin-guide/reporting-issues.html">Reporting issues</a></li>
<li class="toctree-l1"><a class="reference internal" href="../tools/index.html">Userspace tools</a></li>
<li class="toctree-l1"><a class="reference internal" href="../userspace-api/index.html">Userspace API</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../firmware-guide/index.html">Firmware</a></li>
<li class="toctree-l1"><a class="reference internal" href="../devicetree/index.html">Firmware and Devicetree</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../arch/index.html">CPU architectures</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../staging/index.html">Unsorted documentation</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../translations/index.html">Translations</a></li>
</ul>
</div>
<script type="text/javascript"> <!--
var sbar = document.getElementsByClassName("sphinxsidebar")[0];
let currents = document.getElementsByClassName("current")
if (currents.length) {
sbar.scrollTop = currents[currents.length - 1].offsetTop;
}
--> </script>
<div role="note" aria-label="source link">
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="../_sources/networking/vrf.rst.txt"
rel="nofollow">Show Source</a></li>
</ul>
</div>
</div>
</div>
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<section id="virtual-routing-and-forwarding-vrf">
<h1>Virtual Routing and Forwarding (VRF)<a class="headerlink" href="#virtual-routing-and-forwarding-vrf" title="Link to this heading">¶</a></h1>
<section id="the-vrf-device">
<h2>The VRF Device<a class="headerlink" href="#the-vrf-device" title="Link to this heading">¶</a></h2>
<p>The VRF device combined with ip rules provides the ability to create virtual
routing and forwarding domains (aka VRFs, VRF-lite to be specific) in the
Linux network stack. One use case is the multi-tenancy problem where each
tenant has their own unique routing tables and in the very least need
different default gateways.</p>
<p>Processes can be “VRF aware” by binding a socket to the VRF device. Packets
through the socket then use the routing table associated with the VRF
device. An important feature of the VRF device implementation is that it
impacts only Layer 3 and above so L2 tools (e.g., LLDP) are not affected
(ie., they do not need to be run in each VRF). The design also allows
the use of higher priority ip rules (Policy Based Routing, PBR) to take
precedence over the VRF device rules directing specific traffic as desired.</p>
<p>In addition, VRF devices allow VRFs to be nested within namespaces. For
example network namespaces provide separation of network interfaces at the
device layer, VLANs on the interfaces within a namespace provide L2 separation
and then VRF devices provide L3 separation.</p>
<section id="design">
<h3>Design<a class="headerlink" href="#design" title="Link to this heading">¶</a></h3>
<p>A VRF device is created with an associated route table. Network interfaces
are then enslaved to a VRF device:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>+-----------------------------+
| vrf-blue | ===> route table 10
+-----------------------------+
| | |
+------+ +------+ +-------------+
| eth1 | | eth2 | ... | bond1 |
+------+ +------+ +-------------+
| |
+------+ +------+
| eth8 | | eth9 |
+------+ +------+
</pre></div>
</div>
<p>Packets received on an enslaved device and are switched to the VRF device
in the IPv4 and IPv6 processing stacks giving the impression that packets
flow through the VRF device. Similarly on egress routing rules are used to
send packets to the VRF device driver before getting sent out the actual
interface. This allows tcpdump on a VRF device to capture all packets into
and out of the VRF as a whole<a class="footnote-reference brackets" href="#id3" id="id1" role="doc-noteref"><span class="fn-bracket">[</span>1<span class="fn-bracket">]</span></a>. Similarly, netfilter<a class="footnote-reference brackets" href="#id4" id="id2" role="doc-noteref"><span class="fn-bracket">[</span>2<span class="fn-bracket">]</span></a> and tc rules
can be applied using the VRF device to specify rules that apply to the VRF
domain as a whole.</p>
<aside class="footnote-list brackets">
<aside class="footnote brackets" id="id3" role="doc-footnote">
<span class="label"><span class="fn-bracket">[</span><a role="doc-backlink" href="#id1">1</a><span class="fn-bracket">]</span></span>
<p>Packets in the forwarded state do not flow through the device, so those
packets are not seen by tcpdump. Will revisit this limitation in a
future release.</p>
</aside>
<aside class="footnote brackets" id="id4" role="doc-footnote">
<span class="label"><span class="fn-bracket">[</span><a role="doc-backlink" href="#id2">2</a><span class="fn-bracket">]</span></span>
<p>Iptables on ingress supports PREROUTING with skb->dev set to the real
ingress device and both INPUT and PREROUTING rules with skb->dev set to
the VRF device. For egress POSTROUTING and OUTPUT rules can be written
using either the VRF device or real egress device.</p>
</aside>
</aside>
</section>
<section id="setup">
<h3>Setup<a class="headerlink" href="#setup" title="Link to this heading">¶</a></h3>
<ol class="arabic">
<li><p>VRF device is created with an association to a FIB table.
e.g,:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ip link add vrf-blue type vrf table 10
ip link set dev vrf-blue up
</pre></div>
</div>
</li>
<li><p>An l3mdev FIB rule directs lookups to the table associated with the device.
A single l3mdev rule is sufficient for all VRFs. The VRF device adds the
l3mdev rule for IPv4 and IPv6 when the first device is created with a
default preference of 1000. Users may delete the rule if desired and add
with a different priority or install per-VRF rules.</p>
<p>Prior to the v4.8 kernel iif and oif rules are needed for each VRF device:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ip ru add oif vrf-blue table 10
ip ru add iif vrf-blue table 10
</pre></div>
</div>
</li>
<li><p>Set the default route for the table (and hence default route for the VRF):</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ip route add table 10 unreachable default metric 4278198272
</pre></div>
</div>
<p>This high metric value ensures that the default unreachable route can
be overridden by a routing protocol suite. FRRouting interprets
kernel metrics as a combined admin distance (upper byte) and priority
(lower 3 bytes). Thus the above metric translates to [255/8192].</p>
</li>
<li><p>Enslave L3 interfaces to a VRF device:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ip link set dev eth1 master vrf-blue
</pre></div>
</div>
<p>Local and connected routes for enslaved devices are automatically moved to
the table associated with VRF device. Any additional routes depending on
the enslaved device are dropped and will need to be reinserted to the VRF
FIB table following the enslavement.</p>
<p>The IPv6 sysctl option keep_addr_on_down can be enabled to keep IPv6 global
addresses as VRF enslavement changes:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>sysctl -w net.ipv6.conf.all.keep_addr_on_down=1
</pre></div>
</div>
</li>
<li><p>Additional VRF routes are added to associated table:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ip route add table 10 ...
</pre></div>
</div>
</li>
</ol>
</section>
<section id="applications">
<h3>Applications<a class="headerlink" href="#applications" title="Link to this heading">¶</a></h3>
<p>Applications that are to work within a VRF need to bind their socket to the
VRF device:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>setsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, dev, strlen(dev)+1);
</pre></div>
</div>
<p>or to specify the output device using cmsg and IP_PKTINFO.</p>
<p>By default the scope of the port bindings for unbound sockets is
limited to the default VRF. That is, it will not be matched by packets
arriving on interfaces enslaved to an l3mdev and processes may bind to
the same port if they bind to an l3mdev.</p>
<p>TCP & UDP services running in the default VRF context (ie., not bound
to any VRF device) can work across all VRF domains by enabling the
tcp_l3mdev_accept and udp_l3mdev_accept sysctl options:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>sysctl -w net.ipv4.tcp_l3mdev_accept=1
sysctl -w net.ipv4.udp_l3mdev_accept=1
</pre></div>
</div>
<p>These options are disabled by default so that a socket in a VRF is only
selected for packets in that VRF. There is a similar option for RAW
sockets, which is enabled by default for reasons of backwards compatibility.
This is so as to specify the output device with cmsg and IP_PKTINFO, but
using a socket not bound to the corresponding VRF. This allows e.g. older ping
implementations to be run with specifying the device but without executing it
in the VRF. This option can be disabled so that packets received in a VRF
context are only handled by a raw socket bound to the VRF, and packets in the
default VRF are only handled by a socket not bound to any VRF:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>sysctl -w net.ipv4.raw_l3mdev_accept=0
</pre></div>
</div>
<p>netfilter rules on the VRF device can be used to limit access to services
running in the default VRF context as well.</p>
<p>Using VRF-aware applications (applications which simultaneously create sockets
outside and inside VRFs) in conjunction with <code class="docutils literal notranslate"><span class="pre">net.ipv4.tcp_l3mdev_accept=1</span></code>
is possible but may lead to problems in some situations. With that sysctl
value, it is unspecified which listening socket will be selected to handle
connections for VRF traffic; ie. either a socket bound to the VRF or an unbound
socket may be used to accept new connections from a VRF. This somewhat
unexpected behavior can lead to problems if sockets are configured with extra
options (ex. TCP MD5 keys) with the expectation that VRF traffic will
exclusively be handled by sockets bound to VRFs, as would be the case with
<code class="docutils literal notranslate"><span class="pre">net.ipv4.tcp_l3mdev_accept=0</span></code>. Finally and as a reminder, regardless of
which listening socket is selected, established sockets will be created in the
VRF based on the ingress interface, as documented earlier.</p>
</section>
</section>
<hr class="docutils" />
<section id="using-iproute2-for-vrfs">
<h2>Using iproute2 for VRFs<a class="headerlink" href="#using-iproute2-for-vrfs" title="Link to this heading">¶</a></h2>
<p>iproute2 supports the vrf keyword as of v4.7. For backwards compatibility this
section lists both commands where appropriate -- with the vrf keyword and the
older form without it.</p>
<ol class="arabic">
<li><p>Create a VRF</p>
<p>To instantiate a VRF device and associate it with a table:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip link add dev NAME type vrf table ID
</pre></div>
</div>
<p>As of v4.8 the kernel supports the l3mdev FIB rule where a single rule
covers all VRFs. The l3mdev rule is created for IPv4 and IPv6 on first
device create.</p>
</li>
<li><p>List VRFs</p>
<p>To list VRFs that have been created:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip [-d] link show type vrf
NOTE: The -d option is needed to show the table id
</pre></div>
</div>
<p>For example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip -d link show type vrf
11: mgmt: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether 72:b3:ba:91:e2:24 brd ff:ff:ff:ff:ff:ff promiscuity 0
vrf table 1 addrgenmode eui64
12: red: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether b6:6f:6e:f6:da:73 brd ff:ff:ff:ff:ff:ff promiscuity 0
vrf table 10 addrgenmode eui64
13: blue: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether 36:62:e8:7d:bb:8c brd ff:ff:ff:ff:ff:ff promiscuity 0
vrf table 66 addrgenmode eui64
14: green: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether e6:28:b8:63:70:bb brd ff:ff:ff:ff:ff:ff promiscuity 0
vrf table 81 addrgenmode eui64
</pre></div>
</div>
<p>Or in brief output:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip -br link show type vrf
mgmt UP 72:b3:ba:91:e2:24 <NOARP,MASTER,UP,LOWER_UP>
red UP b6:6f:6e:f6:da:73 <NOARP,MASTER,UP,LOWER_UP>
blue UP 36:62:e8:7d:bb:8c <NOARP,MASTER,UP,LOWER_UP>
green UP e6:28:b8:63:70:bb <NOARP,MASTER,UP,LOWER_UP>
</pre></div>
</div>
</li>
<li><p>Assign a Network Interface to a VRF</p>
<p>Network interfaces are assigned to a VRF by enslaving the netdevice to a
VRF device:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip link set dev NAME master NAME
</pre></div>
</div>
<p>On enslavement connected and local routes are automatically moved to the
table associated with the VRF device.</p>
<p>For example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip link set dev eth0 master mgmt
</pre></div>
</div>
</li>
<li><p>Show Devices Assigned to a VRF</p>
<p>To show devices that have been assigned to a specific VRF add the master
option to the ip command:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip link show vrf NAME
$ ip link show master NAME
</pre></div>
</div>
<p>For example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip link show vrf red
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN mode DEFAULT group default qlen 1000
link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff
</pre></div>
</div>
<p>Or using the brief output:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip -br link show vrf red
eth1 UP 02:00:00:00:02:02 <BROADCAST,MULTICAST,UP,LOWER_UP>
eth2 UP 02:00:00:00:02:03 <BROADCAST,MULTICAST,UP,LOWER_UP>
eth5 DOWN 02:00:00:00:02:06 <BROADCAST,MULTICAST>
</pre></div>
</div>
</li>
<li><p>Show Neighbor Entries for a VRF</p>
<p>To list neighbor entries associated with devices enslaved to a VRF device
add the master option to the ip command:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip [-6] neigh show vrf NAME
$ ip [-6] neigh show master NAME
</pre></div>
</div>
<p>For example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip neigh show vrf red
10.2.1.254 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE
10.2.2.254 dev eth2 lladdr 5e:54:01:6a:ee:80 REACHABLE
$ ip -6 neigh show vrf red
2002:1::64 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE
</pre></div>
</div>
</li>
<li><p>Show Addresses for a VRF</p>
<p>To show addresses for interfaces associated with a VRF add the master
option to the ip command:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip addr show vrf NAME
$ ip addr show master NAME
</pre></div>
</div>
<p>For example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip addr show vrf red
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
inet 10.2.1.2/24 brd 10.2.1.255 scope global eth1
valid_lft forever preferred_lft forever
inet6 2002:1::2/120 scope global
valid_lft forever preferred_lft forever
inet6 fe80::ff:fe00:202/64 scope link
valid_lft forever preferred_lft forever
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
inet 10.2.2.2/24 brd 10.2.2.255 scope global eth2
valid_lft forever preferred_lft forever
inet6 2002:2::2/120 scope global
valid_lft forever preferred_lft forever
inet6 fe80::ff:fe00:203/64 scope link
valid_lft forever preferred_lft forever
7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN group default qlen 1000
link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff
</pre></div>
</div>
<p>Or in brief format:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip -br addr show vrf red
eth1 UP 10.2.1.2/24 2002:1::2/120 fe80::ff:fe00:202/64
eth2 UP 10.2.2.2/24 2002:2::2/120 fe80::ff:fe00:203/64
eth5 DOWN
</pre></div>
</div>
</li>
<li><p>Show Routes for a VRF</p>
<p>To show routes for a VRF use the ip command to display the table associated
with the VRF device:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip [-6] route show vrf NAME
$ ip [-6] route show table ID
</pre></div>
</div>
<p>For example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip route show vrf red
unreachable default metric 4278198272
broadcast 10.2.1.0 dev eth1 proto kernel scope link src 10.2.1.2
10.2.1.0/24 dev eth1 proto kernel scope link src 10.2.1.2
local 10.2.1.2 dev eth1 proto kernel scope host src 10.2.1.2
broadcast 10.2.1.255 dev eth1 proto kernel scope link src 10.2.1.2
broadcast 10.2.2.0 dev eth2 proto kernel scope link src 10.2.2.2
10.2.2.0/24 dev eth2 proto kernel scope link src 10.2.2.2
local 10.2.2.2 dev eth2 proto kernel scope host src 10.2.2.2
broadcast 10.2.2.255 dev eth2 proto kernel scope link src 10.2.2.2
$ ip -6 route show vrf red
local 2002:1:: dev lo proto none metric 0 pref medium
local 2002:1::2 dev lo proto none metric 0 pref medium
2002:1::/120 dev eth1 proto kernel metric 256 pref medium
local 2002:2:: dev lo proto none metric 0 pref medium
local 2002:2::2 dev lo proto none metric 0 pref medium
2002:2::/120 dev eth2 proto kernel metric 256 pref medium
local fe80:: dev lo proto none metric 0 pref medium
local fe80:: dev lo proto none metric 0 pref medium
local fe80::ff:fe00:202 dev lo proto none metric 0 pref medium
local fe80::ff:fe00:203 dev lo proto none metric 0 pref medium
fe80::/64 dev eth1 proto kernel metric 256 pref medium
fe80::/64 dev eth2 proto kernel metric 256 pref medium
ff00::/8 dev red metric 256 pref medium
ff00::/8 dev eth1 metric 256 pref medium
ff00::/8 dev eth2 metric 256 pref medium
unreachable default dev lo metric 4278198272 error -101 pref medium
</pre></div>
</div>
</li>
<li><p>Route Lookup for a VRF</p>
<p>A test route lookup can be done for a VRF:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip [-6] route get vrf NAME ADDRESS
$ ip [-6] route get oif NAME ADDRESS
</pre></div>
</div>
<p>For example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip route get 10.2.1.40 vrf red
10.2.1.40 dev eth1 table red src 10.2.1.2
cache
$ ip -6 route get 2002:1::32 vrf red
2002:1::32 from :: dev eth1 table red proto kernel src 2002:1::2 metric 256 pref medium
</pre></div>
</div>
</li>
<li><p>Removing Network Interface from a VRF</p>
<p>Network interfaces are removed from a VRF by breaking the enslavement to
the VRF device:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip link set dev NAME nomaster
</pre></div>
</div>
<p>Connected routes are moved back to the default table and local entries are
moved to the local table.</p>
<p>For example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>$ ip link set dev eth0 nomaster
</pre></div>
</div>
</li>
</ol>
<hr class="docutils" />
<p>Commands used in this example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>cat >> /etc/iproute2/rt_tables.d/vrf.conf <<EOF
1 mgmt
10 red
66 blue
81 green
EOF
function vrf_create
{
VRF=$1
TBID=$2
# create VRF device
ip link add ${VRF} type vrf table ${TBID}
if [ "${VRF}" != "mgmt" ]; then
ip route add table ${TBID} unreachable default metric 4278198272
fi
ip link set dev ${VRF} up
}
vrf_create mgmt 1
ip link set dev eth0 master mgmt
vrf_create red 10
ip link set dev eth1 master red
ip link set dev eth2 master red
ip link set dev eth5 master red
vrf_create blue 66
ip link set dev eth3 master blue
vrf_create green 81
ip link set dev eth4 master green
Interface addresses from /etc/network/interfaces:
auto eth0
iface eth0 inet static
address 10.0.0.2
netmask 255.255.255.0
gateway 10.0.0.254
iface eth0 inet6 static
address 2000:1::2
netmask 120
auto eth1
iface eth1 inet static
address 10.2.1.2
netmask 255.255.255.0
iface eth1 inet6 static
address 2002:1::2
netmask 120
auto eth2
iface eth2 inet static
address 10.2.2.2
netmask 255.255.255.0
iface eth2 inet6 static
address 2002:2::2
netmask 120
auto eth3
iface eth3 inet static
address 10.2.3.2
netmask 255.255.255.0
iface eth3 inet6 static
address 2002:3::2
netmask 120
auto eth4
iface eth4 inet static
address 10.2.4.2
netmask 255.255.255.0
iface eth4 inet6 static
address 2002:4::2
netmask 120
</pre></div>
</div>
</section>
</section>
</div>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="footer">
©The kernel development community.
|
Powered by <a href="https://www.sphinx-doc.org/">Sphinx 8.1.3</a>
& <a href="https://alabaster.readthedocs.io">Alabaster 0.7.16</a>
|
<a href="../_sources/networking/vrf.rst.txt"
rel="nofollow">Page source</a>
</div>
</body>
</html>| Name | Type | Size | Permission | Actions |
|---|---|---|---|---|
| caif | Folder | 0755 |
|
|
| device_drivers | Folder | 0755 |
|
|
| devlink | Folder | 0755 |
|
|
| diagnostic | Folder | 0755 |
|
|
| dsa | Folder | 0755 |
|
|
| mac80211_hwsim | Folder | 0755 |
|
|
| net_cachelines | Folder | 0755 |
|
|
| pse-pd | Folder | 0755 |
|
|
| 6lowpan.html | File | 9.97 KB | 0644 |
|
| 6pack.html | File | 18.06 KB | 0644 |
|
| af_xdp.html | File | 71.08 KB | 0644 |
|
| alias.html | File | 9.71 KB | 0644 |
|
| arcnet-hardware.html | File | 153.3 KB | 0644 |
|
| arcnet.html | File | 37.48 KB | 0644 |
|
| atm.html | File | 8.24 KB | 0644 |
|
| ax25.html | File | 8.75 KB | 0644 |
|
| bareudp.html | File | 10.56 KB | 0644 |
|
| batman-adv.html | File | 16.81 KB | 0644 |
|
| bonding.html | File | 140.89 KB | 0644 |
|
| bridge.html | File | 53.36 KB | 0644 |
|
| can.html | File | 120.11 KB | 0644 |
|
| can_ucan_protocol.html | File | 25.27 KB | 0644 |
|
| cdc_mbim.html | File | 25.28 KB | 0644 |
|
| checksum-offloads.html | File | 16.15 KB | 0644 |
|
| dctcp.html | File | 10.32 KB | 0644 |
|
| devmem.html | File | 24.33 KB | 0644 |
|
| dns_resolver.html | File | 15.11 KB | 0644 |
|
| driver.html | File | 20.41 KB | 0644 |
|
| eql.html | File | 31.48 KB | 0644 |
|
| ethtool-netlink.html | File | 274 KB | 0644 |
|
| failover.html | File | 8.43 KB | 0644 |
|
| fib_trie.html | File | 16.04 KB | 0644 |
|
| filter.html | File | 42.43 KB | 0644 |
|
| gen_stats.html | File | 14.2 KB | 0644 |
|
| generic-hdlc.html | File | 14.67 KB | 0644 |
|
| generic_netlink.html | File | 8.11 KB | 0644 |
|
| gtp.html | File | 20.55 KB | 0644 |
|
| ieee802154.html | File | 25.03 KB | 0644 |
|
| ila.html | File | 21.79 KB | 0644 |
|
| index.html | File | 108.18 KB | 0644 |
|
| ioam6-sysctl.html | File | 8.48 KB | 0644 |
|
| iou-zcrx.html | File | 16.63 KB | 0644 |
|
| ip-sysctl.html | File | 154.81 KB | 0644 |
|
| ip_dynaddr.html | File | 9.97 KB | 0644 |
|
| ipsec.html | File | 9.71 KB | 0644 |
|
| ipv6.html | File | 9.87 KB | 0644 |
|
| ipvlan.html | File | 16.87 KB | 0644 |
|
| ipvs-sysctl.html | File | 20.73 KB | 0644 |
|
| iso15765-2.html | File | 39.91 KB | 0644 |
|
| j1939.html | File | 99.33 KB | 0644 |
|
| kapi.html | File | 1.78 MB | 0644 |
|
| kcm.html | File | 21.67 KB | 0644 |
|
| l2tp.html | File | 47.74 KB | 0644 |
|
| lapb-module.html | File | 22.56 KB | 0644 |
|
| mac80211-injection.html | File | 12.37 KB | 0644 |
|
| mctp.html | File | 35.16 KB | 0644 |
|
| mpls-sysctl.html | File | 9.64 KB | 0644 |
|
| mptcp-sysctl.html | File | 13.33 KB | 0644 |
|
| mptcp.html | File | 19.74 KB | 0644 |
|
| msg_zerocopy.html | File | 19.72 KB | 0644 |
|
| multi-pf-netdev.html | File | 17.48 KB | 0644 |
|
| multiqueue.html | File | 13.21 KB | 0644 |
|
| napi.html | File | 43.36 KB | 0644 |
|
| net_dim.html | File | 76.45 KB | 0644 |
|
| net_failover.html | File | 16.3 KB | 0644 |
|
| netconsole.html | File | 31.44 KB | 0644 |
|
| netdev-features.html | File | 17.75 KB | 0644 |
|
| netdevices.html | File | 43.33 KB | 0644 |
|
| netfilter-sysctl.html | File | 8.43 KB | 0644 |
|
| netif-msg.html | File | 12.93 KB | 0644 |
|
| netmem.html | File | 14.84 KB | 0644 |
|
| nexthop-group-resilient.html | File | 24.56 KB | 0644 |
|
| nf_conntrack-sysctl.html | File | 15.77 KB | 0644 |
|
| nf_flowtable.html | File | 21.24 KB | 0644 |
|
| nfc.html | File | 13.73 KB | 0644 |
|
| oa-tc6-framework.html | File | 39.07 KB | 0644 |
|
| openvswitch.html | File | 21.15 KB | 0644 |
|
| operstates.html | File | 18.28 KB | 0644 |
|
| packet_mmap.html | File | 55.34 KB | 0644 |
|
| page_pool.html | File | 59.25 KB | 0644 |
|
| phonet.html | File | 16.92 KB | 0644 |
|
| phy-link-topology.html | File | 15.77 KB | 0644 |
|
| phy.html | File | 40.5 KB | 0644 |
|
| pktgen.html | File | 24.97 KB | 0644 |
|
| plip.html | File | 18.56 KB | 0644 |
|
| ppp_generic.html | File | 37.23 KB | 0644 |
|
| proc_net_tcp.html | File | 11.13 KB | 0644 |
|
| psp.html | File | 18.66 KB | 0644 |
|
| radiotap-headers.html | File | 14.73 KB | 0644 |
|
| rds.html | File | 29.39 KB | 0644 |
|
| regulatory.html | File | 18.44 KB | 0644 |
|
| representors.html | File | 25.79 KB | 0644 |
|
| rxrpc.html | File | 130.88 KB | 0644 |
|
| scaling.html | File | 40.25 KB | 0644 |
|
| sctp.html | File | 9.73 KB | 0644 |
|
| secid.html | File | 8.42 KB | 0644 |
|
| seg6-sysctl.html | File | 9.53 KB | 0644 |
|
| segmentation-offloads.html | File | 17.81 KB | 0644 |
|
| sfp-phylink.html | File | 41.09 KB | 0644 |
|
| skbuff.html | File | 29.22 KB | 0644 |
|
| smc-sysctl.html | File | 10.42 KB | 0644 |
|
| snmp_counter.html | File | 91.51 KB | 0644 |
|
| sriov.html | File | 9.46 KB | 0644 |
|
| statistics.html | File | 31.78 KB | 0644 |
|
| strparser.html | File | 19.15 KB | 0644 |
|
| switchdev.html | File | 39.55 KB | 0644 |
|
| sysfs-tagging.html | File | 10.95 KB | 0644 |
|
| tc-actions-env-rules.html | File | 8.87 KB | 0644 |
|
| tc-queue-filters.html | File | 9.33 KB | 0644 |
|
| tcp-thin.html | File | 10.33 KB | 0644 |
|
| tcp_ao.html | File | 35.85 KB | 0644 |
|
| team.html | File | 7.93 KB | 0644 |
|
| timestamping.html | File | 59.83 KB | 0644 |
|
| tipc.html | File | 384.61 KB | 0644 |
|
| tls-handshake.html | File | 21.18 KB | 0644 |
|
| tls-offload.html | File | 42.72 KB | 0644 |
|
| tls.html | File | 39.38 KB | 0644 |
|
| tproxy.html | File | 13.18 KB | 0644 |
|
| tuntap.html | File | 19 KB | 0644 |
|
| udplite.html | File | 23.04 KB | 0644 |
|
| vrf.html | File | 28.46 KB | 0644 |
|
| vxlan.html | File | 11.95 KB | 0644 |
|
| x25-iface.html | File | 10.9 KB | 0644 |
|
| x25.html | File | 10.07 KB | 0644 |
|
| xdp-rx-metadata.html | File | 27.46 KB | 0644 |
|
| xfrm_device.html | File | 19.14 KB | 0644 |
|
| xfrm_proc.html | File | 11.37 KB | 0644 |
|
| xfrm_sync.html | File | 15.85 KB | 0644 |
|
| xfrm_sysctl.html | File | 8.07 KB | 0644 |
|
| xsk-tx-metadata.html | File | 18.64 KB | 0644 |
|