|
NAME | SYNOPSIS | DESCRIPTION | OPTIONS | EXAMPLES | SEE ALSO | COLOPHON |
|
Tunnel metadata manipulation actionninntc(8)ata manipulation action in tc(8)
tunnel_key - Tunnel metadata manipulation
tc ... action tunnel_key { unset | SET }
SET := set src_ip ADDRESS dst_ip ADDRESS id KEY_ID dst_port UDP_PORT
[ csum | nocsum ]
The tunnel_key action combined with a shared IP tunnel device, allows
to perform IP tunnel en- or decapsulation on a packet, reflected by
the operation modes UNSET and SET. The UNSET mode is optional - even
without using it, the metadata information will be released
automatically when packet processing will be finished. UNSET
function could be used in cases when traffic is forwarded between two
tunnels, where the metadata from the first tunnel will be used for
encapsulation done by the second tunnel. SET mode requires the
source and destination ip ADDRESS and the tunnel key id KEY_ID which
will be used by the ip tunnel shared device to create the tunnel
header. The tunnel_key action is useful only in combination with a
mirred redirect action to a shared IP tunnel device which will use
the metadata (for SET ) and unset the metadata created by it (for
UNSET ).
unset Unset the tunnel metadata created by the IP tunnel device.
This function is not mandatory and might be used only in some
specific use cases (as explained above).
set Set tunnel metadata to be used by the IP tunnel device.
Requires id , src_ip and dst_ip options. dst_port is
optional.
id Tunnel ID (for example VNI in VXLAN tunnel)
src_ip Outer header source IP address (IPv4 or IPv6)
dst_ip Outer header destination IP address (IPv4 or IPv6)
dst_port
Outer header destination UDP port
[no]csum
Controlls outer UDP checksum. When set to csum (which
is default), the outer UDP checksum is calculated and
included in the packets. When set to nocsum, outer UDP
checksum is zero. Note that when using zero UDP
checksums with IPv6, the other tunnel endpoint must be
configured to accept such packets. In Linux, this
would be the udp6zerocsumrx option for the VXLAN tunnel
interface.
If using nocsum with IPv6, be sure you know what you
are doing. Zero UDP checksums provide weaker protection
against corrupted packets. See RFC6935 for details.
The following example encapsulates incoming ICMP packets on eth0 into
a vxlan tunnel, by setting metadata to VNI 11, source IP 11.11.0.1
and destination IP 11.11.0.2, and by redirecting the packet with the
metadata to device vxlan0, which will do the actual encapsulation
using the metadata:
#tc qdisc add dev eth0 handle ffff: ingress
#tc filter add dev eth0 protocol ip parent ffff: \
flower \
ip_proto icmp \
action tunnel_key set \
src_ip 11.11.0.1 \
dst_ip 11.11.0.2 \
id 11 \
action mirred egress redirect dev vxlan0
Here is an example of the unset function: Incoming VXLAN traffic with
outer IP's and VNI 11 is decapsulated by vxlan0 and metadata is unset
before redirecting to tunl1 device:
#tc qdisc add dev eth0 handle ffff: ingress
#tc filter add dev vxlan0 protocol ip parent ffff: flower \
enc_src_ip 11.11.0.2 enc_dst_ip 11.11.0.1 enc_key_id 11 action tunnel_key unset action mirred egress redirect dev tunl1
tc(8)
This page is part of the iproute2 (utilities for controlling TCP/IP
networking and traffic) project. Information about the project can
be found at
⟨http://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2⟩.
If you have a bug report for this manual page, send it to
netdev@vger.kernel.org, shemminger@osdl.org. This page was obtained
from the project's upstream Git repository
⟨git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git⟩
on 2018-02-02. (At that time, the date of the most recent commit
that was found in the repository was 2018-01-29.) If you discover
any rendering problems in this HTML version of the page, or you
believe there is a better or more up-to-date source for the page, or
you have corrections or improvements to the information in this
COLOPHON (which is not part of the original manual page), send a mail
to man-pages@man7.org
iproute2 T1u0nnNeolvm2e0t1a6data manipulation action in tc(8)
Pages that refer to this page: tc-actions(8)
|
HTML rendering created 2018-02-02 by Michael Kerrisk, author of The Linux Programming Interface, maintainer of the Linux man-pages project. For details of in-depth Linux/UNIX system programming training courses that I teach, look here. Hosting by jambit GmbH.
|
|