1SYSTEMD.NETDEV(5)               systemd.network              SYSTEMD.NETDEV(5)
2
3
4

NAME

6       systemd.netdev - Virtual Network Device configuration
7

SYNOPSIS

9       netdev.netdev
10

DESCRIPTION

12       A plain ini-style text file that encodes configuration about a virtual
13       network device, used by systemd-networkd(8). See systemd.syntax(7) for
14       a general description of the syntax.
15
16       The main Virtual Network Device file must have the extension .netdev;
17       other extensions are ignored. Virtual network devices are created as
18       soon as networkd is started. If a netdev with the specified name
19       already exists, networkd will use that as-is rather than create its
20       own. Note that the settings of the pre-existing netdev will not be
21       changed by networkd.
22
23       The .netdev files are read from the files located in the system network
24       directory /usr/lib/systemd/network, the volatile runtime network
25       directory /run/systemd/network and the local administration network
26       directory /etc/systemd/network. All configuration files are
27       collectively sorted and processed in lexical order, regardless of the
28       directories in which they live. However, files with identical filenames
29       replace each other. Files in /etc have the highest priority, files in
30       /run take precedence over files with the same name in /usr/lib. This
31       can be used to override a system-supplied configuration file with a
32       local file if needed. As a special case, an empty file (file size 0) or
33       symlink with the same name pointing to /dev/null disables the
34       configuration file entirely (it is "masked").
35
36       Along with the netdev file foo.netdev, a "drop-in" directory
37       foo.netdev.d/ may exist. All files with the suffix ".conf" from this
38       directory will be parsed after the file itself is parsed. This is
39       useful to alter or add configuration settings, without having to modify
40       the main configuration file. Each drop-in file must have appropriate
41       section headers.
42
43       In addition to /etc/systemd/network, drop-in ".d" directories can be
44       placed in /usr/lib/systemd/network or /run/systemd/network directories.
45       Drop-in files in /etc take precedence over those in /run which in turn
46       take precedence over those in /usr/lib. Drop-in files under any of
47       these directories take precedence over the main netdev file wherever
48       located. (Of course, since /run is temporary and /usr/lib is for
49       vendors, it is unlikely drop-ins should be used in either of those
50       places.)
51

SUPPORTED NETDEV KINDS

53       The following kinds of virtual network devices may be configured in
54       .netdev files:
55
56       Table 1. Supported kinds of virtual network devices
57       ┌──────────┬────────────────────────────┐
58Kind      Description                
59       ├──────────┼────────────────────────────┤
60bond      │ A bond device is an        │
61       │          │ aggregation of all its     │
62       │          │ slave devices. See Linux   
63       │          │ Ethernet Bonding Driver    │
64       │          │ HOWTO[1] for details.      │
65       ├──────────┼────────────────────────────┤
66bridge    │ A bridge device is a       │
67       │          │ software switch, and each  │
68       │          │ of its slave devices and   │
69       │          │ the bridge itself are      │
70       │          │ ports of the switch.       │
71       ├──────────┼────────────────────────────┤
72dummy     │ A dummy device drops all   │
73       │          │ packets sent to it.        │
74       ├──────────┼────────────────────────────┤
75gre       │ A Level 3 GRE tunnel over  │
76       │          │ IPv4. See RFC 2784[2] for  │
77       │          │ details.                   │
78       ├──────────┼────────────────────────────┤
79gretap    │ A Level 2 GRE tunnel over  │
80       │          │ IPv4.                      │
81       ├──────────┼────────────────────────────┤
82erspan    │ ERSPAN mirrors traffic on  │
83       │          │ one or more source ports   │
84       │          │ and delivers the mirrored  │
85       │          │ traffic to one or more     │
86       │          │ destination ports on       │
87       │          │ another switch. The        │
88       │          │ traffic is encapsulated in │
89       │          │ generic routing            │
90       │          │ encapsulation (GRE) and is │
91       │          │ therefore routable across  │
92       │          │ a layer 3 network between  │
93       │          │ the source switch and the  │
94       │          │ destination switch.        │
95       ├──────────┼────────────────────────────┤
96ip6gre    │ A Level 3 GRE tunnel over  │
97       │          │ IPv6.                      │
98       ├──────────┼────────────────────────────┤
99ip6tnl    │ An IPv4 or IPv6 tunnel     │
100       │          │ over IPv6                  │
101       ├──────────┼────────────────────────────┤
102ip6gretap │ A Level 2 GRE tunnel over  │
103       │          │ IPv6.                      │
104       ├──────────┼────────────────────────────┤
105ipip      │ An IPv4 over IPv4 tunnel.  │
106       ├──────────┼────────────────────────────┤
107ipvlan    │ An IPVLAN device is a      │
108       │          │ stacked device which       │
109       │          │ receives packets from its  │
110       │          │ underlying device based on │
111       │          │ IP address filtering.      │
112       ├──────────┼────────────────────────────┤
113ipvtap    │ An IPVTAP device is a      │
114       │          │ stacked device which       │
115       │          │ receives packets from its  │
116       │          │ underlying device based on │
117       │          │ IP address filtering and   │
118       │          │ can be accessed using the  │
119       │          │ tap user space interface.  │
120       ├──────────┼────────────────────────────┤
121macvlan   │ A macvlan device is a      │
122       │          │ stacked device which       │
123       │          │ receives packets from its  │
124       │          │ underlying device based on │
125       │          │ MAC address filtering.     │
126       ├──────────┼────────────────────────────┤
127macvtap   │ A macvtap device is a      │
128       │          │ stacked device which       │
129       │          │ receives packets from its  │
130       │          │ underlying device based on │
131       │          │ MAC address filtering.     │
132       ├──────────┼────────────────────────────┤
133sit       │ An IPv6 over IPv4 tunnel.  │
134       ├──────────┼────────────────────────────┤
135tap       │ A persistent Level 2       │
136       │          │ tunnel between a network   │
137       │          │ device and a device node.  │
138       ├──────────┼────────────────────────────┤
139tun       │ A persistent Level 3       │
140       │          │ tunnel between a network   │
141       │          │ device and a device node.  │
142       ├──────────┼────────────────────────────┤
143veth      │ An Ethernet tunnel between │
144       │          │ a pair of network devices. │
145       ├──────────┼────────────────────────────┤
146vlan      │ A VLAN is a stacked device │
147       │          │ which receives packets     │
148       │          │ from its underlying device │
149       │          │ based on VLAN tagging. See │
150       │          │ IEEE 802.1Q[3] for         │
151       │          │ details.                   │
152       ├──────────┼────────────────────────────┤
153vti       │ An IPv4 over IPSec tunnel. │
154       ├──────────┼────────────────────────────┤
155vti6      │ An IPv6 over IPSec tunnel. │
156       ├──────────┼────────────────────────────┤
157vxlan     │ A virtual extensible LAN   │
158       │          │ (vxlan), for connecting    │
159       │          │ Cloud computing            │
160       │          │ deployments.               │
161       ├──────────┼────────────────────────────┤
162geneve    │ A GEneric NEtwork          │
163       │          │ Virtualization             │
164       │          │ Encapsulation (GENEVE)     │
165       │          │ netdev driver.             │
166       ├──────────┼────────────────────────────┤
167l2tp      │ A Layer 2 Tunneling        │
168       │          │ Protocol (L2TP) is a       │
169       │          │ tunneling protocol used to │
170       │          │ support virtual private    │
171       │          │ networks (VPNs) or as part │
172       │          │ of the delivery of         │
173       │          │ services by ISPs. It does  │
174       │          │ not provide any encryption │
175       │          │ or confidentiality by      │
176       │          │ itself                     │
177       ├──────────┼────────────────────────────┤
178macsec    │ Media Access Control       │
179       │          │ Security (MACsec) is an    │
180       │          │ 802.1AE IEEE               │
181       │          │ industry-standard security │
182       │          │ technology that provides   │
183       │          │ secure communication for   │
184       │          │ all traffic on Ethernet    │
185       │          │ links. MACsec provides     │
186       │          │ point-to-point security on │
187       │          │ Ethernet links between     │
188       │          │ directly connected nodes   │
189       │          │ and is capable of          │
190       │          │ identifying and preventing │
191       │          │ most security threats.     │
192       ├──────────┼────────────────────────────┤
193vrf       │ A Virtual Routing and      │
194       │          │ Forwarding (VRF[4])        │
195       │          │ interface to create        │
196       │          │ separate routing and       │
197       │          │ forwarding domains.        │
198       ├──────────┼────────────────────────────┤
199vcan      │ The virtual CAN driver     │
200       │          │ (vcan). Similar to the     │
201       │          │ network loopback devices,  │
202       │          │ vcan offers a virtual      │
203       │          │ local CAN interface.       │
204       ├──────────┼────────────────────────────┤
205vxcan     │ The virtual CAN tunnel     │
206       │          │ driver (vxcan). Similar to │
207       │          │ the virtual ethernet       │
208       │          │ driver veth, vxcan         │
209       │          │ implements a local CAN     │
210       │          │ traffic tunnel between two │
211       │          │ virtual CAN network        │
212       │          │ devices. When creating a   │
213       │          │ vxcan, two vxcan devices   │
214       │          │ are created as pair. When  │
215       │          │ one end receives the       │
216       │          │ packet it appears on its   │
217       │          │ pair and vice versa. The   │
218       │          │ vxcan can be used for      │
219       │          │ cross namespace            │
220       │          │ communication.             │
221       ├──────────┼────────────────────────────┤
222wireguard │ WireGuard Secure Network   │
223       │          │ Tunnel.                    │
224       ├──────────┼────────────────────────────┤
225nlmon     │ A Netlink monitor device.  │
226       │          │ Use an nlmon device when   │
227       │          │ you want to monitor system │
228       │          │ Netlink messages.          │
229       ├──────────┼────────────────────────────┤
230fou       │ Foo-over-UDP tunneling.    │
231       ├──────────┼────────────────────────────┤
232xfrm      │ A virtual tunnel interface │
233       │          │ like vti/vti6 but with     │
234       │          │ several advantages.        │
235       ├──────────┼────────────────────────────┤
236ifb       │ The Intermediate           │
237       │          │ Functional Block (ifb)     │
238       │          │ pseudo network interface   │
239       │          │ acts as a QoS concentrator │
240       │          │ for multiple different     │
241       │          │ sources of traffic.        │
242       └──────────┴────────────────────────────┘
243

[MATCH] SECTION OPTIONS

245       A virtual network device is only created if the [Match] section matches
246       the current environment, or if the section is empty. The following keys
247       are accepted:
248
249       Host=
250           Matches against the hostname or machine ID of the host. See
251           "ConditionHost=" in systemd.unit(5) for details. When prefixed with
252           an exclamation mark ("!"), the result is negated. If an empty
253           string is assigned, then previously assigned value is cleared.
254
255       Virtualization=
256           Checks whether the system is executed in a virtualized environment
257           and optionally test whether it is a specific implementation. See
258           "ConditionVirtualization=" in systemd.unit(5) for details. When
259           prefixed with an exclamation mark ("!"), the result is negated. If
260           an empty string is assigned, then previously assigned value is
261           cleared.
262
263       KernelCommandLine=
264           Checks whether a specific kernel command line option is set. See
265           "ConditionKernelCommandLine=" in systemd.unit(5) for details. When
266           prefixed with an exclamation mark ("!"), the result is negated. If
267           an empty string is assigned, then previously assigned value is
268           cleared.
269
270       KernelVersion=
271           Checks whether the kernel version (as reported by uname -r) matches
272           a certain expression. See "ConditionKernelVersion=" in
273           systemd.unit(5) for details. When prefixed with an exclamation mark
274           ("!"), the result is negated. If an empty string is assigned, then
275           previously assigned value is cleared.
276
277       Architecture=
278           Checks whether the system is running on a specific architecture.
279           See "ConditionArchitecture=" in systemd.unit(5) for details. When
280           prefixed with an exclamation mark ("!"), the result is negated. If
281           an empty string is assigned, then previously assigned value is
282           cleared.
283

[NETDEV] SECTION OPTIONS

285       The [NetDev] section accepts the following keys:
286
287       Description=
288           A free-form description of the netdev.
289
290       Name=
291           The interface name used when creating the netdev. This setting is
292           compulsory.
293
294       Kind=
295           The netdev kind. This setting is compulsory. See the "Supported
296           netdev kinds" section for the valid keys.
297
298       MTUBytes=
299           The maximum transmission unit in bytes to set for the device. The
300           usual suffixes K, M, G are supported and are understood to the base
301           of 1024. For "tun" or "tap" devices, MTUBytes= setting is not
302           currently supported in [NetDev] section. Please specify it in
303           [Link] section of corresponding systemd.network(5) files.
304
305       MACAddress=
306           The MAC address to use for the device. For "tun" or "tap" devices,
307           setting MACAddress= in the [NetDev] section is not supported.
308           Please specify it in [Link] section of the corresponding
309           systemd.network(5) file. If this option is not set, "vlan" devices
310           inherit the MAC address of the physical interface. For other kind
311           of netdevs, if this option is not set, then MAC address is
312           generated based on the interface name and the machine-id(5).
313

[BRIDGE] SECTION OPTIONS

315       The [Bridge] section only applies for netdevs of kind "bridge", and
316       accepts the following keys:
317
318       HelloTimeSec=
319           HelloTimeSec specifies the number of seconds between two hello
320           packets sent out by the root bridge and the designated bridges.
321           Hello packets are used to communicate information about the
322           topology throughout the entire bridged local area network.
323
324       MaxAgeSec=
325           MaxAgeSec specifies the number of seconds of maximum message age.
326           If the last seen (received) hello packet is more than this number
327           of seconds old, the bridge in question will start the takeover
328           procedure in attempt to become the Root Bridge itself.
329
330       ForwardDelaySec=
331           ForwardDelaySec specifies the number of seconds spent in each of
332           the Listening and Learning states before the Forwarding state is
333           entered.
334
335       AgeingTimeSec=
336           This specifies the number of seconds a MAC Address will be kept in
337           the forwarding database after having a packet received from this
338           MAC Address.
339
340       Priority=
341           The priority of the bridge. An integer between 0 and 65535. A lower
342           value means higher priority. The bridge having the lowest priority
343           will be elected as root bridge.
344
345       GroupForwardMask=
346           A 16-bit bitmask represented as an integer which allows forwarding
347           of link local frames with 802.1D reserved addresses
348           (01:80:C2:00:00:0X). A logical AND is performed between the
349           specified bitmask and the exponentiation of 2^X, the lower nibble
350           of the last octet of the MAC address. For example, a value of 8
351           would allow forwarding of frames addressed to 01:80:C2:00:00:03
352           (802.1X PAE).
353
354       DefaultPVID=
355           This specifies the default port VLAN ID of a newly attached bridge
356           port. Set this to an integer in the range 1–4094 or "none" to
357           disable the PVID.
358
359       MulticastQuerier=
360           Takes a boolean. This setting controls the IFLA_BR_MCAST_QUERIER
361           option in the kernel. If enabled, the kernel will send general ICMP
362           queries from a zero source address. This feature should allow
363           faster convergence on startup, but it causes some multicast-aware
364           switches to misbehave and disrupt forwarding of multicast packets.
365           When unset, the kernel's default will be used.
366
367       MulticastSnooping=
368           Takes a boolean. This setting controls the IFLA_BR_MCAST_SNOOPING
369           option in the kernel. If enabled, IGMP snooping monitors the
370           Internet Group Management Protocol (IGMP) traffic between hosts and
371           multicast routers. When unset, the kernel's default will be used.
372
373       VLANFiltering=
374           Takes a boolean. This setting controls the IFLA_BR_VLAN_FILTERING
375           option in the kernel. If enabled, the bridge will be started in
376           VLAN-filtering mode. When unset, the kernel's default will be used.
377
378       VLANProtocol=
379           Allows setting the protocol used for VLAN filtering. Takes 802.1q
380           or, 802.1ad, and defaults to unset and kernel's default is used.
381
382       STP=
383           Takes a boolean. This enables the bridge's Spanning Tree Protocol
384           (STP). When unset, the kernel's default will be used.
385
386       MulticastIGMPVersion=
387           Allows changing bridge's multicast Internet Group Management
388           Protocol (IGMP) version. Takes an integer 2 or 3. When unset, the
389           kernel's default will be used.
390

[VLAN] SECTION OPTIONS

392       The [VLAN] section only applies for netdevs of kind "vlan", and accepts
393       the following key:
394
395       Id=
396           The VLAN ID to use. An integer in the range 0–4094. This setting is
397           compulsory.
398
399       GVRP=
400           Takes a boolean. The Generic VLAN Registration Protocol (GVRP) is a
401           protocol that allows automatic learning of VLANs on a network. When
402           unset, the kernel's default will be used.
403
404       MVRP=
405           Takes a boolean. Multiple VLAN Registration Protocol (MVRP)
406           formerly known as GARP VLAN Registration Protocol (GVRP) is a
407           standards-based Layer 2 network protocol, for automatic
408           configuration of VLAN information on switches. It was defined in
409           the 802.1ak amendment to 802.1Q-2005. When unset, the kernel's
410           default will be used.
411
412       LooseBinding=
413           Takes a boolean. The VLAN loose binding mode, in which only the
414           operational state is passed from the parent to the associated
415           VLANs, but the VLAN device state is not changed. When unset, the
416           kernel's default will be used.
417
418       ReorderHeader=
419           Takes a boolean. When enabled, the VLAN reorder header is used and
420           VLAN interfaces behave like physical interfaces. When unset, the
421           kernel's default will be used.
422

[MACVLAN] SECTION OPTIONS

424       The [MACVLAN] section only applies for netdevs of kind "macvlan", and
425       accepts the following key:
426
427       Mode=
428           The MACVLAN mode to use. The supported options are "private",
429           "vepa", "bridge", "passthru", and "source".
430
431       SourceMACAddress=
432           A whitespace-separated list of remote hardware addresses allowed on
433           the MACVLAN. This option only has an effect in source mode. Use
434           full colon-, hyphen- or dot-delimited hexadecimal. This option may
435           appear more than once, in which case the lists are merged. If the
436           empty string is assigned to this option, the list of hardware
437           addresses defined prior to this is reset. Defaults to unset.
438

[MACVTAP] SECTION OPTIONS

440       The [MACVTAP] section applies for netdevs of kind "macvtap" and accepts
441       the same key as [MACVLAN].
442

[IPVLAN] SECTION OPTIONS

444       The [IPVLAN] section only applies for netdevs of kind "ipvlan", and
445       accepts the following key:
446
447       Mode=
448           The IPVLAN mode to use. The supported options are "L2","L3" and
449           "L3S".
450
451       Flags=
452           The IPVLAN flags to use. The supported options are
453           "bridge","private" and "vepa".
454

[IPVTAP] SECTION OPTIONS

456       The [IPVTAP] section only applies for netdevs of kind "ipvtap" and
457       accepts the same key as [IPVLAN].
458

[VXLAN] SECTION OPTIONS

460       The [VXLAN] section only applies for netdevs of kind "vxlan", and
461       accepts the following keys:
462
463       VNI=
464           The VXLAN Network Identifier (or VXLAN Segment ID). Takes a number
465           in the range 1-16777215.
466
467       Remote=
468           Configures destination IP address.
469
470       Local=
471           Configures local IP address.
472
473       Group=
474           Configures VXLAN multicast group IP address. All members of a VXLAN
475           must use the same multicast group address.
476
477       TOS=
478           The Type Of Service byte value for a vxlan interface.
479
480       TTL=
481           A fixed Time To Live N on Virtual eXtensible Local Area Network
482           packets. Takes "inherit" or a number in the range 0–255. 0 is a
483           special value meaning inherit the inner protocol's TTL value.
484           "inherit" means that it will inherit the outer protocol's TTL
485           value.
486
487       MacLearning=
488           Takes a boolean. When true, enables dynamic MAC learning to
489           discover remote MAC addresses.
490
491       FDBAgeingSec=
492           The lifetime of Forwarding Database entry learnt by the kernel, in
493           seconds.
494
495       MaximumFDBEntries=
496           Configures maximum number of FDB entries.
497
498       ReduceARPProxy=
499           Takes a boolean. When true, bridge-connected VXLAN tunnel endpoint
500           answers ARP requests from the local bridge on behalf of remote
501           Distributed Overlay Virtual Ethernet (DVOE)[5] clients. Defaults to
502           false.
503
504       L2MissNotification=
505           Takes a boolean. When true, enables netlink LLADDR miss
506           notifications.
507
508       L3MissNotification=
509           Takes a boolean. When true, enables netlink IP address miss
510           notifications.
511
512       RouteShortCircuit=
513           Takes a boolean. When true, route short circuiting is turned on.
514
515       UDPChecksum=
516           Takes a boolean. When true, transmitting UDP checksums when doing
517           VXLAN/IPv4 is turned on.
518
519       UDP6ZeroChecksumTx=
520           Takes a boolean. When true, sending zero checksums in VXLAN/IPv6 is
521           turned on.
522
523       UDP6ZeroChecksumRx=
524           Takes a boolean. When true, receiving zero checksums in VXLAN/IPv6
525           is turned on.
526
527       RemoteChecksumTx=
528           Takes a boolean. When true, remote transmit checksum offload of
529           VXLAN is turned on.
530
531       RemoteChecksumRx=
532           Takes a boolean. When true, remote receive checksum offload in
533           VXLAN is turned on.
534
535       GroupPolicyExtension=
536           Takes a boolean. When true, it enables Group Policy VXLAN extension
537           security label mechanism across network peers based on VXLAN. For
538           details about the Group Policy VXLAN, see the VXLAN Group Policy[6]
539           document. Defaults to false.
540
541       GenericProtocolExtension=
542           Takes a boolean. When true, Generic Protocol Extension extends the
543           existing VXLAN protocol to provide protocol typing, OAM, and
544           versioning capabilities. For details about the VXLAN GPE Header,
545           see the Generic Protocol Extension for VXLAN[7] document. If
546           destination port is not specified and Generic Protocol Extension is
547           set then default port of 4790 is used. Defaults to false.
548
549       DestinationPort=
550           Configures the default destination UDP port. If the destination
551           port is not specified then Linux kernel default will be used. Set
552           to 4789 to get the IANA assigned value.
553
554       PortRange=
555           Configures the source port range for the VXLAN. The kernel assigns
556           the source UDP port based on the flow to help the receiver to do
557           load balancing. When this option is not set, the normal range of
558           local UDP ports is used.
559
560       FlowLabel=
561           Specifies the flow label to use in outgoing packets. The valid
562           range is 0-1048575.
563
564       IPDoNotFragment=
565           Allows setting the IPv4 Do not Fragment (DF) bit in outgoing
566           packets, or to inherit its value from the IPv4 inner header. Takes
567           a boolean value, or "inherit". Set to "inherit" if the encapsulated
568           protocol is IPv6. When unset, the kernel's default will be used.
569

[GENEVE] SECTION OPTIONS

571       The [GENEVE] section only applies for netdevs of kind "geneve", and
572       accepts the following keys:
573
574       Id=
575           Specifies the Virtual Network Identifier (VNI) to use. Ranges
576           [0-16777215]. This field is mandatory.
577
578       Remote=
579           Specifies the unicast destination IP address to use in outgoing
580           packets.
581
582       TOS=
583           Specifies the TOS value to use in outgoing packets. Ranges [1-255].
584
585       TTL=
586           Accepts the same values as in the [VXLAN] section, except that when
587           unset or set to 0, the kernel's default will be used, meaning that
588           packet TTL will be set from /proc/sys/net/ipv4/ip_default_ttl.
589
590       UDPChecksum=
591           Takes a boolean. When true, specifies that UDP checksum is
592           calculated for transmitted packets over IPv4.
593
594       UDP6ZeroChecksumTx=
595           Takes a boolean. When true, skip UDP checksum calculation for
596           transmitted packets over IPv6.
597
598       UDP6ZeroChecksumRx=
599           Takes a boolean. When true, allows incoming UDP packets over IPv6
600           with zero checksum field.
601
602       DestinationPort=
603           Specifies destination port. Defaults to 6081. If not set or
604           assigned the empty string, the default port of 6081 is used.
605
606       FlowLabel=
607           Specifies the flow label to use in outgoing packets.
608
609       IPDoNotFragment=
610           Accepts the same key in [VXLAN] section.
611

[L2TP] SECTION OPTIONS

613       The [L2TP] section only applies for netdevs of kind "l2tp", and accepts
614       the following keys:
615
616       TunnelId=
617           Specifies the tunnel identifier. Takes an number in the range
618           1–4294967295. The value used must match the "PeerTunnelId=" value
619           being used at the peer. This setting is compulsory.
620
621       PeerTunnelId=
622           Specifies the peer tunnel id. Takes a number in the range
623           1—4294967295. The value used must match the "PeerTunnelId=" value
624           being used at the peer. This setting is compulsory.
625
626       Remote=
627           Specifies the IP address of the remote peer. This setting is
628           compulsory.
629
630       Local=
631           Specifies the IP address of the local interface. Takes an IP
632           address, or the special values "auto", "static", or "dynamic". When
633           an address is set, then the local interface must have the address.
634           If "auto", then one of the addresses on the local interface is
635           used. Similarly, if "static" or "dynamic" is set, then one of the
636           static or dynamic addresses on the local interface is used.
637           Defaults to "auto".
638
639       EncapsulationType=
640           Specifies the encapsulation type of the tunnel. Takes one of "udp"
641           or "ip".
642
643       UDPSourcePort=
644           Specifies the UDP source port to be used for the tunnel. When UDP
645           encapsulation is selected it's mandatory. Ignored when IP
646           encapsulation is selected.
647
648       UDPDestinationPort=
649           Specifies destination port. When UDP encapsulation is selected it's
650           mandatory. Ignored when IP encapsulation is selected.
651
652       UDPChecksum=
653           Takes a boolean. When true, specifies that UDP checksum is
654           calculated for transmitted packets over IPv4.
655
656       UDP6ZeroChecksumTx=
657           Takes a boolean. When true, skip UDP checksum calculation for
658           transmitted packets over IPv6.
659
660       UDP6ZeroChecksumRx=
661           Takes a boolean. When true, allows incoming UDP packets over IPv6
662           with zero checksum field.
663

[L2TPSESSION] SECTION OPTIONS

665       The [L2TPSession] section only applies for netdevs of kind "l2tp", and
666       accepts the following keys:
667
668       Name=
669           Specifies the name of the session. This setting is compulsory.
670
671       SessionId=
672           Specifies the session identifier. Takes an number in the range
673           1–4294967295. The value used must match the "SessionId=" value
674           being used at the peer. This setting is compulsory.
675
676       PeerSessionId=
677           Specifies the peer session identifier. Takes an number in the range
678           1–4294967295. The value used must match the "PeerSessionId=" value
679           being used at the peer. This setting is compulsory.
680
681       Layer2SpecificHeader=
682           Specifies layer2specific header type of the session. One of "none"
683           or "default". Defaults to "default".
684

[MACSEC] SECTION OPTIONS

686       The [MACsec] section only applies for network devices of kind "macsec",
687       and accepts the following keys:
688
689       Port=
690           Specifies the port to be used for the MACsec transmit channel. The
691           port is used to make secure channel identifier (SCI). Takes a value
692           between 1 and 65535. Defaults to unset.
693
694       Encrypt=
695           Takes a boolean. When true, enable encryption. Defaults to unset.
696

[MACSECRECEIVECHANNEL] SECTION OPTIONS

698       The [MACsecReceiveChannel] section only applies for network devices of
699       kind "macsec", and accepts the following keys:
700
701       Port=
702           Specifies the port to be used for the MACsec receive channel. The
703           port is used to make secure channel identifier (SCI). Takes a value
704           between 1 and 65535. This option is compulsory, and is not set by
705           default.
706
707       MACAddress=
708           Specifies the MAC address to be used for the MACsec receive
709           channel. The MAC address used to make secure channel identifier
710           (SCI). This setting is compulsory, and is not set by default.
711

[MACSECTRANSMITASSOCIATION] SECTION OPTIONS

713       The [MACsecTransmitAssociation] section only applies for network
714       devices of kind "macsec", and accepts the following keys:
715
716       PacketNumber=
717           Specifies the packet number to be used for replay protection and
718           the construction of the initialization vector (along with the
719           secure channel identifier [SCI]). Takes a value between
720           1-4,294,967,295. Defaults to unset.
721
722       KeyId=
723           Specifies the identification for the key. Takes a number between
724           0-255. This option is compulsory, and is not set by default.
725
726       Key=
727           Specifies the encryption key used in the transmission channel. The
728           same key must be configured on the peer’s matching receive channel.
729           This setting is compulsory, and is not set by default. Takes a
730           128-bit key encoded in a hexadecimal string, for example
731           "dffafc8d7b9a43d5b9a3dfbbf6a30c16".
732
733       KeyFile=
734           Takes a absolute path to a file which contains a 128-bit key
735           encoded in a hexadecimal string, which will be used in the
736           transmission channel. When this option is specified, Key= is
737           ignored. Note that the file must be readable by the user
738           "systemd-network", so it should be, e.g., owned by
739           "root:systemd-network" with a "0640" file mode. If the path refers
740           to an AF_UNIX stream socket in the file system a connection is made
741           to it and the key read from it.
742
743       Activate=
744           Takes a boolean. If enabled, then the security association is
745           activated. Defaults to unset.
746
747       UseForEncoding=
748           Takes a boolean. If enabled, then the security association is used
749           for encoding. Only one [MACsecTransmitAssociation] section can
750           enable this option. When enabled, Activate=yes is implied. Defaults
751           to unset.
752

[MACSECRECEIVEASSOCIATION] SECTION OPTIONS

754       The [MACsecReceiveAssociation] section only applies for network devices
755       of kind "macsec", and accepts the following keys:
756
757       Port=
758           Accepts the same key in [MACsecReceiveChannel] section.
759
760       MACAddress=
761           Accepts the same key in [MACsecReceiveChannel] section.
762
763       PacketNumber=
764           Accepts the same key in [MACsecTransmitAssociation] section.
765
766       KeyId=
767           Accepts the same key in [MACsecTransmitAssociation] section.
768
769       Key=
770           Accepts the same key in [MACsecTransmitAssociation] section.
771
772       KeyFile=
773           Accepts the same key in [MACsecTransmitAssociation] section.
774
775       Activate=
776           Accepts the same key in [MACsecTransmitAssociation] section.
777

[TUNNEL] SECTION OPTIONS

779       The [Tunnel] section only applies for netdevs of kind "ipip", "sit",
780       "gre", "gretap", "ip6gre", "ip6gretap", "vti", "vti6", "ip6tnl", and
781       "erspan" and accepts the following keys:
782
783       Local=
784           A static local address for tunneled packets. It must be an address
785           on another interface of this host, or the special value "any".
786
787       Remote=
788           The remote endpoint of the tunnel. Takes an IP address or the
789           special value "any".
790
791       TOS=
792           The Type Of Service byte value for a tunnel interface. For details
793           about the TOS, see the Type of Service in the Internet Protocol
794           Suite[8] document.
795
796       TTL=
797           A fixed Time To Live N on tunneled packets. N is a number in the
798           range 1–255. 0 is a special value meaning that packets inherit the
799           TTL value. The default value for IPv4 tunnels is 0 (inherit). The
800           default value for IPv6 tunnels is 64.
801
802       DiscoverPathMTU=
803           Takes a boolean. When true, enables Path MTU Discovery on the
804           tunnel.
805
806       IPv6FlowLabel=
807           Configures the 20-bit flow label (see RFC 6437[9]) field in the
808           IPv6 header (see RFC 2460[10]), which is used by a node to label
809           packets of a flow. It is only used for IPv6 tunnels. A flow label
810           of zero is used to indicate packets that have not been labeled. It
811           can be configured to a value in the range 0–0xFFFFF, or be set to
812           "inherit", in which case the original flowlabel is used.
813
814       CopyDSCP=
815           Takes a boolean. When true, the Differentiated Service Code Point
816           (DSCP) field will be copied to the inner header from outer header
817           during the decapsulation of an IPv6 tunnel packet. DSCP is a field
818           in an IP packet that enables different levels of service to be
819           assigned to network traffic. Defaults to "no".
820
821       EncapsulationLimit=
822           The Tunnel Encapsulation Limit option specifies how many additional
823           levels of encapsulation are permitted to be prepended to the
824           packet. For example, a Tunnel Encapsulation Limit option containing
825           a limit value of zero means that a packet carrying that option may
826           not enter another tunnel before exiting the current tunnel. (see
827           RFC 2473[11]). The valid range is 0–255 and "none". Defaults to 4.
828
829       Key=
830           The Key= parameter specifies the same key to use in both directions
831           (InputKey= and OutputKey=). The Key= is either a number or an IPv4
832           address-like dotted quad. It is used as mark-configured SAD/SPD
833           entry as part of the lookup key (both in data and control path) in
834           IP XFRM (framework used to implement IPsec protocol). See ip-xfrm —
835           transform configuration[12] for details. It is only used for
836           VTI/VTI6, GRE, GRETAP, and ERSPAN tunnels.
837
838       InputKey=
839           The InputKey= parameter specifies the key to use for input. The
840           format is same as Key=. It is only used for VTI/VTI6, GRE, GRETAP,
841           and ERSPAN tunnels.
842
843       OutputKey=
844           The OutputKey= parameter specifies the key to use for output. The
845           format is same as Key=. It is only used for VTI/VTI6, GRE, GRETAP,
846           and ERSPAN tunnels.
847
848       Mode=
849           An "ip6tnl" tunnel can be in one of three modes "ip6ip6" for IPv6
850           over IPv6, "ipip6" for IPv4 over IPv6 or "any" for either.
851
852       Independent=
853           Takes a boolean. When true tunnel does not require .network file.
854           Created as "tunnel@NONE". Defaults to "false".
855
856       AssignToLoopback=
857           Takes a boolean. If set to "yes", the loopback interface "lo" is
858           used as the underlying device of the tunnel interface. Defaults to
859           "no".
860
861       AllowLocalRemote=
862           Takes a boolean. When true allows tunnel traffic on ip6tnl devices
863           where the remote endpoint is a local host address. When unset, the
864           kernel's default will be used.
865
866       FooOverUDP=
867           Takes a boolean. Specifies whether FooOverUDP= tunnel is to be
868           configured. Defaults to false. This takes effects only for IPIP,
869           SIT, GRE, and GRETAP tunnels. For more detail information see Foo
870           over UDP[13]
871
872       FOUDestinationPort=
873           This setting specifies the UDP destination port for encapsulation.
874           This field is mandatory when FooOverUDP=yes, and is not set by
875           default.
876
877       FOUSourcePort=
878           This setting specifies the UDP source port for encapsulation.
879           Defaults to 0 — that is, the source port for packets is left to the
880           network stack to decide.
881
882       Encapsulation=
883           Accepts the same key as in the [FooOverUDP] section.
884
885       IPv6RapidDeploymentPrefix=
886           Reconfigure the tunnel for IPv6 Rapid Deployment[14], also known as
887           6rd. The value is an ISP-specific IPv6 prefix with a non-zero
888           length. Only applicable to SIT tunnels.
889
890       ISATAP=
891           Takes a boolean. If set, configures the tunnel as Intra-Site
892           Automatic Tunnel Addressing Protocol (ISATAP) tunnel. Only
893           applicable to SIT tunnels. When unset, the kernel's default will be
894           used.
895
896       SerializeTunneledPackets=
897           Takes a boolean. If set to yes, then packets are serialized. Only
898           applies for GRE, GRETAP, and ERSPAN tunnels. When unset, the
899           kernel's default will be used.
900
901       ERSPANIndex=
902           Specifies the ERSPAN index field for the interface, an integer in
903           the range 1-1048575 associated with the ERSPAN traffic's source
904           port and direction. This field is mandatory.
905

[FOOOVERUDP] SECTION OPTIONS

907       The [FooOverUDP] section only applies for netdevs of kind "fou" and
908       accepts the following keys:
909
910       Encapsulation=
911           Specifies the encapsulation mechanism used to store networking
912           packets of various protocols inside the UDP packets. Supports the
913           following values: "FooOverUDP" provides the simplest no frills
914           model of UDP encapsulation, it simply encapsulates packets directly
915           in the UDP payload.  "GenericUDPEncapsulation" is a generic and
916           extensible encapsulation, it allows encapsulation of packets for
917           any IP protocol and optional data as part of the encapsulation. For
918           more detailed information see Generic UDP Encapsulation[15].
919           Defaults to "FooOverUDP".
920
921       Port=
922           Specifies the port number, where the IP encapsulation packets will
923           arrive. Please take note that the packets will arrive with the
924           encapsulation will be removed. Then they will be manually fed back
925           into the network stack, and sent ahead for delivery to the real
926           destination. This option is mandatory.
927
928       PeerPort=
929           Specifies the peer port number. Defaults to unset. Note that when
930           peer port is set "Peer=" address is mandatory.
931
932       Protocol=
933           The Protocol= specifies the protocol number of the packets arriving
934           at the UDP port. When Encapsulation=FooOverUDP, this field is
935           mandatory and is not set by default. Takes an IP protocol name such
936           as "gre" or "ipip", or an integer within the range 1-255. When
937           Encapsulation=GenericUDPEncapsulation, this must not be specified.
938
939       Peer=
940           Configures peer IP address. Note that when peer address is set
941           "PeerPort=" is mandatory.
942
943       Local=
944           Configures local IP address.
945

[PEER] SECTION OPTIONS

947       The [Peer] section only applies for netdevs of kind "veth" and accepts
948       the following keys:
949
950       Name=
951           The interface name used when creating the netdev. This setting is
952           compulsory.
953
954       MACAddress=
955           The peer MACAddress, if not set, it is generated in the same way as
956           the MAC address of the main interface.
957

[VXCAN] SECTION OPTIONS

959       The [VXCAN] section only applies for netdevs of kind "vxcan" and
960       accepts the following key:
961
962       Peer=
963           The peer interface name used when creating the netdev. This setting
964           is compulsory.
965

[TUN] SECTION OPTIONS

967       The [Tun] section only applies for netdevs of kind "tun", and accepts
968       the following keys:
969
970       MultiQueue=
971           Takes a boolean. Configures whether to use multiple file
972           descriptors (queues) to parallelize packets sending and receiving.
973           Defaults to "no".
974
975       PacketInfo=
976           Takes a boolean. Configures whether packets should be prepended
977           with four extra bytes (two flag bytes and two protocol bytes). If
978           disabled, it indicates that the packets will be pure IP packets.
979           Defaults to "no".
980
981       VNetHeader=
982           Takes a boolean. Configures IFF_VNET_HDR flag for a tun or tap
983           device. It allows sending and receiving larger Generic Segmentation
984           Offload (GSO) packets. This may increase throughput significantly.
985           Defaults to "no".
986
987       User=
988           User to grant access to the /dev/net/tun device.
989
990       Group=
991           Group to grant access to the /dev/net/tun device.
992

[TAP] SECTION OPTIONS

994       The [Tap] section only applies for netdevs of kind "tap", and accepts
995       the same keys as the [Tun] section.
996

[WIREGUARD] SECTION OPTIONS

998       The [WireGuard] section accepts the following keys:
999
1000       PrivateKey=
1001           The Base64 encoded private key for the interface. It can be
1002           generated using the wg genkey command (see wg(8)). This option or
1003           PrivateKeyFile= is mandatory to use WireGuard. Note that because
1004           this information is secret, you may want to set the permissions of
1005           the .netdev file to be owned by "root:systemd-network" with a
1006           "0640" file mode.
1007
1008       PrivateKeyFile=
1009           Takes an absolute path to a file which contains the Base64 encoded
1010           private key for the interface. When this option is specified, then
1011           PrivateKey= is ignored. Note that the file must be readable by the
1012           user "systemd-network", so it should be, e.g., owned by
1013           "root:systemd-network" with a "0640" file mode. If the path refers
1014           to an AF_UNIX stream socket in the file system a connection is made
1015           to it and the key read from it.
1016
1017       ListenPort=
1018           Sets UDP port for listening. Takes either value between 1 and 65535
1019           or "auto". If "auto" is specified, the port is automatically
1020           generated based on interface name. Defaults to "auto".
1021
1022       FirewallMark=
1023           Sets a firewall mark on outgoing WireGuard packets from this
1024           interface. Takes a number between 1 and 4294967295.
1025

[WIREGUARDPEER] SECTION OPTIONS

1027       The [WireGuardPeer] section accepts the following keys:
1028
1029       PublicKey=
1030           Sets a Base64 encoded public key calculated by wg pubkey (see
1031           wg(8)) from a private key, and usually transmitted out of band to
1032           the author of the configuration file. This option is mandatory for
1033           this section.
1034
1035       PresharedKey=
1036           Optional preshared key for the interface. It can be generated by
1037           the wg genpsk command. This option adds an additional layer of
1038           symmetric-key cryptography to be mixed into the already existing
1039           public-key cryptography, for post-quantum resistance. Note that
1040           because this information is secret, you may want to set the
1041           permissions of the .netdev file to be owned by
1042           "root:systemd-network" with a "0640" file mode.
1043
1044       PresharedKeyFile=
1045           Takes an absolute path to a file which contains the Base64 encoded
1046           preshared key for the peer. When this option is specified, then
1047           PresharedKey= is ignored. Note that the file must be readable by
1048           the user "systemd-network", so it should be, e.g., owned by
1049           "root:systemd-network" with a "0640" file mode. If the path refers
1050           to an AF_UNIX stream socket in the file system a connection is made
1051           to it and the key read from it.
1052
1053       AllowedIPs=
1054           Sets a comma-separated list of IP (v4 or v6) addresses with CIDR
1055           masks from which this peer is allowed to send incoming traffic and
1056           to which outgoing traffic for this peer is directed.
1057
1058           The catch-all 0.0.0.0/0 may be specified for matching all IPv4
1059           addresses, and ::/0 may be specified for matching all IPv6
1060           addresses.
1061
1062           Note that this only affects "routing inside the network interface
1063           itself", as in, which wireguard peer packets with a specific
1064           destination address are sent to, and what source addresses are
1065           accepted from which peer.
1066
1067           To cause packets to be sent via wireguard in first place, a route
1068           needs to be added, as well - either in the "[Routes]" section on
1069           the ".network" matching the wireguard interface, or outside of
1070           networkd.
1071
1072       Endpoint=
1073           Sets an endpoint IP address or hostname, followed by a colon, and
1074           then a port number. This endpoint will be updated automatically
1075           once to the most recent source IP address and port of correctly
1076           authenticated packets from the peer at configuration time.
1077
1078       PersistentKeepalive=
1079           Sets a seconds interval, between 1 and 65535 inclusive, of how
1080           often to send an authenticated empty packet to the peer for the
1081           purpose of keeping a stateful firewall or NAT mapping valid
1082           persistently. For example, if the interface very rarely sends
1083           traffic, but it might at anytime receive traffic from a peer, and
1084           it is behind NAT, the interface might benefit from having a
1085           persistent keepalive interval of 25 seconds. If set to 0 or "off",
1086           this option is disabled. By default or when unspecified, this
1087           option is off. Most users will not need this.
1088

[BOND] SECTION OPTIONS

1090       The [Bond] section accepts the following key:
1091
1092       Mode=
1093           Specifies one of the bonding policies. The default is "balance-rr"
1094           (round robin). Possible values are "balance-rr", "active-backup",
1095           "balance-xor", "broadcast", "802.3ad", "balance-tlb", and
1096           "balance-alb".
1097
1098       TransmitHashPolicy=
1099           Selects the transmit hash policy to use for slave selection in
1100           balance-xor, 802.3ad, and tlb modes. Possible values are "layer2",
1101           "layer3+4", "layer2+3", "encap2+3", and "encap3+4".
1102
1103       LACPTransmitRate=
1104           Specifies the rate with which link partner transmits Link
1105           Aggregation Control Protocol Data Unit packets in 802.3ad mode.
1106           Possible values are "slow", which requests partner to transmit
1107           LACPDUs every 30 seconds, and "fast", which requests partner to
1108           transmit LACPDUs every second. The default value is "slow".
1109
1110       MIIMonitorSec=
1111           Specifies the frequency that Media Independent Interface link
1112           monitoring will occur. A value of zero disables MII link
1113           monitoring. This value is rounded down to the nearest millisecond.
1114           The default value is 0.
1115
1116       UpDelaySec=
1117           Specifies the delay before a link is enabled after a link up status
1118           has been detected. This value is rounded down to a multiple of
1119           MIIMonitorSec. The default value is 0.
1120
1121       DownDelaySec=
1122           Specifies the delay before a link is disabled after a link down
1123           status has been detected. This value is rounded down to a multiple
1124           of MIIMonitorSec. The default value is 0.
1125
1126       LearnPacketIntervalSec=
1127           Specifies the number of seconds between instances where the bonding
1128           driver sends learning packets to each slave peer switch. The valid
1129           range is 1–0x7fffffff; the default value is 1. This option has an
1130           effect only for the balance-tlb and balance-alb modes.
1131
1132       AdSelect=
1133           Specifies the 802.3ad aggregation selection logic to use. Possible
1134           values are "stable", "bandwidth" and "count".
1135
1136       AdActorSystemPriority=
1137           Specifies the 802.3ad actor system priority. Takes a number in the
1138           range 1—65535.
1139
1140       AdUserPortKey=
1141           Specifies the 802.3ad user defined portion of the port key. Takes a
1142           number in the range 0–1023.
1143
1144       AdActorSystem=
1145           Specifies the 802.3ad system mac address. This can not be either
1146           NULL or Multicast.
1147
1148       FailOverMACPolicy=
1149           Specifies whether the active-backup mode should set all slaves to
1150           the same MAC address at the time of enslavement or, when enabled,
1151           to perform special handling of the bond's MAC address in accordance
1152           with the selected policy. The default policy is none. Possible
1153           values are "none", "active" and "follow".
1154
1155       ARPValidate=
1156           Specifies whether or not ARP probes and replies should be validated
1157           in any mode that supports ARP monitoring, or whether non-ARP
1158           traffic should be filtered (disregarded) for link monitoring
1159           purposes. Possible values are "none", "active", "backup" and "all".
1160
1161       ARPIntervalSec=
1162           Specifies the ARP link monitoring frequency. A value of 0 disables
1163           ARP monitoring. The default value is 0, and the default unit
1164           seconds.
1165
1166       ARPIPTargets=
1167           Specifies the IP addresses to use as ARP monitoring peers when
1168           ARPIntervalSec is greater than 0. These are the targets of the ARP
1169           request sent to determine the health of the link to the targets.
1170           Specify these values in IPv4 dotted decimal format. At least one IP
1171           address must be given for ARP monitoring to function. The maximum
1172           number of targets that can be specified is 16. The default value is
1173           no IP addresses.
1174
1175       ARPAllTargets=
1176           Specifies the quantity of ARPIPTargets that must be reachable in
1177           order for the ARP monitor to consider a slave as being up. This
1178           option affects only active-backup mode for slaves with ARPValidate
1179           enabled. Possible values are "any" and "all".
1180
1181       PrimaryReselectPolicy=
1182           Specifies the reselection policy for the primary slave. This
1183           affects how the primary slave is chosen to become the active slave
1184           when failure of the active slave or recovery of the primary slave
1185           occurs. This option is designed to prevent flip-flopping between
1186           the primary slave and other slaves. Possible values are "always",
1187           "better" and "failure".
1188
1189       ResendIGMP=
1190           Specifies the number of IGMP membership reports to be issued after
1191           a failover event. One membership report is issued immediately after
1192           the failover, subsequent packets are sent in each 200ms interval.
1193           The valid range is 0–255. Defaults to 1. A value of 0 prevents the
1194           IGMP membership report from being issued in response to the
1195           failover event.
1196
1197       PacketsPerSlave=
1198           Specify the number of packets to transmit through a slave before
1199           moving to the next one. When set to 0, then a slave is chosen at
1200           random. The valid range is 0–65535. Defaults to 1. This option only
1201           has effect when in balance-rr mode.
1202
1203       GratuitousARP=
1204           Specify the number of peer notifications (gratuitous ARPs and
1205           unsolicited IPv6 Neighbor Advertisements) to be issued after a
1206           failover event. As soon as the link is up on the new slave, a peer
1207           notification is sent on the bonding device and each VLAN
1208           sub-device. This is repeated at each link monitor interval
1209           (ARPIntervalSec or MIIMonitorSec, whichever is active) if the
1210           number is greater than 1. The valid range is 0–255. The default
1211           value is 1. These options affect only the active-backup mode.
1212
1213       AllSlavesActive=
1214           Takes a boolean. Specifies that duplicate frames (received on
1215           inactive ports) should be dropped when false, or delivered when
1216           true. Normally, bonding will drop duplicate frames (received on
1217           inactive ports), which is desirable for most users. But there are
1218           some times it is nice to allow duplicate frames to be delivered.
1219           The default value is false (drop duplicate frames received on
1220           inactive ports).
1221
1222       DynamicTransmitLoadBalancing=
1223           Takes a boolean. Specifies if dynamic shuffling of flows is
1224           enabled. Applies only for balance-tlb mode. Defaults to unset.
1225
1226       MinLinks=
1227           Specifies the minimum number of links that must be active before
1228           asserting carrier. The default value is 0.
1229
1230       For more detail information see Linux Ethernet Bonding Driver HOWTO[1]
1231

[XFRM] SECTION OPTIONS

1233       The [Xfrm] section accepts the following keys:
1234
1235       InterfaceId=
1236           Sets the ID/key of the xfrm interface which needs to be associated
1237           with a SA/policy. Can be decimal or hexadecimal, valid range is
1238           0-0xffffffff, defaults to 0.
1239
1240       Independent=
1241           Takes a boolean. If set to "no", the xfrm interface should have an
1242           underlying device which can be used for hardware offloading.
1243           Defaults to "no". See systemd.network(5) for how to configure the
1244           underlying device.
1245
1246       For more detail information see Virtual XFRM Interfaces[16].
1247

[VRF] SECTION OPTIONS

1249       The [VRF] section only applies for netdevs of kind "vrf" and accepts
1250       the following key:
1251
1252       Table=
1253           The numeric routing table identifier. This setting is compulsory.
1254

EXAMPLES

1256       Example 1. /etc/systemd/network/25-bridge.netdev
1257
1258           [NetDev]
1259           Name=bridge0
1260           Kind=bridge
1261
1262       Example 2. /etc/systemd/network/25-vlan1.netdev
1263
1264           [Match]
1265           Virtualization=no
1266
1267           [NetDev]
1268           Name=vlan1
1269           Kind=vlan
1270
1271           [VLAN]
1272           Id=1
1273
1274       Example 3. /etc/systemd/network/25-ipip.netdev
1275
1276           [NetDev]
1277           Name=ipip-tun
1278           Kind=ipip
1279           MTUBytes=1480
1280
1281           [Tunnel]
1282           Local=192.168.223.238
1283           Remote=192.169.224.239
1284           TTL=64
1285
1286       Example 4. /etc/systemd/network/1-fou-tunnel.netdev
1287
1288           [NetDev]
1289           Name=fou-tun
1290           Kind=fou
1291
1292           [FooOverUDP]
1293           Port=5555
1294           Protocol=4
1295
1296
1297       Example 5. /etc/systemd/network/25-fou-ipip.netdev
1298
1299           [NetDev]
1300           Name=ipip-tun
1301           Kind=ipip
1302
1303           [Tunnel]
1304           Independent=yes
1305           Local=10.65.208.212
1306           Remote=10.65.208.211
1307           FooOverUDP=yes
1308           FOUDestinationPort=5555
1309
1310
1311       Example 6. /etc/systemd/network/25-tap.netdev
1312
1313           [NetDev]
1314           Name=tap-test
1315           Kind=tap
1316
1317           [Tap]
1318           MultiQueue=yes
1319           PacketInfo=yes
1320
1321       Example 7. /etc/systemd/network/25-sit.netdev
1322
1323           [NetDev]
1324           Name=sit-tun
1325           Kind=sit
1326           MTUBytes=1480
1327
1328           [Tunnel]
1329           Local=10.65.223.238
1330           Remote=10.65.223.239
1331
1332       Example 8. /etc/systemd/network/25-6rd.netdev
1333
1334           [NetDev]
1335           Name=6rd-tun
1336           Kind=sit
1337           MTUBytes=1480
1338
1339           [Tunnel]
1340           Local=10.65.223.238
1341           IPv6RapidDeploymentPrefix=2602::/24
1342
1343       Example 9. /etc/systemd/network/25-gre.netdev
1344
1345           [NetDev]
1346           Name=gre-tun
1347           Kind=gre
1348           MTUBytes=1480
1349
1350           [Tunnel]
1351           Local=10.65.223.238
1352           Remote=10.65.223.239
1353
1354       Example 10. /etc/systemd/network/25-ip6gre.netdev
1355
1356           [NetDev]
1357           Name=ip6gre-tun
1358           Kind=ip6gre
1359
1360           [Tunnel]
1361           Key=123
1362
1363       Example 11. /etc/systemd/network/25-vti.netdev
1364
1365           [NetDev]
1366           Name=vti-tun
1367           Kind=vti
1368           MTUBytes=1480
1369
1370           [Tunnel]
1371           Local=10.65.223.238
1372           Remote=10.65.223.239
1373
1374       Example 12. /etc/systemd/network/25-veth.netdev
1375
1376           [NetDev]
1377           Name=veth-test
1378           Kind=veth
1379
1380           [Peer]
1381           Name=veth-peer
1382
1383       Example 13. /etc/systemd/network/25-bond.netdev
1384
1385           [NetDev]
1386           Name=bond1
1387           Kind=bond
1388
1389           [Bond]
1390           Mode=802.3ad
1391           TransmitHashPolicy=layer3+4
1392           MIIMonitorSec=1s
1393           LACPTransmitRate=fast
1394
1395       Example 14. /etc/systemd/network/25-dummy.netdev
1396
1397           [NetDev]
1398           Name=dummy-test
1399           Kind=dummy
1400           MACAddress=12:34:56:78:9a:bc
1401
1402       Example 15. /etc/systemd/network/25-vrf.netdev
1403
1404       Create a VRF interface with table 42.
1405
1406           [NetDev]
1407           Name=vrf-test
1408           Kind=vrf
1409
1410           [VRF]
1411           Table=42
1412
1413       Example 16. /etc/systemd/network/25-macvtap.netdev
1414
1415       Create a MacVTap device.
1416
1417           [NetDev]
1418           Name=macvtap-test
1419           Kind=macvtap
1420
1421
1422       Example 17. /etc/systemd/network/25-wireguard.netdev
1423
1424           [NetDev]
1425           Name=wg0
1426           Kind=wireguard
1427
1428           [WireGuard]
1429           PrivateKey=EEGlnEPYJV//kbvvIqxKkQwOiS+UENyPncC4bF46ong=
1430           ListenPort=51820
1431
1432           [WireGuardPeer]
1433           PublicKey=RDf+LSpeEre7YEIKaxg+wbpsNV7du+ktR99uBEtIiCA=
1434           AllowedIPs=fd31:bf08:57cb::/48,192.168.26.0/24
1435           Endpoint=wireguard.example.com:51820
1436
1437       Example 18. /etc/systemd/network/27-xfrm.netdev
1438
1439           [NetDev]
1440           Name=xfrm0
1441           Kind=xfrm
1442
1443           [Xfrm]
1444           Independent=yes
1445

SEE ALSO

1447       systemd(1), systemd-networkd(8), systemd.link(5), systemd.network(5)
1448

NOTES

1450        1. Linux Ethernet Bonding Driver HOWTO
1451           https://www.kernel.org/doc/Documentation/networking/bonding.txt
1452
1453        2. RFC 2784
1454           https://tools.ietf.org/html/rfc2784
1455
1456        3. IEEE 802.1Q
1457           http://www.ieee802.org/1/pages/802.1Q.html
1458
1459        4. VRF
1460           https://www.kernel.org/doc/Documentation/networking/vrf.txt
1461
1462        5. (DVOE)
1463           https://en.wikipedia.org/wiki/Distributed_Overlay_Virtual_Ethernet
1464
1465        6. VXLAN Group Policy
1466           https://tools.ietf.org/html/draft-smith-vxlan-group-policy
1467
1468        7. Generic Protocol Extension for VXLAN
1469           https://tools.ietf.org/html/draft-ietf-nvo3-vxlan-gpe-07
1470
1471        8. Type of Service in the Internet Protocol Suite
1472           http://tools.ietf.org/html/rfc1349
1473
1474        9. RFC 6437
1475           https://tools.ietf.org/html/rfc6437
1476
1477       10. RFC 2460
1478           https://tools.ietf.org/html/rfc2460
1479
1480       11. RFC 2473
1481           https://tools.ietf.org/html/rfc2473#section-4.1.1
1482
1483       12. ip-xfrm — transform configuration
1484           http://man7.org/linux/man-pages/man8/ip-xfrm.8.html
1485
1486       13. Foo over UDP
1487           https://lwn.net/Articles/614348
1488
1489       14. IPv6 Rapid Deployment
1490           https://tools.ietf.org/html/rfc5569
1491
1492       15. Generic UDP Encapsulation
1493           https://lwn.net/Articles/615044
1494
1495       16. Virtual XFRM Interfaces
1496           https://lwn.net/Articles/757391
1497
1498
1499
1500systemd 246                                                  SYSTEMD.NETDEV(5)
Impressum