1SYSTEMD.NETDEV(5) systemd.network SYSTEMD.NETDEV(5)
2
3
4
6 systemd.netdev - Virtual Network Device configuration
7
9 netdev.netdev
10
12 A plain ini-style text file that encodes configuration about a virtual
13 network device, used by systemd-networkd(8). See systemd.syntax(7) for
14 a general description of the syntax.
15
16 The main Virtual Network Device file must have the extension .netdev;
17 other extensions are ignored. Virtual network devices are created as
18 soon as networkd is started. If a netdev with the specified name
19 already exists, networkd will use that as-is rather than create its
20 own. Note that the settings of the pre-existing netdev will not be
21 changed by networkd.
22
23 The .netdev files are read from the files located in the system network
24 directory /usr/lib/systemd/network, the volatile runtime network
25 directory /run/systemd/network and the local administration network
26 directory /etc/systemd/network. All configuration files are
27 collectively sorted and processed in lexical order, regardless of the
28 directories in which they live. However, files with identical filenames
29 replace each other. Files in /etc have the highest priority, files in
30 /run take precedence over files with the same name in /usr/lib. This
31 can be used to override a system-supplied configuration file with a
32 local file if needed. As a special case, an empty file (file size 0) or
33 symlink with the same name pointing to /dev/null disables the
34 configuration file entirely (it is "masked").
35
36 Along with the netdev file foo.netdev, a "drop-in" directory
37 foo.netdev.d/ may exist. All files with the suffix ".conf" from this
38 directory will be parsed after the file itself is parsed. This is
39 useful to alter or add configuration settings, without having to modify
40 the main configuration file. Each drop-in file must have appropriate
41 section headers.
42
43 In addition to /etc/systemd/network, drop-in ".d" directories can be
44 placed in /usr/lib/systemd/network or /run/systemd/network directories.
45 Drop-in files in /etc take precedence over those in /run which in turn
46 take precedence over those in /usr/lib. Drop-in files under any of
47 these directories take precedence over the main netdev file wherever
48 located. (Of course, since /run is temporary and /usr/lib is for
49 vendors, it is unlikely drop-ins should be used in either of those
50 places.)
51
53 The following kinds of virtual network devices may be configured in
54 .netdev files:
55
56 Table 1. Supported kinds of virtual network devices
57 ┌──────────┬────────────────────────────┐
58 │Kind │ Description │
59 ├──────────┼────────────────────────────┤
60 │bond │ A bond device is an │
61 │ │ aggregation of all its │
62 │ │ slave devices. See Linux │
63 │ │ Ethernet Bonding Driver │
64 │ │ HOWTO[1] for details. │
65 ├──────────┼────────────────────────────┤
66 │bridge │ A bridge device is a │
67 │ │ software switch, and each │
68 │ │ of its slave devices and │
69 │ │ the bridge itself are │
70 │ │ ports of the switch. │
71 ├──────────┼────────────────────────────┤
72 │dummy │ A dummy device drops all │
73 │ │ packets sent to it. │
74 ├──────────┼────────────────────────────┤
75 │gre │ A Level 3 GRE tunnel over │
76 │ │ IPv4. See RFC 2784[2] for │
77 │ │ details. │
78 ├──────────┼────────────────────────────┤
79 │gretap │ A Level 2 GRE tunnel over │
80 │ │ IPv4. │
81 ├──────────┼────────────────────────────┤
82 │erspan │ ERSPAN mirrors traffic on │
83 │ │ one or more source ports │
84 │ │ and delivers the mirrored │
85 │ │ traffic to one or more │
86 │ │ destination ports on │
87 │ │ another switch. The │
88 │ │ traffic is encapsulated in │
89 │ │ generic routing │
90 │ │ encapsulation (GRE) and is │
91 │ │ therefore routable across │
92 │ │ a layer 3 network between │
93 │ │ the source switch and the │
94 │ │ destination switch. │
95 ├──────────┼────────────────────────────┤
96 │ip6gre │ A Level 3 GRE tunnel over │
97 │ │ IPv6. │
98 ├──────────┼────────────────────────────┤
99 │ip6tnl │ An IPv4 or IPv6 tunnel │
100 │ │ over IPv6 │
101 ├──────────┼────────────────────────────┤
102 │ip6gretap │ A Level 2 GRE tunnel over │
103 │ │ IPv6. │
104 ├──────────┼────────────────────────────┤
105 │ipip │ An IPv4 over IPv4 tunnel. │
106 ├──────────┼────────────────────────────┤
107 │ipvlan │ An IPVLAN device is a │
108 │ │ stacked device which │
109 │ │ receives packets from its │
110 │ │ underlying device based on │
111 │ │ IP address filtering. │
112 ├──────────┼────────────────────────────┤
113 │ipvtap │ An IPVTAP device is a │
114 │ │ stacked device which │
115 │ │ receives packets from its │
116 │ │ underlying device based on │
117 │ │ IP address filtering and │
118 │ │ can be accessed using the │
119 │ │ tap user space interface. │
120 ├──────────┼────────────────────────────┤
121 │macvlan │ A macvlan device is a │
122 │ │ stacked device which │
123 │ │ receives packets from its │
124 │ │ underlying device based on │
125 │ │ MAC address filtering. │
126 ├──────────┼────────────────────────────┤
127 │macvtap │ A macvtap device is a │
128 │ │ stacked device which │
129 │ │ receives packets from its │
130 │ │ underlying device based on │
131 │ │ MAC address filtering. │
132 ├──────────┼────────────────────────────┤
133 │sit │ An IPv6 over IPv4 tunnel. │
134 ├──────────┼────────────────────────────┤
135 │tap │ A persistent Level 2 │
136 │ │ tunnel between a network │
137 │ │ device and a device node. │
138 ├──────────┼────────────────────────────┤
139 │tun │ A persistent Level 3 │
140 │ │ tunnel between a network │
141 │ │ device and a device node. │
142 ├──────────┼────────────────────────────┤
143 │veth │ An Ethernet tunnel between │
144 │ │ a pair of network devices. │
145 ├──────────┼────────────────────────────┤
146 │vlan │ A VLAN is a stacked device │
147 │ │ which receives packets │
148 │ │ from its underlying device │
149 │ │ based on VLAN tagging. See │
150 │ │ IEEE 802.1Q[3] for │
151 │ │ details. │
152 ├──────────┼────────────────────────────┤
153 │vti │ An IPv4 over IPSec tunnel. │
154 ├──────────┼────────────────────────────┤
155 │vti6 │ An IPv6 over IPSec tunnel. │
156 ├──────────┼────────────────────────────┤
157 │vxlan │ A virtual extensible LAN │
158 │ │ (vxlan), for connecting │
159 │ │ Cloud computing │
160 │ │ deployments. │
161 ├──────────┼────────────────────────────┤
162 │geneve │ A GEneric NEtwork │
163 │ │ Virtualization │
164 │ │ Encapsulation (GENEVE) │
165 │ │ netdev driver. │
166 ├──────────┼────────────────────────────┤
167 │l2tp │ A Layer 2 Tunneling │
168 │ │ Protocol (L2TP) is a │
169 │ │ tunneling protocol used to │
170 │ │ support virtual private │
171 │ │ networks (VPNs) or as part │
172 │ │ of the delivery of │
173 │ │ services by ISPs. It does │
174 │ │ not provide any encryption │
175 │ │ or confidentiality by │
176 │ │ itself │
177 ├──────────┼────────────────────────────┤
178 │macsec │ Media Access Control │
179 │ │ Security (MACsec) is an │
180 │ │ 802.1AE IEEE │
181 │ │ industry-standard security │
182 │ │ technology that provides │
183 │ │ secure communication for │
184 │ │ all traffic on Ethernet │
185 │ │ links. MACsec provides │
186 │ │ point-to-point security on │
187 │ │ Ethernet links between │
188 │ │ directly connected nodes │
189 │ │ and is capable of │
190 │ │ identifying and preventing │
191 │ │ most security threats. │
192 ├──────────┼────────────────────────────┤
193 │vrf │ A Virtual Routing and │
194 │ │ Forwarding (VRF[4]) │
195 │ │ interface to create │
196 │ │ separate routing and │
197 │ │ forwarding domains. │
198 ├──────────┼────────────────────────────┤
199 │vcan │ The virtual CAN driver │
200 │ │ (vcan). Similar to the │
201 │ │ network loopback devices, │
202 │ │ vcan offers a virtual │
203 │ │ local CAN interface. │
204 ├──────────┼────────────────────────────┤
205 │vxcan │ The virtual CAN tunnel │
206 │ │ driver (vxcan). Similar to │
207 │ │ the virtual ethernet │
208 │ │ driver veth, vxcan │
209 │ │ implements a local CAN │
210 │ │ traffic tunnel between two │
211 │ │ virtual CAN network │
212 │ │ devices. When creating a │
213 │ │ vxcan, two vxcan devices │
214 │ │ are created as pair. When │
215 │ │ one end receives the │
216 │ │ packet it appears on its │
217 │ │ pair and vice versa. The │
218 │ │ vxcan can be used for │
219 │ │ cross namespace │
220 │ │ communication. │
221 ├──────────┼────────────────────────────┤
222 │wireguard │ WireGuard Secure Network │
223 │ │ Tunnel. │
224 ├──────────┼────────────────────────────┤
225 │nlmon │ A Netlink monitor device. │
226 │ │ Use an nlmon device when │
227 │ │ you want to monitor system │
228 │ │ Netlink messages. │
229 ├──────────┼────────────────────────────┤
230 │fou │ Foo-over-UDP tunneling. │
231 ├──────────┼────────────────────────────┤
232 │xfrm │ A virtual tunnel interface │
233 │ │ like vti/vti6 but with │
234 │ │ several advantages. │
235 ├──────────┼────────────────────────────┤
236 │ifb │ The Intermediate │
237 │ │ Functional Block (ifb) │
238 │ │ pseudo network interface │
239 │ │ acts as a QoS concentrator │
240 │ │ for multiple different │
241 │ │ sources of traffic. │
242 └──────────┴────────────────────────────┘
243
245 A virtual network device is only created if the [Match] section matches
246 the current environment, or if the section is empty. The following keys
247 are accepted:
248
249 Host=
250 Matches against the hostname or machine ID of the host. See
251 "ConditionHost=" in systemd.unit(5) for details. When prefixed with
252 an exclamation mark ("!"), the result is negated. If an empty
253 string is assigned, then previously assigned value is cleared.
254
255 Virtualization=
256 Checks whether the system is executed in a virtualized environment
257 and optionally test whether it is a specific implementation. See
258 "ConditionVirtualization=" in systemd.unit(5) for details. When
259 prefixed with an exclamation mark ("!"), the result is negated. If
260 an empty string is assigned, then previously assigned value is
261 cleared.
262
263 KernelCommandLine=
264 Checks whether a specific kernel command line option is set. See
265 "ConditionKernelCommandLine=" in systemd.unit(5) for details. When
266 prefixed with an exclamation mark ("!"), the result is negated. If
267 an empty string is assigned, then previously assigned value is
268 cleared.
269
270 KernelVersion=
271 Checks whether the kernel version (as reported by uname -r) matches
272 a certain expression. See "ConditionKernelVersion=" in
273 systemd.unit(5) for details. When prefixed with an exclamation mark
274 ("!"), the result is negated. If an empty string is assigned, then
275 previously assigned value is cleared.
276
277 Architecture=
278 Checks whether the system is running on a specific architecture.
279 See "ConditionArchitecture=" in systemd.unit(5) for details. When
280 prefixed with an exclamation mark ("!"), the result is negated. If
281 an empty string is assigned, then previously assigned value is
282 cleared.
283
285 The [NetDev] section accepts the following keys:
286
287 Description=
288 A free-form description of the netdev.
289
290 Name=
291 The interface name used when creating the netdev. This setting is
292 compulsory.
293
294 Kind=
295 The netdev kind. This setting is compulsory. See the "Supported
296 netdev kinds" section for the valid keys.
297
298 MTUBytes=
299 The maximum transmission unit in bytes to set for the device. The
300 usual suffixes K, M, G are supported and are understood to the base
301 of 1024. For "tun" or "tap" devices, MTUBytes= setting is not
302 currently supported in [NetDev] section. Please specify it in
303 [Link] section of corresponding systemd.network(5) files.
304
305 MACAddress=
306 The MAC address to use for the device. For "tun" or "tap" devices,
307 setting MACAddress= in the [NetDev] section is not supported.
308 Please specify it in [Link] section of the corresponding
309 systemd.network(5) file. If this option is not set, "vlan" devices
310 inherit the MAC address of the physical interface. For other kind
311 of netdevs, if this option is not set, then MAC address is
312 generated based on the interface name and the machine-id(5).
313
315 The [Bridge] section only applies for netdevs of kind "bridge", and
316 accepts the following keys:
317
318 HelloTimeSec=
319 HelloTimeSec specifies the number of seconds between two hello
320 packets sent out by the root bridge and the designated bridges.
321 Hello packets are used to communicate information about the
322 topology throughout the entire bridged local area network.
323
324 MaxAgeSec=
325 MaxAgeSec specifies the number of seconds of maximum message age.
326 If the last seen (received) hello packet is more than this number
327 of seconds old, the bridge in question will start the takeover
328 procedure in attempt to become the Root Bridge itself.
329
330 ForwardDelaySec=
331 ForwardDelaySec specifies the number of seconds spent in each of
332 the Listening and Learning states before the Forwarding state is
333 entered.
334
335 AgeingTimeSec=
336 This specifies the number of seconds a MAC Address will be kept in
337 the forwarding database after having a packet received from this
338 MAC Address.
339
340 Priority=
341 The priority of the bridge. An integer between 0 and 65535. A lower
342 value means higher priority. The bridge having the lowest priority
343 will be elected as root bridge.
344
345 GroupForwardMask=
346 A 16-bit bitmask represented as an integer which allows forwarding
347 of link local frames with 802.1D reserved addresses
348 (01:80:C2:00:00:0X). A logical AND is performed between the
349 specified bitmask and the exponentiation of 2^X, the lower nibble
350 of the last octet of the MAC address. For example, a value of 8
351 would allow forwarding of frames addressed to 01:80:C2:00:00:03
352 (802.1X PAE).
353
354 DefaultPVID=
355 This specifies the default port VLAN ID of a newly attached bridge
356 port. Set this to an integer in the range 1–4094 or "none" to
357 disable the PVID.
358
359 MulticastQuerier=
360 Takes a boolean. This setting controls the IFLA_BR_MCAST_QUERIER
361 option in the kernel. If enabled, the kernel will send general ICMP
362 queries from a zero source address. This feature should allow
363 faster convergence on startup, but it causes some multicast-aware
364 switches to misbehave and disrupt forwarding of multicast packets.
365 When unset, the kernel's default will be used.
366
367 MulticastSnooping=
368 Takes a boolean. This setting controls the IFLA_BR_MCAST_SNOOPING
369 option in the kernel. If enabled, IGMP snooping monitors the
370 Internet Group Management Protocol (IGMP) traffic between hosts and
371 multicast routers. When unset, the kernel's default will be used.
372
373 VLANFiltering=
374 Takes a boolean. This setting controls the IFLA_BR_VLAN_FILTERING
375 option in the kernel. If enabled, the bridge will be started in
376 VLAN-filtering mode. When unset, the kernel's default will be used.
377
378 VLANProtocol=
379 Allows setting the protocol used for VLAN filtering. Takes 802.1q
380 or, 802.1ad, and defaults to unset and kernel's default is used.
381
382 STP=
383 Takes a boolean. This enables the bridge's Spanning Tree Protocol
384 (STP). When unset, the kernel's default will be used.
385
386 MulticastIGMPVersion=
387 Allows changing bridge's multicast Internet Group Management
388 Protocol (IGMP) version. Takes an integer 2 or 3. When unset, the
389 kernel's default will be used.
390
392 The [VLAN] section only applies for netdevs of kind "vlan", and accepts
393 the following key:
394
395 Id=
396 The VLAN ID to use. An integer in the range 0–4094. This setting is
397 compulsory.
398
399 GVRP=
400 Takes a boolean. The Generic VLAN Registration Protocol (GVRP) is a
401 protocol that allows automatic learning of VLANs on a network. When
402 unset, the kernel's default will be used.
403
404 MVRP=
405 Takes a boolean. Multiple VLAN Registration Protocol (MVRP)
406 formerly known as GARP VLAN Registration Protocol (GVRP) is a
407 standards-based Layer 2 network protocol, for automatic
408 configuration of VLAN information on switches. It was defined in
409 the 802.1ak amendment to 802.1Q-2005. When unset, the kernel's
410 default will be used.
411
412 LooseBinding=
413 Takes a boolean. The VLAN loose binding mode, in which only the
414 operational state is passed from the parent to the associated
415 VLANs, but the VLAN device state is not changed. When unset, the
416 kernel's default will be used.
417
418 ReorderHeader=
419 Takes a boolean. When enabled, the VLAN reorder header is used and
420 VLAN interfaces behave like physical interfaces. When unset, the
421 kernel's default will be used.
422
424 The [MACVLAN] section only applies for netdevs of kind "macvlan", and
425 accepts the following key:
426
427 Mode=
428 The MACVLAN mode to use. The supported options are "private",
429 "vepa", "bridge", "passthru", and "source".
430
431 SourceMACAddress=
432 A whitespace-separated list of remote hardware addresses allowed on
433 the MACVLAN. This option only has an effect in source mode. Use
434 full colon-, hyphen- or dot-delimited hexadecimal. This option may
435 appear more than once, in which case the lists are merged. If the
436 empty string is assigned to this option, the list of hardware
437 addresses defined prior to this is reset. Defaults to unset.
438
440 The [MACVTAP] section applies for netdevs of kind "macvtap" and accepts
441 the same key as [MACVLAN].
442
444 The [IPVLAN] section only applies for netdevs of kind "ipvlan", and
445 accepts the following key:
446
447 Mode=
448 The IPVLAN mode to use. The supported options are "L2","L3" and
449 "L3S".
450
451 Flags=
452 The IPVLAN flags to use. The supported options are
453 "bridge","private" and "vepa".
454
456 The [IPVTAP] section only applies for netdevs of kind "ipvtap" and
457 accepts the same key as [IPVLAN].
458
460 The [VXLAN] section only applies for netdevs of kind "vxlan", and
461 accepts the following keys:
462
463 VNI=
464 The VXLAN Network Identifier (or VXLAN Segment ID). Takes a number
465 in the range 1-16777215.
466
467 Remote=
468 Configures destination IP address.
469
470 Local=
471 Configures local IP address.
472
473 Group=
474 Configures VXLAN multicast group IP address. All members of a VXLAN
475 must use the same multicast group address.
476
477 TOS=
478 The Type Of Service byte value for a vxlan interface.
479
480 TTL=
481 A fixed Time To Live N on Virtual eXtensible Local Area Network
482 packets. Takes "inherit" or a number in the range 0–255. 0 is a
483 special value meaning inherit the inner protocol's TTL value.
484 "inherit" means that it will inherit the outer protocol's TTL
485 value.
486
487 MacLearning=
488 Takes a boolean. When true, enables dynamic MAC learning to
489 discover remote MAC addresses.
490
491 FDBAgeingSec=
492 The lifetime of Forwarding Database entry learnt by the kernel, in
493 seconds.
494
495 MaximumFDBEntries=
496 Configures maximum number of FDB entries.
497
498 ReduceARPProxy=
499 Takes a boolean. When true, bridge-connected VXLAN tunnel endpoint
500 answers ARP requests from the local bridge on behalf of remote
501 Distributed Overlay Virtual Ethernet (DVOE)[5] clients. Defaults to
502 false.
503
504 L2MissNotification=
505 Takes a boolean. When true, enables netlink LLADDR miss
506 notifications.
507
508 L3MissNotification=
509 Takes a boolean. When true, enables netlink IP address miss
510 notifications.
511
512 RouteShortCircuit=
513 Takes a boolean. When true, route short circuiting is turned on.
514
515 UDPChecksum=
516 Takes a boolean. When true, transmitting UDP checksums when doing
517 VXLAN/IPv4 is turned on.
518
519 UDP6ZeroChecksumTx=
520 Takes a boolean. When true, sending zero checksums in VXLAN/IPv6 is
521 turned on.
522
523 UDP6ZeroChecksumRx=
524 Takes a boolean. When true, receiving zero checksums in VXLAN/IPv6
525 is turned on.
526
527 RemoteChecksumTx=
528 Takes a boolean. When true, remote transmit checksum offload of
529 VXLAN is turned on.
530
531 RemoteChecksumRx=
532 Takes a boolean. When true, remote receive checksum offload in
533 VXLAN is turned on.
534
535 GroupPolicyExtension=
536 Takes a boolean. When true, it enables Group Policy VXLAN extension
537 security label mechanism across network peers based on VXLAN. For
538 details about the Group Policy VXLAN, see the VXLAN Group Policy[6]
539 document. Defaults to false.
540
541 GenericProtocolExtension=
542 Takes a boolean. When true, Generic Protocol Extension extends the
543 existing VXLAN protocol to provide protocol typing, OAM, and
544 versioning capabilities. For details about the VXLAN GPE Header,
545 see the Generic Protocol Extension for VXLAN[7] document. If
546 destination port is not specified and Generic Protocol Extension is
547 set then default port of 4790 is used. Defaults to false.
548
549 DestinationPort=
550 Configures the default destination UDP port. If the destination
551 port is not specified then Linux kernel default will be used. Set
552 to 4789 to get the IANA assigned value.
553
554 PortRange=
555 Configures the source port range for the VXLAN. The kernel assigns
556 the source UDP port based on the flow to help the receiver to do
557 load balancing. When this option is not set, the normal range of
558 local UDP ports is used.
559
560 FlowLabel=
561 Specifies the flow label to use in outgoing packets. The valid
562 range is 0-1048575.
563
564 IPDoNotFragment=
565 Allows setting the IPv4 Do not Fragment (DF) bit in outgoing
566 packets, or to inherit its value from the IPv4 inner header. Takes
567 a boolean value, or "inherit". Set to "inherit" if the encapsulated
568 protocol is IPv6. When unset, the kernel's default will be used.
569
571 The [GENEVE] section only applies for netdevs of kind "geneve", and
572 accepts the following keys:
573
574 Id=
575 Specifies the Virtual Network Identifier (VNI) to use. Ranges
576 [0-16777215]. This field is mandatory.
577
578 Remote=
579 Specifies the unicast destination IP address to use in outgoing
580 packets.
581
582 TOS=
583 Specifies the TOS value to use in outgoing packets. Ranges [1-255].
584
585 TTL=
586 Accepts the same values as in the [VXLAN] section, except that when
587 unset or set to 0, the kernel's default will be used, meaning that
588 packet TTL will be set from /proc/sys/net/ipv4/ip_default_ttl.
589
590 UDPChecksum=
591 Takes a boolean. When true, specifies that UDP checksum is
592 calculated for transmitted packets over IPv4.
593
594 UDP6ZeroChecksumTx=
595 Takes a boolean. When true, skip UDP checksum calculation for
596 transmitted packets over IPv6.
597
598 UDP6ZeroChecksumRx=
599 Takes a boolean. When true, allows incoming UDP packets over IPv6
600 with zero checksum field.
601
602 DestinationPort=
603 Specifies destination port. Defaults to 6081. If not set or
604 assigned the empty string, the default port of 6081 is used.
605
606 FlowLabel=
607 Specifies the flow label to use in outgoing packets.
608
609 IPDoNotFragment=
610 Accepts the same key in [VXLAN] section.
611
613 The [L2TP] section only applies for netdevs of kind "l2tp", and accepts
614 the following keys:
615
616 TunnelId=
617 Specifies the tunnel identifier. Takes an number in the range
618 1–4294967295. The value used must match the "PeerTunnelId=" value
619 being used at the peer. This setting is compulsory.
620
621 PeerTunnelId=
622 Specifies the peer tunnel id. Takes a number in the range
623 1—4294967295. The value used must match the "PeerTunnelId=" value
624 being used at the peer. This setting is compulsory.
625
626 Remote=
627 Specifies the IP address of the remote peer. This setting is
628 compulsory.
629
630 Local=
631 Specifies the IP address of the local interface. Takes an IP
632 address, or the special values "auto", "static", or "dynamic". When
633 an address is set, then the local interface must have the address.
634 If "auto", then one of the addresses on the local interface is
635 used. Similarly, if "static" or "dynamic" is set, then one of the
636 static or dynamic addresses on the local interface is used.
637 Defaults to "auto".
638
639 EncapsulationType=
640 Specifies the encapsulation type of the tunnel. Takes one of "udp"
641 or "ip".
642
643 UDPSourcePort=
644 Specifies the UDP source port to be used for the tunnel. When UDP
645 encapsulation is selected it's mandatory. Ignored when IP
646 encapsulation is selected.
647
648 UDPDestinationPort=
649 Specifies destination port. When UDP encapsulation is selected it's
650 mandatory. Ignored when IP encapsulation is selected.
651
652 UDPChecksum=
653 Takes a boolean. When true, specifies that UDP checksum is
654 calculated for transmitted packets over IPv4.
655
656 UDP6ZeroChecksumTx=
657 Takes a boolean. When true, skip UDP checksum calculation for
658 transmitted packets over IPv6.
659
660 UDP6ZeroChecksumRx=
661 Takes a boolean. When true, allows incoming UDP packets over IPv6
662 with zero checksum field.
663
665 The [L2TPSession] section only applies for netdevs of kind "l2tp", and
666 accepts the following keys:
667
668 Name=
669 Specifies the name of the session. This setting is compulsory.
670
671 SessionId=
672 Specifies the session identifier. Takes an number in the range
673 1–4294967295. The value used must match the "SessionId=" value
674 being used at the peer. This setting is compulsory.
675
676 PeerSessionId=
677 Specifies the peer session identifier. Takes an number in the range
678 1–4294967295. The value used must match the "PeerSessionId=" value
679 being used at the peer. This setting is compulsory.
680
681 Layer2SpecificHeader=
682 Specifies layer2specific header type of the session. One of "none"
683 or "default". Defaults to "default".
684
686 The [MACsec] section only applies for network devices of kind "macsec",
687 and accepts the following keys:
688
689 Port=
690 Specifies the port to be used for the MACsec transmit channel. The
691 port is used to make secure channel identifier (SCI). Takes a value
692 between 1 and 65535. Defaults to unset.
693
694 Encrypt=
695 Takes a boolean. When true, enable encryption. Defaults to unset.
696
698 The [MACsecReceiveChannel] section only applies for network devices of
699 kind "macsec", and accepts the following keys:
700
701 Port=
702 Specifies the port to be used for the MACsec receive channel. The
703 port is used to make secure channel identifier (SCI). Takes a value
704 between 1 and 65535. This option is compulsory, and is not set by
705 default.
706
707 MACAddress=
708 Specifies the MAC address to be used for the MACsec receive
709 channel. The MAC address used to make secure channel identifier
710 (SCI). This setting is compulsory, and is not set by default.
711
713 The [MACsecTransmitAssociation] section only applies for network
714 devices of kind "macsec", and accepts the following keys:
715
716 PacketNumber=
717 Specifies the packet number to be used for replay protection and
718 the construction of the initialization vector (along with the
719 secure channel identifier [SCI]). Takes a value between
720 1-4,294,967,295. Defaults to unset.
721
722 KeyId=
723 Specifies the identification for the key. Takes a number between
724 0-255. This option is compulsory, and is not set by default.
725
726 Key=
727 Specifies the encryption key used in the transmission channel. The
728 same key must be configured on the peer’s matching receive channel.
729 This setting is compulsory, and is not set by default. Takes a
730 128-bit key encoded in a hexadecimal string, for example
731 "dffafc8d7b9a43d5b9a3dfbbf6a30c16".
732
733 KeyFile=
734 Takes a absolute path to a file which contains a 128-bit key
735 encoded in a hexadecimal string, which will be used in the
736 transmission channel. When this option is specified, Key= is
737 ignored. Note that the file must be readable by the user
738 "systemd-network", so it should be, e.g., owned by
739 "root:systemd-network" with a "0640" file mode. If the path refers
740 to an AF_UNIX stream socket in the file system a connection is made
741 to it and the key read from it.
742
743 Activate=
744 Takes a boolean. If enabled, then the security association is
745 activated. Defaults to unset.
746
747 UseForEncoding=
748 Takes a boolean. If enabled, then the security association is used
749 for encoding. Only one [MACsecTransmitAssociation] section can
750 enable this option. When enabled, Activate=yes is implied. Defaults
751 to unset.
752
754 The [MACsecReceiveAssociation] section only applies for network devices
755 of kind "macsec", and accepts the following keys:
756
757 Port=
758 Accepts the same key in [MACsecReceiveChannel] section.
759
760 MACAddress=
761 Accepts the same key in [MACsecReceiveChannel] section.
762
763 PacketNumber=
764 Accepts the same key in [MACsecTransmitAssociation] section.
765
766 KeyId=
767 Accepts the same key in [MACsecTransmitAssociation] section.
768
769 Key=
770 Accepts the same key in [MACsecTransmitAssociation] section.
771
772 KeyFile=
773 Accepts the same key in [MACsecTransmitAssociation] section.
774
775 Activate=
776 Accepts the same key in [MACsecTransmitAssociation] section.
777
779 The [Tunnel] section only applies for netdevs of kind "ipip", "sit",
780 "gre", "gretap", "ip6gre", "ip6gretap", "vti", "vti6", "ip6tnl", and
781 "erspan" and accepts the following keys:
782
783 Local=
784 A static local address for tunneled packets. It must be an address
785 on another interface of this host, or the special value "any".
786
787 Remote=
788 The remote endpoint of the tunnel. Takes an IP address or the
789 special value "any".
790
791 TOS=
792 The Type Of Service byte value for a tunnel interface. For details
793 about the TOS, see the Type of Service in the Internet Protocol
794 Suite[8] document.
795
796 TTL=
797 A fixed Time To Live N on tunneled packets. N is a number in the
798 range 1–255. 0 is a special value meaning that packets inherit the
799 TTL value. The default value for IPv4 tunnels is 0 (inherit). The
800 default value for IPv6 tunnels is 64.
801
802 DiscoverPathMTU=
803 Takes a boolean. When true, enables Path MTU Discovery on the
804 tunnel.
805
806 IPv6FlowLabel=
807 Configures the 20-bit flow label (see RFC 6437[9]) field in the
808 IPv6 header (see RFC 2460[10]), which is used by a node to label
809 packets of a flow. It is only used for IPv6 tunnels. A flow label
810 of zero is used to indicate packets that have not been labeled. It
811 can be configured to a value in the range 0–0xFFFFF, or be set to
812 "inherit", in which case the original flowlabel is used.
813
814 CopyDSCP=
815 Takes a boolean. When true, the Differentiated Service Code Point
816 (DSCP) field will be copied to the inner header from outer header
817 during the decapsulation of an IPv6 tunnel packet. DSCP is a field
818 in an IP packet that enables different levels of service to be
819 assigned to network traffic. Defaults to "no".
820
821 EncapsulationLimit=
822 The Tunnel Encapsulation Limit option specifies how many additional
823 levels of encapsulation are permitted to be prepended to the
824 packet. For example, a Tunnel Encapsulation Limit option containing
825 a limit value of zero means that a packet carrying that option may
826 not enter another tunnel before exiting the current tunnel. (see
827 RFC 2473[11]). The valid range is 0–255 and "none". Defaults to 4.
828
829 Key=
830 The Key= parameter specifies the same key to use in both directions
831 (InputKey= and OutputKey=). The Key= is either a number or an IPv4
832 address-like dotted quad. It is used as mark-configured SAD/SPD
833 entry as part of the lookup key (both in data and control path) in
834 IP XFRM (framework used to implement IPsec protocol). See ip-xfrm —
835 transform configuration[12] for details. It is only used for
836 VTI/VTI6, GRE, GRETAP, and ERSPAN tunnels.
837
838 InputKey=
839 The InputKey= parameter specifies the key to use for input. The
840 format is same as Key=. It is only used for VTI/VTI6, GRE, GRETAP,
841 and ERSPAN tunnels.
842
843 OutputKey=
844 The OutputKey= parameter specifies the key to use for output. The
845 format is same as Key=. It is only used for VTI/VTI6, GRE, GRETAP,
846 and ERSPAN tunnels.
847
848 Mode=
849 An "ip6tnl" tunnel can be in one of three modes "ip6ip6" for IPv6
850 over IPv6, "ipip6" for IPv4 over IPv6 or "any" for either.
851
852 Independent=
853 Takes a boolean. When true tunnel does not require .network file.
854 Created as "tunnel@NONE". Defaults to "false".
855
856 AssignToLoopback=
857 Takes a boolean. If set to "yes", the loopback interface "lo" is
858 used as the underlying device of the tunnel interface. Defaults to
859 "no".
860
861 AllowLocalRemote=
862 Takes a boolean. When true allows tunnel traffic on ip6tnl devices
863 where the remote endpoint is a local host address. When unset, the
864 kernel's default will be used.
865
866 FooOverUDP=
867 Takes a boolean. Specifies whether FooOverUDP= tunnel is to be
868 configured. Defaults to false. This takes effects only for IPIP,
869 SIT, GRE, and GRETAP tunnels. For more detail information see Foo
870 over UDP[13]
871
872 FOUDestinationPort=
873 This setting specifies the UDP destination port for encapsulation.
874 This field is mandatory when FooOverUDP=yes, and is not set by
875 default.
876
877 FOUSourcePort=
878 This setting specifies the UDP source port for encapsulation.
879 Defaults to 0 — that is, the source port for packets is left to the
880 network stack to decide.
881
882 Encapsulation=
883 Accepts the same key as in the [FooOverUDP] section.
884
885 IPv6RapidDeploymentPrefix=
886 Reconfigure the tunnel for IPv6 Rapid Deployment[14], also known as
887 6rd. The value is an ISP-specific IPv6 prefix with a non-zero
888 length. Only applicable to SIT tunnels.
889
890 ISATAP=
891 Takes a boolean. If set, configures the tunnel as Intra-Site
892 Automatic Tunnel Addressing Protocol (ISATAP) tunnel. Only
893 applicable to SIT tunnels. When unset, the kernel's default will be
894 used.
895
896 SerializeTunneledPackets=
897 Takes a boolean. If set to yes, then packets are serialized. Only
898 applies for GRE, GRETAP, and ERSPAN tunnels. When unset, the
899 kernel's default will be used.
900
901 ERSPANIndex=
902 Specifies the ERSPAN index field for the interface, an integer in
903 the range 1-1048575 associated with the ERSPAN traffic's source
904 port and direction. This field is mandatory.
905
907 The [FooOverUDP] section only applies for netdevs of kind "fou" and
908 accepts the following keys:
909
910 Encapsulation=
911 Specifies the encapsulation mechanism used to store networking
912 packets of various protocols inside the UDP packets. Supports the
913 following values: "FooOverUDP" provides the simplest no frills
914 model of UDP encapsulation, it simply encapsulates packets directly
915 in the UDP payload. "GenericUDPEncapsulation" is a generic and
916 extensible encapsulation, it allows encapsulation of packets for
917 any IP protocol and optional data as part of the encapsulation. For
918 more detailed information see Generic UDP Encapsulation[15].
919 Defaults to "FooOverUDP".
920
921 Port=
922 Specifies the port number, where the IP encapsulation packets will
923 arrive. Please take note that the packets will arrive with the
924 encapsulation will be removed. Then they will be manually fed back
925 into the network stack, and sent ahead for delivery to the real
926 destination. This option is mandatory.
927
928 PeerPort=
929 Specifies the peer port number. Defaults to unset. Note that when
930 peer port is set "Peer=" address is mandatory.
931
932 Protocol=
933 The Protocol= specifies the protocol number of the packets arriving
934 at the UDP port. When Encapsulation=FooOverUDP, this field is
935 mandatory and is not set by default. Takes an IP protocol name such
936 as "gre" or "ipip", or an integer within the range 1-255. When
937 Encapsulation=GenericUDPEncapsulation, this must not be specified.
938
939 Peer=
940 Configures peer IP address. Note that when peer address is set
941 "PeerPort=" is mandatory.
942
943 Local=
944 Configures local IP address.
945
947 The [Peer] section only applies for netdevs of kind "veth" and accepts
948 the following keys:
949
950 Name=
951 The interface name used when creating the netdev. This setting is
952 compulsory.
953
954 MACAddress=
955 The peer MACAddress, if not set, it is generated in the same way as
956 the MAC address of the main interface.
957
959 The [VXCAN] section only applies for netdevs of kind "vxcan" and
960 accepts the following key:
961
962 Peer=
963 The peer interface name used when creating the netdev. This setting
964 is compulsory.
965
967 The [Tun] section only applies for netdevs of kind "tun", and accepts
968 the following keys:
969
970 MultiQueue=
971 Takes a boolean. Configures whether to use multiple file
972 descriptors (queues) to parallelize packets sending and receiving.
973 Defaults to "no".
974
975 PacketInfo=
976 Takes a boolean. Configures whether packets should be prepended
977 with four extra bytes (two flag bytes and two protocol bytes). If
978 disabled, it indicates that the packets will be pure IP packets.
979 Defaults to "no".
980
981 VNetHeader=
982 Takes a boolean. Configures IFF_VNET_HDR flag for a tun or tap
983 device. It allows sending and receiving larger Generic Segmentation
984 Offload (GSO) packets. This may increase throughput significantly.
985 Defaults to "no".
986
987 User=
988 User to grant access to the /dev/net/tun device.
989
990 Group=
991 Group to grant access to the /dev/net/tun device.
992
994 The [Tap] section only applies for netdevs of kind "tap", and accepts
995 the same keys as the [Tun] section.
996
998 The [WireGuard] section accepts the following keys:
999
1000 PrivateKey=
1001 The Base64 encoded private key for the interface. It can be
1002 generated using the wg genkey command (see wg(8)). This option or
1003 PrivateKeyFile= is mandatory to use WireGuard. Note that because
1004 this information is secret, you may want to set the permissions of
1005 the .netdev file to be owned by "root:systemd-network" with a
1006 "0640" file mode.
1007
1008 PrivateKeyFile=
1009 Takes an absolute path to a file which contains the Base64 encoded
1010 private key for the interface. When this option is specified, then
1011 PrivateKey= is ignored. Note that the file must be readable by the
1012 user "systemd-network", so it should be, e.g., owned by
1013 "root:systemd-network" with a "0640" file mode. If the path refers
1014 to an AF_UNIX stream socket in the file system a connection is made
1015 to it and the key read from it.
1016
1017 ListenPort=
1018 Sets UDP port for listening. Takes either value between 1 and 65535
1019 or "auto". If "auto" is specified, the port is automatically
1020 generated based on interface name. Defaults to "auto".
1021
1022 FirewallMark=
1023 Sets a firewall mark on outgoing WireGuard packets from this
1024 interface. Takes a number between 1 and 4294967295.
1025
1027 The [WireGuardPeer] section accepts the following keys:
1028
1029 PublicKey=
1030 Sets a Base64 encoded public key calculated by wg pubkey (see
1031 wg(8)) from a private key, and usually transmitted out of band to
1032 the author of the configuration file. This option is mandatory for
1033 this section.
1034
1035 PresharedKey=
1036 Optional preshared key for the interface. It can be generated by
1037 the wg genpsk command. This option adds an additional layer of
1038 symmetric-key cryptography to be mixed into the already existing
1039 public-key cryptography, for post-quantum resistance. Note that
1040 because this information is secret, you may want to set the
1041 permissions of the .netdev file to be owned by
1042 "root:systemd-network" with a "0640" file mode.
1043
1044 PresharedKeyFile=
1045 Takes an absolute path to a file which contains the Base64 encoded
1046 preshared key for the peer. When this option is specified, then
1047 PresharedKey= is ignored. Note that the file must be readable by
1048 the user "systemd-network", so it should be, e.g., owned by
1049 "root:systemd-network" with a "0640" file mode. If the path refers
1050 to an AF_UNIX stream socket in the file system a connection is made
1051 to it and the key read from it.
1052
1053 AllowedIPs=
1054 Sets a comma-separated list of IP (v4 or v6) addresses with CIDR
1055 masks from which this peer is allowed to send incoming traffic and
1056 to which outgoing traffic for this peer is directed.
1057
1058 The catch-all 0.0.0.0/0 may be specified for matching all IPv4
1059 addresses, and ::/0 may be specified for matching all IPv6
1060 addresses.
1061
1062 Note that this only affects "routing inside the network interface
1063 itself", as in, which wireguard peer packets with a specific
1064 destination address are sent to, and what source addresses are
1065 accepted from which peer.
1066
1067 To cause packets to be sent via wireguard in first place, a route
1068 needs to be added, as well - either in the "[Routes]" section on
1069 the ".network" matching the wireguard interface, or outside of
1070 networkd.
1071
1072 Endpoint=
1073 Sets an endpoint IP address or hostname, followed by a colon, and
1074 then a port number. This endpoint will be updated automatically
1075 once to the most recent source IP address and port of correctly
1076 authenticated packets from the peer at configuration time.
1077
1078 PersistentKeepalive=
1079 Sets a seconds interval, between 1 and 65535 inclusive, of how
1080 often to send an authenticated empty packet to the peer for the
1081 purpose of keeping a stateful firewall or NAT mapping valid
1082 persistently. For example, if the interface very rarely sends
1083 traffic, but it might at anytime receive traffic from a peer, and
1084 it is behind NAT, the interface might benefit from having a
1085 persistent keepalive interval of 25 seconds. If set to 0 or "off",
1086 this option is disabled. By default or when unspecified, this
1087 option is off. Most users will not need this.
1088
1090 The [Bond] section accepts the following key:
1091
1092 Mode=
1093 Specifies one of the bonding policies. The default is "balance-rr"
1094 (round robin). Possible values are "balance-rr", "active-backup",
1095 "balance-xor", "broadcast", "802.3ad", "balance-tlb", and
1096 "balance-alb".
1097
1098 TransmitHashPolicy=
1099 Selects the transmit hash policy to use for slave selection in
1100 balance-xor, 802.3ad, and tlb modes. Possible values are "layer2",
1101 "layer3+4", "layer2+3", "encap2+3", and "encap3+4".
1102
1103 LACPTransmitRate=
1104 Specifies the rate with which link partner transmits Link
1105 Aggregation Control Protocol Data Unit packets in 802.3ad mode.
1106 Possible values are "slow", which requests partner to transmit
1107 LACPDUs every 30 seconds, and "fast", which requests partner to
1108 transmit LACPDUs every second. The default value is "slow".
1109
1110 MIIMonitorSec=
1111 Specifies the frequency that Media Independent Interface link
1112 monitoring will occur. A value of zero disables MII link
1113 monitoring. This value is rounded down to the nearest millisecond.
1114 The default value is 0.
1115
1116 UpDelaySec=
1117 Specifies the delay before a link is enabled after a link up status
1118 has been detected. This value is rounded down to a multiple of
1119 MIIMonitorSec. The default value is 0.
1120
1121 DownDelaySec=
1122 Specifies the delay before a link is disabled after a link down
1123 status has been detected. This value is rounded down to a multiple
1124 of MIIMonitorSec. The default value is 0.
1125
1126 LearnPacketIntervalSec=
1127 Specifies the number of seconds between instances where the bonding
1128 driver sends learning packets to each slave peer switch. The valid
1129 range is 1–0x7fffffff; the default value is 1. This option has an
1130 effect only for the balance-tlb and balance-alb modes.
1131
1132 AdSelect=
1133 Specifies the 802.3ad aggregation selection logic to use. Possible
1134 values are "stable", "bandwidth" and "count".
1135
1136 AdActorSystemPriority=
1137 Specifies the 802.3ad actor system priority. Takes a number in the
1138 range 1—65535.
1139
1140 AdUserPortKey=
1141 Specifies the 802.3ad user defined portion of the port key. Takes a
1142 number in the range 0–1023.
1143
1144 AdActorSystem=
1145 Specifies the 802.3ad system mac address. This can not be either
1146 NULL or Multicast.
1147
1148 FailOverMACPolicy=
1149 Specifies whether the active-backup mode should set all slaves to
1150 the same MAC address at the time of enslavement or, when enabled,
1151 to perform special handling of the bond's MAC address in accordance
1152 with the selected policy. The default policy is none. Possible
1153 values are "none", "active" and "follow".
1154
1155 ARPValidate=
1156 Specifies whether or not ARP probes and replies should be validated
1157 in any mode that supports ARP monitoring, or whether non-ARP
1158 traffic should be filtered (disregarded) for link monitoring
1159 purposes. Possible values are "none", "active", "backup" and "all".
1160
1161 ARPIntervalSec=
1162 Specifies the ARP link monitoring frequency. A value of 0 disables
1163 ARP monitoring. The default value is 0, and the default unit
1164 seconds.
1165
1166 ARPIPTargets=
1167 Specifies the IP addresses to use as ARP monitoring peers when
1168 ARPIntervalSec is greater than 0. These are the targets of the ARP
1169 request sent to determine the health of the link to the targets.
1170 Specify these values in IPv4 dotted decimal format. At least one IP
1171 address must be given for ARP monitoring to function. The maximum
1172 number of targets that can be specified is 16. The default value is
1173 no IP addresses.
1174
1175 ARPAllTargets=
1176 Specifies the quantity of ARPIPTargets that must be reachable in
1177 order for the ARP monitor to consider a slave as being up. This
1178 option affects only active-backup mode for slaves with ARPValidate
1179 enabled. Possible values are "any" and "all".
1180
1181 PrimaryReselectPolicy=
1182 Specifies the reselection policy for the primary slave. This
1183 affects how the primary slave is chosen to become the active slave
1184 when failure of the active slave or recovery of the primary slave
1185 occurs. This option is designed to prevent flip-flopping between
1186 the primary slave and other slaves. Possible values are "always",
1187 "better" and "failure".
1188
1189 ResendIGMP=
1190 Specifies the number of IGMP membership reports to be issued after
1191 a failover event. One membership report is issued immediately after
1192 the failover, subsequent packets are sent in each 200ms interval.
1193 The valid range is 0–255. Defaults to 1. A value of 0 prevents the
1194 IGMP membership report from being issued in response to the
1195 failover event.
1196
1197 PacketsPerSlave=
1198 Specify the number of packets to transmit through a slave before
1199 moving to the next one. When set to 0, then a slave is chosen at
1200 random. The valid range is 0–65535. Defaults to 1. This option only
1201 has effect when in balance-rr mode.
1202
1203 GratuitousARP=
1204 Specify the number of peer notifications (gratuitous ARPs and
1205 unsolicited IPv6 Neighbor Advertisements) to be issued after a
1206 failover event. As soon as the link is up on the new slave, a peer
1207 notification is sent on the bonding device and each VLAN
1208 sub-device. This is repeated at each link monitor interval
1209 (ARPIntervalSec or MIIMonitorSec, whichever is active) if the
1210 number is greater than 1. The valid range is 0–255. The default
1211 value is 1. These options affect only the active-backup mode.
1212
1213 AllSlavesActive=
1214 Takes a boolean. Specifies that duplicate frames (received on
1215 inactive ports) should be dropped when false, or delivered when
1216 true. Normally, bonding will drop duplicate frames (received on
1217 inactive ports), which is desirable for most users. But there are
1218 some times it is nice to allow duplicate frames to be delivered.
1219 The default value is false (drop duplicate frames received on
1220 inactive ports).
1221
1222 DynamicTransmitLoadBalancing=
1223 Takes a boolean. Specifies if dynamic shuffling of flows is
1224 enabled. Applies only for balance-tlb mode. Defaults to unset.
1225
1226 MinLinks=
1227 Specifies the minimum number of links that must be active before
1228 asserting carrier. The default value is 0.
1229
1230 For more detail information see Linux Ethernet Bonding Driver HOWTO[1]
1231
1233 The [Xfrm] section accepts the following keys:
1234
1235 InterfaceId=
1236 Sets the ID/key of the xfrm interface which needs to be associated
1237 with a SA/policy. Can be decimal or hexadecimal, valid range is
1238 0-0xffffffff, defaults to 0.
1239
1240 Independent=
1241 Takes a boolean. If set to "no", the xfrm interface should have an
1242 underlying device which can be used for hardware offloading.
1243 Defaults to "no". See systemd.network(5) for how to configure the
1244 underlying device.
1245
1246 For more detail information see Virtual XFRM Interfaces[16].
1247
1249 The [VRF] section only applies for netdevs of kind "vrf" and accepts
1250 the following key:
1251
1252 Table=
1253 The numeric routing table identifier. This setting is compulsory.
1254
1256 Example 1. /etc/systemd/network/25-bridge.netdev
1257
1258 [NetDev]
1259 Name=bridge0
1260 Kind=bridge
1261
1262 Example 2. /etc/systemd/network/25-vlan1.netdev
1263
1264 [Match]
1265 Virtualization=no
1266
1267 [NetDev]
1268 Name=vlan1
1269 Kind=vlan
1270
1271 [VLAN]
1272 Id=1
1273
1274 Example 3. /etc/systemd/network/25-ipip.netdev
1275
1276 [NetDev]
1277 Name=ipip-tun
1278 Kind=ipip
1279 MTUBytes=1480
1280
1281 [Tunnel]
1282 Local=192.168.223.238
1283 Remote=192.169.224.239
1284 TTL=64
1285
1286 Example 4. /etc/systemd/network/1-fou-tunnel.netdev
1287
1288 [NetDev]
1289 Name=fou-tun
1290 Kind=fou
1291
1292 [FooOverUDP]
1293 Port=5555
1294 Protocol=4
1295
1296
1297 Example 5. /etc/systemd/network/25-fou-ipip.netdev
1298
1299 [NetDev]
1300 Name=ipip-tun
1301 Kind=ipip
1302
1303 [Tunnel]
1304 Independent=yes
1305 Local=10.65.208.212
1306 Remote=10.65.208.211
1307 FooOverUDP=yes
1308 FOUDestinationPort=5555
1309
1310
1311 Example 6. /etc/systemd/network/25-tap.netdev
1312
1313 [NetDev]
1314 Name=tap-test
1315 Kind=tap
1316
1317 [Tap]
1318 MultiQueue=yes
1319 PacketInfo=yes
1320
1321 Example 7. /etc/systemd/network/25-sit.netdev
1322
1323 [NetDev]
1324 Name=sit-tun
1325 Kind=sit
1326 MTUBytes=1480
1327
1328 [Tunnel]
1329 Local=10.65.223.238
1330 Remote=10.65.223.239
1331
1332 Example 8. /etc/systemd/network/25-6rd.netdev
1333
1334 [NetDev]
1335 Name=6rd-tun
1336 Kind=sit
1337 MTUBytes=1480
1338
1339 [Tunnel]
1340 Local=10.65.223.238
1341 IPv6RapidDeploymentPrefix=2602::/24
1342
1343 Example 9. /etc/systemd/network/25-gre.netdev
1344
1345 [NetDev]
1346 Name=gre-tun
1347 Kind=gre
1348 MTUBytes=1480
1349
1350 [Tunnel]
1351 Local=10.65.223.238
1352 Remote=10.65.223.239
1353
1354 Example 10. /etc/systemd/network/25-ip6gre.netdev
1355
1356 [NetDev]
1357 Name=ip6gre-tun
1358 Kind=ip6gre
1359
1360 [Tunnel]
1361 Key=123
1362
1363 Example 11. /etc/systemd/network/25-vti.netdev
1364
1365 [NetDev]
1366 Name=vti-tun
1367 Kind=vti
1368 MTUBytes=1480
1369
1370 [Tunnel]
1371 Local=10.65.223.238
1372 Remote=10.65.223.239
1373
1374 Example 12. /etc/systemd/network/25-veth.netdev
1375
1376 [NetDev]
1377 Name=veth-test
1378 Kind=veth
1379
1380 [Peer]
1381 Name=veth-peer
1382
1383 Example 13. /etc/systemd/network/25-bond.netdev
1384
1385 [NetDev]
1386 Name=bond1
1387 Kind=bond
1388
1389 [Bond]
1390 Mode=802.3ad
1391 TransmitHashPolicy=layer3+4
1392 MIIMonitorSec=1s
1393 LACPTransmitRate=fast
1394
1395 Example 14. /etc/systemd/network/25-dummy.netdev
1396
1397 [NetDev]
1398 Name=dummy-test
1399 Kind=dummy
1400 MACAddress=12:34:56:78:9a:bc
1401
1402 Example 15. /etc/systemd/network/25-vrf.netdev
1403
1404 Create a VRF interface with table 42.
1405
1406 [NetDev]
1407 Name=vrf-test
1408 Kind=vrf
1409
1410 [VRF]
1411 Table=42
1412
1413 Example 16. /etc/systemd/network/25-macvtap.netdev
1414
1415 Create a MacVTap device.
1416
1417 [NetDev]
1418 Name=macvtap-test
1419 Kind=macvtap
1420
1421
1422 Example 17. /etc/systemd/network/25-wireguard.netdev
1423
1424 [NetDev]
1425 Name=wg0
1426 Kind=wireguard
1427
1428 [WireGuard]
1429 PrivateKey=EEGlnEPYJV//kbvvIqxKkQwOiS+UENyPncC4bF46ong=
1430 ListenPort=51820
1431
1432 [WireGuardPeer]
1433 PublicKey=RDf+LSpeEre7YEIKaxg+wbpsNV7du+ktR99uBEtIiCA=
1434 AllowedIPs=fd31:bf08:57cb::/48,192.168.26.0/24
1435 Endpoint=wireguard.example.com:51820
1436
1437 Example 18. /etc/systemd/network/27-xfrm.netdev
1438
1439 [NetDev]
1440 Name=xfrm0
1441 Kind=xfrm
1442
1443 [Xfrm]
1444 Independent=yes
1445
1447 systemd(1), systemd-networkd(8), systemd.link(5), systemd.network(5)
1448
1450 1. Linux Ethernet Bonding Driver HOWTO
1451 https://www.kernel.org/doc/Documentation/networking/bonding.txt
1452
1453 2. RFC 2784
1454 https://tools.ietf.org/html/rfc2784
1455
1456 3. IEEE 802.1Q
1457 http://www.ieee802.org/1/pages/802.1Q.html
1458
1459 4. VRF
1460 https://www.kernel.org/doc/Documentation/networking/vrf.txt
1461
1462 5. (DVOE)
1463 https://en.wikipedia.org/wiki/Distributed_Overlay_Virtual_Ethernet
1464
1465 6. VXLAN Group Policy
1466 https://tools.ietf.org/html/draft-smith-vxlan-group-policy
1467
1468 7. Generic Protocol Extension for VXLAN
1469 https://tools.ietf.org/html/draft-ietf-nvo3-vxlan-gpe-07
1470
1471 8. Type of Service in the Internet Protocol Suite
1472 http://tools.ietf.org/html/rfc1349
1473
1474 9. RFC 6437
1475 https://tools.ietf.org/html/rfc6437
1476
1477 10. RFC 2460
1478 https://tools.ietf.org/html/rfc2460
1479
1480 11. RFC 2473
1481 https://tools.ietf.org/html/rfc2473#section-4.1.1
1482
1483 12. ip-xfrm — transform configuration
1484 http://man7.org/linux/man-pages/man8/ip-xfrm.8.html
1485
1486 13. Foo over UDP
1487 https://lwn.net/Articles/614348
1488
1489 14. IPv6 Rapid Deployment
1490 https://tools.ietf.org/html/rfc5569
1491
1492 15. Generic UDP Encapsulation
1493 https://lwn.net/Articles/615044
1494
1495 16. Virtual XFRM Interfaces
1496 https://lwn.net/Articles/757391
1497
1498
1499
1500systemd 246 SYSTEMD.NETDEV(5)