mirror of
https://git.proxmox.com/git/mirror_iproute2
synced 2025-10-06 03:54:27 +00:00
d57639a475
This action could be used before redirecting packets to a shared tunnel
device, or when redirecting packets arriving from a such a device.
The 'unset' action is optional. It is used to explicitly unset the
metadata created by the tunnel device during decap. If not used, the
metadata will be released automatically by the kernel.
The 'set' operation, will set the metadata with the specified values for
the encap.
For example, the following flower filter will forward all ICMP packets
destined to 11.11.11.2 through the shared vxlan device 'vxlan0'. Before
redirecting, a metadata for the vxlan tunnel is created using the
tunnel_key action and it's arguments:
$ tc filter add dev net0 protocol ip parent ffff: \
flower \
ip_proto 1 \
dst_ip 11.11.11.2 \
action tunnel_key set \
src_ip 11.11.0.1 \
dst_ip 11.11.0.2 \
id 11 \
action mirred egress redirect dev vxlan0
Signed-off-by: Amir Vadai <amir@vadai.me>
113 lines
2.7 KiB
Groff
113 lines
2.7 KiB
Groff
.TH "Tunnel metadata manipulation action in tc" 8 "10 Nov 2016" "iproute2" "Linux"
|
|
|
|
.SH NAME
|
|
tunnel_key - Tunnel metadata manipulation
|
|
.SH SYNOPSIS
|
|
.in +8
|
|
.ti -8
|
|
.BR tc " ... " "action tunnel_key" " { " unset " | "
|
|
.IR SET " }"
|
|
|
|
.ti -8
|
|
.IR SET " := "
|
|
.BR set " " src_ip
|
|
.IR ADDRESS
|
|
.BR dst_ip
|
|
.IR ADDRESS
|
|
.BI id " KEY_ID"
|
|
|
|
.SH DESCRIPTION
|
|
The
|
|
.B tunnel_key
|
|
action combined with a shared IP tunnel device, allows to perform IP tunnel en-
|
|
or decapsulation on a packet, reflected by
|
|
the operation modes
|
|
.IR UNSET " and " SET .
|
|
The
|
|
.I UNSET
|
|
mode is optional - even without using it, the metadata information will be
|
|
released automatically when packet processing will be finished.
|
|
.IR UNSET
|
|
function could be used in cases when traffic is forwarded between two tunnels,
|
|
where the metadata from the first tunnel will be used for encapsulation done by
|
|
the second tunnel.
|
|
.IR SET
|
|
mode requires the source and destination ip
|
|
.I ADDRESS
|
|
and the tunnel key id
|
|
.I KEY_ID
|
|
which will be used by the ip tunnel shared device to create the tunnel header. The
|
|
.B tunnel_key
|
|
action is useful only in combination with a
|
|
.B mirred redirect
|
|
action to a shared IP tunnel device which will use the metadata (for
|
|
.I SET
|
|
) and unset the metadata created by it (for
|
|
.I UNSET
|
|
).
|
|
|
|
.SH OPTIONS
|
|
.TP
|
|
.B unset
|
|
Unset the tunnel metadata created by the IP tunnel device. This function is
|
|
not mandatory and might be used only in some specific use cases (as explained
|
|
above).
|
|
.TP
|
|
.B set
|
|
Set tunnel metadata to be used by the IP tunnel device. Requires
|
|
.B id
|
|
,
|
|
.B src_ip
|
|
and
|
|
.B dst_ip
|
|
options.
|
|
.RS
|
|
.TP
|
|
.B id
|
|
Tunnel ID (for example VNI in VXLAN tunnel)
|
|
.TP
|
|
.B src_ip
|
|
Outer header source IP address (IPv4 or IPv6)
|
|
.TP
|
|
.B dst_ip
|
|
Outer header destination IP address (IPv4 or IPv6)
|
|
.RE
|
|
.SH EXAMPLES
|
|
The following example encapsulates incoming ICMP packets on eth0 into a vxlan
|
|
tunnel, by setting metadata to VNI 11, source IP 11.11.0.1 and destination IP
|
|
11.11.0.2, and by redirecting the packet with the metadata to device vxlan0,
|
|
which will do the actual encapsulation using the metadata:
|
|
|
|
.RS
|
|
.EX
|
|
#tc qdisc add dev eth0 handle ffff: ingress
|
|
#tc filter add dev eth0 protocol ip parent ffff: \\
|
|
flower \\
|
|
ip_proto icmp \\
|
|
action tunnel_key set \\
|
|
src_ip 11.11.0.1 \\
|
|
dst_ip 11.11.0.2 \\
|
|
id 11 \\
|
|
action mirred egress redirect dev vxlan0
|
|
.EE
|
|
.RE
|
|
|
|
Here is an example of the
|
|
.B unset
|
|
function: Incoming VXLAN traffic with outer IP's and VNI 11 is decapsulated by
|
|
vxlan0 and metadata is unset before redirecting to tunl1 device:
|
|
|
|
.RS
|
|
.EX
|
|
#tc qdisc add dev eth0 handle ffff: ingress
|
|
#tc filter add dev vxlan0 protocol ip parent ffff: \
|
|
flower \\
|
|
enc_src_ip 11.11.0.2 enc_dst_ip 11.11.0.1 enc_key_id 11 \
|
|
action tunnel_key unset \
|
|
action mirred egress redirect dev tunl1
|
|
.EE
|
|
.RE
|
|
|
|
.SH SEE ALSO
|
|
.BR tc (8)
|