tc-tunnel_key(8) — Linux manual page


Tunnel metada...n action in tc(8) LinuxTunnel metada...n action in tc(8)

NAME         top

       tunnel_key - Tunnel metadata manipulation

SYNOPSIS         top

       tc ... action tunnel_key { unset | SET }

       SET := set src_ip ADDRESS dst_ip ADDRESS id KEY_ID dst_port
               UDP_PORT tos TOS ttl TTL [ csum | nocsum ]

DESCRIPTION         top

       The tunnel_key action combined with a shared IP tunnel device,
       allows one to perform IP tunnel en- or decapsulation on a packet,
       reflected by the operation modes UNSET and SET.  The UNSET mode
       is optional - even without using it, the metadata information
       will be released automatically when packet processing will be
       finished.  UNSET function could be used in cases when traffic is
       forwarded between two tunnels, where the metadata from the first
       tunnel will be used for encapsulation done by the second tunnel.
       SET mode requires the source and destination ip ADDRESS and the
       tunnel key id KEY_ID which will be used by the ip tunnel shared
       device to create the tunnel header. The tunnel_key action is
       useful only in combination with a mirred redirect action to a
       shared IP tunnel device which will use the metadata (for SET )
       and unset the metadata created by it (for UNSET ).

OPTIONS         top

       unset  Unset the tunnel metadata created by the IP tunnel device.
              This function is not mandatory and might be used only in
              some specific use cases (as explained above).

       set    Set tunnel metadata to be used by the IP tunnel device.
              Requires src_ip and dst_ip options.  id , dst_port ,
              geneve_opts , vxlan_opts and erspan_opts are optional.

              id     Tunnel ID (for example VNI in VXLAN tunnel)

              src_ip Outer header source IP address (IPv4 or IPv6)

              dst_ip Outer header destination IP address (IPv4 or IPv6)

                     Outer header destination UDP port

                     Geneve variable length options.  geneve_opts is
                     specified in the form CLASS:TYPE:DATA, where CLASS
                     is represented as a 16bit hexadecimal value, TYPE
                     as an 8bit hexadecimal value and DATA as a variable
                     length hexadecimal value. Additionally multiple
                     options may be listed using a comma delimiter.

                     Vxlan metadata options.  vxlan_opts is specified in
                     the form GBP, as a 32bit number. Multiple options
                     is not supported.

                     Erspan metadata options.  erspan_opts is specified
                     in the form VERSION:INDEX:DIR:HWID, where VERSION
                     is represented as a 8bit number, INDEX as an 32bit
                     number, DIR and HWID as a 8bit number.  Multiple
                     options is not supported. Note INDEX is used when
                     VERSION is 1, and DIR and HWID are used when
                     VERSION is 2.

              tos    Outer header TOS

              ttl    Outer header TTL

                     Controls outer UDP checksum. When set to csum
                     (which is default), the outer UDP checksum is
                     calculated and included in the packets. When set to
                     nocsum, outer UDP checksum is zero. Note that when
                     using zero UDP checksums with IPv6, the other
                     tunnel endpoint must be configured to accept such
                     packets.  In Linux, this would be the
                     udp6zerocsumrx option for the VXLAN tunnel

                     If using nocsum with IPv6, be sure you know what
                     you are doing. Zero UDP checksums provide weaker
                     protection against corrupted packets. See RFC6935
                     for details.

              nofrag disallow IP fragmentation.

EXAMPLES         top

       The following example encapsulates incoming ICMP packets on eth0
       into a vxlan tunnel, by setting metadata to VNI 11, source IP and destination IP, and by redirecting the
       packet with the metadata to device vxlan0, which will do the
       actual encapsulation using the metadata:

              #tc qdisc add dev eth0 handle ffff: ingress
              #tc filter add dev eth0 protocol ip parent ffff: \
                flower \
                  ip_proto icmp \
                action tunnel_key set \
                  src_ip \
                  dst_ip \
                  id 11 \
                action mirred egress redirect dev vxlan0

       Here is an example of the unset function: Incoming VXLAN traffic
       with outer IP's and VNI 11 is decapsulated by vxlan0 and metadata
       is unset before redirecting to tunl1 device:

              #tc qdisc add dev eth0 handle ffff: ingress
              #tc filter add dev vxlan0 protocol ip parent ffff:   flower \
                     enc_src_ip enc_dst_ip enc_key_id 11   action tunnel_key unset  action mirred egress redirect dev tunl1

SEE ALSO         top


COLOPHON         top

       This page is part of the iproute2 (utilities for controlling
       TCP/IP networking and traffic) project.  Information about the
       project can be found at 
       If you have a bug report for this manual page, send it to,  This page was
       obtained from the project's upstream Git repository
       ⟨⟩ on
       2023-12-22.  (At that time, the date of the most recent commit
       that was found in the repository was 2023-12-20.)  If you
       discover any rendering problems in this HTML version of the page,
       or you believe there is a better or more up-to-date source for
       the page, or you have corrections or improvements to the
       information in this COLOPHON (which is not part of the original
       manual page), send a mail to

iproute2                       10 Nov 20T1u6nnel metada...n action in tc(8)

Pages that refer to this page: tc-actions(8)