tc-tunnel_key(8) — Linux manual page


Tunnel metadata manipulation actionninntc(8)ata manipulation action in tc(8)

NAME         top

       tunnel_key - Tunnel metadata manipulation

SYNOPSIS         top

       tc ... action tunnel_key { unset | SET }

       SET := set src_ip ADDRESS dst_ip ADDRESS id KEY_ID dst_port UDP_PORT
               tos TOS ttl TTL [ csum | nocsum ]

DESCRIPTION         top

       The tunnel_key action combined with a shared IP tunnel device, allows
       to perform IP tunnel en- or decapsulation on a packet, reflected by
       the operation modes UNSET and SET.  The UNSET mode is optional - even
       without using it, the metadata information will be released
       automatically when packet processing will be finished.  UNSET
       function could be used in cases when traffic is forwarded between two
       tunnels, where the metadata from the first tunnel will be used for
       encapsulation done by the second tunnel.  SET mode requires the
       source and destination ip ADDRESS and the tunnel key id KEY_ID which
       will be used by the ip tunnel shared device to create the tunnel
       header. The tunnel_key action is useful only in combination with a
       mirred redirect action to a shared IP tunnel device which will use
       the metadata (for SET ) and unset the metadata created by it (for
       UNSET ).

OPTIONS         top

       unset  Unset the tunnel metadata created by the IP tunnel device.
              This function is not mandatory and might be used only in some
              specific use cases (as explained above).

       set    Set tunnel metadata to be used by the IP tunnel device.
              Requires src_ip and dst_ip options.  id , dst_port ,
              geneve_opts , vxlan_opts and erspan_opts are optional.

              id     Tunnel ID (for example VNI in VXLAN tunnel)

              src_ip Outer header source IP address (IPv4 or IPv6)

              dst_ip Outer header destination IP address (IPv4 or IPv6)

                     Outer header destination UDP port

                     Geneve variable length options.  geneve_opts is
                     specified in the form CLASS:TYPE:DATA, where CLASS is
                     represented as a 16bit hexadecimal value, TYPE as an
                     8bit hexadecimal value and DATA as a variable length
                     hexadecimal value. Additionally multiple options may be
                     listed using a comma delimiter.

                     Vxlan metatdata options.  vxlan_opts is specified in
                     the form GBP, as a 32bit number. Multiple options is
                     not supported.

                     Erspan metatdata options.  erspan_opts is specified in
                     the form VERSION:INDEX:DIR:HWID, where VERSION is
                     represented as a 8bit number, INDEX as an 32bit number,
                     DIR and HWID as a 8bit number.  Multiple options is not
                     supported. Note INDEX is used when VERSION is 1, and
                     DIR and HWID are used when VERSION is 2.

              tos    Outer header TOS

              ttl    Outer header TTL

                     Controls outer UDP checksum. When set to csum (which is
                     default), the outer UDP checksum is calculated and
                     included in the packets. When set to nocsum, outer UDP
                     checksum is zero. Note that when using zero UDP
                     checksums with IPv6, the other tunnel endpoint must be
                     configured to accept such packets.  In Linux, this
                     would be the udp6zerocsumrx option for the VXLAN tunnel

                     If using nocsum with IPv6, be sure you know what you
                     are doing. Zero UDP checksums provide weaker protection
                     against corrupted packets. See RFC6935 for details.

EXAMPLES         top

       The following example encapsulates incoming ICMP packets on eth0 into
       a vxlan tunnel, by setting metadata to VNI 11, source IP
       and destination IP, and by redirecting the packet with the
       metadata to device vxlan0, which will do the actual encapsulation
       using the metadata:

              #tc qdisc add dev eth0 handle ffff: ingress
              #tc filter add dev eth0 protocol ip parent ffff: \
                flower \
                  ip_proto icmp \
                action tunnel_key set \
                  src_ip \
                  dst_ip \
                  id 11 \
                action mirred egress redirect dev vxlan0

       Here is an example of the unset function: Incoming VXLAN traffic with
       outer IP's and VNI 11 is decapsulated by vxlan0 and metadata is unset
       before redirecting to tunl1 device:

              #tc qdisc add dev eth0 handle ffff: ingress
              #tc filter add dev vxlan0 protocol ip parent ffff:   flower \
                     enc_src_ip enc_dst_ip enc_key_id 11   action tunnel_key unset  action mirred egress redirect dev tunl1

SEE ALSO         top


COLOPHON         top

       This page is part of the iproute2 (utilities for controlling TCP/IP
       networking and traffic) project.  Information about the project can
       be found at 
       If you have a bug report for this manual page, send it to,  This page was obtained
       from the project's upstream Git repository
       ⟨⟩ on
       2020-11-01.  (At that time, the date of the most recent commit that
       was found in the repository was 2020-10-28.)  If you discover any
       rendering problems in this HTML version of the page, or you believe
       there is a better or more up-to-date source for the page, or you have
       corrections or improvements to the information in this COLOPHON
       (which is not part of the original manual page), send a mail to

iproute2                        T1u0nnNeolvm2e0t1a6data manipulation action in tc(8)

Pages that refer to this page: actions(8)tc-actions(8)