tunnel_key - Tunnel metadata manipulation tc " ... " "action tunnel_key" " { " unset " | " SET " }" SET " := " set " " src_ip ADDRESS dst_ip ADDRESS id " KEY_ID" dst_port " UDP_PORT" "[ " csum " | " nocsum " ]" The tunnel_key action combined with a shared IP tunnel device, allows to perform IP tunnel en- or decapsulation on a packet, reflected by the operation modes UNSET " and " SET . The UNSET mode is optional - even without using it, the metadata information will be released automatically when packet processing will be finished. UNSET function could be used in cases when traffic is forwarded between two tunnels, where the metadata from the first tunnel will be used for encapsulation done by the second tunnel. SET mode requires the source and destination ip ADDRESS and the tunnel key id KEY_ID which will be used by the ip tunnel shared device to create the tunnel header. The tunnel_key action is useful only in combination with a mirred redirect action to a shared IP tunnel device which will use the metadata (for SET ) and unset the metadata created by it (for UNSET ).

unset Unset the tunnel metadata created by the IP tunnel device. This function is not mandatory and might be used only in some specific use cases (as explained above).

set Set tunnel metadata to be used by the IP tunnel device. Requires id , src_ip and dst_ip options. dst_port is optional.

The following example encapsulates incoming ICMP packets on eth0 into a vxlan tunnel, by setting metadata to VNI 11, source IP 11.11.0.1 and destination IP 11.11.0.2, and by redirecting the packet with the metadata to device vxlan0, which will do the actual encapsulation using the metadata: Here is an example of the unset function: Incoming VXLAN traffic with outer IP's and VNI 11 is decapsulated by vxlan0 and metadata is unset before redirecting to tunl1 device: tc (8)