1 2 IPVLAN Driver HOWTO 3 4Initial Release: 5 Mahesh Bandewar <maheshb AT google.com> 6 71. Introduction: 8 This is conceptually very similar to the macvlan driver with one major 9exception of using L3 for mux-ing /demux-ing among slaves. This property makes 10the master device share the L2 with it's slave devices. I have developed this 11driver in conjunction with network namespaces and not sure if there is use case 12outside of it. 13 14 152. Building and Installation: 16 In order to build the driver, please select the config item CONFIG_IPVLAN. 17The driver can be built into the kernel (CONFIG_IPVLAN=y) or as a module 18(CONFIG_IPVLAN=m). 19 20 213. Configuration: 22 There are no module parameters for this driver and it can be configured 23using IProute2/ip utility. 24 25 ip link add link <master> name <slave> type ipvlan [ mode MODE ] [ FLAGS ] 26 where 27 MODE: l3 (default) | l3s | l2 28 FLAGS: bridge (default) | private | vepa 29 30 e.g. 31 (a) Following will create IPvlan link with eth0 as master in 32 L3 bridge mode 33 bash# ip link add link eth0 name ipvl0 type ipvlan 34 (b) This command will create IPvlan link in L2 bridge mode. 35 bash# ip link add link eth0 name ipvl0 type ipvlan mode l2 bridge 36 (c) This command will create an IPvlan device in L2 private mode. 37 bash# ip link add link eth0 name ipvlan type ipvlan mode l2 private 38 (d) This command will create an IPvlan device in L2 vepa mode. 39 bash# ip link add link eth0 name ipvlan type ipvlan mode l2 vepa 40 41 424. Operating modes: 43 IPvlan has two modes of operation - L2 and L3. For a given master device, 44you can select one of these two modes and all slaves on that master will 45operate in the same (selected) mode. The RX mode is almost identical except 46that in L3 mode the slaves wont receive any multicast / broadcast traffic. 47L3 mode is more restrictive since routing is controlled from the other (mostly) 48default namespace. 49 504.1 L2 mode: 51 In this mode TX processing happens on the stack instance attached to the 52slave device and packets are switched and queued to the master device to send 53out. In this mode the slaves will RX/TX multicast and broadcast (if applicable) 54as well. 55 564.2 L3 mode: 57 In this mode TX processing up to L3 happens on the stack instance attached 58to the slave device and packets are switched to the stack instance of the 59master device for the L2 processing and routing from that instance will be 60used before packets are queued on the outbound device. In this mode the slaves 61will not receive nor can send multicast / broadcast traffic. 62 634.3 L3S mode: 64 This is very similar to the L3 mode except that iptables (conn-tracking) 65works in this mode and hence it is L3-symmetric (L3s). This will have slightly less 66performance but that shouldn't matter since you are choosing this mode over plain-L3 67mode to make conn-tracking work. 68 695. Mode flags: 70 At this time following mode flags are available 71 725.1 bridge: 73 This is the default option. To configure the IPvlan port in this mode, 74user can choose to either add this option on the command-line or don't specify 75anything. This is the traditional mode where slaves can cross-talk among 76themselves apart from talking through the master device. 77 785.2 private: 79 If this option is added to the command-line, the port is set in private 80mode. i.e. port won't allow cross communication between slaves. 81 825.3 vepa: 83 If this is added to the command-line, the port is set in VEPA mode. 84i.e. port will offload switching functionality to the external entity as 85described in 802.1Qbg 86Note: VEPA mode in IPvlan has limitations. IPvlan uses the mac-address of the 87master-device, so the packets which are emitted in this mode for the adjacent 88neighbor will have source and destination mac same. This will make the switch / 89router send the redirect message. 90 916. What to choose (macvlan vs. ipvlan)? 92 These two devices are very similar in many regards and the specific use 93case could very well define which device to choose. if one of the following 94situations defines your use case then you can choose to use ipvlan - 95 (a) The Linux host that is connected to the external switch / router has 96policy configured that allows only one mac per port. 97 (b) No of virtual devices created on a master exceed the mac capacity and 98puts the NIC in promiscuous mode and degraded performance is a concern. 99 (c) If the slave device is to be put into the hostile / untrusted network 100namespace where L2 on the slave could be changed / misused. 101 102 1036. Example configuration: 104 105 +=============================================================+ 106 | Host: host1 | 107 | | 108 | +----------------------+ +----------------------+ | 109 | | NS:ns0 | | NS:ns1 | | 110 | | | | | | 111 | | | | | | 112 | | ipvl0 | | ipvl1 | | 113 | +----------#-----------+ +-----------#----------+ | 114 | # # | 115 | ################################ | 116 | # eth0 | 117 +==============================#==============================+ 118 119 120 (a) Create two network namespaces - ns0, ns1 121 ip netns add ns0 122 ip netns add ns1 123 124 (b) Create two ipvlan slaves on eth0 (master device) 125 ip link add link eth0 ipvl0 type ipvlan mode l2 126 ip link add link eth0 ipvl1 type ipvlan mode l2 127 128 (c) Assign slaves to the respective network namespaces 129 ip link set dev ipvl0 netns ns0 130 ip link set dev ipvl1 netns ns1 131 132 (d) Now switch to the namespace (ns0 or ns1) to configure the slave devices 133 - For ns0 134 (1) ip netns exec ns0 bash 135 (2) ip link set dev ipvl0 up 136 (3) ip link set dev lo up 137 (4) ip -4 addr add 127.0.0.1 dev lo 138 (5) ip -4 addr add $IPADDR dev ipvl0 139 (6) ip -4 route add default via $ROUTER dev ipvl0 140 - For ns1 141 (1) ip netns exec ns1 bash 142 (2) ip link set dev ipvl1 up 143 (3) ip link set dev lo up 144 (4) ip -4 addr add 127.0.0.1 dev lo 145 (5) ip -4 addr add $IPADDR dev ipvl1 146 (6) ip -4 route add default via $ROUTER dev ipvl1 147