Linux网络：Virtual Routing and Forwarding (VRF)

最新推荐文章于 2025-02-10 10:30:19 发布

rtoax

最新推荐文章于 2025-02-10 10:30:19 发布

阅读量1.6k

点赞数

分类专栏：【Linux内核】

原文链接：https://tonydeng.github.io/sdn-handbook/linux/vrf.html

版权

【Linux内核】专栏收录该内容

734 篇文章

订阅专栏

本文详细介绍了Linux内核中的Virtual Routing and Forwarding (VRF)技术，包括VRF的安装步骤、示例配置、如何将网卡绑定到VRF以及进行相关操作如创建、查询VRF等。此外，还讲解了如何将进程绑定到VRF以及启用相关系统设置以实现跨VRF的通信。VRF技术允许在同一主机上创建多个独立的路由域，对于网络隔离和管理具有重要意义。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Virtual Routing and Forwarding (VRF)

Virtual Routing and Forwarding (VRF)

Linux内核的Virtual Routing and Forwarding (VRF) 是由路由表和一组网络设备组成的路由实例。

VRF安装

Ubuntu默认不包括vrf内核模块，需要额外安装:

apt-get install linux-headers-4.10.0-14-generic linux-image-extra-4.10.0-14-generic
reboot
apt-get install linux-image-extra-$(uname -r)
modprobe vrf

VRF示例

# create vrf device
ip link add vrf-blue type vrf table 10
ip link set dev vrf-blue up

# An l3mdev FIB rule directs lookups to the table associated with the device.
# A single l3mdev rule is sufficient for all VRFs.
# Prior to the v4.8 kernel iif and oif rules are needed for each VRF device:
ip ru add oif vrf-blue table 10
ip ru add iif vrf-blue table 10

#Set the default route for the table (and hence default route for the VRF).
ip route add table 10 unreachable default

# Enslave L3 interfaces to a VRF device.
# Local and connected routes for enslaved devices are automatically moved to
# the table associated with VRF device. Any additional routes depending on
# the enslaved device are dropped and will need to be reinserted to the VRF
# FIB table following the enslavement.
ip link set dev eth1 master vrf-blue

# The IPv6 sysctl option keep_addr_on_down can be enabled to keep IPv6 global
# addresses as VRF enslavement changes.
sysctl -w net.ipv6.conf.all.keep_addr_on_down=1

# Additional VRF routes are added to associated table.
ip route add table 10 ...

进程绑定VRF

Linux进程可以通过在VRF设备上监听socket来绑定VRF：

setsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, dev, strlen(dev)+1);

TCP & UDP services running in the default VRF context (ie., not bound to any VRF device) can work across all VRF domains by enabling the tcp_l3mdev_accept and udp_l3mdev_accept sysctl options:

sysctl -w net.ipv4.tcp_l3mdev_accept=1
sysctl -w net.ipv4.udp_l3mdev_accept=1