NAME

       tunnel_key - Tunnel metadata manipulation

SYNOPSIS

       tc ... action tunnel_key { unset | SET }

       SET := set src_ip ADDRESS dst_ip ADDRESS id KEY_ID dst_port UDP_PORT [ csum | nocsum ]

DESCRIPTION

       The tunnel_key action combined with a shared IP tunnel device, allows to perform IP tunnel
       en- or decapsulation on a packet, reflected by the operation modes  UNSET  and  SET.   The
       UNSET  mode is optional - even without using it, the metadata information will be released
       automatically when packet processing will be finished.  UNSET function could  be  used  in
       cases  when  traffic  is  forwarded between two tunnels, where the metadata from the first
       tunnel will be used for encapsulation done by the second tunnel.  SET  mode  requires  the
       source  and  destination ip ADDRESS and the tunnel key id KEY_ID which will be used by the
       ip tunnel shared device to create the tunnel header. The tunnel_key action is useful  only
       in  combination  with a mirred redirect action to a shared IP tunnel device which will use
       the metadata (for SET ) and unset the metadata created by it (for UNSET ).

OPTIONS

       unset  Unset the tunnel metadata created by the IP tunnel device.  This  function  is  not
              mandatory and might be used only in some specific use cases (as explained above).

       set    Set  tunnel  metadata  to be used by the IP tunnel device. Requires id , src_ip and
              dst_ip options.  dst_port is optional.

              id     Tunnel ID (for example VNI in VXLAN tunnel)

              src_ip Outer header source IP address (IPv4 or IPv6)

              dst_ip Outer header destination IP address (IPv4 or IPv6)

              dst_port
                     Outer header destination UDP port

              [no]csum
                     Controlls outer UDP checksum. When set to csum (which is default), the outer
                     UDP  checksum is calculated and included in the packets. When set to nocsum,
                     outer UDP checksum is zero. Note that when using  zero  UDP  checksums  with
                     IPv6,  the  other tunnel endpoint must be configured to accept such packets.
                     In Linux, this would be the  udp6zerocsumrx  option  for  the  VXLAN  tunnel
                     interface.

                     If  using  nocsum  with  IPv6, be sure you know what you are doing. Zero UDP
                     checksums provide weaker protection against corrupted packets.  See  RFC6935
                     for details.

EXAMPLES

       The  following  example encapsulates incoming ICMP packets on eth0 into a vxlan tunnel, by
       setting metadata to VNI 11, source IP 11.11.0.1  and  destination  IP  11.11.0.2,  and  by
       redirecting  the  packet  with  the  metadata  to  device vxlan0, which will do the actual
       encapsulation using the metadata:

              #tc qdisc add dev eth0 handle ffff: ingress
              #tc filter add dev eth0 protocol ip parent ffff: \
                flower \
                  ip_proto icmp \
                action tunnel_key set \
                  src_ip 11.11.0.1 \
                  dst_ip 11.11.0.2 \
                  id 11 \
                action mirred egress redirect dev vxlan0

       Here is an example of the unset function: Incoming VXLAN traffic with outer IP's  and  VNI
       11 is decapsulated by vxlan0 and metadata is unset before redirecting to tunl1 device:

              #tc qdisc add dev eth0 handle ffff: ingress
              #tc filter add dev vxlan0 protocol ip parent ffff:   flower \
                     enc_src_ip 11.11.0.2 enc_dst_ip 11.11.0.1 enc_key_id 11   action tunnel_key unset  action mirred egress redirect dev tunl1

SEE ALSO

       tc(8)

iproute2                                   10 Nov 201Tunnel metadata manipulation action in tc(8)