ETHERIP(4)

💅 ETHERIP(4) 💅

ok so like — this is page ETHERIP(4) from the Kernel Interfaces Manual, and bestie, we're about to get into tunnels. buckle up 🎀

✨ NAME ✨

etherip — the EtherIP tunnel interface. that's her. that's the whole vibe.

🦋 SYNOPSIS 🦋

pseudo-device etherip

🌸 DESCRIPTION 🌸

okay so the etherip driver is literally the main character of point-to-point tunnel interfaces — it carries Ethernet frames across IPv4 and IPv6 networks using RFC 3378 EtherIP encapsulation. no cap, that's the whole job. 💖

you can create an etherip interface with the ifconfig etheripN create command, or by setting up a hostname.if(5) configuration file for netstart(8). it has to be configured with the addresses used for the outer header — you can do that with ifconfig(8)'s tunnel command (which is secretly using the SIOCSLIFPHYADDR ioctl, iykyk). also the sysctl(2) variable net.inet.etherip.allow must be set to 1, unless ipsec(4) is being used to protect the traffic. periodt.

etherip interfaces can be configured as part of an Ethernet bridge — think veb(4), tpmr(4), and bridge(4) — to extend the connectivity of Ethernet networks across IP networks, possibly across the Internet. it's giving "same LAN but make it long distance" 🌈

⚠️ okay this part is important, don't skip it: the EtherIP protocol does not provide any integrated security features. like, none. zero. EtherIP should only be deployed on trusted private networks, or protected with IPsec to add authentication and encryption for confidentiality. IPsec is especially recommended when transporting EtherIP over the public Internet. 🫶

EtherIP encapsulated packets may be protected with IPsec by specifying the appropriate IPsec flows between the two endpoints. and to only protect the encapsulated EtherIP traffic between the tunnel endpoints, the IP transport protocol 97 (etherip) selector may be used in ipsec.conf(5) or iked.conf(5). slay.

---

🔥 EXAMPLES 🔥

given two physically separate Ethernet networks, etherip can be used as follows to make them appear as the same local area network. so like — if host gw1 has the external IP address 192.0.2.10 and is connected to network1 on em1, and host gw2 has the external IP address 198.51.100.14 and is connected to network2 on ix1, the following configuration can be used to bridge network1 and network2. 💜

first, create a bridge using a veb(4) interface, adding the etherip interface and internal Ethernet interface to the bridge.

on gw1:

gw1# ifconfig etherip0 create tunnel 192.0.2.10 198.51.100.14
gw1# ifconfig veb0 create add etherip0 add em1

on gw2:

gw2# ifconfig etherip0 create tunnel 198.51.100.14 192.0.2.10
gw2# ifconfig veb0 create add etherip0 add ix1

🎀 setting up the SAs 🎀

create Security Associations (SAs) between the external IP address of each bridge and matching ingress flows by using the following ipsec.conf(5) file on gw1:

esp from 198.51.100.14 to 192.0.2.10 spi 0x4242:0x4243 \
        authkey file "auth1:auth2" enckey file "enc1:enc2"
flow esp proto etherip from 198.51.100.14 to 192.0.2.10

now load these rules into the kernel by issuing the ipsecctl(8) command:

gw1# ipsecctl -f ipsec.conf

appropriate ipsec.conf(5) for gw2:

esp from 198.51.100.14 to 192.0.2.10 spi 0x4243:0x4242 \
        authkey file "auth2:auth1" enckey file "enc2:enc1"
flow esp proto etherip from 198.51.100.14 to 192.0.2.10

and load them:

gw2# ipsecctl -f ipsec.conf

🧚 finally, bring everything up 🧚

finally, bring all the interfaces up (if not already up). yes, all of them. 👑

on gw1:

gw1# ifconfig em1 up
gw1# ifconfig etherip0 up
gw1# ifconfig veb0 up

on gw2:

gw1# ifconfig ix1 up
gw1# ifconfig etherip0 up
gw1# ifconfig veb0 up

🙈 and yeah — that last block literally says gw1# on gw2, we're keeping it exactly as written, don't come for me, it's what the page says bestie 😭

---

💀 SEE ALSO 💀

sysctl(2), bridge(4), inet(4), inet6(4), ipsec(4), tpmr(4), veb(4), hostname.if(5), iked.conf(5), ipsec.conf(5), ifconfig(8), netstart(8)

⭐ STANDARDS ⭐

R. Housley and S. Hollenbeck, EtherIP: Tunneling Ethernet Frames in IP Datagrams, RFC 3378, September 2002. iconic citation honestly 📚

🌺 HISTORY 🌺

the etherip device first appeared in OpenBSD 5.9. a legend was born ✨

👑 AUTHORS 👑

the etherip driver was written by Kazuya Goda <goda@openbsd.org>. thank you for your service 🫡💖

---

and that's the page!! this Debian build is dated August 30, 2024, and it's filed under ETHERIP(4) — mwah, go set up your tunnels responsibly, ily 🎀💅