IP-TUNNEL(8)

🎀 NAME 🎀

okay bestie, let's talk about ip-tunnel 🧚 it's the manual page for ip-tunnel, and the whole thing is about tunnel configuration ✨

💅 SYNOPSIS 💅

ip tunnel help

ip [ OPTIONS ] tunnel { add | change | del | show | prl | 6rd } [ NAME ]
        [ mode MODE ] [ remote ADDR ] [ local ADDR ]
        [ [i|o]seq ] [ [i|o]key KEY ] [ [i|o]csum ] ]
        [ encaplimit ELIM ] [ ttl|hoplimit TTL ]
        [ tos TOS ] [ flowlabel FLOWLABEL ]
        [ prl-default ADDR ] [ prl-nodefault ADDR ] [ prl-delete ADDR ]
        [ 6rd-prefix ADDR ] [ 6rd-relay_prefix ADDR ] [ 6rd-reset ]
        [ [no]pmtudisc ] [ [no]ignore-df ] [ [no]allow-localremote ]
        [ dev PHYS_DEV ]

MODE :=  { ipip | gre | sit | isatap | vti | ip6ip6 | ipip6 | ip6gre |
        vti6 | any }

ADDR := { IP_ADDRESS | any }

TOS := { STRING | 00..ff | inherit | inherit/STRING | inherit/00..ff }

ELIM := { none | 0..255 }

TTL := { 1..255 | inherit }

KEY := { DOTTED_QUAD | NUMBER }

🦋 DESCRIPTION 🦋

okay so tunnel objects are tunnels 🌈 they wrap up your packets inside other IP packets and then ship them off over the IP infrastructure. the encapsulating (aka outer) address family is picked with the -f option, and it's IPv4 by default, so you don't have to do anything if you're happy with that 💖

🌸 Commands 🌸

• ip tunnel add — add a new tunnel ✨
• ip tunnel change — change an existing tunnel 🔥
• ip tunnel delete — destroy a tunnel 💀

🎀 Attributes 🎀

these are the bits you can set on a tunnel. they're all part of the add, change, and delete flow 🫶

• name NAME (default) — pick the tunnel device name, so your tunnel gets a cute little identity 🧚
• mode MODE — sets the tunnel mode 💜 which modes you can use depends on the encapsulating address family:
  • IPv4 encapsulation supports ipip, sit, isatap, vti, and gre
  • IPv6 encapsulation supports ip6ip6, ipip6, ip6gre, vti6, and any
• remote ADDRESS — sets the remote endpoint of the tunnel 🦋
• local ADDRESS — sets a fixed local address for tunneled packets. it has to be an address that lives on another interface of this host, so no sneaking in a random one 🙈
• ttl N / hoplimit N — sets a fixed TTL (IPv4) or hoplimit (IPv6) on your tunneled packets. N is a number from 1 to 255. 0 is a special value that means the packets just inherit the TTL from the original. the default is inherit for IPv4 tunnels and 64 for IPv6 tunnels 🌸
• tos T / dsfield T / tclass T — sets the type of service (IPv4) or traffic class (IPv6) field on your tunneled packets 💅 you can give it as a two-digit hex value (like c0) or a predefined string (like internet). the value inherit copies the field from the original IP header. inherit/STRING or inherit/00..ff set the field to STRING or 00..ff when you're tunneling non-IP packets. the default is 00 ✨
• dev NAME — binds the tunnel to the device NAME. this keeps your tunneled packets routed only through that device, so they can't escape to another one when the route to the endpoint changes 🔒
• nopmtudisc — disables Path MTU Discovery on this tunnel. it's enabled by default. heads up, a fixed ttl doesn't play nicely with this option: tunneling with a fixed ttl always does pmtu discovery anyway 🙃
• ignore-df — enables IPv4 DF suppression on this tunnel. normally, datagrams that are bigger than the MTU get fragmented. the DF flag stops that, and instead you get an ICMP Unreachable (Fragmentation Required) message back. turning this on makes the DF flag get ignored 🌈
• key K / ikey K / okey K (only GRE tunnels) — uses keyed GRE with key K 🔑 K is either a number or a dotted quad that looks like an IP address. key sets the key for both directions, while ikey and okey let you set different keys for input and output 🫧
• csum, icsum, ocsum (only GRE tunnels) — generates and/or requires checksums for tunneled packets ✅ ocsum calculates checksums for outgoing packets. icsum requires every input packet to have the correct checksum. csum is the same as using icsum ocsum together 💖
• seq, iseq, oseq (only GRE tunnels) — serializes packets 📦 oseq turns on sequencing for outgoing packets. iseq requires all input packets to be serialized. seq is the same as iseq oseq together.

💀 bestie, seq doesn't work. please don't use it.

• encaplimit ELIM (only IPv6 tunnels) — sets a fixed encapsulation limit. the default is 4 🍓
• flowlabel FLOWLABEL (only IPv6 tunnels) — sets a fixed flowlabel 🧚
• allow-localremote (only IPv6 tunnels) — lets the remote endpoint be on the local host too 🙈

🌈 prl 🌈

ip tunnel prl is the potential router list. it's for ISATAP only 🫶

• dev NAME — the device name. this one is mandatory, no skipping it 💅
• prl-default ADDR, prl-nodefault ADDR, prl-delete ADDR — add or delete ADDR as a potential router or default router 👑

🔥 show 🔥

• ip tunnel show — lists tunnels. this command has no arguments, so just type it and go ✨

🌷 SEE ALSO 🌷

ip(8) is where you'll want to look next 🧚

🫶 AUTHOR 🫶

Original Manpage by Michail Litvak <mci@owl.openwall.com> 💜

bestie, you're all caught up now 🎀 this page is from iproute2, last touched 20 Dec 2011, and it's IP-TUNNEL(8) all the way 💖✨