IP-VRF(8)

✨ IP-VRF(8) — ip-vrf 💖

Okay bestie, this is the manual page for ip-vrf, the little helper that runs a command against a specific VRF 🦋 Let's get into it.

🎀 NAME

ip-vrf - run a command against a vrf 💅

🌸 SYNOPSIS

ip vrf  { COMMAND | help }
ip vrf show [ NAME ]
ip vrf identify [ PID ]
ip vrf pids NAME
ip vrf exec [ NAME ] command...

🧚 DESCRIPTION

okay so a VRF gives you traffic isolation at layer 3 for routing, kind of like how a VLAN isolates traffic at layer 2 🫶 Fundamentally? A VRF is just a separate routing table. You associate a network device with a VRF by enslaving the device to it. From that point on, the addresses on that device are local to the VRF, and the host and connected routes get moved into the table tied to the VRF ✨

A process can pick its VRF in a few ways: binding the socket to the VRF device with SO_BINDTODEVICE, setting the association with IP_UNICAST_IF or IPV6_UNICAST_IF, or specifying the VRF for one specific message using IP_PKTINFO or IPV6_PKTINFO 💜

By default a process is not bound to any VRF 🙈 It can get an association explicitly (the program uses one of those APIs) or implicitly, through a helper that sets SO_BINDTODEVICE on every IPv4 and IPv6 socket (AF_INET and AF_INET6) when it gets created. This ip-vrf command is that helper: it runs a command against a specific VRF, and the VRF association gets inherited from parent to child 👑

✨ ip vrf show [ NAME ] - Show all configured VRF

This command lists every VRF along with its corresponding table ids 💅 If you give it a NAME, only that VRF and its table id show up. This one is super useful for scripting, when you need the table id for a VRF 🍓

🦋 ip vrf exec [ NAME ] cmd ... - Run cmd against the named VRF

This command lets apps that are VRF unaware run against a VRF other than the default one (main table) 🌈 You can run a command against the default VRF by passing "default" as the VRF name. This is handy if your current shell is already tied to another VRF (e.g, Management VRF) 🫶

⚠️ This command requires the system to be booted with cgroup v2 (e.g. with systemd, add systemd.unified_cgroup_hierarchy=1 to the kernel command line).

⚠️ This command also has to be run as root. Alternatively, an unprivileged user can run it if the following capabilities(7) are given 🔥

• CAP_BPF — to load the BPF program.
• CAP_NET_ADMIN — to set the socket into the cgroup.
• CAP_DAC_OVERRIDE — to create the cgroup subdir in /sys.

If you have these capabilities and ip(8) is built with libcap(3), they get dropped before cmd runs under ip vrf exec. For every other unprivileged invocation of ip(8), all capabilities are dropped 💀

NOTE: capabilities will NOT be dropped if CAP_NET_ADMIN is set to INHERITABLE. This avoids breaking programs with ambient capabilities that call ip 🙈

🌷 ip vrf identify [PID] - Report VRF association for process

This command shows the VRF association of the process you specify 🧚 If you don't give a PID, the id of the current process is used ✨

💜 ip vrf pids NAME - Report processes associated with the named VRF

This command shows every process id associated with the VRF you name 🦋

🌈 CAVEATS

This command needs a kernel compiled with CGROUPS and CGROUP_BPF enabled 💀

⚠️ The VRF helper only affects network layer sockets. Not everything, bestie 😭

🍓 EXAMPLES

ip vrf exec red ssh 10.100.1.254

This runs ssh to 10.100.1.254 against the VRF red table 💖

👑 SEE ALSO

ip(8), ip-link(8), ip-address(8), ip-route(8), ip-neighbor(8) 🫶

🎀 AUTHOR

Original Manpage by David Ahern 💅

---

Bye bestie, go slay the routing tables 🦋💅✨ (iproute2, 7 Dec 2016 🌸)