VRF or Virtual Routing and Forwarding (or perhaps Virtual Routing Functions) provide virtualization of the routing table. They are useful for isolating services and entire networks from each other while avoiding the complexity of network namespaces.
To make use of VRFs, you will need `iproute2` and a kernel that is capable of using eBPF installed. Kernel 5.4.19-r1 and later are capable of using eBPF.
The easiest way to define VRFs is to add them to /etc/network/interfaces:
auto vrf-mgmt iface vrf-mgmt inet manual pre-up ip link add $IFACE type vrf table 42 up ip link set dev $IFACE up
You can then associate specific interfaces with VRFs using pre-up commands:
auto eth0 iface eth0 inet static address 188.8.131.52 netmask 255.255.255.0 pre-up ip link set $IFACE master vrf-mgmt up ip route add default table 42 via 184.108.40.206
VRF-based Service Isolation
Services can be isolated to specific VRFs when running OpenRC 0.42.1-r4 or newer. You can set the
$vrf variable in an
/etc/conf.d file for a service to isolate it in most cases.
For example, with sshd:
# echo 'vrf="vrf-mgmt"' >> /etc/conf.d/sshd # rc-service sshd restart
Name route tables
Routing tables can be named i.e. 42 can be named mgmt be editing /etc/iproute2/rt_tables or creating and separate config (e.g. /etc/iproute2/rt_tables.d/vrf.conf)
42 mgmt 43 int 44 ext
Then instead of having to remember that 42 is is used for mgmt it can be used directly with ip route, example ```
- ip route add default table mgmt via 220.127.116.11