]> git.ipfire.org Git - thirdparty/systemd.git/blame - man/systemd.network.xml
license: LGPL-2.1+ -> LGPL-2.1-or-later
[thirdparty/systemd.git] / man / systemd.network.xml
CommitLineData
514094f9 1<?xml version='1.0'?>
3a54a157 2<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
12b42c76 3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
db9ecf05 4<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
eac684ef 5
d9b20454
ZJS
6<refentry id="systemd.network" conditional='ENABLE_NETWORKD'
7 xmlns:xi="http://www.w3.org/2001/XInclude">
eac684ef 8
798d3a52
ZJS
9 <refentryinfo>
10 <title>systemd.network</title>
11 <productname>systemd</productname>
798d3a52
ZJS
12 </refentryinfo>
13
14 <refmeta>
15 <refentrytitle>systemd.network</refentrytitle>
16 <manvolnum>5</manvolnum>
17 </refmeta>
18
19 <refnamediv>
20 <refname>systemd.network</refname>
21 <refpurpose>Network configuration</refpurpose>
22 </refnamediv>
23
24 <refsynopsisdiv>
25 <para><filename><replaceable>network</replaceable>.network</filename></para>
26 </refsynopsisdiv>
27
28 <refsect1>
29 <title>Description</title>
30
d4de2b2a
ZJS
31 <para>A plain ini-style text file that encodes network configuration for matching network interfaces,
32 used by
798d3a52 33 <citerefentry><refentrytitle>systemd-networkd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
675fa6ea 34 See <citerefentry><refentrytitle>systemd.syntax</refentrytitle><manvolnum>7</manvolnum></citerefentry>
d4de2b2a 35 for a general description of the syntax.</para>
798d3a52 36
bac150e9
ZJS
37 <para>The main network file must have the extension <filename>.network</filename>; other
38 extensions are ignored. Networks are applied to links whenever the links appear.</para>
39
dc0d4078
ZJS
40 <para>The <filename>.network</filename> files are read from the files located in the system network
41 directories <filename>/usr/lib/systemd/network</filename> and
42 <filename>/usr/local/lib/systemd/network</filename>, the volatile runtime network directory
43 <filename>/run/systemd/network</filename> and the local administration network directory
44 <filename>/etc/systemd/network</filename>. All configuration files are collectively sorted and processed
45 in lexical order, regardless of the directories in which they live. However, files with identical
3b121157
ZJS
46 filenames replace each other. Files in <filename>/etc/</filename> have the highest priority, files in
47 <filename>/run/</filename> take precedence over files with the same name under
48 <filename>/usr/</filename>. This can be used to override a system-supplied configuration file with a local
dc0d4078
ZJS
49 file if needed. As a special case, an empty file (file size 0) or symlink with the same name pointing to
50 <filename>/dev/null</filename> disables the configuration file entirely (it is "masked").</para>
bac150e9
ZJS
51
52 <para>Along with the network file <filename>foo.network</filename>, a "drop-in" directory
53 <filename>foo.network.d/</filename> may exist. All files with the suffix
54 <literal>.conf</literal> from this directory will be parsed after the file itself is
55 parsed. This is useful to alter or add configuration settings, without having to modify the main
56 configuration file. Each drop-in file must have appropriate section headers.</para>
57
58 <para>In addition to <filename>/etc/systemd/network</filename>, drop-in <literal>.d</literal>
59 directories can be placed in <filename>/usr/lib/systemd/network</filename> or
60 <filename>/run/systemd/network</filename> directories. Drop-in files in
3b121157
ZJS
61 <filename>/etc/</filename> take precedence over those in <filename>/run/</filename> which in turn
62 take precedence over those in <filename>/usr/lib/</filename>. Drop-in files under any of these
b1e91af8 63 directories take precedence over the main network file wherever located.</para>
bac150e9
ZJS
64
65 <para>Note that an interface without any static IPv6 addresses configured, and neither DHCPv6
66 nor IPv6LL enabled, shall be considered to have no IPv6 support. IPv6 will be automatically
67 disabled for that interface by writing "1" to
68 <filename>/proc/sys/net/ipv6/conf/<replaceable>ifname</replaceable>/disable_ipv6</filename>.
82ecb4c3 69 </para>
798d3a52
ZJS
70 </refsect1>
71
72 <refsect1>
73 <title>[Match] Section Options</title>
74
bdac5608
ZJS
75 <para>The network file contains a [Match] section, which determines if a given network file may be
76 applied to a given device; and a [Network] section specifying how the device should be configured. The
77 first (in lexical order) of the network files that matches a given device is applied, all later files
78 are ignored, even if they match as well.</para>
79
80 <para>A network file is said to match a network interface if all matches specified by the [Match]
81 section are satisfied. When a network file does not contain valid settings in [Match] section, then the
82 file will match all interfaces and <command>systemd-networkd</command> warns about that. Hint: to avoid
83 the warning and to make it clear that all interfaces shall be matched, add the following:
84 <programlisting>Name=*</programlisting> The following keys are accepted:</para>
798d3a52
ZJS
85
86 <variablelist class='network-directives'>
d9b20454
ZJS
87 <xi:include href="systemd.link.xml" xpointer="mac-address" />
88 <xi:include href="systemd.link.xml" xpointer="permanent-mac-address" />
89 <xi:include href="systemd.link.xml" xpointer="path" />
90 <xi:include href="systemd.link.xml" xpointer="driver" />
91 <xi:include href="systemd.link.xml" xpointer="type" />
92 <xi:include href="systemd.link.xml" xpointer="property" />
9310bf4b 93
798d3a52
ZJS
94 <varlistentry>
95 <term><varname>Name=</varname></term>
96 <listitem>
572b21d9
YW
97 <para>A whitespace-separated list of shell-style globs matching the device name, as exposed
98 by the udev property <literal>INTERFACE</literal>, or device's alternative names. If the
99 list is prefixed with a "!", the test is inverted.</para>
798d3a52
ZJS
100 </listitem>
101 </varlistentry>
44005bfb 102
78404d22 103 <varlistentry>
1bcefad9 104 <term><varname>WLANInterfaceType=</varname></term>
78404d22
YW
105 <listitem>
106 <para>A whitespace-separated list of wireless network type. Supported values are
107 <literal>ad-hoc</literal>, <literal>station</literal>, <literal>ap</literal>,
108 <literal>ap-vlan</literal>, <literal>wds</literal>, <literal>monitor</literal>,
109 <literal>mesh-point</literal>, <literal>p2p-client</literal>, <literal>p2p-go</literal>,
110 <literal>p2p-device</literal>, <literal>ocb</literal>, and <literal>nan</literal>. If the
111 list is prefixed with a "!", the test is inverted.
112 </para>
113 </listitem>
114 </varlistentry>
d9b20454 115
8d968fdd
YW
116 <varlistentry>
117 <term><varname>SSID=</varname></term>
118 <listitem>
119 <para>A whitespace-separated list of shell-style globs matching the SSID of the currently
120 connected wireless LAN. If the list is prefixed with a "!", the test is inverted.
121 </para>
122 </listitem>
123 </varlistentry>
d9b20454 124
277ba8d1
YW
125 <varlistentry>
126 <term><varname>BSSID=</varname></term>
127 <listitem>
128 <para>A whitespace-separated list of hardware address of the currently connected wireless
129 LAN. Use full colon-, hyphen- or dot-delimited hexadecimal. See the example in
e9dd6984
ZJS
130 <varname>MACAddress=</varname>. This option may appear more than once, in which case the
131 lists are merged. If the empty string is assigned to this option, the list is reset.</para>
277ba8d1
YW
132 </listitem>
133 </varlistentry>
d9b20454
ZJS
134
135 <xi:include href="systemd.link.xml" xpointer="host" />
136 <xi:include href="systemd.link.xml" xpointer="virtualization" />
137 <xi:include href="systemd.link.xml" xpointer="kernel-command-line" />
138 <xi:include href="systemd.link.xml" xpointer="kernel-version" />
139 <xi:include href="systemd.link.xml" xpointer="architecture" />
798d3a52
ZJS
140 </variablelist>
141
142 </refsect1>
143
144 <refsect1>
145 <title>[Link] Section Options</title>
146
bdac5608 147 <para> The [Link] section accepts the following keys:</para>
798d3a52
ZJS
148
149 <variablelist class='network-directives'>
150 <varlistentry>
151 <term><varname>MACAddress=</varname></term>
152 <listitem>
de25aae1 153 <para>The hardware address to set for the device.</para>
798d3a52
ZJS
154 </listitem>
155 </varlistentry>
156 <varlistentry>
157 <term><varname>MTUBytes=</varname></term>
158 <listitem>
159 <para>The maximum transmission unit in bytes to set for the
160 device. The usual suffixes K, M, G, are supported and are
161 understood to the base of 1024.</para>
439689c6
SS
162 <para>Note that if IPv6 is enabled on the interface, and the MTU is chosen
163 below 1280 (the minimum MTU for IPv6) it will automatically be increased to this value.</para>
798d3a52
ZJS
164 </listitem>
165 </varlistentry>
99d2baa2
SS
166 <varlistentry>
167 <term><varname>ARP=</varname></term>
168 <listitem>
9b6ffef3
YW
169 <para>Takes a boolean. If set to true, the ARP (low-level Address Resolution Protocol)
170 for this interface is enabled. When unset, the kernel's default will be used.</para>
99d2baa2
SS
171 <para> For example, disabling ARP is useful when creating multiple MACVLAN or VLAN virtual
172 interfaces atop a single lower-level physical interface, which will then only serve as a
173 link/"bridge" device aggregating traffic to the same physical link and not participate in
174 the network otherwise.</para>
175 </listitem>
176 </varlistentry>
e6ebebbe
SS
177 <varlistentry>
178 <term><varname>Multicast=</varname></term>
179 <listitem>
9b6ffef3 180 <para>Takes a boolean. If set to true, the multicast flag on the device is enabled.</para>
866e6b7a
SS
181 </listitem>
182 </varlistentry>
183 <varlistentry>
184 <term><varname>AllMulticast=</varname></term>
185 <listitem>
9b6ffef3 186 <para>Takes a boolean. If set to true, the driver retrieves all multicast packets from the network.
866e6b7a 187 This happens when multicast routing is enabled.</para>
e6ebebbe
SS
188 </listitem>
189 </varlistentry>
a09dc546
DM
190 <varlistentry>
191 <term><varname>Unmanaged=</varname></term>
192 <listitem>
9b6ffef3 193 <para>Takes a boolean. When <literal>yes</literal>, no attempts are
a09dc546
DM
194 made to bring up or configure matching links, equivalent to
195 when there are no matching network files. Defaults to
196 <literal>no</literal>.</para>
197 <para>This is useful for preventing later matching network
198 files from interfering with certain interfaces that are fully
199 controlled by other applications.</para>
200 </listitem>
201 </varlistentry>
89fe6535
SS
202 <varlistentry>
203 <term><varname>Group=</varname></term>
204 <listitem>
205 <para>Link groups are similar to port ranges found in managed switches.
206 When network interfaces are added to a numbered group, operations on
207 all the interfaces from that group can be performed at once. An unsigned
e9dd6984 208 integer in the range 0—4294967294. Defaults to unset.</para>
89fe6535
SS
209 </listitem>
210 </varlistentry>
c1a38904
MTL
211 <varlistentry>
212 <term><varname>RequiredForOnline=</varname></term>
213 <listitem>
75cd4a5d
DDM
214 <para>Takes a boolean or a minimum operational state and an optional maximum operational state.
215 Please see <citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
8d6082e4
YW
216 for possible operational states. When <literal>yes</literal>, the network is deemed required when
217 determining whether the system is online when running
218 <command>systemd-networkd-wait-online</command>. When <literal>no</literal>, the network is ignored
75cd4a5d
DDM
219 when checking for online state. When a minimum operational state and an optional maximum operational
220 state are set, <literal>yes</literal> is implied, and this controls the minimum and maximum
221 operational state required for the network interface to be considered online.
8d6082e4
YW
222 Defaults to <literal>yes</literal>.</para>
223
c1a38904
MTL
224 <para>The network will be brought up normally in all cases, but in
225 the event that there is no address being assigned by DHCP or the
226 cable is not plugged in, the link will simply remain offline and be
8d6082e4 227 skipped automatically by <command>systemd-networkd-wait-online</command>
ca92fe36 228 if <literal>RequiredForOnline=no</literal>.</para>
c1a38904
MTL
229 </listitem>
230 </varlistentry>
798d3a52
ZJS
231 </variablelist>
232 </refsect1>
233
518cd6b5
SS
234 <refsect1>
235 <title>[SR-IOV] Section Options</title>
bdac5608
ZJS
236 <para>The [SR-IOV] section accepts the following keys. Specify several [SR-IOV] sections to configure
237 several SR-IOVs. SR-IOV provides the ability to partition a single physical PCI resource into virtual
238 PCI functions which can then be injected into a VM. In the case of network VFs, SR-IOV improves
239 north-south network performance (that is, traffic with endpoints outside the host machine) by allowing
240 traffic to bypass the host machine’s network stack.</para>
518cd6b5
SS
241
242 <variablelist class='network-directives'>
243 <varlistentry>
244 <term><varname>VirtualFunction=</varname></term>
245 <listitem>
246 <para>Specifies a Virtual Function (VF), lightweight PCIe function designed solely to move data
247 in and out. Takes an unsigned integer in the range 0..2147483646. This option is compulsory.</para>
248 </listitem>
249 </varlistentry>
250
251 <varlistentry>
252 <term><varname>VLANId=</varname></term>
253 <listitem>
254 <para>Specifies VLAN ID of the virtual function. Takes an unsigned integer in the range 1..4095.</para>
255 </listitem>
256 </varlistentry>
257
258 <varlistentry>
259 <term><varname>QualityOfService=</varname></term>
260 <listitem>
261 <para>Specifies quality of service of the virtual function. Takes an unsigned integer in the range 1..4294967294.</para>
262 </listitem>
e64b31c8
YW
263 </varlistentry>
264
265 <varlistentry>
266 <term><varname>VLANProtocol=</varname></term>
267 <listitem>
268 <para>Specifies VLAN protocol of the virtual function. Takes <literal>802.1Q</literal> or
269 <literal>802.1ad</literal>.</para>
270 </listitem>
518cd6b5
SS
271 </varlistentry>
272
273 <varlistentry>
274 <term><varname>MACSpoofCheck=</varname></term>
275 <listitem>
276 <para>Takes a boolean. Controls the MAC spoof checking. When unset, the kernel's default will be used.</para>
277 </listitem>
278 </varlistentry>
279
280 <varlistentry>
281 <term><varname>QueryReceiveSideScaling=</varname></term>
282 <listitem>
283 <para>Takes a boolean. Toggle the ability of querying the receive side scaling (RSS)
284 configuration of the virtual function (VF). The VF RSS information like RSS hash key may be
285 considered sensitive on some devices where this information is shared between VF and the
286 physical function (PF). When unset, the kernel's default will be used.</para>
287 </listitem>
288 </varlistentry>
289
290 <varlistentry>
291 <term><varname>Trust=</varname></term>
292 <listitem>
293 <para>Takes a boolean. Allows to set trust mode of the virtual function (VF). When set, VF
294 users can set a specific feature which may impact security and/or performance. When unset,
295 the kernel's default will be used.</para>
296 </listitem>
297 </varlistentry>
298
299 <varlistentry>
300 <term><varname>LinkState=</varname></term>
301 <listitem>
302 <para>Allows to set the link state of the virtual function (VF). Takes a boolean or a
303 special value <literal>auto</literal>. Setting to <literal>auto</literal> means a
304 reflection of the physical function (PF) link state, <literal>yes</literal> lets the VF to
305 communicate with other VFs on this host even if the PF link state is down,
306 <literal>no</literal> causes the hardware to drop any packets sent by the VF. When unset,
307 the kernel's default will be used.</para>
308 </listitem>
309 </varlistentry>
310
c3a5025d
YW
311 <varlistentry>
312 <term><varname>MACAddress=</varname></term>
313 <listitem>
314 <para>Specifies the MAC address for the virtual function.</para>
315 </listitem>
316 </varlistentry>
518cd6b5
SS
317 </variablelist>
318 </refsect1>
319
798d3a52
ZJS
320 <refsect1>
321 <title>[Network] Section Options</title>
322
bdac5608 323 <para>The [Network] section accepts the following keys:</para>
798d3a52
ZJS
324
325 <variablelist class='network-directives'>
326 <varlistentry>
327 <term><varname>Description=</varname></term>
328 <listitem>
329 <para>A description of the device. This is only used for
330 presentation purposes.</para>
331 </listitem>
332 </varlistentry>
333 <varlistentry>
334 <term><varname>DHCP=</varname></term>
335 <listitem>
ad943783 336 <para>Enables DHCPv4 and/or DHCPv6 client support. Accepts
798d3a52 337 <literal>yes</literal>, <literal>no</literal>,
c702bd3b
LY
338 <literal>ipv4</literal>, or <literal>ipv6</literal>. Defaults
339 to <literal>no</literal>.</para>
e88d8021 340
f5a8c43f 341 <para>Note that DHCPv6 will by default be triggered by Router
7f3fdb7f 342 Advertisement, if that is enabled, regardless of this parameter.
f5a8c43f
TG
343 By enabling DHCPv6 support explicitly, the DHCPv6 client will
344 be started regardless of the presence of routers on the link,
345 or what flags the routers pass. See
f921f573 346 <literal>IPv6AcceptRA=</literal>.</para>
f5a8c43f
TG
347
348 <para>Furthermore, note that by default the domain name
e88d8021
ZJS
349 specified through DHCP is not used for name resolution.
350 See option <option>UseDomains=</option> below.</para>
2ef322fc 351
bdac5608
ZJS
352 <para>See the [DHCPv4] or [DHCPv6] sections below for further configuration options for the DHCP
353 client support.</para>
798d3a52
ZJS
354 </listitem>
355 </varlistentry>
356 <varlistentry>
357 <term><varname>DHCPServer=</varname></term>
358 <listitem>
68b7f7ac 359 <para>Takes a boolean. If set to <literal>yes</literal>, DHCPv4 server will be started. Defaults
bdac5608 360 to <literal>no</literal>. Further settings for the DHCP server may be set in the [DHCPServer]
ad943783 361 section described below.</para>
798d3a52
ZJS
362 </listitem>
363 </varlistentry>
364 <varlistentry>
56fd6bf7 365 <term><varname>LinkLocalAddressing=</varname></term>
798d3a52 366 <listitem>
85fc09c9 367 <para>Enables link-local address autoconfiguration. Accepts <literal>yes</literal>,
8bc17bb3
SS
368 <literal>no</literal>, <literal>ipv4</literal>, <literal>ipv6</literal>,
369 <literal>fallback</literal>, or <literal>ipv4-fallback</literal>. If
370 <literal>fallback</literal> or <literal>ipv4-fallback</literal> is specified, then an IPv4
371 link-local address is configured only when DHCPv4 fails. If <literal>fallback</literal>,
372 an IPv6 link-local address is always configured, and if <literal>ipv4-fallback</literal>,
373 the address is not configured. Note that, the fallback mechanism works only when DHCPv4
374 client is enabled, that is, it requires <literal>DHCP=yes</literal> or
375 <literal>DHCP=ipv4</literal>. If <varname>Bridge=</varname> is set, defaults to
376 <literal>no</literal>, and if not, defaults to <literal>ipv6</literal>.
377 </para>
798d3a52
ZJS
378 </listitem>
379 </varlistentry>
6f6296b9
YW
380 <varlistentry>
381 <term><varname>IPv6LinkLocalAddressGenerationMode=</varname></term>
382 <listitem>
383 <para>Specifies how IPv6 link local address is generated. Takes one of <literal>eui64</literal>,
384 <literal>none</literal>, <literal>stable-privacy</literal> and <literal>random</literal>.
385 When unset, the kernel's default will be used. Note that if <varname>LinkLocalAdressing=</varname>
386 not configured as <literal>ipv6</literal> then <varname>IPv6LinkLocalAddressGenerationMode=</varname>
387 is ignored.</para>
388 </listitem>
389 </varlistentry>
798d3a52
ZJS
390 <varlistentry>
391 <term><varname>IPv4LLRoute=</varname></term>
392 <listitem>
9b6ffef3 393 <para>Takes a boolean. If set to true, sets up the route needed for
798d3a52
ZJS
394 non-IPv4LL hosts to communicate with IPv4LL-only hosts. Defaults
395 to false.
396 </para>
397 </listitem>
398 </varlistentry>
5d5003ab
YW
399 <varlistentry>
400 <term><varname>DefaultRouteOnDevice=</varname></term>
401 <listitem>
402 <para>Takes a boolean. If set to true, sets up the default route bound to the interface.
403 Defaults to false. This is useful when creating routes on point-to-point interfaces.
404 This is equivalent to e.g. the following.
405 <programlisting>ip route add default dev veth99</programlisting></para>
406 </listitem>
407 </varlistentry>
798d3a52 408 <varlistentry>
113bfde1
TG
409 <term><varname>IPv6Token=</varname></term>
410 <listitem>
b27caa34
YW
411 <para>Specifies an optional address generation mode for the Stateless Address
412 Autoconfiguration (SLAAC). Supported modes are <literal>prefixstable</literal> and
413 <literal>static</literal>.</para>
414
415 <para>When the mode is set to <literal>static</literal>, an IPv6 address must be
416 specified after a colon (<literal>:</literal>), and the lower bits of the supplied
417 address are combined with the upper bits of a prefix received in a Router Advertisement
418 (RA) message to form a complete address. Note that if multiple prefixes are received in an
419 RA message, or in multiple RA messages, addresses will be formed from each of them using
420 the supplied address. This mode implements SLAAC but uses a static interface identifier
421 instead of an identifier generated by using the EUI-64 algorithm. Because the interface
422 identifier is static, if Duplicate Address Detection detects that the computed address is a
423 duplicate (in use by another node on the link), then this mode will fail to provide an
424 address for that prefix. If an IPv6 address without mode is specified, then
425 <literal>static</literal> mode is assumed.</para>
426
427 <para>When the mode is set to <literal>prefixstable</literal> the
428 <ulink url="https://tools.ietf.org/html/rfc7217">RFC 7217</ulink> algorithm for generating
429 interface identifiers will be used. This mode can optionally take an IPv6 address separated
430 with a colon (<literal>:</literal>). If an IPv6 address is specified, then an interface
431 identifier is generated only when a prefix received in an RA message matches the supplied
432 address.</para>
433
434 <para>If no address generation mode is specified (which is the default), or a received
435 prefix does not match any of the addresses provided in <literal>prefixstable</literal>
436 mode, then the EUI-64 algorithm will be used to form an interface identifier for that
437 prefix. This mode is also SLAAC, but with a potentially stable interface identifier which
438 does not directly map to the interface's hardware address.</para>
439
440 <para>Note that the <literal>prefixstable</literal> algorithm uses both the interface
441 name and MAC address as input to the hash to compute the interface identifier, so if either
442 of those are changed the resulting interface identifier (and address) will change, even if
443 the prefix received in the RA message has not changed.</para>
444
445 <para>This setting can be specified multiple times. If an empty string is assigned, then
446 the all previous assignments are cleared.</para>
447
448 <para>Examples:
449 <programlisting>IPv6Token=::1a:2b:3c:4d
450IPv6Token=static:::1a:2b:3c:4d
451IPv6Token=prefixstable
452IPv6Token=prefixstable:2002:da8:1::</programlisting></para>
113bfde1
TG
453 </listitem>
454 </varlistentry>
455 <varlistentry>
798d3a52
ZJS
456 <term><varname>LLMNR=</varname></term>
457 <listitem>
9b6ffef3 458 <para>Takes a boolean or <literal>resolve</literal>. When true,
aaa297d4
LP
459 enables <ulink
460 url="https://tools.ietf.org/html/rfc4795">Link-Local
461 Multicast Name Resolution</ulink> on the link. When set to
462 <literal>resolve</literal>, only resolution is enabled,
463 but not host registration and announcement. Defaults to
464 true. This setting is read by
465 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
466 </listitem>
467 </varlistentry>
468 <varlistentry>
469 <term><varname>MulticastDNS=</varname></term>
470 <listitem>
9b6ffef3 471 <para>Takes a boolean or <literal>resolve</literal>. When true,
aaa297d4
LP
472 enables <ulink
473 url="https://tools.ietf.org/html/rfc6762">Multicast
474 DNS</ulink> support on the link. When set to
475 <literal>resolve</literal>, only resolution is enabled,
476 but not host or service registration and
477 announcement. Defaults to false. This setting is read by
478 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
798d3a52
ZJS
479 </listitem>
480 </varlistentry>
30e59c84 481 <varlistentry>
c9299be2 482 <term><varname>DNSOverTLS=</varname></term>
30e59c84 483 <listitem>
4310bfc2
IT
484 <para>Takes a boolean or <literal>opportunistic</literal>.
485 When true, enables
30e59c84
IT
486 <ulink
487 url="https://tools.ietf.org/html/rfc7858">DNS-over-TLS</ulink>
4310bfc2
IT
488 support on the link.
489 When set to <literal>opportunistic</literal>, compatibility with
490 non-DNS-over-TLS servers is increased, by automatically
491 turning off DNS-over-TLS servers in this case.
492 This option defines a per-interface setting for
30e59c84 493 <citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>'s
c9299be2 494 global <varname>DNSOverTLS=</varname> option. Defaults to
30e59c84
IT
495 false. This setting is read by
496 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
497 </listitem>
498 </varlistentry>
ad6c0475
LP
499 <varlistentry>
500 <term><varname>DNSSEC=</varname></term>
501 <listitem>
e9dd6984
ZJS
502 <para>Takes a boolean or <literal>allow-downgrade</literal>. When true, enables
503 <ulink url="https://tools.ietf.org/html/rfc4033">DNSSEC</ulink>
ad6c0475
LP
504 DNS validation support on the link. When set to
505 <literal>allow-downgrade</literal>, compatibility with
506 non-DNSSEC capable networks is increased, by automatically
785889e5 507 turning off DNSSEC in this case. This option defines a
ad6c0475
LP
508 per-interface setting for
509 <citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>'s
510 global <varname>DNSSEC=</varname> option. Defaults to
511 false. This setting is read by
512 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
513 </listitem>
514 </varlistentry>
8a516214
LP
515 <varlistentry>
516 <term><varname>DNSSECNegativeTrustAnchors=</varname></term>
517 <listitem><para>A space-separated list of DNSSEC negative
518 trust anchor domains. If specified and DNSSEC is enabled,
519 look-ups done via the interface's DNS server will be subject
520 to the list of negative trust anchors, and not require
521 authentication for the specified domains, or anything below
522 it. Use this to disable DNSSEC authentication for specific
523 private domains, that cannot be proven valid using the
524 Internet DNS hierarchy. Defaults to the empty list. This
525 setting is read by
526 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
527 </listitem>
528 </varlistentry>
798d3a52
ZJS
529 <varlistentry>
530 <term><varname>LLDP=</varname></term>
531 <listitem>
da6c766d
LP
532 <para>Controls support for Ethernet LLDP packet reception. LLDP is a link-layer protocol commonly
533 implemented on professional routers and bridges which announces which physical port a system is connected
534 to, as well as other related data. Accepts a boolean or the special value
34437b4f
LP
535 <literal>routers-only</literal>. When true, incoming LLDP packets are accepted and a database of all LLDP
536 neighbors maintained. If <literal>routers-only</literal> is set only LLDP data of various types of routers
537 is collected and LLDP data about other types of devices ignored (such as stations, telephones and
7cececb2 538 others). If false, LLDP reception is disabled. Defaults to <literal>routers-only</literal>. Use
34437b4f 539 <citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> to query the
da6c766d
LP
540 collected neighbor data. LLDP is only available on Ethernet links. See <varname>EmitLLDP=</varname> below
541 for enabling LLDP packet emission from the local system.
798d3a52
ZJS
542 </para>
543 </listitem>
544 </varlistentry>
da6c766d
LP
545 <varlistentry>
546 <term><varname>EmitLLDP=</varname></term>
547 <listitem>
7272b25e
LP
548 <para>Controls support for Ethernet LLDP packet emission. Accepts a boolean parameter or the special values
549 <literal>nearest-bridge</literal>, <literal>non-tpmr-bridge</literal> and
550 <literal>customer-bridge</literal>. Defaults to false, which turns off LLDP packet emission. If not false,
551 a short LLDP packet with information about the local system is sent out in regular intervals on the
38b38500 552 link. The LLDP packet will contain information about the local hostname, the local machine ID (as stored
7272b25e 553 in <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>) and the
da6c766d
LP
554 local interface name, as well as the pretty hostname of the system (as set in
555 <citerefentry><refentrytitle>machine-info</refentrytitle><manvolnum>5</manvolnum></citerefentry>). LLDP
7272b25e
LP
556 emission is only available on Ethernet links. Note that this setting passes data suitable for
557 identification of host to the network and should thus not be enabled on untrusted networks, where such
558 identification data should not be made available. Use this option to permit other systems to identify on
559 which interfaces they are connected to this system. The three special values control propagation of the
560 LLDP packets. The <literal>nearest-bridge</literal> setting permits propagation only to the nearest
561 connected bridge, <literal>non-tpmr-bridge</literal> permits propagation across Two-Port MAC Relays, but
562 not any other bridges, and <literal>customer-bridge</literal> permits propagation until a customer bridge
563 is reached. For details about these concepts, see <ulink
6a1bae83 564 url="https://standards.ieee.org/findstds/standard/802.1AB-2016.html">IEEE 802.1AB-2016</ulink>. Note that
7272b25e
LP
565 configuring this setting to true is equivalent to <literal>nearest-bridge</literal>, the recommended and
566 most restricted level of propagation. See <varname>LLDP=</varname> above for an option to enable LLDP
567 reception.</para>
da6c766d
LP
568 </listitem>
569 </varlistentry>
e9a8c550 570
0d4ad91d
AR
571 <varlistentry>
572 <term><varname>BindCarrier=</varname></term>
573 <listitem>
2ae7505f
TG
574 <para>A link name or a list of link names. When set, controls the behavior of the current
575 link. When all links in the list are in an operational down state, the current link is brought
576 down. When at least one link has carrier, the current interface is brought up.
0d4ad91d
AR
577 </para>
578 </listitem>
579 </varlistentry>
798d3a52
ZJS
580 <varlistentry>
581 <term><varname>Address=</varname></term>
582 <listitem>
583 <para>A static IPv4 or IPv6 address and its prefix length,
584 separated by a <literal>/</literal> character. Specify
585 this key more than once to configure several addresses.
586 The format of the address must be as described in
3ba3a79d 587 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
798d3a52
ZJS
588 This is a short-hand for an [Address] section only
589 containing an Address key (see below). This option may be
590 specified more than once.
591 </para>
592
e6ef3a13
YW
593 <para>If the specified address is <literal>0.0.0.0</literal> (for IPv4) or <literal>::</literal>
594 (for IPv6), a new address range of the requested size is automatically allocated from a
595 system-wide pool of unused ranges. Note that the prefix length must be equal or larger than 8 for
596 IPv4, and 64 for IPv6. The allocated range is checked against all current network interfaces and
597 all known network configuration files to avoid address range conflicts. The default system-wide
598 pool consists of 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 for IPv4, and fd00::/8 for IPv6.
599 This functionality is useful to manage a large number of dynamically created network interfaces
600 with the same network configuration and automatic address range assignment.</para>
798d3a52
ZJS
601
602 </listitem>
603 </varlistentry>
604 <varlistentry>
605 <term><varname>Gateway=</varname></term>
606 <listitem>
607 <para>The gateway address, which must be in the format
608 described in
3ba3a79d 609 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
798d3a52
ZJS
610 This is a short-hand for a [Route] section only containing
611 a Gateway key. This option may be specified more than
612 once.</para>
613 </listitem>
614 </varlistentry>
615 <varlistentry>
616 <term><varname>DNS=</varname></term>
617 <listitem>
618 <para>A DNS server address, which must be in the format
619 described in
3ba3a79d 620 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
711dd5db
YW
621 This option may be specified more than once. Each address can optionally take a port number
622 separated with <literal>:</literal>, a network interface name or index separated with
623 <literal>%</literal>, and a Server Name Indication (SNI) separated with <literal>#</literal>.
624 When IPv6 address is specified with a port number, then the address must be in the square
625 brackets. That is, the acceptable full formats are
626 <literal>111.222.333.444:9953%ifname#example.com</literal> for IPv4 and
627 <literal>[1111:2222::3333]:9953%ifname#example.com</literal> for IPv6. This setting can be
628 specified multiple times. If an empty string is assigned, then the all previous assignments
629 are cleared. This setting is read by
3df9bec5 630 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
798d3a52
ZJS
631 </listitem>
632 </varlistentry>
633 <varlistentry>
634 <term><varname>Domains=</varname></term>
635 <listitem>
cd517eb7
ZJS
636 <para>A whitespace-separated list of domains which should be resolved using the DNS servers on
637 this link. Each item in the list should be a domain name, optionally prefixed with a tilde
638 (<literal>~</literal>). The domains with the prefix are called "routing-only domains". The
639 domains without the prefix are called "search domains" and are first used as search suffixes for
38b38500
ZJS
640 extending single-label hostnames (hostnames containing no dots) to become fully qualified
641 domain names (FQDNs). If a single-label hostname is resolved on this interface, each of the
cd517eb7
ZJS
642 specified search domains are appended to it in turn, converting it into a fully qualified domain
643 name, until one of them may be successfully resolved.</para>
2df22529 644
38b38500 645 <para>Both "search" and "routing-only" domains are used for routing of DNS queries: look-ups for hostnames
2df22529
ZJS
646 ending in those domains (hence also single label names, if any "search domains" are listed), are routed to
647 the DNS servers configured for this interface. The domain routing logic is particularly useful on
648 multi-homed hosts with DNS servers serving particular private DNS zones on each interface.</para>
649
650 <para>The "routing-only" domain <literal>~.</literal> (the tilde indicating definition of a routing domain,
651 the dot referring to the DNS root domain which is the implied suffix of all valid DNS names) has special
652 effect. It causes all DNS traffic which does not match another configured domain routing entry to be routed
653 to DNS servers specified for this interface. This setting is useful to prefer a certain set of DNS servers
654 if a link on which they are connected is available.</para>
3df9bec5
LP
655
656 <para>This setting is read by
2df22529
ZJS
657 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
658 "Search domains" correspond to the <varname>domain</varname> and <varname>search</varname> entries in
98e9d710 659 <citerefentry project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
2df22529
ZJS
660 Domain name routing has no equivalent in the traditional glibc API, which has no concept of domain
661 name servers limited to a specific link.</para>
798d3a52
ZJS
662 </listitem>
663 </varlistentry>
7ece6f58
LP
664 <varlistentry>
665 <term><varname>DNSDefaultRoute=</varname></term>
666 <listitem>
667 <para>Takes a boolean argument. If true, this link's configured DNS servers are used for resolving domain
668 names that do not match any link's configured <varname>Domains=</varname> setting. If false, this link's
669 configured DNS servers are never used for such domains, and are exclusively used for resolving names that
670 match at least one of the domains configured on this link. If not specified defaults to an automatic mode:
671 queries not matching any link's configured domains will be routed to this link if it has no routing-only
672 domains configured.</para>
673 </listitem>
674 </varlistentry>
798d3a52
ZJS
675 <varlistentry>
676 <term><varname>NTP=</varname></term>
677 <listitem>
2a71d57f 678 <para>An NTP server address (either an IP address, or a hostname). This option may be specified more than once. This setting is read by
3df9bec5 679 <citerefentry><refentrytitle>systemd-timesyncd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
798d3a52
ZJS
680 </listitem>
681 </varlistentry>
682 <varlistentry>
683 <term><varname>IPForward=</varname></term>
765afd5c
LP
684 <listitem><para>Configures IP packet forwarding for the
685 system. If enabled, incoming packets on any network
686 interface will be forwarded to any other interfaces
9b6ffef3
YW
687 according to the routing table. Takes a boolean,
688 or the values <literal>ipv4</literal> or
765afd5c
LP
689 <literal>ipv6</literal>, which only enable IP packet
690 forwarding for the specified address family. This controls
691 the <filename>net.ipv4.ip_forward</filename> and
692 <filename>net.ipv6.conf.all.forwarding</filename> sysctl
693 options of the network interface (see <ulink
4046d836
LP
694 url="https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt">ip-sysctl.txt</ulink>
695 for details about sysctl options). Defaults to
696 <literal>no</literal>.</para>
697
765afd5c
LP
698 <para>Note: this setting controls a global kernel option,
699 and does so one way only: if a network that has this setting
700 enabled is set up the global setting is turned on. However,
701 it is never turned off again, even after all networks with
702 this setting enabled are shut down again.</para>
703
704 <para>To allow IP packet forwarding only between specific
705 network interfaces use a firewall.</para>
4046d836 706 </listitem>
798d3a52
ZJS
707 </varlistentry>
708 <varlistentry>
709 <term><varname>IPMasquerade=</varname></term>
710 <listitem><para>Configures IP masquerading for the network
b938cb90 711 interface. If enabled, packets forwarded from the network
798d3a52
ZJS
712 interface will be appear as coming from the local host.
713 Takes a boolean argument. Implies
5c82dd13 714 <varname>IPForward=ipv4</varname>. Defaults to
4046d836 715 <literal>no</literal>.</para></listitem>
798d3a52 716 </varlistentry>
a46e37cb
SS
717 <varlistentry>
718 <term><varname>IPv6PrivacyExtensions=</varname></term>
1f0d9695
LP
719 <listitem><para>Configures use of stateless temporary
720 addresses that change over time (see <ulink
721 url="https://tools.ietf.org/html/rfc4941">RFC 4941</ulink>,
722 Privacy Extensions for Stateless Address Autoconfiguration
723 in IPv6). Takes a boolean or the special values
724 <literal>prefer-public</literal> and
b938cb90 725 <literal>kernel</literal>. When true, enables the privacy
1f0d9695 726 extensions and prefers temporary addresses over public
b938cb90 727 addresses. When <literal>prefer-public</literal>, enables the
1f0d9695
LP
728 privacy extensions, but prefers public addresses over
729 temporary addresses. When false, the privacy extensions
b938cb90 730 remain disabled. When <literal>kernel</literal>, the kernel's
1f0d9695 731 default setting will be left in place. Defaults to
a46e37cb
SS
732 <literal>no</literal>.</para></listitem>
733 </varlistentry>
941d0aa8 734 <varlistentry>
f921f573 735 <term><varname>IPv6AcceptRA=</varname></term>
c7fe06fb
ZJS
736 <listitem><para>Takes a boolean. Controls IPv6 Router Advertisement (RA) reception support for the
737 interface. If true, RAs are accepted; if false, RAs are ignored. When RAs are accepted, they may
738 trigger the start of the DHCPv6 client if the relevant flags are set in the RA data, or if no
739 routers are found on the link. The default is to disable RA reception for bridge devices or when IP
740 forwarding is enabled, and to enable it otherwise. Cannot be enabled on bond devices and when link
86b52a39 741 local addressing is disabled.</para>
1e7a0e21 742
bdac5608
ZJS
743 <para>Further settings for the IPv6 RA support may be configured in the [IPv6AcceptRA] section, see
744 below.</para>
1e7a0e21
LP
745
746 <para>Also see <ulink
747 url="https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt">ip-sysctl.txt</ulink> in the kernel
748 documentation regarding <literal>accept_ra</literal>, but note that systemd's setting of
749 <constant>1</constant> (i.e. true) corresponds to kernel's setting of <constant>2</constant>.</para>
c4a05aa1 750
b3454e1e
YW
751 <para>Note that kernel's implementation of the IPv6 RA protocol is always disabled,
752 regardless of this setting. If this option is enabled, a userspace implementation of the IPv6
753 RA protocol is used, and the kernel's own implementation remains disabled, since
754 <command>systemd-networkd</command> needs to know all details supplied in the advertisements,
755 and these are not available from the kernel if the kernel's own implementation is used.</para>
ebf98081 756 </listitem>
941d0aa8 757 </varlistentry>
44de7fb1
SS
758 <varlistentry>
759 <term><varname>IPv6DuplicateAddressDetection=</varname></term>
a8eaaee7 760 <listitem><para>Configures the amount of IPv6 Duplicate
025314d9 761 Address Detection (DAD) probes to send. When unset, the kernel's default will be used.
44de7fb1
SS
762 </para></listitem>
763 </varlistentry>
a86cba89
SS
764 <varlistentry>
765 <term><varname>IPv6HopLimit=</varname></term>
766 <listitem><para>Configures IPv6 Hop Limit. For each router that
767 forwards the packet, the hop limit is decremented by 1. When the
768 hop limit field reaches zero, the packet is discarded.
025314d9 769 When unset, the kernel's default will be used.
a86cba89
SS
770 </para></listitem>
771 </varlistentry>
94d76d07
YW
772 <varlistentry>
773 <term><varname>IPv4AcceptLocal=</varname></term>
774 <listitem><para>Takes a boolean. Accept packets with local source addresses. In combination
775 with suitable routing, this can be used to direct packets between two local interfaces over
776 the wire and have them accepted properly. When unset, the kernel's default will be used.
777 </para></listitem>
778 </varlistentry>
23d8b221 779 <varlistentry>
8f9a206b 780 <term><varname>IPv4ProxyARP=</varname></term>
9b6ffef3 781 <listitem><para>Takes a boolean. Configures proxy ARP for IPv4. Proxy ARP is the technique in which one host,
23d8b221 782 usually a router, answers ARP requests intended for another machine. By "faking" its identity,
e9dd6984 783 the router accepts responsibility for routing packets to the "real" destination. See <ulink
23d8b221 784 url="https://tools.ietf.org/html/rfc1027">RFC 1027</ulink>.
025314d9 785 When unset, the kernel's default will be used.
23d8b221
SS
786 </para></listitem>
787 </varlistentry>
a0e5c15d 788 <varlistentry>
465dfe59 789 <term><varname>IPv6ProxyNDP=</varname></term>
9b6ffef3 790 <listitem><para>Takes a boolean. Configures proxy NDP for IPv6. Proxy NDP (Neighbor Discovery
465dfe59
HV
791 Protocol) is a technique for IPv6 to allow routing of addresses to a different
792 destination when peers expect them to be present on a certain physical link.
a0e5c15d
FK
793 In this case a router answers Neighbour Advertisement messages intended for
794 another machine by offering its own MAC address as destination.
465dfe59 795 Unlike proxy ARP for IPv4, it is not enabled globally, but will only send Neighbour
a0e5c15d 796 Advertisement messages for addresses in the IPv6 neighbor proxy table,
465dfe59
HV
797 which can also be shown by <command>ip -6 neighbour show proxy</command>.
798 systemd-networkd will control the per-interface `proxy_ndp` switch for each configured
799 interface depending on this option.
025314d9 800 When unset, the kernel's default will be used.
465dfe59
HV
801 </para></listitem>
802 </varlistentry>
803 <varlistentry>
804 <term><varname>IPv6ProxyNDPAddress=</varname></term>
805 <listitem><para>An IPv6 address, for which Neighbour Advertisement messages will be
806 proxied. This option may be specified more than once. systemd-networkd will add the
807 <option>IPv6ProxyNDPAddress=</option> entries to the kernel's IPv6 neighbor proxy table.
964c4eda 808 This option implies <option>IPv6ProxyNDP=yes</option> but has no effect if
025314d9 809 <option>IPv6ProxyNDP</option> has been set to false. When unset, the kernel's default will be used.
a0e5c15d
FK
810 </para></listitem>
811 </varlistentry>
3f9e0236 812 <varlistentry>
e5ff2245
YW
813 <term><varname>IPv6SendRA=</varname></term>
814 <listitem><para>Whether to enable or disable Router Advertisement sending on a link. Takes a
815 boolean value. When enabled, prefixes configured in [IPv6Prefix] sections and routes
816 configured in [IPv6RoutePrefix] sections are distributed as defined in the [IPv6SendRA]
817 section. If <varname>DHCPv6PrefixDelegation=</varname> is enabled, then the delegated
818 prefixes are also distributed. See <varname>DHCPv6PrefixDelegation=</varname> setting and the
819 [IPv6SendRA], [IPv6Prefix], [IPv6RoutePrefix], and [DHCPv6PrefixDelegation] sections for more
bdac5608 820 configuration options.</para></listitem>
3f9e0236 821 </varlistentry>
e5ff2245
YW
822 <varlistentry>
823 <term><varname>DHCPv6PrefixDelegation=</varname></term>
824 <listitem><para>Takes a boolean value. When enabled, requests prefixes using a DHCPv6 client
825 configured on another link. By default, an address within each delegated prefix will be
826 assigned, and the prefixes will be announced through IPv6 Router Advertisement when
827 <varname>IPv6SendRA=</varname> is enabled. Such default settings can be configured in
828 [DHCPv6PrefixDelegation] section.</para></listitem>
829 </varlistentry>
11102cba
SS
830 <varlistentry>
831 <term><varname>IPv6MTUBytes=</varname></term>
832 <listitem><para>Configures IPv6 maximum transmission unit (MTU).
025314d9 833 An integer greater than or equal to 1280 bytes. When unset, the kernel's default will be used.
11102cba
SS
834 </para></listitem>
835 </varlistentry>
798d3a52
ZJS
836 <varlistentry>
837 <term><varname>Bridge=</varname></term>
838 <listitem>
9e35b3de
ZJS
839 <para>The name of the bridge to add the link to. See
840 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
841 </para>
798d3a52
ZJS
842 </listitem>
843 </varlistentry>
844 <varlistentry>
845 <term><varname>Bond=</varname></term>
846 <listitem>
9e35b3de
ZJS
847 <para>The name of the bond to add the link to. See
848 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
849 </para>
798d3a52
ZJS
850 </listitem>
851 </varlistentry>
6cb955c6
AR
852 <varlistentry>
853 <term><varname>VRF=</varname></term>
854 <listitem>
9e35b3de
ZJS
855 <para>The name of the VRF to add the link to. See
856 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
857 </para>
6cb955c6
AR
858 </listitem>
859 </varlistentry>
798d3a52
ZJS
860 <varlistentry>
861 <term><varname>VLAN=</varname></term>
862 <listitem>
9e35b3de
ZJS
863 <para>The name of a VLAN to create on the link. See
864 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
865 This option may be specified more than once.</para>
798d3a52
ZJS
866 </listitem>
867 </varlistentry>
2479c4fe 868 <varlistentry>
869 <term><varname>IPVLAN=</varname></term>
870 <listitem>
871 <para>The name of a IPVLAN to create on the link. See
872 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
873 This option may be specified more than once.</para>
874 </listitem>
875 </varlistentry>
798d3a52
ZJS
876 <varlistentry>
877 <term><varname>MACVLAN=</varname></term>
878 <listitem>
9e35b3de
ZJS
879 <para>The name of a MACVLAN to create on the link. See
880 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
881 This option may be specified more than once.</para>
798d3a52
ZJS
882 </listitem>
883 </varlistentry>
884 <varlistentry>
885 <term><varname>VXLAN=</varname></term>
886 <listitem>
9e35b3de
ZJS
887 <para>The name of a VXLAN to create on the link. See
888 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
889 This option may be specified more than once.</para>
798d3a52
ZJS
890 </listitem>
891 </varlistentry>
892 <varlistentry>
893 <term><varname>Tunnel=</varname></term>
894 <listitem>
9e35b3de
ZJS
895 <para>The name of a Tunnel to create on the link. See
896 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
897 This option may be specified more than once.</para>
798d3a52
ZJS
898 </listitem>
899 </varlistentry>
81962db7
SS
900 <varlistentry>
901 <term><varname>MACsec=</varname></term>
902 <listitem>
903 <para>The name of a MACsec device to create on the link. See
904 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
905 This option may be specified more than once.</para>
906 </listitem>
907 </varlistentry>
dd5f3175
SS
908 <varlistentry>
909 <term><varname>ActiveSlave=</varname></term>
910 <listitem>
9b6ffef3 911 <para>Takes a boolean. Specifies the new active slave. The <literal>ActiveSlave=</literal>
dd5f3175
SS
912 option is only valid for following modes:
913 <literal>active-backup</literal>,
914 <literal>balance-alb</literal> and
915 <literal>balance-tlb</literal>. Defaults to false.
916 </para>
917 </listitem>
918 </varlistentry>
919 <varlistentry>
920 <term><varname>PrimarySlave=</varname></term>
921 <listitem>
9b6ffef3 922 <para>Takes a boolean. Specifies which slave is the primary device. The specified
dd5f3175
SS
923 device will always be the active slave while it is available. Only when the
924 primary is off-line will alternate devices be used. This is useful when
925 one slave is preferred over another, e.g. when one slave has higher throughput
926 than another. The <literal>PrimarySlave=</literal> option is only valid for
927 following modes:
928 <literal>active-backup</literal>,
929 <literal>balance-alb</literal> and
930 <literal>balance-tlb</literal>. Defaults to false.
931 </para>
932 </listitem>
933 </varlistentry>
dad2d78e
SS
934 <varlistentry>
935 <term><varname>ConfigureWithoutCarrier=</varname></term>
936 <listitem>
9b6ffef3 937 <para>Takes a boolean. Allows networkd to configure a specific link even if it has no carrier.
bd0d471c
DS
938 Defaults to false. If <option>IgnoreCarrierLoss=</option> is not explicitly set, it will
939 default to this value.
dad2d78e
SS
940 </para>
941 </listitem>
942 </varlistentry>
93b4dab5
SS
943 <varlistentry>
944 <term><varname>IgnoreCarrierLoss=</varname></term>
945 <listitem>
bd0d471c
DS
946 <para>Takes a boolean. Allows networkd to retain both the static and dynamic configuration
947 of the interface even if its carrier is lost. When unset, the value specified with
948 <option>ConfigureWithoutCarrier=</option> is used.
93b4dab5
SS
949 </para>
950 </listitem>
951 </varlistentry>
98d20a17 952 <varlistentry>
953 <term><varname>Xfrm=</varname></term>
954 <listitem>
955 <para>The name of the xfrm to create on the link. See
956 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
957 This option may be specified more than once.</para>
958 </listitem>
959 </varlistentry>
c98d78d3
YW
960 <varlistentry>
961 <term><varname>KeepConfiguration=</varname></term>
962 <listitem>
963 <para>Takes a boolean or one of <literal>static</literal>, <literal>dhcp-on-stop</literal>,
964 <literal>dhcp</literal>. When <literal>static</literal>, <command>systemd-networkd</command>
965 will not drop static addresses and routes on starting up process. When set to
966 <literal>dhcp-on-stop</literal>, <command>systemd-networkd</command> will not drop addresses
967 and routes on stopping the daemon. When <literal>dhcp</literal>,
968 the addresses and routes provided by a DHCP server will never be dropped even if the DHCP
969 lease expires. This is contrary to the DHCP specification, but may be the best choice if,
970 e.g., the root filesystem relies on this connection. The setting <literal>dhcp</literal>
971 implies <literal>dhcp-on-stop</literal>, and <literal>yes</literal> implies
80060352
ZJS
972 <literal>dhcp</literal> and <literal>static</literal>. Defaults to <literal>no</literal>.
973 </para>
c98d78d3
YW
974 </listitem>
975 </varlistentry>
93b4dab5 976
798d3a52
ZJS
977 </variablelist>
978
979 </refsect1>
980
981 <refsect1>
982 <title>[Address] Section Options</title>
983
bdac5608 984 <para>An [Address] section accepts the following keys. Specify several [Address]
798d3a52
ZJS
985 sections to configure several addresses.</para>
986
987 <variablelist class='network-directives'>
988 <varlistentry>
989 <term><varname>Address=</varname></term>
990 <listitem>
bdac5608
ZJS
991 <para>As in the [Network] section. This key is mandatory. Each [Address] section can contain one
992 <varname>Address=</varname> setting.</para>
798d3a52
ZJS
993 </listitem>
994 </varlistentry>
995 <varlistentry>
996 <term><varname>Peer=</varname></term>
997 <listitem>
998 <para>The peer address in a point-to-point connection.
4e68898e 999 Accepts the same format as the <varname>Address=</varname>
798d3a52
ZJS
1000 key.</para>
1001 </listitem>
1002 </varlistentry>
1003 <varlistentry>
1004 <term><varname>Broadcast=</varname></term>
1005 <listitem>
1006 <para>The broadcast address, which must be in the format
1007 described in
3ba3a79d 1008 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
798d3a52 1009 This key only applies to IPv4 addresses. If it is not
4e68898e 1010 given, it is derived from the <varname>Address=</varname>
798d3a52
ZJS
1011 key.</para>
1012 </listitem>
1013 </varlistentry>
1014 <varlistentry>
1015 <term><varname>Label=</varname></term>
1016 <listitem>
1017 <para>An address label.</para>
1018 </listitem>
1019 </varlistentry>
b5834a0b
SS
1020 <varlistentry>
1021 <term><varname>PreferredLifetime=</varname></term>
1022 <listitem>
1023 <para>Allows the default "preferred lifetime" of the address to be overridden.
1024 Only three settings are accepted: <literal>forever</literal> or <literal>infinity</literal>
1025 which is the default and means that the address never expires, and <literal>0</literal> which means
1026 that the address is considered immediately "expired" and will not be used,
1027 unless explicitly requested. A setting of PreferredLifetime=0 is useful for
1028 addresses which are added to be used only by a specific application,
1029 which is then configured to use them explicitly.</para>
1030 </listitem>
1031 </varlistentry>
2959fb07
SS
1032 <varlistentry>
1033 <term><varname>Scope=</varname></term>
1034 <listitem>
1035 <para>The scope of the address, which can be <literal>global</literal>,
e9dd6984 1036 <literal>link</literal> or <literal>host</literal> or an unsigned integer in the range 0—255.
2959fb07
SS
1037 Defaults to <literal>global</literal>.</para>
1038 </listitem>
1039 </varlistentry>
e63be084
SS
1040 <varlistentry>
1041 <term><varname>HomeAddress=</varname></term>
1042 <listitem>
9b6ffef3 1043 <para>Takes a boolean. Designates this address the "home address" as defined in
e63be084
SS
1044 <ulink url="https://tools.ietf.org/html/rfc6275">RFC 6275</ulink>.
1045 Supported only on IPv6. Defaults to false.</para>
1046 </listitem>
1047 </varlistentry>
1048 <varlistentry>
1049 <term><varname>DuplicateAddressDetection=</varname></term>
1050 <listitem>
051e77ca
SS
1051 <para>Takes one of <literal>ipv4</literal>, <literal>ipv6</literal>,
1052 <literal>both</literal>, <literal>none</literal>. When <literal>ipv4</literal>,
1053 performs IPv4 Duplicate Address Detection. See
1054 <ulink url="https://tools.ietf.org/html/rfc5227">RFC 5224</ulink>.
1055 When <literal>ipv6</literal>, performs IPv6 Duplicate Address Detection. See
1056 <ulink url="https://tools.ietf.org/html/rfc4862">RFC 4862</ulink>.
1057 Defaults to <literal>ipv6</literal>.</para>
e63be084
SS
1058 </listitem>
1059 </varlistentry>
1060 <varlistentry>
1061 <term><varname>ManageTemporaryAddress=</varname></term>
1062 <listitem>
9b6ffef3 1063 <para>Takes a boolean. If true the kernel manage temporary addresses created
e63be084
SS
1064 from this one as template on behalf of Privacy Extensions
1065 <ulink url="https://tools.ietf.org/html/rfc3041">RFC 3041</ulink>. For this to become
1066 active, the use_tempaddr sysctl setting has to be set to a value greater than zero.
11fcfc53 1067 The given address needs to have a prefix length of 64. This flag allows using privacy
e63be084
SS
1068 extensions in a manually configured network, just like if stateless auto-configuration
1069 was active. Defaults to false. </para>
1070 </listitem>
1071 </varlistentry>
1072 <varlistentry>
de697db0 1073 <term><varname>AddPrefixRoute=</varname></term>
e63be084 1074 <listitem>
de697db0
YW
1075 <para>Takes a boolean. When true, the prefix route for the address is automatically added.
1076 Defaults to true.</para>
e63be084
SS
1077 </listitem>
1078 </varlistentry>
1079 <varlistentry>
1080 <term><varname>AutoJoin=</varname></term>
1081 <listitem>
9b6ffef3 1082 <para>Takes a boolean. Joining multicast group on ethernet level via
e63be084
SS
1083 <command>ip maddr</command> command would not work if we have an Ethernet switch that does
1084 IGMP snooping since the switch would not replicate multicast packets on ports that did not
1085 have IGMP reports for the multicast addresses. Linux vxlan interfaces created via
1086 <command>ip link add vxlan</command> or networkd's netdev kind vxlan have the group option
1087 that enables then to do the required join. By extending ip address command with option
1088 <literal>autojoin</literal> we can get similar functionality for openvswitch (OVS) vxlan
1089 interfaces as well as other tunneling mechanisms that need to receive multicast traffic.
1090 Defaults to <literal>no</literal>.</para>
1091 </listitem>
1092 </varlistentry>
798d3a52
ZJS
1093 </variablelist>
1094 </refsect1>
1095
e4a71bf3
WKI
1096 <refsect1>
1097 <title>[Neighbor] Section Options</title>
bdac5608
ZJS
1098 <para>A [Neighbor] section accepts the following keys. The neighbor section adds a permanent, static
1099 entry to the neighbor table (IPv6) or ARP table (IPv4) for the given hardware address on the links
1100 matched for the network. Specify several [Neighbor] sections to configure several static neighbors.
1101 </para>
e4a71bf3
WKI
1102
1103 <variablelist class='network-directives'>
1104 <varlistentry>
1105 <term><varname>Address=</varname></term>
1106 <listitem>
1107 <para>The IP address of the neighbor.</para>
1108 </listitem>
1109 </varlistentry>
1110 <varlistentry>
b956364d 1111 <term><varname>LinkLayerAddress=</varname></term>
e4a71bf3 1112 <listitem>
b956364d 1113 <para>The link layer address (MAC address or IP address) of the neighbor.</para>
e4a71bf3
WKI
1114 </listitem>
1115 </varlistentry>
1116 </variablelist>
1117 </refsect1>
1118
95b74ef6
SS
1119 <refsect1>
1120 <title>[IPv6AddressLabel] Section Options</title>
1121
bdac5608
ZJS
1122 <para>An [IPv6AddressLabel] section accepts the following keys. Specify several [IPv6AddressLabel]
1123 sections to configure several address labels. IPv6 address labels are used for address selection. See
1124 <ulink url="https://tools.ietf.org/html/rfc3484">RFC 3484</ulink>. Precedence is managed by userspace,
1125 and only the label itself is stored in the kernel</para>
95b74ef6
SS
1126
1127 <variablelist class='network-directives'>
1128 <varlistentry>
1129 <term><varname>Label=</varname></term>
1130 <listitem>
e9dd6984
ZJS
1131 <para>The label for the prefix, an unsigned integer in the range 0–4294967294.
1132 0xffffffff is reserved. This setting is mandatory.</para>
95b74ef6
SS
1133 </listitem>
1134 </varlistentry>
1135 <varlistentry>
1136 <term><varname>Prefix=</varname></term>
1137 <listitem>
1138 <para>IPv6 prefix is an address with a prefix length, separated by a slash <literal>/</literal> character.
1139 This key is mandatory. </para>
1140 </listitem>
1141 </varlistentry>
1142 </variablelist>
1143 </refsect1>
1144
bce67bbe
SS
1145 <refsect1>
1146 <title>[RoutingPolicyRule] Section Options</title>
1147
bdac5608 1148 <para>An [RoutingPolicyRule] section accepts the following keys. Specify several [RoutingPolicyRule]
bce67bbe
SS
1149 sections to configure several rules.</para>
1150
1151 <variablelist class='network-directives'>
1152 <varlistentry>
1153 <term><varname>TypeOfService=</varname></term>
1154 <listitem>
e9dd6984 1155 <para>Takes a number between 0 and 255 that specifies the type of service to match.</para>
bce67bbe
SS
1156 </listitem>
1157 </varlistentry>
1158 <varlistentry>
1159 <term><varname>From=</varname></term>
1160 <listitem>
1161 <para>Specifies the source address prefix to match. Possibly followed by a slash and the prefix length.</para>
1162 </listitem>
1163 </varlistentry>
1164 <varlistentry>
1165 <term><varname>To=</varname></term>
1166 <listitem>
1167 <para>Specifies the destination address prefix to match. Possibly followed by a slash and the prefix length.</para>
1168 </listitem>
1169 </varlistentry>
1170 <varlistentry>
1171 <term><varname>FirewallMark=</varname></term>
1172 <listitem>
1173 <para>Specifies the iptables firewall mark value to match (a number between 1 and 4294967295).</para>
1174 </listitem>
1175 </varlistentry>
1176 <varlistentry>
1177 <term><varname>Table=</varname></term>
1178 <listitem>
41b90a1e
YW
1179 <para>Specifies the routing table identifier to lookup if the rule selector matches. Takes
1180 one of <literal>default</literal>, <literal>main</literal>, and <literal>local</literal>,
1181 or a number between 1 and 4294967295. Defaults to <literal>main</literal>.</para>
bce67bbe
SS
1182 </listitem>
1183 </varlistentry>
1184 <varlistentry>
1185 <term><varname>Priority=</varname></term>
1186 <listitem>
1187 <para>Specifies the priority of this rule. <varname>Priority=</varname> is an unsigned
1188 integer. Higher number means lower priority, and rules get processed in order of increasing number.</para>
1189 </listitem>
1190 </varlistentry>
762e2659
SS
1191 <varlistentry>
1192 <term><varname>IncomingInterface=</varname></term>
1193 <listitem>
1194 <para>Specifies incoming device to match. If the interface is loopback, the rule only matches packets originating from this host.</para>
1195 </listitem>
1196 </varlistentry>
1197 <varlistentry>
1198 <term><varname>OutgoingInterface=</varname></term>
1199 <listitem>
1200 <para>Specifies the outgoing device to match. The outgoing interface is only available for packets originating from local sockets that are bound to a device.</para>
1201 </listitem>
1202 </varlistentry>
926062f0
SS
1203 <varlistentry>
1204 <term><varname>SourcePort=</varname></term>
1205 <listitem>
1206 <para>Specifies the source IP port or IP port range match in forwarding information base (FIB) rules.
1207 A port range is specified by the lower and upper port separated by a dash. Defaults to unset.</para>
1208 </listitem>
1209 </varlistentry>
1210 <varlistentry>
1211 <term><varname>DestinationPort=</varname></term>
1212 <listitem>
1213 <para>Specifies the destination IP port or IP port range match in forwarding information base (FIB) rules.
1214 A port range is specified by the lower and upper port separated by a dash. Defaults to unset.</para>
1215 </listitem>
1216 </varlistentry>
1217 <varlistentry>
97f9df9e 1218 <term><varname>IPProtocol=</varname></term>
926062f0 1219 <listitem>
3a269dcf
YW
1220 <para>Specifies the IP protocol to match in forwarding information base (FIB) rules. Takes IP protocol name such as <literal>tcp</literal>,
1221 <literal>udp</literal> or <literal>sctp</literal>, or IP protocol number such as <literal>6</literal> for <literal>tcp</literal> or
1222 <literal>17</literal> for <literal>udp</literal>.
926062f0
SS
1223 Defaults to unset.</para>
1224 </listitem>
1225 </varlistentry>
8b220643
SS
1226 <varlistentry>
1227 <term><varname>InvertRule=</varname></term>
1228 <listitem>
53e1ba28 1229 <para>A boolean. Specifies whether the rule is to be inverted. Defaults to false.</para>
8b220643
SS
1230 </listitem>
1231 </varlistentry>
f6c6ff97
YW
1232 <varlistentry>
1233 <term><varname>Family=</varname></term>
1234 <listitem>
1235 <para>Takes a special value <literal>ipv4</literal>, <literal>ipv6</literal>, or
1236 <literal>both</literal>. By default, the address family is determined by the address
1237 specified in <varname>To=</varname> or <varname>From=</varname>. If neither
1238 <varname>To=</varname> nor <varname>From=</varname> are specified, then defaults to
1239 <literal>ipv4</literal>.</para>
1240 </listitem>
1241 </varlistentry>
ea471a46
YW
1242 <varlistentry>
1243 <term><varname>User=</varname></term>
1244 <listitem>
1245 <para>Takes a username, a user ID, or a range of user IDs separated by a dash. Defaults to
1246 unset.</para>
1247 </listitem>
1248 </varlistentry>
53e1ba28
NF
1249 <varlistentry>
1250 <term><varname>SuppressPrefixLength=</varname></term>
1251 <listitem>
1252 <para>Takes a number <replaceable>N</replaceable> in the range 0-128 and rejects routing
1253 decisions that have a prefix length of <replaceable>N</replaceable> or less. Defaults to
1254 unset.</para>
1255 </listitem>
1256 </varlistentry>
bce67bbe 1257 </variablelist>
c16c7808
SS
1258 </refsect1>
1259
1260 <refsect1>
1261 <title>[NextHop] Section Options</title>
e9dd6984
ZJS
1262 <para>The [NextHop] section is used to manipulate entries in the kernel's "nexthop" tables. The
1263 [NextHop] section accepts the following keys. Specify several [NextHop] sections to configure several
1264 hops.</para>
c16c7808
SS
1265
1266 <variablelist class='network-directives'>
1267 <varlistentry>
1268 <term><varname>Gateway=</varname></term>
1269 <listitem>
bdac5608 1270 <para>As in the [Network] section. This is mandatory.</para>
c16c7808
SS
1271 </listitem>
1272 </varlistentry>
1273 <varlistentry>
1274 <term><varname>Id=</varname></term>
1275 <listitem>
1276 <para>The id of the nexthop (an unsigned integer). If unspecified or '0' then automatically chosen by kernel.</para>
1277 </listitem>
1278 </varlistentry>
1279 </variablelist>
bce67bbe
SS
1280 </refsect1>
1281
798d3a52
ZJS
1282 <refsect1>
1283 <title>[Route] Section Options</title>
bdac5608
ZJS
1284 <para>The [Route] section accepts the following keys. Specify several [Route] sections to configure
1285 several routes.</para>
798d3a52
ZJS
1286
1287 <variablelist class='network-directives'>
1288 <varlistentry>
1289 <term><varname>Gateway=</varname></term>
1290 <listitem>
d306d1d0 1291 <para>Takes the gateway address or the special values <literal>_dhcp4</literal> and
b8caa4ef
YW
1292 <literal>_ipv6ra</literal>. If <literal>_dhcp4</literal> or <literal>_ipv6ra</literal> is
1293 set, then the gateway address provided by DHCPv4 or IPv6 RA is used.</para>
798d3a52
ZJS
1294 </listitem>
1295 </varlistentry>
28959f7d 1296 <varlistentry>
9cb8c559 1297 <term><varname>GatewayOnLink=</varname></term>
28959f7d 1298 <listitem>
9b6ffef3 1299 <para>Takes a boolean. If set to true, the kernel does not have
28959f7d
SS
1300 to check if the gateway is reachable directly by the current machine (i.e., the kernel does
1301 not need to check if the gateway is attached to the local network), so that we can insert the
9b6ffef3 1302 route in the kernel table without it being complained about. Defaults to <literal>no</literal>.
28959f7d
SS
1303 </para>
1304 </listitem>
1305 </varlistentry>
798d3a52
ZJS
1306 <varlistentry>
1307 <term><varname>Destination=</varname></term>
1308 <listitem>
1309 <para>The destination prefix of the route. Possibly
b938cb90 1310 followed by a slash and the prefix length. If omitted, a
798d3a52
ZJS
1311 full-length host route is assumed.</para>
1312 </listitem>
1313 </varlistentry>
1314 <varlistentry>
1315 <term><varname>Source=</varname></term>
1316 <listitem>
1317 <para>The source prefix of the route. Possibly followed by
b938cb90 1318 a slash and the prefix length. If omitted, a full-length
798d3a52
ZJS
1319 host route is assumed.</para>
1320 </listitem>
1321 </varlistentry>
1322 <varlistentry>
1323 <term><varname>Metric=</varname></term>
1324 <listitem>
b938cb90 1325 <para>The metric of the route (an unsigned integer).</para>
798d3a52
ZJS
1326 </listitem>
1327 </varlistentry>
b5bf6f64
SS
1328 <varlistentry>
1329 <term><varname>IPv6Preference=</varname></term>
1330 <listitem>
1331 <para>Specifies the route preference as defined in <ulink
e9dd6984
ZJS
1332 url="https://tools.ietf.org/html/rfc4191">RFC 4191</ulink> for Router Discovery messages. Which
1333 can be one of <literal>low</literal> the route has a lowest priority, <literal>medium</literal>
1334 the route has a default priority or <literal>high</literal> the route has a highest priority.
1335 </para>
b5bf6f64
SS
1336 </listitem>
1337 </varlistentry>
769b56a3
TG
1338 <varlistentry>
1339 <term><varname>Scope=</varname></term>
1340 <listitem>
f5c38922
YW
1341 <para>The scope of the route, which can be <literal>global</literal>, <literal>site</literal>,
1342 <literal>link</literal>, <literal>host</literal>, or <literal>nowhere</literal>. For IPv4 route,
1343 defaults to <literal>host</literal> if <varname>Type=</varname> is <literal>local</literal>
1344 or <literal>nat</literal>, and <literal>link</literal> if <varname>Type=</varname> is
1345 <literal>broadcast</literal>, <literal>multicast</literal>, or <literal>anycast</literal>.
1346 In other cases, defaults to <literal>global</literal>.</para>
769b56a3 1347 </listitem>
0d07e595
JK
1348 </varlistentry>
1349 <varlistentry>
1350 <term><varname>PreferredSource=</varname></term>
1351 <listitem>
1352 <para>The preferred source address of the route. The address
1353 must be in the format described in
1354 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.</para>
1355 </listitem>
769b56a3 1356 </varlistentry>
c953b24c 1357 <varlistentry>
f5c38922 1358 <term><varname>Table=</varname></term>
c953b24c 1359 <listitem>
f5c38922
YW
1360 <para>The table identifier for the route. Takes <literal>default</literal>,
1361 <literal>main</literal>, <literal>local</literal> or a number between 1 and 4294967295.
1362 The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
1363 If unset and <varname>Type=</varname> is <literal>local</literal>, <literal>broadcast</literal>,
1364 <literal>anycast</literal>, or <literal>nat</literal>, then <literal>local</literal> is used.
1365 In other cases, defaults to <literal>main</literal>.
c953b24c
SS
1366 </para>
1367 </listitem>
1368 </varlistentry>
c83ecc04
SS
1369 <varlistentry>
1370 <term><varname>Protocol=</varname></term>
1371 <listitem>
88925d2f 1372 <para>The protocol identifier for the route. Takes a number between 0 and 255 or the special values
ca420b62
YW
1373 <literal>kernel</literal>, <literal>boot</literal>, <literal>static</literal>,
1374 <literal>ra</literal> and <literal>dhcp</literal>. Defaults to <literal>static</literal>.
c83ecc04
SS
1375 </para>
1376 </listitem>
1377 </varlistentry>
983226f3
SS
1378 <varlistentry>
1379 <term><varname>Type=</varname></term>
1380 <listitem>
94d6e299
YW
1381 <para>Specifies the type for the route. Takes one of <literal>unicast</literal>,
1382 <literal>local</literal>, <literal>broadcast</literal>, <literal>anycast</literal>,
1383 <literal>multicast</literal>, <literal>blackhole</literal>, <literal>unreachable</literal>,
1384 <literal>prohibit</literal>, <literal>throw</literal>, <literal>nat</literal>, and
1385 <literal>xresolve</literal>. If <literal>unicast</literal>, a regular route is defined, i.e. a
66d7235e
LP
1386 route indicating the path to take to a destination network address. If <literal>blackhole</literal>, packets
1387 to the defined route are discarded silently. If <literal>unreachable</literal>, packets to the defined route
1388 are discarded and the ICMP message "Host Unreachable" is generated. If <literal>prohibit</literal>, packets
1389 to the defined route are discarded and the ICMP message "Communication Administratively Prohibited" is
1390 generated. If <literal>throw</literal>, route lookup in the current routing table will fail and the route
1391 selection process will return to Routing Policy Database (RPDB). Defaults to <literal>unicast</literal>.
983226f3
SS
1392 </para>
1393 </listitem>
1394 </varlistentry>
323d9329
SS
1395 <varlistentry>
1396 <term><varname>InitialCongestionWindow=</varname></term>
1397 <listitem>
3cb7af5b
YW
1398 <para>The TCP initial congestion window is used during the start of a TCP connection.
1399 During the start of a TCP session, when a client requests a resource, the server's initial
1400 congestion window determines how many packets will be sent during the initial burst of data
1401 without waiting for acknowledgement. Takes a number between 1 and 1023. Note that 100 is
1402 considered an extremely large value for this option. When unset, the kernel's default
1403 (typically 10) will be used.</para>
323d9329
SS
1404 </listitem>
1405 </varlistentry>
1406 <varlistentry>
1407 <term><varname>InitialAdvertisedReceiveWindow=</varname></term>
1408 <listitem>
3cb7af5b
YW
1409 <para>The TCP initial advertised receive window is the amount of receive data (in bytes)
1410 that can initially be buffered at one time on a connection. The sending host can send only
1411 that amount of data before waiting for an acknowledgment and window update from the
1412 receiving host. Takes a number between 1 and 1023. Note that 100 is considered an extremely
1413 large value for this option. When unset, the kernel's default will be used.</para>
323d9329
SS
1414 </listitem>
1415 </varlistentry>
09f5dfad
SS
1416 <varlistentry>
1417 <term><varname>QuickAck=</varname></term>
1418 <listitem>
9b6ffef3 1419 <para>Takes a boolean. When true enables TCP quick ack mode for the route. When unset, the kernel's default will be used.
09f5dfad
SS
1420 </para>
1421 </listitem>
1422 </varlistentry>
633c7258
SS
1423 <varlistentry>
1424 <term><varname>FastOpenNoCookie=</varname></term>
1425 <listitem>
1426 <para>Takes a boolean. When true enables TCP fastopen without a cookie on a per-route basis.
1427 When unset, the kernel's default will be used.
1428 </para>
1429 </listitem>
09f5dfad 1430 </varlistentry>
9b88f20a
SS
1431 <varlistentry>
1432 <term><varname>TTLPropagate=</varname></term>
1433 <listitem>
1434 <para>Takes a boolean. When true enables TTL propagation at Label Switched Path (LSP) egress.
1435 When unset, the kernel's default will be used.
1436 </para>
1437 </listitem>
1438 </varlistentry>
cea79e66
SS
1439 <varlistentry>
1440 <term><varname>MTUBytes=</varname></term>
1441 <listitem>
1442 <para>The maximum transmission unit in bytes to set for the
1443 route. The usual suffixes K, M, G, are supported and are
1444 understood to the base of 1024.</para>
1445 <para>Note that if IPv6 is enabled on the interface, and the MTU is chosen
1446 below 1280 (the minimum MTU for IPv6) it will automatically be increased to this value.</para>
1447 </listitem>
afe42aef
SC
1448 </varlistentry>
1449 <varlistentry>
1450 <term><varname>IPServiceType=</varname></term>
1451 <listitem>
e681a2ee
YW
1452 <para>Takes string; <literal>CS6</literal> or <literal>CS4</literal>. Used to set IP
1453 service type to CS6 (network control) or CS4 (Realtime). Defaults to CS6.</para>
afe42aef
SC
1454 </listitem>
1455 </varlistentry>
6ff5cc6b
YW
1456 <varlistentry>
1457 <term><varname>MultiPathRoute=<replaceable>address</replaceable>[@<replaceable>name</replaceable>] [<replaceable>weight</replaceable>]</varname></term>
1458 <listitem>
1459 <para>Configures multipath route. Multipath routing is the technique of using multiple
1460 alternative paths through a network. Takes gateway address. Optionally, takes a network
1461 interface name or index separated with <literal>@</literal>, and a weight in 1..256 for
1462 this multipath route separated with whitespace. This setting can be specified multiple
1463 times. If an empty string is assigned, then the all previous assignments are cleared.</para>
1464 </listitem>
1465 </varlistentry>
798d3a52
ZJS
1466 </variablelist>
1467 </refsect1>
1468
1469 <refsect1>
4f7331a8 1470 <title>[DHCPv4] Section Options</title>
bdac5608 1471 <para>The [DHCPv4] section configures the DHCPv4 client, if it is enabled with the
ad943783 1472 <varname>DHCP=</varname> setting described above:</para>
798d3a52
ZJS
1473
1474 <variablelist class='network-directives'>
1475 <varlistentry>
1476 <term><varname>UseDNS=</varname></term>
1477 <listitem>
1478 <para>When true (the default), the DNS servers received
1479 from the DHCP server will be used and take precedence over
1480 any statically configured ones.</para>
e88d8021
ZJS
1481
1482 <para>This corresponds to the <option>nameserver</option>
ad943783
LP
1483 option in <citerefentry
1484 project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
798d3a52
ZJS
1485 </listitem>
1486 </varlistentry>
a24e12f0
YW
1487 <varlistentry>
1488 <term><varname>RoutesToDNS=</varname></term>
1489 <listitem>
1490 <para>When true, the routes to the DNS servers received from the DHCP server will be
1491 configured. When <varname>UseDNS=</varname> is disabled, this setting is ignored.
f7e7bb65 1492 Defaults to false.</para>
a24e12f0
YW
1493 </listitem>
1494 </varlistentry>
301f4073
MM
1495 <varlistentry>
1496 <term><varname>UseNTP=</varname></term>
1497 <listitem>
2a71d57f
LP
1498 <para>When true (the default), the NTP servers received from the DHCP server will be used by
1499 <filename>systemd-timesyncd.service</filename> and take precedence over any statically configured
1500 ones.</para>
301f4073
MM
1501 </listitem>
1502 </varlistentry>
299d578f
SS
1503 <varlistentry>
1504 <term><varname>UseSIP=</varname></term>
1505 <listitem>
2a71d57f
LP
1506 <para>When true (the default), the SIP servers received from the DHCP server will be collected
1507 and made available to client programs.</para>
299d578f
SS
1508 </listitem>
1509 </varlistentry>
284e8fd0 1510
798d3a52
ZJS
1511 <varlistentry>
1512 <term><varname>UseMTU=</varname></term>
1513 <listitem>
1514 <para>When true, the interface maximum transmission unit
1515 from the DHCP server will be used on the current link.
7169cdc8 1516 If <varname>MTUBytes=</varname> is set, then this setting is ignored.
95ab9eff 1517 Defaults to false.</para>
798d3a52
ZJS
1518 </listitem>
1519 </varlistentry>
7585baa0 1520 <varlistentry>
1521 <term><varname>Anonymize=</varname></term>
1522 <listitem>
9b6ffef3 1523 <para>Takes a boolean. When true, the options sent to the DHCP server will
7585baa0 1524 follow the <ulink url="https://tools.ietf.org/html/rfc7844">RFC 7844</ulink>
1525 (Anonymity Profiles for DHCP Clients) to minimize disclosure of identifying information.
1526 Defaults to false.</para>
1527
1528 <para>This option should only be set to true when
1529 <varname>MACAddressPolicy=</varname> is set to <literal>random</literal>
1530 (see <citerefentry
1531 project='man-pages'><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>).</para>
1532
1533 <para>Note that this configuration will overwrite others.
1534 In concrete, the following variables will be ignored:
1535 <varname>SendHostname=</varname>, <varname>ClientIdentifier=</varname>,
da2076a1
TK
1536 <varname>UseRoutes=</varname>, <varname>UseMTU=</varname>,
1537 <varname>VendorClassIdentifier=</varname>, <varname>UseTimezone=</varname>.</para>
fba10579
LP
1538
1539 <para>With this option enabled DHCP requests will mimic those generated by Microsoft Windows, in
1540 order to reduce the ability to fingerprint and recognize installations. This means DHCP request
1541 sizes will grow and lease data will be more comprehensive than normally, though most of the
1542 requested data is not actually used.</para>
7585baa0 1543 </listitem>
1544 </varlistentry>
798d3a52
ZJS
1545 <varlistentry>
1546 <term><varname>SendHostname=</varname></term>
1547 <listitem>
31ee3973
YW
1548 <para>When true (the default), the machine's hostname will be sent to the DHCP server.
1549 Note that the machine's hostname must consist only of 7-bit ASCII lower-case characters and
1550 no spaces or dots, and be formatted as a valid DNS domain name. Otherwise, the hostname is not
cad8d671 1551 sent even if this is set to true.</para>
798d3a52
ZJS
1552 </listitem>
1553 </varlistentry>
7b8d23a9
SS
1554
1555 <varlistentry>
1556 <term><varname>MUDURL=</varname></term>
1557 <listitem>
0558f303
ZJS
1558 <para>When configured, the specified Manufacturer Usage Description (MUD) URL will be sent to the
1559 DHCPv4 server. Takes a URL of length up to 255 characters. A superficial verification that the
1560 string is a valid URL will be performed. DHCPv4 clients are intended to have at most one MUD URL
1561 associated with them. See <ulink url="https://tools.ietf.org/html/rfc8520">RFC 8520</ulink>.
1562 </para>
1563
1564 <para>MUD is an embedded software standard defined by the IETF that allows IoT device makers to
1565 advertise device specifications, including the intended communication patterns for their device
1566 when it connects to the network. The network can then use this to author a context-specific
1567 access policy, so the device functions only within those parameters.</para>
7b8d23a9
SS
1568 </listitem>
1569 </varlistentry>
1570
798d3a52
ZJS
1571 <varlistentry>
1572 <term><varname>UseHostname=</varname></term>
1573 <listitem>
1574 <para>When true (the default), the hostname received from
31ee3973 1575 the DHCP server will be set as the transient hostname of the system.
d59be2cf 1576 </para>
798d3a52
ZJS
1577 </listitem>
1578 </varlistentry>
1adc5d0b 1579 <varlistentry>
31ee3973
YW
1580 <term><varname>Hostname=</varname></term>
1581 <listitem>
1582 <para>Use this value for the hostname which is sent to the DHCP server, instead of machine's hostname.
1583 Note that the specified hostname must consist only of 7-bit ASCII lower-case characters and
1584 no spaces or dots, and be formatted as a valid DNS domain name.</para>
1585 </listitem>
1586 </varlistentry>
798d3a52
ZJS
1587 <varlistentry>
1588 <term><varname>UseDomains=</varname></term>
1589 <listitem>
9b6ffef3 1590 <para>Takes a boolean, or the special value <literal>route</literal>. When true, the domain name
b2a81c0b
LP
1591 received from the DHCP server will be used as DNS search domain over this link, similar to the effect of
1592 the <option>Domains=</option> setting. If set to <literal>route</literal>, the domain name received from
1593 the DHCP server will be used for routing DNS queries only, but not for searching, similar to the effect of
1594 the <option>Domains=</option> setting when the argument is prefixed with <literal>~</literal>. Defaults to
1595 false.</para>
1596
1597 <para>It is recommended to enable this option only on trusted networks, as setting this affects resolution
38b38500 1598 of all hostnames, in particular of single-label names. It is generally safer to use the supplied domain
b2a81c0b
LP
1599 only as routing domain, rather than as search domain, in order to not have it affect local resolution of
1600 single-label names.</para>
1601
1602 <para>When set to true, this setting corresponds to the <option>domain</option> option in <citerefentry
1603 project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
798d3a52
ZJS
1604 </listitem>
1605 </varlistentry>
1606 <varlistentry>
1607 <term><varname>UseRoutes=</varname></term>
1608 <listitem>
d6eac9bd
DW
1609 <para>When true (the default), the static routes will be requested from the DHCP server and added to the
1610 routing table with a metric of 1024, and a scope of "global", "link" or "host", depending on the route's
1611 destination and gateway. If the destination is on the local host, e.g., 127.x.x.x, or the same as the
1612 link's own address, the scope will be set to "host". Otherwise if the gateway is null (a direct route), a
1613 "link" scope will be used. For anything else, scope defaults to "global".</para>
798d3a52
ZJS
1614 </listitem>
1615 </varlistentry>
b4531227
YW
1616 <varlistentry>
1617 <term><varname>UseGateway=</varname></term>
1618 <listitem>
589397a2
DS
1619 <para>When true, the gateway will be requested from the DHCP server and added to the routing table with a
1620 metric of 1024, and a scope of "link". When unset, the value specified with <option>UseRoutes=</option>
1621 is used.</para>
b4531227
YW
1622 </listitem>
1623 </varlistentry>
ad943783
LP
1624 <varlistentry>
1625 <term><varname>UseTimezone=</varname></term>
1626
1627 <listitem><para>When true, the timezone received from the
7f3fdb7f 1628 DHCP server will be set as timezone of the local
ad943783
LP
1629 system. Defaults to <literal>no</literal>.</para></listitem>
1630 </varlistentry>
1631
3e43b2cd
JJ
1632 <varlistentry>
1633 <term><varname>ClientIdentifier=</varname></term>
1634 <listitem>
dace710c
YW
1635 <para>The DHCPv4 client identifier to use. Takes one of <literal>mac</literal>, <literal>duid</literal> or <literal>duid-only</literal>.
1636 If set to <literal>mac</literal>, the MAC address of the link is used.
1637 If set to <literal>duid</literal>, an RFC4361-compliant Client ID, which is the combination of IAID and DUID (see below), is used.
1638 If set to <literal>duid-only</literal>, only DUID is used, this may not be RFC compliant, but some setups may require to use this.
1639 Defaults to <literal>duid</literal>.</para>
3e43b2cd
JJ
1640 </listitem>
1641 </varlistentry>
e2e08e77 1642
798d3a52
ZJS
1643 <varlistentry>
1644 <term><varname>VendorClassIdentifier=</varname></term>
1645 <listitem>
1646 <para>The vendor class identifier used to identify vendor
1647 type and configuration.</para>
1648 </listitem>
1649 </varlistentry>
076ea6f6 1650
af1c0de0
SS
1651 <varlistentry>
1652 <term><varname>UserClass=</varname></term>
1653 <listitem>
1654 <para>A DHCPv4 client can use UserClass option to identify the type or category of user or applications
1655 it represents. The information contained in this option is a string that represents the user class of which
1656 the client is a member. Each class sets an identifying string of information to be used by the DHCP
1657 service to classify clients. Takes a whitespace-separated list of strings.</para>
1658 </listitem>
1659 </varlistentry>
1660
715cedfb
SS
1661 <varlistentry>
1662 <term><varname>MaxAttempts=</varname></term>
1663 <listitem>
1664 <para>Specifies how many times the DHCPv4 client configuration should be attempted. Takes a
1665 number or <literal>infinity</literal>. Defaults to <literal>infinity</literal>.
1666 Note that the time between retries is increased exponentially, so the network will not be
1667 overloaded even if this number is high.</para>
1668 </listitem>
1669 </varlistentry>
1670
e2e08e77
ZJS
1671 <varlistentry>
1672 <term><varname>DUIDType=</varname></term>
1673 <listitem>
1674 <para>Override the global <varname>DUIDType</varname> setting for this network. See
1675 <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1676 for a description of possible values.</para>
1677 </listitem>
1678 </varlistentry>
076ea6f6 1679
e2e08e77
ZJS
1680 <varlistentry>
1681 <term><varname>DUIDRawData=</varname></term>
1682 <listitem>
1683 <para>Override the global <varname>DUIDRawData</varname> setting for this network. See
1684 <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1685 for a description of possible values.</para>
076ea6f6
LP
1686 </listitem>
1687 </varlistentry>
e2e08e77 1688
d05def16
LP
1689 <varlistentry>
1690 <term><varname>IAID=</varname></term>
1691 <listitem>
1692 <para>The DHCP Identity Association Identifier (IAID) for the interface, a 32-bit unsigned integer.</para>
1693 </listitem>
1694 </varlistentry>
1695
798d3a52
ZJS
1696 <varlistentry>
1697 <term><varname>RequestBroadcast=</varname></term>
1698 <listitem>
1699 <para>Request the server to use broadcast messages before
1700 the IP address has been configured. This is necessary for
1701 devices that cannot receive RAW packets, or that cannot
1702 receive packets at all before an IP address has been
1703 configured. On the other hand, this must not be enabled on
1704 networks where broadcasts are filtered out.</para>
1705 </listitem>
1706 </varlistentry>
e2e08e77 1707
798d3a52
ZJS
1708 <varlistentry>
1709 <term><varname>RouteMetric=</varname></term>
1710 <listitem>
1bf1bfd9 1711 <para>Set the routing metric for routes specified by the DHCP server. Defaults to 1024.</para>
798d3a52
ZJS
1712 </listitem>
1713 </varlistentry>
f594276b
JK
1714
1715 <varlistentry>
1716 <term><varname>RouteTable=<replaceable>num</replaceable></varname></term>
1717 <listitem>
d11e656a 1718 <para>The table identifier for DHCP routes (a number between 1 and 4294967295, or 0 to unset).
f594276b
JK
1719 The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
1720 </para>
e9dd6984
ZJS
1721 <para>When used in combination with <varname>VRF=</varname>, the
1722 VRF's routing table is used when this parameter is not specified.
917b2260 1723 </para>
f594276b
JK
1724 </listitem>
1725 </varlistentry>
9faed222 1726
c695dcf9
SS
1727 <varlistentry>
1728 <term><varname>RouteMTUBytes=</varname></term>
1729 <listitem>
1730 <para>Specifies the MTU for the DHCP routes. Please see the [Route] section for further details.</para>
1731 </listitem>
1732 </varlistentry>
1733
9faed222
SS
1734 <varlistentry>
1735 <term><varname>ListenPort=</varname></term>
1736 <listitem>
1737 <para>Allow setting custom port for the DHCP client to listen on.</para>
1738 </listitem>
1739 </varlistentry>
fb5c8216 1740
d6463307
SS
1741 <varlistentry>
1742 <term><varname>FallbackLeaseLifetimeSec=</varname></term>
1743 <listitem>
1744 <para>Allows to set DHCPv4 lease lifetime when DHCPv4 server does not send the lease lifetime.
1745 Takes one of <literal>forever</literal> or <literal>infinity</literal> means that the address
1746 never expires. Defaults to unset.</para>
1747 </listitem>
1748 </varlistentry>
1749
1501b429
SS
1750 <varlistentry>
1751 <term><varname>SendRelease=</varname></term>
1752 <listitem>
1753 <para>When true, the DHCPv4 client sends a DHCP release packet when it stops.
5f3b5f19 1754 Defaults to true.</para>
1501b429
SS
1755 </listitem>
1756 </varlistentry>
1757
0f3ff4ea
SS
1758 <varlistentry>
1759 <term><varname>SendDecline=</varname></term>
1760 <listitem>
e9dd6984
ZJS
1761 <para>A boolean. When <literal>true</literal>, the DHCPv4 client receives the IP address from the
1762 DHCP server. After a new IP is received, the DHCPv4 client performs IPv4 Duplicate Address
1763 Detection. If duplicate use is detected, the DHCPv4 client rejects the IP by sending a
1764 DHCPDECLINE packet and tries to obtain an IP address again. See <ulink
1765 url="https://tools.ietf.org/html/rfc5227">RFC 5224</ulink>. Defaults to
1766 <literal>unset</literal>.</para>
0f3ff4ea
SS
1767 </listitem>
1768 </varlistentry>
1769
caa8ca42 1770 <varlistentry>
6b000af4 1771 <term><varname>DenyList=</varname></term>
5bc945be 1772 <listitem>
98ebef62
SS
1773 <para>A whitespace-separated list of IPv4 addresses. DHCP offers from servers in the list are rejected. Note that
1774 if <varname>AllowList=</varname> is configured then <varname>DenyList=</varname> is ignored.</para>
1775 </listitem>
1776 </varlistentry>
1777
1778 <varlistentry>
1779 <term><varname>AllowList=</varname></term>
1780 <listitem>
1781 <para>A whitespace-separated list of IPv4 addresses. DHCP offers from servers in the list are accepted.</para>
5bc945be
SS
1782 </listitem>
1783 </varlistentry>
1784
1785 <varlistentry>
1786 <term><varname>RequestOptions=</varname></term>
caa8ca42 1787 <listitem>
35f6a5cb
SS
1788 <para>When configured, allows to set arbitrary request options in the DHCPv4 request options list and will be
1789 sent to the DHCPV4 server. A whitespace-separated list of integers in the range 1..254. Defaults to unset.</para>
caa8ca42
SS
1790 </listitem>
1791 </varlistentry>
1792
cb29c156 1793 <varlistentry>
864edb39 1794 <term><varname>SendOption=</varname></term>
cb29c156 1795 <listitem>
7354900d
DW
1796 <para>Send an arbitrary raw option in the DHCPv4 request. Takes a DHCP option number, data type
1797 and data separated with a colon
1798 (<literal><replaceable>option</replaceable>:<replaceable>type</replaceable>:<replaceable>value</replaceable></literal>).
1799 The option number must be an integer in the range 1..254. The type takes one of <literal>uint8</literal>,
1800 <literal>uint16</literal>, <literal>uint32</literal>, <literal>ipv4address</literal>, or
1801 <literal>string</literal>. Special characters in the data string may be escaped using
1802 <ulink url="https://en.wikipedia.org/wiki/Escape_sequences_in_C#Table_of_escape_sequences">C-style
1803 escapes</ulink>. This setting can be specified multiple times. If an empty string is specified,
1804 then all options specified earlier are cleared. Defaults to unset.</para>
1805 </listitem>
1806 </varlistentry>
1807
1808 <varlistentry>
1809 <term><varname>SendVendorOption=</varname></term>
1810 <listitem>
1811 <para>Send an arbitrary vendor option in the DHCPv4 request. Takes a DHCP option number, data type
d8b736bd
YW
1812 and data separated with a colon
1813 (<literal><replaceable>option</replaceable>:<replaceable>type</replaceable>:<replaceable>value</replaceable></literal>).
11fcfc53 1814 The option number must be an integer in the range 1..254. The type takes one of <literal>uint8</literal>,
d8b736bd
YW
1815 <literal>uint16</literal>, <literal>uint32</literal>, <literal>ipv4address</literal>, or
1816 <literal>string</literal>. Special characters in the data string may be escaped using
a2cc708a 1817 <ulink url="https://en.wikipedia.org/wiki/Escape_sequences_in_C#Table_of_escape_sequences">C-style
d8b736bd 1818 escapes</ulink>. This setting can be specified multiple times. If an empty string is specified,
a2cc708a 1819 then all options specified earlier are cleared. Defaults to unset.</para>
cb29c156
SS
1820 </listitem>
1821 </varlistentry>
caa8ca42
SS
1822 </variablelist>
1823 </refsect1>
1824
1825 <refsect1>
1826 <title>[DHCPv6] Section Options</title>
bdac5608 1827 <para>The [DHCPv6] section configures the DHCPv6 client, if it is enabled with the
4f7331a8 1828 <varname>DHCP=</varname> setting described above, or invoked by the IPv6 Router Advertisement:</para>
caa8ca42
SS
1829
1830 <variablelist class='network-directives'>
1831 <varlistentry>
1832 <term><varname>UseDNS=</varname></term>
1833 <term><varname>UseNTP=</varname></term>
1834 <listitem>
bdac5608 1835 <para>As in the [DHCPv4] section.</para>
caa8ca42
SS
1836 </listitem>
1837 </varlistentry>
1838
1bf1bfd9
YW
1839 <varlistentry>
1840 <term><varname>RouteMetric=</varname></term>
1841 <listitem>
1842 <para>Set the routing metric for routes specified by the DHCP server. Defaults to 1024.</para>
1843 </listitem>
1844 </varlistentry>
1845
fb5c8216
SS
1846 <varlistentry>
1847 <term><varname>RapidCommit=</varname></term>
1848 <listitem>
9b6ffef3 1849 <para>Takes a boolean. The DHCPv6 client can obtain configuration parameters from a DHCPv6 server through
fb5c8216
SS
1850 a rapid two-message exchange (solicit and reply). When the rapid commit option is enabled by both
1851 the DHCPv6 client and the DHCPv6 server, the two-message exchange is used, rather than the default
e9dd6984 1852 four-message exchange (solicit, advertise, request, and reply). The two-message exchange provides
fb5c8216
SS
1853 faster client configuration and is beneficial in environments in which networks are under a heavy load.
1854 See <ulink url="https://tools.ietf.org/html/rfc3315#section-17.2.1">RFC 3315</ulink> for details.
1855 Defaults to true.</para>
1856 </listitem>
1857 </varlistentry>
1858
3175a8c2
SS
1859 <varlistentry>
1860 <term><varname>MUDURL=</varname></term>
1861 <listitem>
0558f303
ZJS
1862 <para>When configured, the specified Manufacturer Usage Description (MUD) URL will be sent to
1863 the DHCPV6 server. The syntax and semantics are the same as for <varname>MUDURL=</varname> in the
1864 [DHCPv4] section described above.</para>
3175a8c2
SS
1865 </listitem>
1866 </varlistentry>
1867
35f6a5cb
SS
1868 <varlistentry>
1869 <term><varname>RequestOptions=</varname></term>
1870 <listitem>
885a4e6c
ZJS
1871 <para>When configured, allows to set arbitrary request options in the DHCPv6 request options list
1872 that will be sent to the DHCPV6 server. A whitespace-separated list of integers in the range
1873 1..254. Defaults to unset.</para>
35f6a5cb
SS
1874 </listitem>
1875 </varlistentry>
1876
b4ccc5de
SS
1877 <varlistentry>
1878 <term><varname>SendVendorOption=</varname></term>
1879 <listitem>
e9dd6984
ZJS
1880 <para>Send an arbitrary vendor option in the DHCPv6 request. Takes an enterprise identifier, DHCP
1881 option number, data type, and data separated with a colon (<literal><replaceable>enterprise
1882 identifier</replaceable>:<replaceable>option</replaceable>:<replaceable>type</replaceable>:
1883 <replaceable>value</replaceable></literal>). Enterprise identifier is an unsigned integer in the
1884 range 1–4294967294. The option number must be an integer in the range 1–254. Data type takes one
1885 of <literal>uint8</literal>, <literal>uint16</literal>, <literal>uint32</literal>,
1886 <literal>ipv4address</literal>, <literal>ipv6address</literal>, or
1887 <literal>string</literal>. Special characters in the data string may be escaped using <ulink
1888 url="https://en.wikipedia.org/wiki/Escape_sequences_in_C#Table_of_escape_sequences">C-style
b4ccc5de
SS
1889 escapes</ulink>. This setting can be specified multiple times. If an empty string is specified,
1890 then all options specified earlier are cleared. Defaults to unset.</para>
1891 </listitem>
1892 </varlistentry>
1893
125f20b4
PF
1894 <varlistentry>
1895 <term><varname>ForceDHCPv6PDOtherInformation=</varname></term>
1896 <listitem>
9b6ffef3 1897 <para>Takes a boolean that enforces DHCPv6 stateful mode when the 'Other information' bit is set in
125f20b4
PF
1898 Router Advertisement messages. By default setting only the 'O' bit in Router Advertisements
1899 makes DHCPv6 request network information in a stateless manner using a two-message Information
1900 Request and Information Reply message exchange.
1901 <ulink url="https://tools.ietf.org/html/rfc7084">RFC 7084</ulink>, requirement WPD-4, updates
1902 this behavior for a Customer Edge router so that stateful DHCPv6 Prefix Delegation is also
1903 requested when only the 'O' bit is set in Router Advertisements. This option enables such a CE
1904 behavior as it is impossible to automatically distinguish the intention of the 'O' bit otherwise.
1905 By default this option is set to 'false', enable it if no prefixes are delegated when the device
1906 should be acting as a CE router.</para>
1907 </listitem>
1908 </varlistentry>
1909
2805536b
SS
1910 <varlistentry>
1911 <term><varname>PrefixDelegationHint=</varname></term>
1912 <listitem>
e9dd6984
ZJS
1913 <para>Takes an IPv6 address with prefix length in the same format as the
1914 <varname>Address=</varname> in the [Network] section. The DHCPv6 client will include a prefix
1915 hint in the DHCPv6 solicitation sent to the server. The prefix length must be in the range
1916 1–128. Defaults to unset.</para>
2805536b
SS
1917 </listitem>
1918 </varlistentry>
cd305af1
SS
1919
1920 <varlistentry>
1921 <term><varname>WithoutRA=</varname></term>
1922 <listitem>
e9dd6984
ZJS
1923 <para>Allows DHCPv6 client to start without router advertisements's managed or other address
1924 configuration flag. Takes one of <literal>solicit</literal> or
1925 <literal>information-request</literal>. Defaults to unset.</para>
cd305af1
SS
1926 </listitem>
1927 </varlistentry>
e7d5fe17
AD
1928
1929 <varlistentry>
1930 <term><varname>SendOption=</varname></term>
1931 <listitem>
bdac5608 1932 <para>As in the [DHCPv4] section, however because DHCPv6 uses 16-bit fields to store
e7d5fe17
AD
1933 option numbers, the option number is an integer in the range 1..65536.</para>
1934 </listitem>
1935 </varlistentry>
f37f2a6b
SS
1936
1937 <varlistentry>
1938 <term><varname>UserClass=</varname></term>
1939 <listitem>
1940 <para>A DHCPv6 client can use User Class option to identify the type or category of user or applications
1941 it represents. The information contained in this option is a string that represents the user class of which
1942 the client is a member. Each class sets an identifying string of information to be used by the DHCP
1943 service to classify clients. Special characters in the data string may be escaped using
1944 <ulink url="https://en.wikipedia.org/wiki/Escape_sequences_in_C#Table_of_escape_sequences">C-style
1945 escapes</ulink>. This setting can be specified multiple times. If an empty string is specified,
1946 then all options specified earlier are cleared. Takes a whitespace-separated list of strings. Note that
1947 currently NUL bytes are not allowed.</para>
1948 </listitem>
1949 </varlistentry>
ed0d1b2e
SS
1950
1951 <varlistentry>
1952 <term><varname>VendorClass=</varname></term>
1953 <listitem>
1954 <para>A DHCPv6 client can use VendorClass option to identify the vendor that
1955 manufactured the hardware on which the client is running. The information
1956 contained in the data area of this option is contained in one or more opaque
1957 fields that identify details of the hardware configuration. Takes a
1958 whitespace-separated list of strings.</para>
1959 </listitem>
1960 </varlistentry>
ad943783 1961 </variablelist>
caa8ca42 1962 </refsect1>
99e015e2
YW
1963
1964 <refsect1>
1965 <title>[DHCPv6PrefixDelegation] Section Options</title>
e5ff2245
YW
1966 <para>The [DHCPv6PrefixDelegation] section configures delegated prefixes assigned by DHCPv6 server.
1967 The settings in this section are used only when <varname>DHCPv6PrefixDelegation=</varname> setting
1968 is enabled.</para>
99e015e2
YW
1969
1970 <variablelist class='network-directives'>
1971 <varlistentry>
1972 <term><varname>SubnetId=</varname></term>
1973 <listitem>
1974 <para>Configure a specific subnet ID on the interface from a (previously) received prefix
1975 delegation. You can either set "auto" (the default) or a specific subnet ID (as defined in
1976 <ulink url="https://tools.ietf.org/html/rfc4291#section-2.5.4">RFC 4291</ulink>, section
1977 2.5.4), in which case the allowed value is hexadecimal, from 0 to 0x7fffffffffffffff
e5ff2245
YW
1978 inclusive.</para>
1979 </listitem>
1980 </varlistentry>
1981
1982 <varlistentry>
1983 <term><varname>Announce=</varname></term>
1984 <listitem>
1985 <para>Takes a boolean. When enabled, and <varname>IPv6SendRA=</varname> in [Network] section
1986 is enabled, the delegated prefixes are distributed through the IPv6 Router Advertisement.
1987 Defaults to yes.</para>
99e015e2
YW
1988 </listitem>
1989 </varlistentry>
1990
1991 <varlistentry>
1992 <term><varname>Assign=</varname></term>
1993 <listitem>
1994 <para>Takes a boolean. Specifies whether to add an address from the delegated prefixes which
e5ff2245
YW
1995 are received from the WAN interface by the DHCPv6 Prefix Delegation. When true (on LAN
1996 interfce), the EUI-64 algorithm will be used by default to form an interface identifier from
1997 the delegated prefixes. See also <varname>Token=</varname> setting below. Defaults to yes.
1998 </para>
99e015e2
YW
1999 </listitem>
2000 </varlistentry>
2001
2002 <varlistentry>
2003 <term><varname>Token=</varname></term>
2004 <listitem>
e5ff2245
YW
2005 <para>Specifies an optional address generation mode for assigning an address in each
2006 delegated prefix. Takes an IPv6 address. When set, the lower bits of the supplied address is
2007 combined with the upper bits of each delegatad prefix received from the WAN interface by the
2008 DHCPv6 Prefix Delegation to form a complete address. When <varname>Assign=</varname> is
2009 disabled, this setting is ignored. When unset, the EUI-64 algorithm will be used to form
2010 addresses. Defaults to unset.</para>
99e015e2
YW
2011 </listitem>
2012 </varlistentry>
2013 </variablelist>
2014 </refsect1>
413708d1 2015
1e7a0e21 2016 <refsect1>
f921f573 2017 <title>[IPv6AcceptRA] Section Options</title>
bdac5608
ZJS
2018 <para>The [IPv6AcceptRA] section configures the IPv6 Router Advertisement (RA) client, if it is enabled
2019 with the <varname>IPv6AcceptRA=</varname> setting described above:</para>
1e7a0e21
LP
2020
2021 <variablelist class='network-directives'>
2022 <varlistentry>
2023 <term><varname>UseDNS=</varname></term>
2024 <listitem>
2025 <para>When true (the default), the DNS servers received in the Router Advertisement will be used and take
2026 precedence over any statically configured ones.</para>
2027
2028 <para>This corresponds to the <option>nameserver</option> option in <citerefentry
2029 project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
2030 </listitem>
2031 </varlistentry>
2032
2033 <varlistentry>
2034 <term><varname>UseDomains=</varname></term>
2035 <listitem>
9b6ffef3 2036 <para>Takes a boolean, or the special value <literal>route</literal>. When true, the domain name
1e7a0e21
LP
2037 received via IPv6 Router Advertisement (RA) will be used as DNS search domain over this link, similar to
2038 the effect of the <option>Domains=</option> setting. If set to <literal>route</literal>, the domain name
2039 received via IPv6 RA will be used for routing DNS queries only, but not for searching, similar to the
2040 effect of the <option>Domains=</option> setting when the argument is prefixed with
2041 <literal>~</literal>. Defaults to false.</para>
2042
2043 <para>It is recommended to enable this option only on trusted networks, as setting this affects resolution
38b38500 2044 of all hostnames, in particular of single-label names. It is generally safer to use the supplied domain
1e7a0e21
LP
2045 only as routing domain, rather than as search domain, in order to not have it affect local resolution of
2046 single-label names.</para>
2047
2048 <para>When set to true, this setting corresponds to the <option>domain</option> option in <citerefentry
2049 project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
2050 </listitem>
2051 </varlistentry>
2ba31d29
JK
2052
2053 <varlistentry>
2054 <term><varname>RouteTable=<replaceable>num</replaceable></varname></term>
2055 <listitem>
d11e656a
ZJS
2056 <para>The table identifier for the routes received in the Router Advertisement
2057 (a number between 1 and 4294967295, or 0 to unset).
2ba31d29
JK
2058 The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
2059 </para>
2060 </listitem>
2061 </varlistentry>
062c2eea
SS
2062
2063 <varlistentry>
2064 <term><varname>UseAutonomousPrefix=</varname></term>
2065 <listitem>
2066 <para>When true (the default), the autonomous prefix received in the Router Advertisement will be used and take
2067 precedence over any statically configured ones.</para>
2068 </listitem>
2069 </varlistentry>
2070
2071 <varlistentry>
2072 <term><varname>UseOnLinkPrefix=</varname></term>
2073 <listitem>
885a4e6c
ZJS
2074 <para>When true (the default), the onlink prefix received in the Router Advertisement will be
2075 used and takes precedence over any statically configured ones.</para>
062c2eea
SS
2076 </listitem>
2077 </varlistentry>
2078
e520ce64 2079 <varlistentry>
6b000af4 2080 <term><varname>DenyList=</varname></term>
e520ce64
SS
2081 <listitem>
2082 <para>A whitespace-separated list of IPv6 prefixes. IPv6 prefixes supplied via router advertisements in the list are ignored.</para>
2083 </listitem>
2084 </varlistentry>
2085
d739fdde
YW
2086 <varlistentry>
2087 <term><varname>DHCPv6Client=</varname></term>
2088 <listitem>
ac24e418
SS
2089 <para>Takes a boolean, or the special value <literal>always</literal>. When true (the default), the DHCPv6 client will be started when the
2090 RA has the managed or other information flag. If set to <literal>always</literal>, the DHCPv6 client will be started even if there is no
2091 managed or other information flag in the RA.</para>
d739fdde
YW
2092 </listitem>
2093 </varlistentry>
1e7a0e21
LP
2094 </variablelist>
2095 </refsect1>
2096
ad943783
LP
2097 <refsect1>
2098 <title>[DHCPServer] Section Options</title>
bdac5608 2099 <para>The [DHCPServer] section contains settings for the DHCP server, if enabled via the
ad943783
LP
2100 <varname>DHCPServer=</varname> option described above:</para>
2101
2102 <variablelist class='network-directives'>
2103
9b3a67c5
TG
2104 <varlistentry>
2105 <term><varname>PoolOffset=</varname></term>
2106 <term><varname>PoolSize=</varname></term>
2107
2108 <listitem><para>Configures the pool of addresses to hand out. The pool
2109 is a contiguous sequence of IP addresses in the subnet configured for
2110 the server address, which does not include the subnet nor the broadcast
2111 address. <varname>PoolOffset=</varname> takes the offset of the pool
2112 from the start of subnet, or zero to use the default value.
2113 <varname>PoolSize=</varname> takes the number of IP addresses in the
b938cb90 2114 pool or zero to use the default value. By default, the pool starts at
9b3a67c5
TG
2115 the first address after the subnet address and takes up the rest of
2116 the subnet, excluding the broadcast address. If the pool includes
2117 the server address (the default), this is reserved and not handed
2118 out to clients.</para></listitem>
2119 </varlistentry>
2120
ad943783
LP
2121 <varlistentry>
2122 <term><varname>DefaultLeaseTimeSec=</varname></term>
2123 <term><varname>MaxLeaseTimeSec=</varname></term>
2124
2125 <listitem><para>Control the default and maximum DHCP lease
2126 time to pass to clients. These settings take time values in seconds or
2127 another common time unit, depending on the suffix. The default
2128 lease time is used for clients that did not ask for a specific
2129 lease time. If a client asks for a lease time longer than the
b938cb90 2130 maximum lease time, it is automatically shortened to the
ad943783
LP
2131 specified time. The default lease time defaults to 1h, the
2132 maximum lease time to 12h. Shorter lease times are beneficial
2133 if the configuration data in DHCP leases changes frequently
2134 and clients shall learn the new settings with shorter
2135 latencies. Longer lease times reduce the generated DHCP
2136 network traffic.</para></listitem>
2137 </varlistentry>
2138
2139 <varlistentry>
2140 <term><varname>EmitDNS=</varname></term>
2141 <term><varname>DNS=</varname></term>
2142
2a71d57f
LP
2143 <listitem><para><varname>EmitDNS=</varname> takes a boolean. Configures whether the DHCP leases
2144 handed out to clients shall contain DNS server information. Defaults to <literal>yes</literal>. The
2145 DNS servers to pass to clients may be configured with the <varname>DNS=</varname> option, which takes
2146 a list of IPv4 addresses. If the <varname>EmitDNS=</varname> option is enabled but no servers
2147 configured, the servers are automatically propagated from an "uplink" interface that has appropriate
2148 servers set. The "uplink" interface is determined by the default route of the system with the highest
2149 priority. Note that this information is acquired at the time the lease is handed out, and does not
2150 take uplink interfaces into account that acquire DNS server information at a later point. If no
2151 suitable uplinkg interface is found the DNS server data from <filename>/etc/resolv.conf</filename> is
2152 used. Also, note that the leases are not refreshed if the uplink network configuration changes. To
2153 ensure clients regularly acquire the most current uplink DNS server information, it is thus advisable
2154 to shorten the DHCP lease time via <varname>MaxLeaseTimeSec=</varname> described
ad943783
LP
2155 above.</para></listitem>
2156 </varlistentry>
2157
2158 <varlistentry>
2159 <term><varname>EmitNTP=</varname></term>
2160 <term><varname>NTP=</varname></term>
299d578f
SS
2161 <term><varname>EmitSIP=</varname></term>
2162 <term><varname>SIP=</varname></term>
2a71d57f
LP
2163 <term><varname>EmitPOP3=</varname></term>
2164 <term><varname>POP3=</varname></term>
2165 <term><varname>EmitSMTP=</varname></term>
2166 <term><varname>SMTP=</varname></term>
2167 <term><varname>EmitLPR=</varname></term>
2168 <term><varname>LPR=</varname></term>
2169
2170 <listitem><para>Similar to the <varname>EmitDNS=</varname> and <varname>DNS=</varname> settings
2171 described above, these settings configure whether and what server information for the indicate
2172 protocol shall be emitted as part of the DHCP lease. The same syntax, propagation semantics and
2173 defaults apply as for <varname>EmitDNS=</varname> and <varname>DNS=</varname>.</para></listitem>
284e8fd0
SS
2174 </varlistentry>
2175
77ff6022
CG
2176 <varlistentry>
2177 <term><varname>EmitRouter=</varname></term>
2178
2179 <listitem><para>Similar to the <varname>EmitDNS=</varname>
2180 setting described above, this setting configures whether the
2181 DHCP lease should contain the router option. The same syntax,
2182 propagation semantics and defaults apply as for
2183 <varname>EmitDNS=</varname>.</para></listitem>
2184 </varlistentry>
2185
ad943783
LP
2186 <varlistentry>
2187 <term><varname>EmitTimezone=</varname></term>
2188 <term><varname>Timezone=</varname></term>
2189
9b6ffef3
YW
2190 <listitem><para>Takes a boolean. Configures whether the DHCP leases handed out
2191 to clients shall contain timezone information. Defaults to <literal>yes</literal>. The
ad943783
LP
2192 <varname>Timezone=</varname> setting takes a timezone string
2193 (such as <literal>Europe/Berlin</literal> or
2194 <literal>UTC</literal>) to pass to clients. If no explicit
b938cb90 2195 timezone is set, the system timezone of the local host is
ad943783
LP
2196 propagated, as determined by the
2197 <filename>/etc/localtime</filename> symlink.</para></listitem>
2198 </varlistentry>
2199
564ca984 2200 <varlistentry>
d8b736bd
YW
2201 <term><varname>SendOption=</varname></term>
2202 <listitem>
2203 <para>Send a raw option with value via DHCPv4 server. Takes a DHCP option number, data type
2204 and data (<literal><replaceable>option</replaceable>:<replaceable>type</replaceable>:<replaceable>value</replaceable></literal>).
2205 The option number is an integer in the range 1..254. The type takes one of <literal>uint8</literal>,
e7d5fe17 2206 <literal>uint16</literal>, <literal>uint32</literal>, <literal>ipv4address</literal>, <literal>ipv6address</literal>, or
7354900d
DW
2207 <literal>string</literal>. Special characters in the data string may be escaped using
2208 <ulink url="https://en.wikipedia.org/wiki/Escape_sequences_in_C#Table_of_escape_sequences">C-style
2209 escapes</ulink>. This setting can be specified multiple times. If an empty string is specified,
2210 then all options specified earlier are cleared. Defaults to unset.</para>
2211 </listitem>
2212 </varlistentry>
2213
2214 <varlistentry>
2215 <term><varname>SendVendorOption=</varname></term>
2216 <listitem>
2217 <para>Send a vendor option with value via DHCPv4 server. Takes a DHCP option number, data type
2218 and data (<literal><replaceable>option</replaceable>:<replaceable>type</replaceable>:<replaceable>value</replaceable></literal>).
2219 The option number is an integer in the range 1..254. The type takes one of <literal>uint8</literal>,
d8b736bd
YW
2220 <literal>uint16</literal>, <literal>uint32</literal>, <literal>ipv4address</literal>, or
2221 <literal>string</literal>. Special characters in the data string may be escaped using
2222 <ulink url="https://en.wikipedia.org/wiki/Escape_sequences_in_C#Table_of_escape_sequences">C-style
2223 escapes</ulink>. This setting can be specified multiple times. If an empty string is specified,
2224 then all options specified earlier are cleared. Defaults to unset.</para>
2225 </listitem>
564ca984
SS
2226 </varlistentry>
2227
ad943783
LP
2228 </variablelist>
2229 </refsect1>
2230
798d3a52 2231 <refsect1>
e5ff2245
YW
2232 <title>[IPv6SendRA] Section Options</title>
2233 <para>The [IPv6SendRA] section contains settings for sending IPv6 Router Advertisements and whether
2234 to act as a router, if enabled via the <varname>IPv6SendRA=</varname> option described above. IPv6
2235 network prefixes or routes are defined with one or more [IPv6Prefix] or [IPv6RoutePrefix] sections.
2236 </para>
3f9e0236
PF
2237
2238 <variablelist class='network-directives'>
2239
2240 <varlistentry>
2241 <term><varname>Managed=</varname></term>
2242 <term><varname>OtherInformation=</varname></term>
2243
9b6ffef3
YW
2244 <listitem><para>Takes a boolean. Controls whether a DHCPv6 server is used to acquire IPv6
2245 addresses on the network link when <varname>Managed=</varname>
3f9e0236
PF
2246 is set to <literal>true</literal> or if only additional network
2247 information can be obtained via DHCPv6 for the network link when
9b6ffef3 2248 <varname>OtherInformation=</varname> is set to
3f9e0236
PF
2249 <literal>true</literal>. Both settings default to
2250 <literal>false</literal>, which means that a DHCPv6 server is not being
2251 used.</para></listitem>
2252 </varlistentry>
2253
2254 <varlistentry>
2255 <term><varname>RouterLifetimeSec=</varname></term>
2256
9b6ffef3 2257 <listitem><para>Takes a timespan. Configures the IPv6 router lifetime in seconds. If set,
3f9e0236 2258 this host also announces itself in Router Advertisements as an IPv6
025314d9 2259 router for the network link. When unset, the host is not acting as a router.</para>
3f9e0236
PF
2260 </listitem>
2261 </varlistentry>
2262
2263 <varlistentry>
2264 <term><varname>RouterPreference=</varname></term>
2265
2266 <listitem><para>Configures IPv6 router preference if
2267 <varname>RouterLifetimeSec=</varname> is non-zero. Valid values are
2268 <literal>high</literal>, <literal>medium</literal> and
2269 <literal>low</literal>, with <literal>normal</literal> and
2270 <literal>default</literal> added as synonyms for
2271 <literal>medium</literal> just to make configuration easier. See
2272 <ulink url="https://tools.ietf.org/html/rfc4191">RFC 4191</ulink>
2273 for details. Defaults to <literal>medium</literal>.</para></listitem>
2274 </varlistentry>
2275
2276 <varlistentry>
4cb8478c 2277 <term><varname>EmitDNS=</varname></term>
3f9e0236
PF
2278 <term><varname>DNS=</varname></term>
2279
bdac5608
ZJS
2280 <listitem><para><varname>DNS=</varname> specifies a list of recursive DNS server IPv6 addresses that
2281 are distributed via Router Advertisement messages when <varname>EmitDNS=</varname> is
2282 true. <varname>DNS=</varname> also takes special value <literal>_link_local</literal>; in that case
2283 the IPv6 link local address is distributed. If <varname>DNS=</varname> is empty, DNS servers are read
2284 from the [Network] section. If the [Network] section does not contain any DNS servers either, DNS
2285 servers from the uplink with the highest priority default route are used. When
2286 <varname>EmitDNS=</varname> is false, no DNS server information is sent in Router Advertisement
2287 messages. <varname>EmitDNS=</varname> defaults to true.</para></listitem>
3f9e0236
PF
2288 </varlistentry>
2289
760021c0 2290 <varlistentry>
4cb8478c 2291 <term><varname>EmitDomains=</varname></term>
760021c0
PF
2292 <term><varname>Domains=</varname></term>
2293
bdac5608
ZJS
2294 <listitem><para>A list of DNS search domains distributed via Router Advertisement messages when
2295 <varname>EmitDomains=</varname> is true. If <varname>Domains=</varname> is empty, DNS search domains
2296 are read from the [Network] section. If the [Network] section does not contain any DNS search domains
2297 either, DNS search domains from the uplink with the highest priority default route are used. When
2298 <varname>EmitDomains=</varname> is false, no DNS search domain information is sent in Router
2299 Advertisement messages. <varname>EmitDomains=</varname> defaults to true.</para></listitem>
760021c0
PF
2300 </varlistentry>
2301
3f9e0236
PF
2302 <varlistentry>
2303 <term><varname>DNSLifetimeSec=</varname></term>
2304
2305 <listitem><para>Lifetime in seconds for the DNS server addresses listed
760021c0
PF
2306 in <varname>DNS=</varname> and search domains listed in
2307 <varname>Domains=</varname>.</para></listitem>
3f9e0236
PF
2308 </varlistentry>
2309
2310 </variablelist>
2311 </refsect1>
2312
203d4df5 2313 <refsect1>
3f9e0236 2314 <title>[IPv6Prefix] Section Options</title>
e9dd6984
ZJS
2315 <para>One or more [IPv6Prefix] sections contain the IPv6 prefixes that are announced via Router
2316 Advertisements. See <ulink url="https://tools.ietf.org/html/rfc4861">RFC 4861</ulink> for further
2317 details.</para>
3f9e0236
PF
2318
2319 <variablelist class='network-directives'>
2320
2321 <varlistentry>
2322 <term><varname>AddressAutoconfiguration=</varname></term>
2323 <term><varname>OnLink=</varname></term>
2324
9b6ffef3 2325 <listitem><para>Takes a boolean to specify whether IPv6 addresses can be
3f9e0236
PF
2326 autoconfigured with this prefix and whether the prefix can be used for
2327 onlink determination. Both settings default to <literal>true</literal>
2328 in order to ease configuration.
2329 </para></listitem>
2330 </varlistentry>
2331
2332 <varlistentry>
2333 <term><varname>Prefix=</varname></term>
2334
bdac5608
ZJS
2335 <listitem><para>The IPv6 prefix that is to be distributed to hosts. Similarly to configuring static
2336 IPv6 addresses, the setting is configured as an IPv6 prefix and its prefix length, separated by a
2337 <literal>/</literal> character. Use multiple [IPv6Prefix] sections to configure multiple IPv6
2338 prefixes since prefix lifetimes, address autoconfiguration and onlink status may differ from one
2339 prefix to another.</para></listitem>
3f9e0236
PF
2340 </varlistentry>
2341
2342 <varlistentry>
2343 <term><varname>PreferredLifetimeSec=</varname></term>
2344 <term><varname>ValidLifetimeSec=</varname></term>
2345
2346 <listitem><para>Preferred and valid lifetimes for the prefix measured in
2347 seconds. <varname>PreferredLifetimeSec=</varname> defaults to 604800
2348 seconds (one week) and <varname>ValidLifetimeSec=</varname> defaults
2349 to 2592000 seconds (30 days).</para></listitem>
203d4df5
SS
2350 </varlistentry>
2351
bd6379ec
SS
2352 <varlistentry>
2353 <term><varname>Assign=</varname></term>
2354 <listitem><para>Takes a boolean. When true, adds an address from the prefix. Default to false.
2355 </para></listitem>
2356 </varlistentry>
203d4df5
SS
2357 </variablelist>
2358 </refsect1>
2359
2360 <refsect1>
2361 <title>[IPv6RoutePrefix] Section Options</title>
bdac5608 2362 <para>One or more [IPv6RoutePrefix] sections contain the IPv6
203d4df5
SS
2363 prefix routes that are announced via Router Advertisements. See
2364 <ulink url="https://tools.ietf.org/html/rfc4191">RFC 4191</ulink>
2365 for further details.</para>
2366
2367 <variablelist class='network-directives'>
2368
2369 <varlistentry>
2370 <term><varname>Route=</varname></term>
2371
bdac5608
ZJS
2372 <listitem><para>The IPv6 route that is to be distributed to hosts. Similarly to configuring static
2373 IPv6 routes, the setting is configured as an IPv6 prefix routes and its prefix route length,
2374 separated by a <literal>/</literal> character. Use multiple [IPv6PrefixRoutes] sections to configure
2375 multiple IPv6 prefix routes.</para></listitem>
203d4df5
SS
2376 </varlistentry>
2377
2378 <varlistentry>
2379 <term><varname>LifetimeSec=</varname></term>
2380
2381 <listitem><para>Lifetime for the route prefix measured in
2382 seconds. <varname>LifetimeSec=</varname> defaults to 604800 seconds (one week).
2383 </para></listitem>
3f9e0236
PF
2384 </varlistentry>
2385
2386 </variablelist>
2387 </refsect1>
2388
2389 <refsect1>
798d3a52 2390 <title>[Bridge] Section Options</title>
bdac5608 2391 <para>The [Bridge] section accepts the following keys:</para>
798d3a52 2392 <variablelist class='network-directives'>
165c41a9
SS
2393 <varlistentry>
2394 <term><varname>UnicastFlood=</varname></term>
2395 <listitem>
9b6ffef3 2396 <para>Takes a boolean. Controls whether the bridge should flood
072f9e4a 2397 traffic for which an FDB entry is missing and the destination
025314d9 2398 is unknown through this port. When unset, the kernel's default will be used.
47c7dfe2 2399 </para>
165c41a9
SS
2400 </listitem>
2401 </varlistentry>
7f15b714
TJ
2402 <varlistentry>
2403 <term><varname>MulticastFlood=</varname></term>
2404 <listitem>
2405 <para>Takes a boolean. Controls whether the bridge should flood
2406 traffic for which an MDB entry is missing and the destination
2407 is unknown through this port. When unset, the kernel's default will be used.
2408 </para>
2409 </listitem>
2410 </varlistentry>
d3aa8b49
SS
2411 <varlistentry>
2412 <term><varname>MulticastToUnicast=</varname></term>
2413 <listitem>
2414 <para>Takes a boolean. Multicast to unicast works on top of the multicast snooping feature of
2415 the bridge. Which means unicast copies are only delivered to hosts which are interested in it.
2416 When unset, the kernel's default will be used.
2417 </para>
2418 </listitem>
2419 </varlistentry>
7f15b714
TJ
2420 <varlistentry>
2421 <term><varname>NeighborSuppression=</varname></term>
2422 <listitem>
2423 <para>Takes a boolean. Configures whether ARP and ND neighbor suppression is enabled for
2424 this port. When unset, the kernel's default will be used.
2425 </para>
2426 </listitem>
2427 </varlistentry>
2428 <varlistentry>
2429 <term><varname>Learning=</varname></term>
2430 <listitem>
2431 <para>Takes a boolean. Configures whether MAC address learning is enabled for
2432 this port. When unset, the kernel's default will be used.
2433 </para>
2434 </listitem>
2435 </varlistentry>
165c41a9
SS
2436 <varlistentry>
2437 <term><varname>HairPin=</varname></term>
2438 <listitem>
e9dd6984
ZJS
2439 <para>Takes a boolean. Configures whether traffic may be sent back out of the port on which it
2440 was received. When this flag is false, then the bridge will not forward traffic back out of the
2441 receiving port. When unset, the kernel's default will be used.</para>
165c41a9
SS
2442 </listitem>
2443 </varlistentry>
2444 <varlistentry>
84c34096 2445 <term><varname>UseBPDU=</varname></term>
165c41a9 2446 <listitem>
9b6ffef3 2447 <para>Takes a boolean. Configures whether STP Bridge Protocol Data Units will be
025314d9 2448 processed by the bridge port. When unset, the kernel's default will be used.</para>
165c41a9
SS
2449 </listitem>
2450 </varlistentry>
2451 <varlistentry>
2452 <term><varname>FastLeave=</varname></term>
2453 <listitem>
9b6ffef3 2454 <para>Takes a boolean. This flag allows the bridge to immediately stop multicast
a8eaaee7 2455 traffic on a port that receives an IGMP Leave message. It is only used with
025314d9 2456 IGMP snooping if enabled on the bridge. When unset, the kernel's default will be used.</para>
165c41a9
SS
2457 </listitem>
2458 </varlistentry>
2459 <varlistentry>
23da66bb 2460 <term><varname>AllowPortToBeRoot=</varname></term>
165c41a9 2461 <listitem>
9b6ffef3 2462 <para>Takes a boolean. Configures whether a given port is allowed to
47c7dfe2 2463 become a root port. Only used when STP is enabled on the bridge.
025314d9 2464 When unset, the kernel's default will be used.</para>
165c41a9
SS
2465 </listitem>
2466 </varlistentry>
1087623b
SS
2467 <varlistentry>
2468 <term><varname>ProxyARP=</varname></term>
2469 <listitem>
2470 <para>Takes a boolean. Configures whether proxy ARP to be enabled on this port.
2471 When unset, the kernel's default will be used.</para>
2472 </listitem>
2473 </varlistentry>
2474 <varlistentry>
2475 <term><varname>ProxyARPWiFi=</varname></term>
2476 <listitem>
2477 <para>Takes a boolean. Configures whether proxy ARP to be enabled on this port
2478 which meets extended requirements by IEEE 802.11 and Hotspot 2.0 specifications.
2479 When unset, the kernel's default will be used.</para>
2480 </listitem>
2481 </varlistentry>
0fadb2a4
SS
2482 <varlistentry>
2483 <term><varname>MulticastRouter=</varname></term>
2484 <listitem>
2485 <para>Configures this port for having multicast routers attached. A port with a multicast
2486 router will receive all multicast traffic. Takes one of <literal>no</literal>
2487 to disable multicast routers on this port, <literal>query</literal> to let the system detect
2488 the presence of routers, <literal>permanent</literal> to permanently enable multicast traffic
2489 forwarding on this port, or <literal>temporary</literal> to enable multicast routers temporarily
2490 on this port, not depending on incoming queries. When unset, the kernel's default will be used.</para>
2491 </listitem>
2492 </varlistentry>
798d3a52
ZJS
2493 <varlistentry>
2494 <term><varname>Cost=</varname></term>
2495 <listitem>
47c7dfe2 2496 <para>Sets the "cost" of sending packets of this interface.
a8eaaee7 2497 Each port in a bridge may have a different speed and the cost
798d3a52 2498 is used to decide which link to use. Faster interfaces
785889e5 2499 should have lower costs. It is an integer value between 1 and
b56be296
DJL
2500 65535.</para>
2501 </listitem>
2502 </varlistentry>
2503 <varlistentry>
2504 <term><varname>Priority=</varname></term>
2505 <listitem>
2506 <para>Sets the "priority" of sending packets on this interface.
2507 Each port in a bridge may have a different priority which is used
2508 to decide which link to use. Lower value means higher priority.
785889e5 2509 It is an integer value between 0 to 63. Networkd does not set any
b56be296 2510 default, meaning the kernel default value of 32 is used.</para>
798d3a52
ZJS
2511 </listitem>
2512 </varlistentry>
2513 </variablelist>
2514 </refsect1>
798d3a52
ZJS
2515 <refsect1>
2516 <title>[BridgeFDB] Section Options</title>
bdac5608
ZJS
2517 <para>The [BridgeFDB] section manages the forwarding database table of a port and accepts the following
2518 keys. Specify several [BridgeFDB] sections to configure several static MAC table entries.</para>
798d3a52
ZJS
2519
2520 <variablelist class='network-directives'>
2521 <varlistentry>
2522 <term><varname>MACAddress=</varname></term>
2523 <listitem>
bdac5608 2524 <para>As in the [Network] section. This key is mandatory.</para>
798d3a52
ZJS
2525 </listitem>
2526 </varlistentry>
c2c2793f
SS
2527 <varlistentry>
2528 <term><varname>Destination=</varname></term>
2529 <listitem>
2530 <para>Takes an IP address of the destination VXLAN tunnel endpoint.</para>
2531 </listitem>
2532 </varlistentry>
798d3a52
ZJS
2533 <varlistentry>
2534 <term><varname>VLANId=</varname></term>
2535 <listitem>
a8eaaee7 2536 <para>The VLAN ID for the new static MAC table entry. If
db9b9fb9 2537 omitted, no VLAN ID information is appended to the new static MAC
798d3a52
ZJS
2538 table entry.</para>
2539 </listitem>
2540 </varlistentry>
61b824c5
SS
2541 <varlistentry>
2542 <term><varname>VNI=</varname></term>
2543 <listitem>
2544 <para>The VXLAN Network Identifier (or VXLAN Segment ID) to use to connect to
2545 the remote VXLAN tunnel endpoint. Takes a number in the range 1-16777215.
2546 Defaults to unset.</para>
2547 </listitem>
2548 </varlistentry>
bdb397ed
SS
2549 <varlistentry>
2550 <term><varname>AssociatedWith=</varname></term>
2551 <listitem>
2552 <para>Specifies where the address is associated with. Takes one of <literal>use</literal>,
2553 <literal>self</literal>, <literal>master</literal> or <literal>router</literal>.
2554 <literal>use</literal> means the address is in use. User space can use this option to
2555 indicate to the kernel that the fdb entry is in use. <literal>self</literal> means
2556 the address is associated with the port drivers fdb. Usually hardware. <literal>master</literal>
2557 means the address is associated with master devices fdb. <literal>router</literal> means
2558 the destination address is associated with a router. Note that it's valid if the referenced
2559 device is a VXLAN type device and has route shortcircuit enabled. Defaults to <literal>self</literal>.</para>
2560 </listitem>
2561 </varlistentry>
798d3a52
ZJS
2562 </variablelist>
2563 </refsect1>
a1717e9a
DM
2564 <refsect1>
2565 <title>[BridgeMDB] Section Options</title>
2566 <para>The [BridgeMDB] section manages the multicast membership entries forwarding database table of a port and accepts the following
2567 keys. Specify several [BridgeMDB] sections to configure several permanent multicast membership entries.</para>
2568
2569 <variablelist class='network-directives'>
2570 <varlistentry>
2571 <term><varname>MulticastGroupAddress=</varname></term>
2572 <listitem>
2573 <para>Specifies the IPv4 or IPv6 multicast group address to add. This setting is mandatory.</para>
2574 </listitem>
2575 </varlistentry>
2576 <varlistentry>
2577 <term><varname>VLANId=</varname></term>
2578 <listitem>
2579 <para>The VLAN ID for the new entry. Valid ranges are 0 (no VLAN) to 4094. Optional, defaults to 0.</para>
2580 </listitem>
2581 </varlistentry>
2582 </variablelist>
2583 </refsect1>
06828bb6 2584
e9a8c550
SS
2585 <refsect1>
2586 <title>[LLDP] Section Options</title>
bdac5608 2587 <para>The [LLDP] section manages the Link Layer Discovery Protocol (LLDP) and accepts the following
885a4e6c 2588 keys:</para>
e9a8c550
SS
2589 <variablelist class='network-directives'>
2590 <varlistentry>
2591 <term><varname>MUDURL=</varname></term>
2592 <listitem>
0558f303
ZJS
2593 <para>When configured, the specified Manufacturer Usage Descriptions (MUD) URL will be sent in
2594 LLDP packets. The syntax and semantics are the same as for <varname>MUDURL=</varname> in the
2595 [DHCPv4] section described above.</para>
2596
2597 <para>The MUD URLs received via LLDP packets are saved and can be read using the
e9a8c550
SS
2598 <function>sd_lldp_neighbor_get_mud_url()</function> function.</para>
2599 </listitem>
2600 </varlistentry>
2601 </variablelist>
2602 </refsect1>
2603
06828bb6
HP
2604 <refsect1>
2605 <title>[CAN] Section Options</title>
bdac5608
ZJS
2606 <para>The [CAN] section manages the Controller Area Network (CAN bus) and accepts the
2607 following keys:</para>
06828bb6
HP
2608 <variablelist class='network-directives'>
2609 <varlistentry>
2610 <term><varname>BitRate=</varname></term>
2611 <listitem>
2612 <para>The bitrate of CAN device in bits per second. The usual SI prefixes (K, M) with the base of 1000 can
74a27268 2613 be used here. Takes a number in the range 1..4294967295.</para>
06828bb6
HP
2614 </listitem>
2615 </varlistentry>
2616 <varlistentry>
2617 <term><varname>SamplePoint=</varname></term>
2618 <listitem>
2619 <para>Optional sample point in percent with one decimal (e.g. <literal>75%</literal>,
2620 <literal>87.5%</literal>) or permille (e.g. <literal>875‰</literal>).</para>
2621 </listitem>
2622 </varlistentry>
7e025e9c
RP
2623 <varlistentry>
2624 <term><varname>DataBitRate=</varname></term>
2625 <term><varname>DataSamplePoint=</varname></term>
2626 <listitem>
2627 <para>The bitrate and sample point for the data phase, if CAN-FD is used. These settings are
2628 analogous to the <varname>BitRate=</varname> and <varname>SamplePoint=</varname> keys.</para>
2629 </listitem>
2630 </varlistentry>
2631 <varlistentry>
2632 <term><varname>FDMode=</varname></term>
2633 <listitem>
2634 <para>Takes a boolean. When <literal>yes</literal>, CAN-FD mode is enabled for the interface.
2635 Note, that a bitrate and optional sample point should also be set for the CAN-FD data phase using
2636 the <varname>DataBitRate=</varname> and <varname>DataSamplePoint=</varname> keys.</para>
2637 </listitem>
2638 </varlistentry>
2639 <varlistentry>
2640 <term><varname>FDNonISO=</varname></term>
2641 <listitem>
2642 <para>Takes a boolean. When <literal>yes</literal>, non-ISO CAN-FD mode is enabled for the
2643 interface. When unset, the kernel's default will be used.</para>
2644 </listitem>
2645 </varlistentry>
06828bb6
HP
2646 <varlistentry>
2647 <term><varname>RestartSec=</varname></term>
2648 <listitem>
2649 <para>Automatic restart delay time. If set to a non-zero value, a restart of the CAN controller will be
2650 triggered automatically in case of a bus-off condition after the specified delay time. Subsecond delays can
2651 be specified using decimals (e.g. <literal>0.1s</literal>) or a <literal>ms</literal> or
2652 <literal>us</literal> postfix. Using <literal>infinity</literal> or <literal>0</literal> will turn the
2653 automatic restart off. By default automatic restart is disabled.</para>
2654 </listitem>
2655 </varlistentry>
52aa38f1
MR
2656 <varlistentry>
2657 <term><varname>Termination=</varname></term>
2658 <listitem>
2659 <para>Takes a boolean. When <literal>yes</literal>, the termination resistor will be selected for
2660 the bias network. When unset, the kernel's default will be used.</para>
2661 </listitem>
2662 </varlistentry>
c423be28
CG
2663 <varlistentry>
2664 <term><varname>TripleSampling=</varname></term>
2665 <listitem>
2666 <para>Takes a boolean. When <literal>yes</literal>, three samples (instead of one) are used to determine
2667 the value of a received bit by majority rule. When unset, the kernel's default will be used.</para>
2668 </listitem>
2669 </varlistentry>
74f0fb90
YW
2670 <varlistentry>
2671 <term><varname>ListenOnly=</varname></term>
2672 <listitem>
2673 <para>Takes a boolean. When <literal>yes</literal>, listen-only mode is enabled. When the
2674 interface is in listen-only mode, the interface neither transmit CAN frames nor send ACK
2675 bit. Listen-only mode is important to debug CAN networks without interfering with the
2676 communication or acknowledge the CAN frame. When unset, the kernel's default will be used.
2677 </para>
2678 </listitem>
2679 </varlistentry>
06828bb6
HP
2680 </variablelist>
2681 </refsect1>
2682
2ed5f6d5
YW
2683 <refsect1>
2684 <title>[QDisc] Section Options</title>
bdac5608 2685 <para>The [QDisc] section manages the traffic control queueing discipline (qdisc).</para>
2ed5f6d5
YW
2686
2687 <variablelist class='network-directives'>
2688 <varlistentry>
2689 <term><varname>Parent=</varname></term>
2690 <listitem>
2691 <para>Specifies the parent Queueing Discipline (qdisc). Takes one of <literal>clsact</literal>
2692 or <literal>ingress</literal>. This is mandatory.</para>
2693 </listitem>
2694 </varlistentry>
d8b2396d 2695
f344a492 2696 <xi:include href="tc.xml" xpointer="qdisc-handle" />
2ed5f6d5
YW
2697 </variablelist>
2698 </refsect1>
2699
0f5bd7fe 2700 <refsect1>
18de0969 2701 <title>[NetworkEmulator] Section Options</title>
bdac5608
ZJS
2702 <para>The [NetworkEmulator] section manages the queueing discipline (qdisc) of the network emulator. It
2703 can be used to configure the kernel packet scheduler and simulate packet delay and loss for UDP or TCP
2704 applications, or limit the bandwidth usage of a particular service to simulate internet connections.
2705 </para>
0f5bd7fe
SS
2706
2707 <variablelist class='network-directives'>
f344a492
YW
2708 <xi:include href="tc.xml" xpointer="qdisc-parent" />
2709 <xi:include href="tc.xml" xpointer="qdisc-handle" />
d8b2396d 2710
0f5bd7fe 2711 <varlistentry>
18de0969 2712 <term><varname>DelaySec=</varname></term>
0f5bd7fe
SS
2713 <listitem>
2714 <para>Specifies the fixed amount of delay to be added to all packets going out of the
2715 interface. Defaults to unset.</para>
2716 </listitem>
2717 </varlistentry>
2718
2719 <varlistentry>
18de0969 2720 <term><varname>DelayJitterSec=</varname></term>
0f5bd7fe
SS
2721 <listitem>
2722 <para>Specifies the chosen delay to be added to the packets outgoing to the network
2723 interface. Defaults to unset.</para>
2724 </listitem>
2725 </varlistentry>
2726
2727 <varlistentry>
18de0969 2728 <term><varname>PacketLimit=</varname></term>
0f5bd7fe
SS
2729 <listitem>
2730 <para>Specifies the maximum number of packets the qdisc may hold queued at a time.
e9dd6984 2731 An unsigned integer in the range 0–4294967294. Defaults to 1000.</para>
0f5bd7fe
SS
2732 </listitem>
2733 </varlistentry>
2734
2735 <varlistentry>
18de0969 2736 <term><varname>LossRate=</varname></term>
0f5bd7fe
SS
2737 <listitem>
2738 <para>Specifies an independent loss probability to be added to the packets outgoing from the
2739 network interface. Takes a percentage value, suffixed with "%". Defaults to unset.</para>
2740 </listitem>
2741 </varlistentry>
2742
b9c5aa3c 2743 <varlistentry>
18de0969 2744 <term><varname>DuplicateRate=</varname></term>
b9c5aa3c
SS
2745 <listitem>
2746 <para>Specifies that the chosen percent of packets is duplicated before queuing them.
2747 Takes a percentage value, suffixed with "%". Defaults to unset.</para>
2748 </listitem>
2749 </varlistentry>
18de0969
YW
2750 </variablelist>
2751 </refsect1>
b9c5aa3c 2752
18de0969 2753 <refsect1>
60ed2dcf 2754 <title>[TokenBucketFilter] Section Options</title>
e9dd6984
ZJS
2755 <para>The [TokenBucketFilter] section manages the queueing discipline (qdisc) of token bucket filter
2756 (tbf).</para>
18de0969
YW
2757
2758 <variablelist class='network-directives'>
f344a492
YW
2759 <xi:include href="tc.xml" xpointer="qdisc-parent" />
2760 <xi:include href="tc.xml" xpointer="qdisc-handle" />
d8b2396d 2761
18de0969
YW
2762 <varlistentry>
2763 <term><varname>LatencySec=</varname></term>
ba5841b5
SS
2764 <listitem>
2765 <para>Specifies the latency parameter, which specifies the maximum amount of time a
60ed2dcf 2766 packet can sit in the Token Bucket Filter (TBF). Defaults to unset.</para>
ba5841b5
SS
2767 </listitem>
2768 </varlistentry>
2769
dcfc23ae 2770 <varlistentry>
c03ef420 2771 <term><varname>LimitBytes=</varname></term>
dcfc23ae
YW
2772 <listitem>
2773 <para>Takes the number of bytes that can be queued waiting for tokens to become available.
2774 When the size is suffixed with K, M, or G, it is parsed as Kilobytes, Megabytes, or Gigabytes,
c03ef420 2775 respectively, to the base of 1024. Defaults to unset.</para>
dcfc23ae
YW
2776 </listitem>
2777 </varlistentry>
2778
ba5841b5 2779 <varlistentry>
c03ef420 2780 <term><varname>BurstBytes=</varname></term>
ba5841b5
SS
2781 <listitem>
2782 <para>Specifies the size of the bucket. This is the maximum amount of bytes that tokens
2783 can be available for instantaneous transfer. When the size is suffixed with K, M, or G, it is
c03ef420 2784 parsed as Kilobytes, Megabytes, or Gigabytes, respectively, to the base of 1024. Defaults to
ba5841b5
SS
2785 unset.</para>
2786 </listitem>
2787 </varlistentry>
2788
2789 <varlistentry>
18de0969 2790 <term><varname>Rate=</varname></term>
ba5841b5
SS
2791 <listitem>
2792 <para>Specifies the device specific bandwidth. When suffixed with K, M, or G, the specified
6b8fe4c3 2793 bandwidth is parsed as Kilobits, Megabits, or Gigabits, respectively, to the base of 1000.
ba5841b5
SS
2794 Defaults to unset.</para>
2795 </listitem>
2796 </varlistentry>
2797
dcfc23ae 2798 <varlistentry>
18de0969 2799 <term><varname>MPUBytes=</varname></term>
dcfc23ae
YW
2800 <listitem>
2801 <para>The Minimum Packet Unit (MPU) determines the minimal token usage (specified in bytes)
2802 for a packet. When suffixed with K, M, or G, the specified size is parsed as Kilobytes,
c03ef420 2803 Megabytes, or Gigabytes, respectively, to the base of 1024. Defaults to zero.</para>
dcfc23ae
YW
2804 </listitem>
2805 </varlistentry>
2806
2807 <varlistentry>
18de0969 2808 <term><varname>PeakRate=</varname></term>
dcfc23ae
YW
2809 <listitem>
2810 <para>Takes the maximum depletion rate of the bucket. When suffixed with K, M, or G, the
6b8fe4c3 2811 specified size is parsed as Kilobits, Megabits, or Gigabits, respectively, to the base of
dcfc23ae
YW
2812 1000. Defaults to unset.</para>
2813 </listitem>
2814 </varlistentry>
2815
2816 <varlistentry>
18de0969 2817 <term><varname>MTUBytes=</varname></term>
dcfc23ae
YW
2818 <listitem>
2819 <para>Specifies the size of the peakrate bucket. When suffixed with K, M, or G, the specified
c03ef420 2820 size is parsed as Kilobytes, Megabytes, or Gigabytes, respectively, to the base of 1024.
dcfc23ae
YW
2821 Defaults to unset.</para>
2822 </listitem>
2823 </varlistentry>
18de0969
YW
2824 </variablelist>
2825 </refsect1>
2826
bde4ae88
SS
2827 <refsect1>
2828 <title>[PIE] Section Options</title>
bdac5608
ZJS
2829 <para>The [PIE] section manages the queueing discipline (qdisc) of Proportional Integral
2830 controller-Enhanced (PIE).</para>
bde4ae88
SS
2831
2832 <variablelist class='network-directives'>
f344a492
YW
2833 <xi:include href="tc.xml" xpointer="qdisc-parent" />
2834 <xi:include href="tc.xml" xpointer="qdisc-handle" />
bde4ae88
SS
2835
2836 <varlistentry>
2837 <term><varname>PacketLimit=</varname></term>
2838 <listitem>
2839 <para>Specifies the hard limit on the queue size in number of packets. When this limit is reached, incoming packets are
e9dd6984 2840 dropped. An unsigned integer in the range 1–4294967294. Defaults to unset and kernel's default is used.</para>
8f6b6d70
SS
2841 </listitem>
2842 </varlistentry>
2843 </variablelist>
2844 </refsect1>
2845
2846 <refsect1>
2847 <title>[FlowQueuePIE] Section Options</title>
2848 <para>The <literal>[FlowQueuePIE]</literal> section manages the queueing discipline
2849 (qdisc) of Flow Queue Proportional Integral controller-Enhanced (fq_pie).</para>
2850
2851 <variablelist class='network-directives'>
2852 <xi:include href="tc.xml" xpointer="qdisc-parent" />
2853 <xi:include href="tc.xml" xpointer="qdisc-handle" />
2854
2855 <varlistentry>
2856 <term><varname>PacketLimit=</varname></term>
2857 <listitem>
2858 <para>Specifies the hard limit on the queue size in number of packets. When this limit is reached, incoming packets are
2859 dropped. An unsigned integer ranges 1 to 4294967294. Defaults to unset and kernel's default is used.</para>
bde4ae88
SS
2860 </listitem>
2861 </varlistentry>
2862 </variablelist>
2863 </refsect1>
2864
982998b0
SS
2865 <refsect1>
2866 <title>[StochasticFairBlue] Section Options</title>
bdac5608
ZJS
2867 <para>The [StochasticFairBlue] section manages the queueing discipline (qdisc) of stochastic fair blue
2868 (sfb).</para>
982998b0
SS
2869
2870 <variablelist class='network-directives'>
f344a492
YW
2871 <xi:include href="tc.xml" xpointer="qdisc-parent" />
2872 <xi:include href="tc.xml" xpointer="qdisc-handle" />
982998b0
SS
2873
2874 <varlistentry>
2875 <term><varname>PacketLimit=</varname></term>
2876 <listitem>
e9dd6984
ZJS
2877 <para>Specifies the hard limit on the queue size in number of packets. When this limit is reached,
2878 incoming packets are dropped. An unsigned integer in the range 0–4294967294. Defaults to unset and
2879 kernel's default is used.</para>
982998b0
SS
2880 </listitem>
2881 </varlistentry>
2882 </variablelist>
2883 </refsect1>
2884
18de0969
YW
2885 <refsect1>
2886 <title>[StochasticFairnessQueueing] Section Options</title>
bdac5608
ZJS
2887 <para>The [StochasticFairnessQueueing] section manages the queueing discipline (qdisc) of stochastic
2888 fairness queueing (sfq).</para>
18de0969
YW
2889
2890 <variablelist class='network-directives'>
f344a492
YW
2891 <xi:include href="tc.xml" xpointer="qdisc-parent" />
2892 <xi:include href="tc.xml" xpointer="qdisc-handle" />
d8b2396d 2893
9942b710 2894 <varlistentry>
18de0969 2895 <term><varname>PerturbPeriodSec=</varname></term>
9942b710
SS
2896 <listitem>
2897 <para>Specifies the interval in seconds for queue algorithm perturbation. Defaults to unset.</para>
2898 </listitem>
2899 </varlistentry>
18de0969
YW
2900 </variablelist>
2901 </refsect1>
2902
c853f594
SS
2903 <refsect1>
2904 <title>[BFIFO] Section Options</title>
bdac5608
ZJS
2905 <para>The [BFIFO] section manages the queueing discipline (qdisc) of Byte limited Packet First In First
2906 Out (bfifo).</para>
c853f594
SS
2907
2908 <variablelist class='network-directives'>
f344a492
YW
2909 <xi:include href="tc.xml" xpointer="qdisc-parent" />
2910 <xi:include href="tc.xml" xpointer="qdisc-handle" />
c853f594
SS
2911
2912 <varlistentry>
c03ef420 2913 <term><varname>LimitBytes=</varname></term>
c853f594 2914 <listitem>
885a4e6c
ZJS
2915 <para>Specifies the hard limit in bytes on the FIFO buffer size. The size limit prevents overflow
2916 in case the kernel is unable to dequeue packets as quickly as it receives them. When this limit is
2917 reached, incoming packets are dropped. When suffixed with K, M, or G, the specified size is parsed
2918 as Kilobytes, Megabytes, or Gigabytes, respectively, to the base of 1024. Defaults to unset and
2919 kernel default is used.</para>
c853f594
SS
2920 </listitem>
2921 </varlistentry>
2922 </variablelist>
2923 </refsect1>
2924
a7476065
SS
2925 <refsect1>
2926 <title>[PFIFO] Section Options</title>
bdac5608
ZJS
2927 <para>The [PFIFO] section manages the queueing discipline (qdisc) of Packet First In First Out
2928 (pfifo).</para>
a7476065
SS
2929
2930 <variablelist class='network-directives'>
f344a492
YW
2931 <xi:include href="tc.xml" xpointer="qdisc-parent" />
2932 <xi:include href="tc.xml" xpointer="qdisc-handle" />
a7476065
SS
2933
2934 <varlistentry>
2935 <term><varname>PacketLimit=</varname></term>
2936 <listitem>
e9dd6984
ZJS
2937 <para>Specifies the hard limit on the FIFO size in number of packets. The size limit (a buffer
2938 size) to prevent it from overflowing in case it is unable to dequeue packets as quickly as it
2939 receives them. When this limit is reached, incoming packets are dropped. An unsigned integer in the
2940 range 0–4294967294. Defaults to unset and kernel's default is used.</para>
a7476065
SS
2941 </listitem>
2942 </varlistentry>
ad8352f4
SS
2943 </variablelist>
2944 </refsect1>
2945
053a2ddb
SS
2946 <refsect1>
2947 <title>[PFIFOHeadDrop] Section Options</title>
bdac5608
ZJS
2948 <para>The [PFIFOHeadDrop] section manages the queueing discipline (qdisc) of Packet First In First Out
2949 Head Drop (pfifo_head_drop).</para>
053a2ddb
SS
2950
2951 <variablelist class='network-directives'>
f344a492
YW
2952 <xi:include href="tc.xml" xpointer="qdisc-parent" />
2953 <xi:include href="tc.xml" xpointer="qdisc-handle" />
053a2ddb
SS
2954
2955 <varlistentry>
2956 <term><varname>PacketLimit=</varname></term>
2957 <listitem>
bdac5608 2958 <para>As in [PFIFO] section.</para></listitem>
053a2ddb
SS
2959 </varlistentry>
2960 </variablelist>
2961 </refsect1>
2962
1a95964b
SS
2963 <refsect1>
2964 <title>[PFIFOFast] Section Options</title>
bdac5608
ZJS
2965 <para>The [PFIFOFast] section manages the queueing discipline (qdisc) of Packet First In First Out Fast
2966 (pfifo_fast).</para>
1a95964b
SS
2967
2968 <variablelist class='network-directives'>
f344a492
YW
2969 <xi:include href="tc.xml" xpointer="qdisc-parent" />
2970 <xi:include href="tc.xml" xpointer="qdisc-handle" />
1a95964b
SS
2971 </variablelist>
2972 </refsect1>
2973
ad8352f4
SS
2974 <refsect1>
2975 <title>[CAKE] Section Options</title>
bdac5608
ZJS
2976 <para>The [CAKE] section manages the queueing discipline (qdisc) of Common Applications Kept Enhanced
2977 (CAKE).</para>
ad8352f4
SS
2978
2979 <variablelist class='network-directives'>
f344a492
YW
2980 <xi:include href="tc.xml" xpointer="qdisc-parent" />
2981 <xi:include href="tc.xml" xpointer="qdisc-handle" />
a7476065 2982
ad8352f4 2983 <varlistentry>
c03ef420 2984 <term><varname>OverheadBytes=</varname></term>
ad8352f4 2985 <listitem>
e9dd6984
ZJS
2986 <para>Specifies that bytes to be addeded to the size of each packet. Bytes may be negative. Takes
2987 an integer in the range from -64 to 256. Defaults to unset and kernel's default is used.</para>
ad8352f4 2988 </listitem>
f344a492 2989 </varlistentry>
ad8352f4
SS
2990
2991 <varlistentry>
2992 <term><varname>Bandwidth=</varname></term>
2993 <listitem>
2994 <para>Specifies the shaper bandwidth. When suffixed with K, M, or G, the specified size is
2995 parsed as Kilobits, Megabits, or Gigabits, respectively, to the base of 1000. Defaults to
2996 unset and kernel's default is used.</para>
2997 </listitem>
2998 </varlistentry>
a7476065
SS
2999 </variablelist>
3000 </refsect1>
3001
18de0969
YW
3002 <refsect1>
3003 <title>[ControlledDelay] Section Options</title>
bdac5608 3004 <para>The [ControlledDelay] section manages the queueing discipline (qdisc) of
18de0969 3005 controlled delay (CoDel).</para>
9942b710 3006
18de0969 3007 <variablelist class='network-directives'>
f344a492
YW
3008 <xi:include href="tc.xml" xpointer="qdisc-parent" />
3009 <xi:include href="tc.xml" xpointer="qdisc-handle" />
d8b2396d 3010
18de0969
YW
3011 <varlistentry>
3012 <term><varname>PacketLimit=</varname></term>
a9a5d632 3013 <listitem>
e9dd6984
ZJS
3014 <para>Specifies the hard limit on the queue size in number of packets. When this limit is reached,
3015 incoming packets are dropped. An unsigned integer in the range 0–4294967294. Defaults to unset and
3016 kernel's default is used.</para>
a9a5d632
SS
3017 </listitem>
3018 </varlistentry>
3019
b078e528 3020 <varlistentry>
18de0969 3021 <term><varname>TargetSec=</varname></term>
b078e528
YW
3022 <listitem>
3023 <para>Takes a timespan. Specifies the acceptable minimum standing/persistent queue delay.
3024 Defaults to unset and kernel's default is used.</para>
3025 </listitem>
3026 </varlistentry>
3027
3028 <varlistentry>
18de0969 3029 <term><varname>IntervalSec=</varname></term>
b078e528
YW
3030 <listitem>
3031 <para>Takes a timespan. This is used to ensure that the measured minimum delay does not
3032 become too stale. Defaults to unset and kernel's default is used.</para>
3033 </listitem>
3034 </varlistentry>
3035
3036 <varlistentry>
18de0969 3037 <term><varname>ECN=</varname></term>
b078e528
YW
3038 <listitem>
3039 <para>Takes a boolean. This can be used to mark packets instead of dropping them. Defaults to
3040 unset and kernel's default is used.</para>
3041 </listitem>
3042 </varlistentry>
3043
3044 <varlistentry>
18de0969 3045 <term><varname>CEThresholdSec=</varname></term>
b078e528
YW
3046 <listitem>
3047 <para>Takes a timespan. This sets a threshold above which all packets are marked with ECN
3048 Congestion Experienced (CE). Defaults to unset and kernel's default is used.</para>
3049 </listitem>
3050 </varlistentry>
18de0969
YW
3051 </variablelist>
3052 </refsect1>
b078e528 3053
f5fc0441
SS
3054 <refsect1>
3055 <title>[DeficitRoundRobinScheduler] Section Options</title>
bdac5608
ZJS
3056 <para>The [DeficitRoundRobinScheduler] section manages the queueing discipline (qdisc) of Deficit Round
3057 Robin Scheduler (DRR).</para>
f5fc0441
SS
3058
3059 <variablelist class='network-directives'>
f344a492
YW
3060 <xi:include href="tc.xml" xpointer="qdisc-parent" />
3061 <xi:include href="tc.xml" xpointer="qdisc-handle" />
f5fc0441
SS
3062 </variablelist>
3063 </refsect1>
3064
ad365c5d
YW
3065 <refsect1>
3066 <title>[DeficitRoundRobinSchedulerClass] Section Options</title>
bdac5608
ZJS
3067 <para>The [DeficitRoundRobinSchedulerClass] section manages the traffic control class of Deficit Round
3068 Robin Scheduler (DRR).</para>
ad365c5d
YW
3069
3070 <variablelist class='network-directives'>
f344a492
YW
3071 <xi:include href="tc.xml" xpointer="tclass-parent" />
3072 <xi:include href="tc.xml" xpointer="tclass-classid" />
ad365c5d
YW
3073
3074 <varlistentry>
c03ef420 3075 <term><varname>QuantumBytes=</varname></term>
ad365c5d 3076 <listitem>
c03ef420
YW
3077 <para>Specifies the amount of bytes a flow is allowed to dequeue before the scheduler moves
3078 to the next class. When suffixed with K, M, or G, the specified size is parsed as Kilobytes,
3079 Megabytes, or Gigabytes, respectively, to the base of 1024. Defaults to the MTU of the
3080 interface.</para>
ad365c5d
YW
3081 </listitem>
3082 </varlistentry>
3083
3084 </variablelist>
3085 </refsect1>
3086
d474aa51
YW
3087 <refsect1>
3088 <title>[EnhancedTransmissionSelection] Section Options</title>
bdac5608
ZJS
3089 <para>The [EnhancedTransmissionSelection] section manages the queueing discipline (qdisc) of Enhanced
3090 Transmission Selection (ETS).</para>
d474aa51
YW
3091
3092 <variablelist class='network-directives'>
3093 <xi:include href="tc.xml" xpointer="qdisc-parent" />
3094 <xi:include href="tc.xml" xpointer="qdisc-handle" />
3095
3096 <varlistentry>
3097 <term><varname>Bands=</varname></term>
3098 <listitem>
e9dd6984
ZJS
3099 <para>Specifies the number of bands. An unsigned integer in the range 1–16. This value has to be at
3100 least large enough to cover the strict bands specified through the <varname>StrictBands=</varname>
3101 and bandwidth-sharing bands specified in <varname>QuantumBytes=</varname>.</para>
d474aa51
YW
3102 </listitem>
3103 </varlistentry>
3104
3105 <varlistentry>
3106 <term><varname>StrictBands=</varname></term>
3107 <listitem>
e9dd6984
ZJS
3108 <para>Specifies the number of bands that should be created in strict mode. An unsigned integer in
3109 the range 1–16.</para>
d474aa51
YW
3110 </listitem>
3111 </varlistentry>
3112
3113 <varlistentry>
3114 <term><varname>QuantumBytes=</varname></term>
3115 <listitem>
3116 <para>Specifies the white-space separated list of quantum used in band-sharing bands. When
3117 suffixed with K, M, or G, the specified size is parsed as Kilobytes, Megabytes, or Gigabytes,
3118 respectively, to the base of 1024. This setting can be specified multiple times. If an empty
3119 string is assigned, then the all previous assignments are cleared.</para>
3120 </listitem>
3121 </varlistentry>
3122
3123 <varlistentry>
3124 <term><varname>PriorityMap=</varname></term>
3125 <listitem>
885a4e6c
ZJS
3126 <para>The priority map maps the priority of a packet to a band. The argument is a whitespace
3127 separated list of numbers. The first number indicates which band the packets with priority 0 should
3128 be put to, the second is for priority 1, and so on. There can be up to 16 numbers in the list. If
3129 there are fewer, the default band that traffic with one of the unmentioned priorities goes to is
3130 the last one. Each band number must be in the range 0..255. This setting can be specified multiple
3131 times. If an empty string is assigned, then the all previous assignments are cleared.</para>
d474aa51
YW
3132 </listitem>
3133 </varlistentry>
3134 </variablelist>
3135 </refsect1>
3136
609e8340
SS
3137 <refsect1>
3138 <title>[GenericRandomEarlyDetection] Section Options</title>
bdac5608
ZJS
3139 <para>The [GenericRandomEarlyDetection] section manages the queueing discipline (qdisc) of Generic Random
3140 Early Detection (GRED).</para>
609e8340
SS
3141
3142 <variablelist class='network-directives'>
f344a492
YW
3143 <xi:include href="tc.xml" xpointer="qdisc-parent" />
3144 <xi:include href="tc.xml" xpointer="qdisc-handle" />
609e8340
SS
3145
3146 <varlistentry>
3147 <term><varname>VirtualQueues=</varname></term>
3148 <listitem>
3149 <para>Specifies the number of virtual queues. Takes a integer in the range 1-16. Defaults to unset and kernel's default is used.</para>
3150 </listitem>
3151 </varlistentry>
3152
3153 <varlistentry>
3154 <term><varname>DefaultVirtualQueue=</varname></term>
3155 <listitem>
3156 <para>Specifies the number of default virtual queue. This must be less than <varname>VirtualQueue=</varname>.
3157 Defaults to unset and kernel's default is used.</para>
3158 </listitem>
3159 </varlistentry>
3160
3161 <varlistentry>
3162 <term><varname>GenericRIO=</varname></term>
3163 <listitem>
3164 <para>Takes a boolean. It turns on the RIO-like buffering scheme. Defaults to
3165 unset and kernel's default is used.</para>
3166 </listitem>
3167 </varlistentry>
3168 </variablelist>
3169 </refsect1>
3170
18de0969
YW
3171 <refsect1>
3172 <title>[FairQueueingControlledDelay] Section Options</title>
bdac5608
ZJS
3173 <para>The [FairQueueingControlledDelay] section manages the queueing discipline (qdisc) of fair queuing
3174 controlled delay (FQ-CoDel).</para>
18de0969
YW
3175
3176 <variablelist class='network-directives'>
f344a492
YW
3177 <xi:include href="tc.xml" xpointer="qdisc-parent" />
3178 <xi:include href="tc.xml" xpointer="qdisc-handle" />
d8b2396d 3179
18de0969
YW
3180 <varlistentry>
3181 <term><varname>PacketLimit=</varname></term>
4e5ef149
SS
3182 <listitem>
3183 <para>Specifies the hard limit on the real queue size. When this limit is reached, incoming packets are
3184 dropped. Defaults to unset and kernel's default is used.</para>
3185 </listitem>
3186 </varlistentry>
3187
ac810b75 3188 <varlistentry>
c03ef420 3189 <term><varname>MemoryLimitBytes=</varname></term>
ac810b75
YW
3190 <listitem>
3191 <para>Specifies the limit on the total number of bytes that can be queued in this FQ-CoDel instance.
3192 When suffixed with K, M, or G, the specified size is parsed as Kilobytes, Megabytes, or Gigabytes,
3193 respectively, to the base of 1024. Defaults to unset and kernel's default is used.</para>
3194 </listitem>
3195 </varlistentry>
3196
3197 <varlistentry>
18de0969 3198 <term><varname>Flows=</varname></term>
ac810b75
YW
3199 <listitem>
3200 <para>Specifies the number of flows into which the incoming packets are classified.
3201 Defaults to unset and kernel's default is used.</para>
3202 </listitem>
3203 </varlistentry>
3204
3205 <varlistentry>
18de0969 3206 <term><varname>TargetSec=</varname></term>
ac810b75
YW
3207 <listitem>
3208 <para>Takes a timespan. Specifies the acceptable minimum standing/persistent queue delay.
3209 Defaults to unset and kernel's default is used.</para>
3210 </listitem>
3211 </varlistentry>
3212
3213 <varlistentry>
18de0969 3214 <term><varname>IntervalSec=</varname></term>
ac810b75
YW
3215 <listitem>
3216 <para>Takes a timespan. This is used to ensure that the measured minimum delay does not
3217 become too stale. Defaults to unset and kernel's default is used.</para>
3218 </listitem>
3219 </varlistentry>
3220
3221 <varlistentry>
c03ef420 3222 <term><varname>QuantumBytes=</varname></term>
ac810b75 3223 <listitem>
e9dd6984 3224 <para>Specifies the number of bytes used as the "deficit" in the fair queuing algorithm timespan.
ac810b75
YW
3225 When suffixed with K, M, or G, the specified size is parsed as Kilobytes, Megabytes, or Gigabytes,
3226 respectively, to the base of 1024. Defaults to unset and kernel's default is used.</para>
3227 </listitem>
3228 </varlistentry>
3229
3230 <varlistentry>
18de0969 3231 <term><varname>ECN=</varname></term>
ac810b75
YW
3232 <listitem>
3233 <para>Takes a boolean. This can be used to mark packets instead of dropping them. Defaults to
3234 unset and kernel's default is used.</para>
3235 </listitem>
3236 </varlistentry>
3237
3238 <varlistentry>
18de0969 3239 <term><varname>CEThresholdSec=</varname></term>
ac810b75
YW
3240 <listitem>
3241 <para>Takes a timespan. This sets a threshold above which all packets are marked with ECN
3242 Congestion Experienced (CE). Defaults to unset and kernel's default is used.</para>
3243 </listitem>
3244 </varlistentry>
18de0969
YW
3245 </variablelist>
3246 </refsect1>
3247
3248 <refsect1>
ca58d00c 3249 <title>[FairQueueing] Section Options</title>
bdac5608
ZJS
3250 <para>The [FairQueueing] section manages the queueing discipline (qdisc) of fair queue traffic policing
3251 (FQ).</para>
18de0969
YW
3252
3253 <variablelist class='network-directives'>
f344a492
YW
3254 <xi:include href="tc.xml" xpointer="qdisc-parent" />
3255 <xi:include href="tc.xml" xpointer="qdisc-handle" />
d8b2396d 3256
7234b915 3257 <varlistentry>
18de0969 3258 <term><varname>PacketLimit=</varname></term>
7234b915
SS
3259 <listitem>
3260 <para>Specifies the hard limit on the real queue size. When this limit is reached, incoming packets are
3261 dropped. Defaults to unset and kernel's default is used.</para>
3262 </listitem>
3263 </varlistentry>
3264
e83562e5 3265 <varlistentry>
18de0969 3266 <term><varname>FlowLimit=</varname></term>
e83562e5
YW
3267 <listitem>
3268 <para>Specifies the hard limit on the maximum number of packets queued per flow. Defaults to
3269 unset and kernel's default is used.</para>
3270 </listitem>
3271 </varlistentry>
3272
3273 <varlistentry>
c03ef420 3274 <term><varname>QuantumBytes=</varname></term>
e83562e5
YW
3275 <listitem>
3276 <para>Specifies the credit per dequeue RR round, i.e. the amount of bytes a flow is allowed
3277 to dequeue at once. When suffixed with K, M, or G, the specified size is parsed as Kilobytes,
3278 Megabytes, or Gigabytes, respectively, to the base of 1024. Defaults to unset and kernel's
3279 default is used.</para>
3280 </listitem>
3281 </varlistentry>
3282
3283 <varlistentry>
c03ef420 3284 <term><varname>InitialQuantumBytes=</varname></term>
e83562e5
YW
3285 <listitem>
3286 <para>Specifies the initial sending rate credit, i.e. the amount of bytes a new flow is
3287 allowed to dequeue initially. When suffixed with K, M, or G, the specified size is parsed as
3288 Kilobytes, Megabytes, or Gigabytes, respectively, to the base of 1024. Defaults to unset and
3289 kernel's default is used.</para>
3290 </listitem>
3291 </varlistentry>
3292
3293 <varlistentry>
18de0969 3294 <term><varname>MaximumRate=</varname></term>
e83562e5
YW
3295 <listitem>
3296 <para>Specifies the maximum sending rate of a flow. When suffixed with K, M, or G, the
6b8fe4c3 3297 specified size is parsed as Kilobits, Megabits, or Gigabits, respectively, to the base of
e83562e5
YW
3298 1000. Defaults to unset and kernel's default is used.</para>
3299 </listitem>
3300 </varlistentry>
3301
3302 <varlistentry>
18de0969 3303 <term><varname>Buckets=</varname></term>
e83562e5
YW
3304 <listitem>
3305 <para>Specifies the size of the hash table used for flow lookups. Defaults to unset and
3306 kernel's default is used.</para>
3307 </listitem>
3308 </varlistentry>
3309
3310 <varlistentry>
18de0969 3311 <term><varname>OrphanMask=</varname></term>
e83562e5
YW
3312 <listitem>
3313 <para>Takes an unsigned integer. For packets not owned by a socket, fq is able to mask a part
3314 of hash and reduce number of buckets associated with the traffic. Defaults to unset and
3315 kernel's default is used.</para>
3316 </listitem>
3317 </varlistentry>
3318
3319 <varlistentry>
18de0969 3320 <term><varname>Pacing=</varname></term>
e83562e5
YW
3321 <listitem>
3322 <para>Takes a boolean, and enables or disables flow pacing. Defaults to unset and kernel's
3323 default is used.</para>
3324 </listitem>
3325 </varlistentry>
3326
3327 <varlistentry>
18de0969 3328 <term><varname>CEThresholdSec=</varname></term>
e83562e5
YW
3329 <listitem>
3330 <para>Takes a timespan. This sets a threshold above which all packets are marked with ECN
3331 Congestion Experienced (CE). Defaults to unset and kernel's default is used.</para>
3332 </listitem>
3333 </varlistentry>
0f5bd7fe
SS
3334 </variablelist>
3335 </refsect1>
3336
9b749c11
YW
3337 <refsect1>
3338 <title>[TrivialLinkEqualizer] Section Options</title>
bdac5608
ZJS
3339 <para>The [TrivialLinkEqualizer] section manages the queueing discipline (qdisc) of trivial link
3340 equalizer (teql).</para>
9b749c11
YW
3341
3342 <variablelist class='network-directives'>
f344a492
YW
3343 <xi:include href="tc.xml" xpointer="qdisc-parent" />
3344 <xi:include href="tc.xml" xpointer="qdisc-handle" />
d8b2396d 3345
9b749c11
YW
3346 <varlistentry>
3347 <term><varname>Id=</varname></term>
3348 <listitem>
3349 <para>Specifies the interface ID <literal>N</literal> of teql. Defaults to <literal>0</literal>.
3350 Note that when teql is used, currently, the module <constant>sch_teql</constant> with
3351 <constant>max_equalizers=N+1</constant> option must be loaded before
3352 <command>systemd-networkd</command> is started.</para>
3353 </listitem>
3354 </varlistentry>
3355 </variablelist>
3356 </refsect1>
3357
b934ac3d
YW
3358 <refsect1>
3359 <title>[HierarchyTokenBucket] Section Options</title>
bdac5608
ZJS
3360 <para>The [HierarchyTokenBucket] section manages the queueing discipline (qdisc) of hierarchy token
3361 bucket (htb).</para>
b934ac3d
YW
3362
3363 <variablelist class='network-directives'>
f344a492
YW
3364 <xi:include href="tc.xml" xpointer="qdisc-parent" />
3365 <xi:include href="tc.xml" xpointer="qdisc-handle" />
b934ac3d
YW
3366
3367 <varlistentry>
3368 <term><varname>DefaultClass=</varname></term>
3369 <listitem>
3370 <para>Takes the minor id in hexadecimal of the default class. Unclassified traffic gets sent
3371 to the class. Defaults to unset.</para>
3372 </listitem>
3373 </varlistentry>
d9eacc1c
YW
3374
3375 <varlistentry>
3376 <term><varname>RateToQuantum=</varname></term>
3377 <listitem>
3378 <para>Takes an unsigned integer. The DRR quantums are calculated by dividing the value
3379 configured in <varname>Rate=</varname> by <varname>RateToQuantum=</varname>.</para>
3380 </listitem>
3381 </varlistentry>
b934ac3d
YW
3382 </variablelist>
3383 </refsect1>
3384
19f86a63
YW
3385 <refsect1>
3386 <title>[HierarchyTokenBucketClass] Section Options</title>
bdac5608
ZJS
3387 <para>The [HierarchyTokenBucketClass] section manages the traffic control class of hierarchy token bucket
3388 (htb).</para>
19f86a63
YW
3389
3390 <variablelist class='network-directives'>
f344a492
YW
3391 <xi:include href="tc.xml" xpointer="tclass-parent" />
3392 <xi:include href="tc.xml" xpointer="tclass-classid" />
19f86a63
YW
3393
3394 <varlistentry>
3395 <term><varname>Priority=</varname></term>
3396 <listitem>
3397 <para>Specifies the priority of the class. In the round-robin process, classes with the lowest
d9eacc1c
YW
3398 priority field are tried for packets first.</para>
3399 </listitem>
3400 </varlistentry>
3401
3402 <varlistentry>
3403 <term><varname>QuantumBytes=</varname></term>
3404 <listitem>
3405 <para>Specifies how many bytes to serve from leaf at once. When suffixed with K, M, or G, the
3406 specified size is parsed as Kilobytes, Megabytes, or Gigabytes, respectively, to the base of
3407 1024.</para>
3408 </listitem>
3409 </varlistentry>
3410
3411 <varlistentry>
3412 <term><varname>MTUBytes=</varname></term>
3413 <listitem>
3414 <para>Specifies the maximum packet size we create. When suffixed with K, M, or G, the specified
3415 size is parsed as Kilobytes, Megabytes, or Gigabytes, respectively, to the base of 1024.</para>
3416 </listitem>
3417 </varlistentry>
3418
3419 <varlistentry>
3420 <term><varname>OverheadBytes=</varname></term>
3421 <listitem>
3422 <para>Takes an unsigned integer which specifies per-packet size overhead used in rate
3423 computations. When suffixed with K, M, or G, the specified size is parsed as Kilobytes,
3424 Megabytes, or Gigabytes, respectively, to the base of 1024.</para>
19f86a63
YW
3425 </listitem>
3426 </varlistentry>
3427
3428 <varlistentry>
3429 <term><varname>Rate=</varname></term>
3430 <listitem>
3431 <para>Specifies the maximum rate this class and all its children are guaranteed. When suffixed
3432 with K, M, or G, the specified size is parsed as Kilobits, Megabits, or Gigabits, respectively,
3433 to the base of 1000. This setting is mandatory.</para>
3434 </listitem>
3435 </varlistentry>
3436
3437 <varlistentry>
3438 <term><varname>CeilRate=</varname></term>
3439 <listitem>
3440 <para>Specifies the maximum rate at which a class can send, if its parent has bandwidth to spare.
3441 When suffixed with K, M, or G, the specified size is parsed as Kilobits, Megabits, or Gigabits,
3442 respectively, to the base of 1000. When unset, the value specified with <varname>Rate=</varname>
3443 is used.</para>
3444 </listitem>
3445 </varlistentry>
d9eacc1c
YW
3446
3447 <varlistentry>
3448 <term><varname>BufferBytes=</varname></term>
3449 <listitem>
3450 <para>Specifies the maximum bytes burst which can be accumulated during idle period. When suffixed
3451 with K, M, or G, the specified size is parsed as Kilobytes, Megabytes, or Gigabytes, respectively,
3452 to the base of 1024.</para>
3453 </listitem>
3454 </varlistentry>
3455
3456 <varlistentry>
3457 <term><varname>CeilBufferBytes=</varname></term>
3458 <listitem>
3459 <para>Specifies the maximum bytes burst for ceil which can be accumulated during idle period.
3460 When suffixed with K, M, or G, the specified size is parsed as Kilobytes, Megabytes, or Gigabytes,
3461 respectively, to the base of 1024.</para>
3462 </listitem>
3463 </varlistentry>
7f224020
SS
3464 </variablelist>
3465 </refsect1>
3466
3467 <refsect1>
3468 <title>[HeavyHitterFilter] Section Options</title>
bdac5608
ZJS
3469 <para>The [HeavyHitterFilter] section manages the queueing discipline (qdisc) of Heavy Hitter Filter
3470 (hhf).</para>
7f224020
SS
3471
3472 <variablelist class='network-directives'>
f344a492
YW
3473 <xi:include href="tc.xml" xpointer="qdisc-parent" />
3474 <xi:include href="tc.xml" xpointer="qdisc-handle" />
19f86a63 3475
7f224020
SS
3476 <varlistentry>
3477 <term><varname>PacketLimit=</varname></term>
3478 <listitem>
e9dd6984
ZJS
3479 <para>Specifies the hard limit on the queue size in number of packets. When this limit is reached,
3480 incoming packets are dropped. An unsigned integer in the range 0–4294967294. Defaults to unset and
3481 kernel's default is used.</para>
7f224020
SS
3482 </listitem>
3483 </varlistentry>
19f86a63
YW
3484 </variablelist>
3485 </refsect1>
3486
b12aaee5
SS
3487 <refsect1>
3488 <title>[QuickFairQueueing] Section Options</title>
bdac5608
ZJS
3489 <para>The [QuickFairQueueing] section manages the queueing discipline (qdisc) of Quick Fair Queueing
3490 (QFQ).</para>
b12aaee5
SS
3491
3492 <variablelist class='network-directives'>
3493 <xi:include href="tc.xml" xpointer="qdisc-parent" />
3494 <xi:include href="tc.xml" xpointer="qdisc-handle" />
3495 </variablelist>
3496 </refsect1>
3497
4d7ddaf9
YW
3498 <refsect1>
3499 <title>[QuickFairQueueingClass] Section Options</title>
bdac5608
ZJS
3500 <para>The [QuickFairQueueingClass] section manages the traffic control class of Quick Fair Queueing
3501 (qfq).</para>
4d7ddaf9
YW
3502
3503 <variablelist class='network-directives'>
3504 <xi:include href="tc.xml" xpointer="tclass-parent" />
3505 <xi:include href="tc.xml" xpointer="tclass-classid" />
3506
3507 <varlistentry>
3508 <term><varname>Weight=</varname></term>
3509 <listitem>
7487b486 3510 <para>Specifies the weight of the class. Takes an integer in the range 1..1023. Defaults to
4d7ddaf9
YW
3511 unset in which case the kernel default is used.</para>
3512 </listitem>
3513 </varlistentry>
3514
3515 <varlistentry>
c03ef420 3516 <term><varname>MaxPacketBytes=</varname></term>
4d7ddaf9
YW
3517 <listitem>
3518 <para>Specifies the maximum packet size in bytes for the class. When suffixed with K, M, or G, the specified
c03ef420 3519 size is parsed as Kilobytes, Megabytes, or Gigabytes, respectively, to the base of 1024. When unset,
4d7ddaf9
YW
3520 the kernel default is used.</para>
3521 </listitem>
3522 </varlistentry>
3523 </variablelist>
3524 </refsect1>
3525
13b498f9
TJ
3526 <refsect1>
3527 <title>[BridgeVLAN] Section Options</title>
bdac5608
ZJS
3528 <para>The [BridgeVLAN] section manages the VLAN ID configuration of a bridge port and accepts the
3529 following keys. Specify several [BridgeVLAN] sections to configure several VLAN entries. The
3530 <varname>VLANFiltering=</varname> option has to be enabled, see the [Bridge] section in
13b498f9
TJ
3531 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
3532
3533 <variablelist class='network-directives'>
3534 <varlistentry>
3535 <term><varname>VLAN=</varname></term>
3536 <listitem>
3537 <para>The VLAN ID allowed on the port. This can be either a single ID or a range M-N. VLAN IDs are valid
3538 from 1 to 4094.</para>
3539 </listitem>
3540 </varlistentry>
3541 <varlistentry>
3542 <term><varname>EgressUntagged=</varname></term>
3543 <listitem>
3544 <para>The VLAN ID specified here will be used to untag frames on egress. Configuring
3545 <varname>EgressUntagged=</varname> implicates the use of <varname>VLAN=</varname> above and will enable the
3546 VLAN ID for ingress as well. This can be either a single ID or a range M-N.</para>
3547 </listitem>
3548 </varlistentry>
3549 <varlistentry>
3550 <term><varname>PVID=</varname></term>
3551 <listitem>
3552 <para>The Port VLAN ID specified here is assigned to all untagged frames at ingress.
3553 <varname>PVID=</varname> can be used only once. Configuring <varname>PVID=</varname> implicates the use of
3554 <varname>VLAN=</varname> above and will enable the VLAN ID for ingress as well.</para>
3555 </listitem>
3556 </varlistentry>
3557 </variablelist>
3558 </refsect1>
798d3a52
ZJS
3559
3560 <refsect1>
9e35b3de 3561 <title>Examples</title>
798d3a52 3562 <example>
9e35b3de 3563 <title>Static network configuration</title>
798d3a52 3564
9e35b3de
ZJS
3565 <programlisting># /etc/systemd/network/50-static.network
3566[Match]
eac684ef
TG
3567Name=enp2s0
3568
3569[Network]
3570Address=192.168.0.15/24
3571Gateway=192.168.0.1</programlisting>
9e35b3de
ZJS
3572
3573 <para>This brings interface <literal>enp2s0</literal> up with a static address. The
3574 specified gateway will be used for a default route.</para>
798d3a52 3575 </example>
eac684ef 3576
798d3a52 3577 <example>
9e35b3de 3578 <title>DHCP on ethernet links</title>
eac684ef 3579
9e35b3de
ZJS
3580 <programlisting># /etc/systemd/network/80-dhcp.network
3581[Match]
eac684ef
TG
3582Name=en*
3583
3584[Network]
9c8ca3f7 3585DHCP=yes</programlisting>
9e35b3de
ZJS
3586
3587 <para>This will enable DHCPv4 and DHCPv6 on all interfaces with names starting with
3588 <literal>en</literal> (i.e. ethernet interfaces).</para>
798d3a52 3589 </example>
eac684ef 3590
4c94a4c2 3591 <example>
3592 <title>IPv6 Prefix Delegation</title>
3593
3594 <programlisting># /etc/systemd/network/55-ipv6-pd-upstream.network
3595[Match]
3596Name=enp1s0
3597
3598[Network]
3599DHCP=ipv6</programlisting>
3600
3601 <programlisting># /etc/systemd/network/56-ipv6-pd-downstream.network
3602[Match]
3603Name=enp2s0
3604
3605[Network]
e5ff2245
YW
3606IPv6SendRA=yes
3607DHCPv6PrefixDelegation=yes</programlisting>
4c94a4c2 3608
e5ff2245
YW
3609 <para>This will enable DHCPv6-PD on the interface enp1s0 as an upstream interface where the
3610 DHCPv6 client is running and enp2s0 as a downstream interface where the prefix is delegated to.
3611 The delegated prefixes are distributed by IPv6 Router Advertisement on the downstream network.
3612 </para>
4c94a4c2 3613 </example>
3614
798d3a52 3615 <example>
9e35b3de 3616 <title>A bridge with two enslaved links</title>
f47c5c47 3617
9e35b3de
ZJS
3618 <programlisting># /etc/systemd/network/25-bridge-static.network
3619[Match]
f47c5c47 3620Name=bridge0
3621
3622[Network]
3623Address=192.168.0.15/24
3624Gateway=192.168.0.1
3625DNS=192.168.0.1</programlisting>
f47c5c47 3626
9e35b3de
ZJS
3627 <programlisting># /etc/systemd/network/25-bridge-slave-interface-1.network
3628[Match]
f47c5c47 3629Name=enp2s0
3630
3631[Network]
3632Bridge=bridge0</programlisting>
9e35b3de
ZJS
3633
3634 <programlisting># /etc/systemd/network/25-bridge-slave-interface-2.network
3635[Match]
3636Name=wlp3s0
3637
3638[Network]
3639Bridge=bridge0</programlisting>
3640
3641 <para>This creates a bridge and attaches devices <literal>enp2s0</literal> and
3642 <literal>wlp3s0</literal> to it. The bridge will have the specified static address
3643 and network assigned, and a default route via the specified gateway will be
3644 added. The specified DNS server will be added to the global list of DNS resolvers.
3645 </para>
13b498f9 3646 </example>
9e35b3de 3647
13b498f9 3648 <example>
9e35b3de 3649 <title></title>
13b498f9 3650
9e35b3de
ZJS
3651 <programlisting>
3652# /etc/systemd/network/20-bridge-slave-interface-vlan.network
3653[Match]
13b498f9
TJ
3654Name=enp2s0
3655
3656[Network]
3657Bridge=bridge0
3658
3659[BridgeVLAN]
3660VLAN=1-32
3661PVID=42
3662EgressUntagged=42
3663
3664[BridgeVLAN]
3665VLAN=100-200
3666
3667[BridgeVLAN]
3668EgressUntagged=300-400</programlisting>
0a8a0fad 3669
9e35b3de
ZJS
3670 <para>This overrides the configuration specified in the previous example for the
3671 interface <literal>enp2s0</literal>, and enables VLAN on that bridge port. VLAN IDs
3672 1-32, 42, 100-400 will be allowed. Packets tagged with VLAN IDs 42, 300-400 will be
3673 untagged when they leave on this interface. Untagged packets which arrive on this
3674 interface will be assigned VLAN ID 42.</para>
798d3a52 3675 </example>
0a8a0fad 3676
798d3a52 3677 <example>
9e35b3de 3678 <title>Various tunnels</title>
0a8a0fad 3679
9e35b3de
ZJS
3680 <programlisting>/etc/systemd/network/25-tunnels.network
3681[Match]
3682Name=ens1
0a8a0fad
TG
3683
3684[Network]
9e35b3de
ZJS
3685Tunnel=ipip-tun
3686Tunnel=sit-tun
3687Tunnel=gre-tun
3688Tunnel=vti-tun
3689 </programlisting>
3690
3691 <programlisting>/etc/systemd/network/25-tunnel-ipip.netdev
3692[NetDev]
3693Name=ipip-tun
3694Kind=ipip
3695 </programlisting>
3696
3697 <programlisting>/etc/systemd/network/25-tunnel-sit.netdev
3698[NetDev]
3699Name=sit-tun
3700Kind=sit
3701 </programlisting>
3702
3703 <programlisting>/etc/systemd/network/25-tunnel-gre.netdev
3704[NetDev]
3705Name=gre-tun
3706Kind=gre
3707 </programlisting>
3708
3709 <programlisting>/etc/systemd/network/25-tunnel-vti.netdev
3710[NetDev]
3711Name=vti-tun
3712Kind=vti
3713 </programlisting>
3714
3715 <para>This will bring interface <literal>ens1</literal> up and create an IPIP tunnel,
3716 a SIT tunnel, a GRE tunnel, and a VTI tunnel using it.</para>
798d3a52 3717 </example>
0a8a0fad 3718
798d3a52 3719 <example>
9e35b3de 3720 <title>A bond device</title>
0a8a0fad 3721
9e35b3de
ZJS
3722 <programlisting># /etc/systemd/network/30-bond1.network
3723[Match]
3724Name=bond1
0a8a0fad
TG
3725
3726[Network]
9e35b3de
ZJS
3727DHCP=ipv6
3728</programlisting>
0a8a0fad 3729
9e35b3de
ZJS
3730 <programlisting># /etc/systemd/network/30-bond1.netdev
3731[NetDev]
3732Name=bond1
3733Kind=bond
3734</programlisting>
0a8a0fad 3735
301a21a8 3736 <programlisting># /etc/systemd/network/30-bond1-dev1.network
9e35b3de
ZJS
3737[Match]
3738MACAddress=52:54:00:e9:64:41
0a8a0fad
TG
3739
3740[Network]
9e35b3de
ZJS
3741Bond=bond1
3742</programlisting>
d94facdc 3743
301a21a8 3744 <programlisting># /etc/systemd/network/30-bond1-dev2.network
9e35b3de
ZJS
3745[Match]
3746MACAddress=52:54:00:e9:64:42
d94facdc
MH
3747
3748[Network]
9e35b3de 3749Bond=bond1
6cb955c6 3750</programlisting>
9e35b3de
ZJS
3751
3752 <para>This will create a bond device <literal>bond1</literal> and enslave the two
3753 devices with MAC addresses 52:54:00:e9:64:41 and 52:54:00:e9:64:42 to it. IPv6 DHCP
3754 will be used to acquire an address.</para>
6cb955c6
AR
3755 </example>
3756
3757 <example>
9e35b3de
ZJS
3758 <title>Virtual Routing and Forwarding (VRF)</title>
3759 <para>Add the <literal>bond1</literal> interface to the VRF master interface
3760 <literal>vrf1</literal>. This will redirect routes generated on this interface to be
11d38b90
AR
3761 within the routing table defined during VRF creation. For kernels before 4.8 traffic
3762 won't be redirected towards the VRFs routing table unless specific ip-rules are added.
3763 </para>
9e35b3de
ZJS
3764 <programlisting># /etc/systemd/network/25-vrf.network
3765[Match]
6cb955c6
AR
3766Name=bond1
3767
3768[Network]
9e35b3de 3769VRF=vrf1
d94facdc
MH
3770</programlisting>
3771 </example>
3772
42125eda
SS
3773 <example>
3774 <title>MacVTap</title>
3775 <para>This brings up a network interface <literal>macvtap-test</literal>
3776 and attaches it to <literal>enp0s25</literal>.</para>
83ddf5d3 3777 <programlisting># /usr/lib/systemd/network/25-macvtap.network
42125eda
SS
3778[Match]
3779Name=enp0s25
3780
3781[Network]
3782MACVTAP=macvtap-test
3783</programlisting>
3784 </example>
98d20a17 3785
3786 <example>
3787 <title>A Xfrm interface with physical underlying device.</title>
3788
3789 <programlisting># /etc/systemd/network/27-xfrm.netdev
3790[NetDev]
3791Name=xfrm0
3792
3793[Xfrm]
3794InterfaceId=7</programlisting>
3795
3796 <programlisting># /etc/systemd/network/27-eth0.network
3797[Match]
3798Name=eth0
3799
3800[Network]
3801Xfrm=xfrm0</programlisting>
3802
3803 <para>This creates a <literal>xfrm0</literal> interface and binds it to the <literal>eth0</literal> device.
3804 This allows hardware based ipsec offloading to the <literal>eth0</literal> nic.
3805 If offloading is not needed, xfrm interfaces can be assigned to the <literal>lo</literal> device.
3806 </para>
3807 </example>
798d3a52
ZJS
3808 </refsect1>
3809
3810 <refsect1>
3811 <title>See Also</title>
3812 <para>
3813 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
f41b446a 3814 <citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
798d3a52 3815 <citerefentry><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
aaa297d4
LP
3816 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
3817 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
798d3a52
ZJS
3818 </para>
3819 </refsect1>
eac684ef
TG
3820
3821</refentry>