]> git.ipfire.org Git - thirdparty/systemd.git/blame - man/systemd.network.xml
trivial spelling fixes (#13339)
[thirdparty/systemd.git] / man / systemd.network.xml
CommitLineData
514094f9 1<?xml version='1.0'?>
3a54a157 2<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
12b42c76 3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
0307f791 4<!-- SPDX-License-Identifier: LGPL-2.1+ -->
eac684ef
TG
5
6<refentry id="systemd.network" conditional='ENABLE_NETWORKD'>
7
798d3a52
ZJS
8 <refentryinfo>
9 <title>systemd.network</title>
10 <productname>systemd</productname>
798d3a52
ZJS
11 </refentryinfo>
12
13 <refmeta>
14 <refentrytitle>systemd.network</refentrytitle>
15 <manvolnum>5</manvolnum>
16 </refmeta>
17
18 <refnamediv>
19 <refname>systemd.network</refname>
20 <refpurpose>Network configuration</refpurpose>
21 </refnamediv>
22
23 <refsynopsisdiv>
24 <para><filename><replaceable>network</replaceable>.network</filename></para>
25 </refsynopsisdiv>
26
27 <refsect1>
28 <title>Description</title>
29
30 <para>Network setup is performed by
31 <citerefentry><refentrytitle>systemd-networkd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
32 </para>
33
bac150e9
ZJS
34 <para>The main network file must have the extension <filename>.network</filename>; other
35 extensions are ignored. Networks are applied to links whenever the links appear.</para>
36
dc0d4078
ZJS
37 <para>The <filename>.network</filename> files are read from the files located in the system network
38 directories <filename>/usr/lib/systemd/network</filename> and
39 <filename>/usr/local/lib/systemd/network</filename>, the volatile runtime network directory
40 <filename>/run/systemd/network</filename> and the local administration network directory
41 <filename>/etc/systemd/network</filename>. All configuration files are collectively sorted and processed
42 in lexical order, regardless of the directories in which they live. However, files with identical
43 filenames replace each other. Files in <filename>/etc</filename> have the highest priority, files in
44 <filename>/run</filename> take precedence over files with the same name under
45 <filename>/usr</filename>. This can be used to override a system-supplied configuration file with a local
46 file if needed. As a special case, an empty file (file size 0) or symlink with the same name pointing to
47 <filename>/dev/null</filename> disables the configuration file entirely (it is "masked").</para>
bac150e9
ZJS
48
49 <para>Along with the network file <filename>foo.network</filename>, a "drop-in" directory
50 <filename>foo.network.d/</filename> may exist. All files with the suffix
51 <literal>.conf</literal> from this directory will be parsed after the file itself is
52 parsed. This is useful to alter or add configuration settings, without having to modify the main
53 configuration file. Each drop-in file must have appropriate section headers.</para>
54
55 <para>In addition to <filename>/etc/systemd/network</filename>, drop-in <literal>.d</literal>
56 directories can be placed in <filename>/usr/lib/systemd/network</filename> or
57 <filename>/run/systemd/network</filename> directories. Drop-in files in
58 <filename>/etc</filename> take precedence over those in <filename>/run</filename> which in turn
59 take precedence over those in <filename>/usr/lib</filename>. Drop-in files under any of these
b1e91af8 60 directories take precedence over the main network file wherever located.</para>
bac150e9
ZJS
61
62 <para>Note that an interface without any static IPv6 addresses configured, and neither DHCPv6
63 nor IPv6LL enabled, shall be considered to have no IPv6 support. IPv6 will be automatically
64 disabled for that interface by writing "1" to
65 <filename>/proc/sys/net/ipv6/conf/<replaceable>ifname</replaceable>/disable_ipv6</filename>.
82ecb4c3 66 </para>
798d3a52
ZJS
67 </refsect1>
68
69 <refsect1>
70 <title>[Match] Section Options</title>
71
72 <para>The network file contains a <literal>[Match]</literal>
73 section, which determines if a given network file may be applied
74 to a given device; and a <literal>[Network]</literal> section
75 specifying how the device should be configured. The first (in
76 lexical order) of the network files that matches a given device
a22e1850
LP
77 is applied, all later files are ignored, even if they match as
78 well.</para>
798d3a52 79
84ea567e
YW
80 <para>A network file is said to match a network interface if all matches specified by the
81 <literal>[Match]</literal> section are satisfied. When a network file does not contain valid
82 settings in <literal>[Match]</literal> section, then the file will match all interfaces and
83 <command>systemd-networkd</command> warns about that. Hint: to avoid the warning and to make it
84 clear that all interfaces shall be matched, add the following:
85 <programlisting>Name=*</programlisting>
86 The following keys are accepted:</para>
798d3a52
ZJS
87
88 <variablelist class='network-directives'>
89 <varlistentry>
90 <term><varname>MACAddress=</varname></term>
91 <listitem>
9310bf4b 92 <para>A whitespace-separated list of hardware addresses. Use full colon-, hyphen- or dot-delimited hexadecimal. See the example below.
b1e91af8 93 This option may appear more than once, in which case the lists are merged. If the empty string is assigned to this option, the list
9310bf4b
YW
94 of hardware addresses defined prior to this is reset.</para>
95
96 <para>Example:
97 <programlisting>MACAddress=01:23:45:67:89:ab 00-11-22-33-44-55 AABB.CCDD.EEFF</programlisting></para>
798d3a52
ZJS
98 </listitem>
99 </varlistentry>
100 <varlistentry>
101 <term><varname>Path=</varname></term>
102 <listitem>
5256e00e
TG
103 <para>A whitespace-separated list of shell-style globs
104 matching the persistent path, as exposed by the udev
618b196e
DM
105 property <literal>ID_PATH</literal>. If the list is
106 prefixed with a "!", the test is inverted; i.e. it is
107 true when <literal>ID_PATH</literal> does not match any
108 item in the list.</para>
798d3a52
ZJS
109 </listitem>
110 </varlistentry>
111 <varlistentry>
112 <term><varname>Driver=</varname></term>
113 <listitem>
5256e00e
TG
114 <para>A whitespace-separated list of shell-style globs
115 matching the driver currently bound to the device, as
c382025a 116 exposed by the udev property <literal>ID_NET_DRIVER</literal>
798d3a52
ZJS
117 of its parent device, or if that is not set the driver
118 as exposed by <literal>ethtool -i</literal> of the
618b196e
DM
119 device itself. If the list is prefixed with a "!", the
120 test is inverted.</para>
798d3a52
ZJS
121 </listitem>
122 </varlistentry>
123 <varlistentry>
124 <term><varname>Type=</varname></term>
125 <listitem>
5256e00e
TG
126 <para>A whitespace-separated list of shell-style globs
127 matching the device type, as exposed by the udev property
618b196e
DM
128 <literal>DEVTYPE</literal>. If the list is prefixed with
129 a "!", the test is inverted.</para>
798d3a52
ZJS
130 </listitem>
131 </varlistentry>
132 <varlistentry>
133 <term><varname>Name=</varname></term>
134 <listitem>
5256e00e
TG
135 <para>A whitespace-separated list of shell-style globs
136 matching the device name, as exposed by the udev property
618b196e
DM
137 <literal>INTERFACE</literal>. If the list is prefixed
138 with a "!", the test is inverted.</para>
798d3a52
ZJS
139 </listitem>
140 </varlistentry>
44005bfb
YW
141 <varlistentry>
142 <term><varname>Property=</varname></term>
143 <listitem>
144 <para>A whitespace-separated list of udev property name with its value after a equal
145 (<literal>=</literal>). If multiple properties are specified, the test results are ANDed.
146 If the list is prefixed with a "!", the test is inverted. If a value contains white
147 spaces, then please quote whole key and value pair. If a value contains quotation, then
148 please escape the quotation with <literal>\</literal>.</para>
149
150 <para>Example: if a .network file has the following:
151 <programlisting>Property=ID_MODEL_ID=9999 "ID_VENDOR_FROM_DATABASE=vendor name" "KEY=with \"quotation\""</programlisting>
152 then, the .network file matches only when an interface has all the above three properties.
153 </para>
154 </listitem>
155 </varlistentry>
798d3a52
ZJS
156 <varlistentry>
157 <term><varname>Host=</varname></term>
158 <listitem>
d689bbca
YW
159 <para>Matches against the hostname or machine ID of the host. See
160 <literal>ConditionHost=</literal> in
798d3a52 161 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
d689bbca
YW
162 for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
163 If an empty string is assigned, then previously assigned value is cleared.
798d3a52
ZJS
164 </para>
165 </listitem>
166 </varlistentry>
167 <varlistentry>
168 <term><varname>Virtualization=</varname></term>
169 <listitem>
d689bbca
YW
170 <para>Checks whether the system is executed in a virtualized environment and optionally test
171 whether it is a specific implementation. See <literal>ConditionVirtualization=</literal> in
798d3a52 172 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
d689bbca
YW
173 for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
174 If an empty string is assigned, then previously assigned value is cleared.
798d3a52
ZJS
175 </para>
176 </listitem>
177 </varlistentry>
178 <varlistentry>
179 <term><varname>KernelCommandLine=</varname></term>
180 <listitem>
d689bbca 181 <para>Checks whether a specific kernel command line option is set. See
798d3a52
ZJS
182 <literal>ConditionKernelCommandLine=</literal> in
183 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
d689bbca
YW
184 for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
185 If an empty string is assigned, then previously assigned value is cleared.
798d3a52
ZJS
186 </para>
187 </listitem>
188 </varlistentry>
5022f08a
LP
189 <varlistentry>
190 <term><varname>KernelVersion=</varname></term>
191 <listitem>
d689bbca
YW
192 <para>Checks whether the kernel version (as reported by <command>uname -r</command>) matches a
193 certain expression. See <literal>ConditionKernelVersion=</literal> in
194 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
195 for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
196 If an empty string is assigned, then previously assigned value is cleared.
5022f08a
LP
197 </para>
198 </listitem>
199 </varlistentry>
798d3a52
ZJS
200 <varlistentry>
201 <term><varname>Architecture=</varname></term>
202 <listitem>
d689bbca
YW
203 <para>Checks whether the system is running on a specific architecture. See
204 <literal>ConditionArchitecture=</literal> in
798d3a52 205 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
d689bbca
YW
206 for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
207 If an empty string is assigned, then previously assigned value is cleared.
798d3a52
ZJS
208 </para>
209 </listitem>
210 </varlistentry>
211 </variablelist>
212
213 </refsect1>
214
215 <refsect1>
216 <title>[Link] Section Options</title>
217
218 <para> The <literal>[Link]</literal> section accepts the following keys:</para>
219
220 <variablelist class='network-directives'>
221 <varlistentry>
222 <term><varname>MACAddress=</varname></term>
223 <listitem>
de25aae1 224 <para>The hardware address to set for the device.</para>
798d3a52
ZJS
225 </listitem>
226 </varlistentry>
227 <varlistentry>
228 <term><varname>MTUBytes=</varname></term>
229 <listitem>
230 <para>The maximum transmission unit in bytes to set for the
231 device. The usual suffixes K, M, G, are supported and are
232 understood to the base of 1024.</para>
439689c6
SS
233 <para>Note that if IPv6 is enabled on the interface, and the MTU is chosen
234 below 1280 (the minimum MTU for IPv6) it will automatically be increased to this value.</para>
798d3a52
ZJS
235 </listitem>
236 </varlistentry>
99d2baa2
SS
237 <varlistentry>
238 <term><varname>ARP=</varname></term>
239 <listitem>
9b6ffef3
YW
240 <para>Takes a boolean. If set to true, the ARP (low-level Address Resolution Protocol)
241 for this interface is enabled. When unset, the kernel's default will be used.</para>
99d2baa2
SS
242 <para> For example, disabling ARP is useful when creating multiple MACVLAN or VLAN virtual
243 interfaces atop a single lower-level physical interface, which will then only serve as a
244 link/"bridge" device aggregating traffic to the same physical link and not participate in
245 the network otherwise.</para>
246 </listitem>
247 </varlistentry>
e6ebebbe
SS
248 <varlistentry>
249 <term><varname>Multicast=</varname></term>
250 <listitem>
9b6ffef3 251 <para>Takes a boolean. If set to true, the multicast flag on the device is enabled.</para>
866e6b7a
SS
252 </listitem>
253 </varlistentry>
254 <varlistentry>
255 <term><varname>AllMulticast=</varname></term>
256 <listitem>
9b6ffef3 257 <para>Takes a boolean. If set to true, the driver retrieves all multicast packets from the network.
866e6b7a 258 This happens when multicast routing is enabled.</para>
e6ebebbe
SS
259 </listitem>
260 </varlistentry>
a09dc546
DM
261 <varlistentry>
262 <term><varname>Unmanaged=</varname></term>
263 <listitem>
9b6ffef3 264 <para>Takes a boolean. When <literal>yes</literal>, no attempts are
a09dc546
DM
265 made to bring up or configure matching links, equivalent to
266 when there are no matching network files. Defaults to
267 <literal>no</literal>.</para>
268 <para>This is useful for preventing later matching network
269 files from interfering with certain interfaces that are fully
270 controlled by other applications.</para>
271 </listitem>
272 </varlistentry>
c1a38904
MTL
273 <varlistentry>
274 <term><varname>RequiredForOnline=</varname></term>
275 <listitem>
8d6082e4
YW
276 <para>Takes a boolean or operational state. Please see
277 <citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
278 for possible operational states. When <literal>yes</literal>, the network is deemed required when
279 determining whether the system is online when running
280 <command>systemd-networkd-wait-online</command>. When <literal>no</literal>, the network is ignored
281 when checking for online state. When an operational state is set, <literal>yes</literal> is implied,
282 and this controls the operational state required for the network interface to be considered online.
283 Defaults to <literal>yes</literal>.</para>
284
c1a38904
MTL
285 <para>The network will be brought up normally in all cases, but in
286 the event that there is no address being assigned by DHCP or the
287 cable is not plugged in, the link will simply remain offline and be
8d6082e4 288 skipped automatically by <command>systemd-networkd-wait-online</command>
ca92fe36 289 if <literal>RequiredForOnline=no</literal>.</para>
c1a38904
MTL
290 </listitem>
291 </varlistentry>
798d3a52
ZJS
292 </variablelist>
293 </refsect1>
294
295 <refsect1>
296 <title>[Network] Section Options</title>
297
298 <para>The <literal>[Network]</literal> section accepts the following keys:</para>
299
300 <variablelist class='network-directives'>
301 <varlistentry>
302 <term><varname>Description=</varname></term>
303 <listitem>
304 <para>A description of the device. This is only used for
305 presentation purposes.</para>
306 </listitem>
307 </varlistentry>
308 <varlistentry>
309 <term><varname>DHCP=</varname></term>
310 <listitem>
ad943783 311 <para>Enables DHCPv4 and/or DHCPv6 client support. Accepts
798d3a52 312 <literal>yes</literal>, <literal>no</literal>,
c702bd3b
LY
313 <literal>ipv4</literal>, or <literal>ipv6</literal>. Defaults
314 to <literal>no</literal>.</para>
e88d8021 315
f5a8c43f 316 <para>Note that DHCPv6 will by default be triggered by Router
7f3fdb7f 317 Advertisement, if that is enabled, regardless of this parameter.
f5a8c43f
TG
318 By enabling DHCPv6 support explicitly, the DHCPv6 client will
319 be started regardless of the presence of routers on the link,
320 or what flags the routers pass. See
f921f573 321 <literal>IPv6AcceptRA=</literal>.</para>
f5a8c43f
TG
322
323 <para>Furthermore, note that by default the domain name
e88d8021
ZJS
324 specified through DHCP is not used for name resolution.
325 See option <option>UseDomains=</option> below.</para>
2ef322fc 326
4f7331a8
YW
327 <para>See the <literal>[DHCPv4]</literal> or <literal>[DHCPv6]</literal> section below for
328 further configuration options for the DHCP client support.</para>
798d3a52
ZJS
329 </listitem>
330 </varlistentry>
331 <varlistentry>
332 <term><varname>DHCPServer=</varname></term>
333 <listitem>
68b7f7ac 334 <para>Takes a boolean. If set to <literal>yes</literal>, DHCPv4 server will be started. Defaults
ad943783
LP
335 to <literal>no</literal>. Further settings for the DHCP
336 server may be set in the <literal>[DHCPServer]</literal>
337 section described below.</para>
798d3a52
ZJS
338 </listitem>
339 </varlistentry>
340 <varlistentry>
56fd6bf7 341 <term><varname>LinkLocalAddressing=</varname></term>
798d3a52 342 <listitem>
85fc09c9 343 <para>Enables link-local address autoconfiguration. Accepts <literal>yes</literal>,
8bc17bb3
SS
344 <literal>no</literal>, <literal>ipv4</literal>, <literal>ipv6</literal>,
345 <literal>fallback</literal>, or <literal>ipv4-fallback</literal>. If
346 <literal>fallback</literal> or <literal>ipv4-fallback</literal> is specified, then an IPv4
347 link-local address is configured only when DHCPv4 fails. If <literal>fallback</literal>,
348 an IPv6 link-local address is always configured, and if <literal>ipv4-fallback</literal>,
349 the address is not configured. Note that, the fallback mechanism works only when DHCPv4
350 client is enabled, that is, it requires <literal>DHCP=yes</literal> or
351 <literal>DHCP=ipv4</literal>. If <varname>Bridge=</varname> is set, defaults to
352 <literal>no</literal>, and if not, defaults to <literal>ipv6</literal>.
353 </para>
798d3a52
ZJS
354 </listitem>
355 </varlistentry>
356 <varlistentry>
357 <term><varname>IPv4LLRoute=</varname></term>
358 <listitem>
9b6ffef3 359 <para>Takes a boolean. If set to true, sets up the route needed for
798d3a52
ZJS
360 non-IPv4LL hosts to communicate with IPv4LL-only hosts. Defaults
361 to false.
362 </para>
363 </listitem>
364 </varlistentry>
5d5003ab
YW
365 <varlistentry>
366 <term><varname>DefaultRouteOnDevice=</varname></term>
367 <listitem>
368 <para>Takes a boolean. If set to true, sets up the default route bound to the interface.
369 Defaults to false. This is useful when creating routes on point-to-point interfaces.
370 This is equivalent to e.g. the following.
371 <programlisting>ip route add default dev veth99</programlisting></para>
372 </listitem>
373 </varlistentry>
798d3a52 374 <varlistentry>
113bfde1
TG
375 <term><varname>IPv6Token=</varname></term>
376 <listitem>
377 <para>An IPv6 address with the top 64 bits unset. When set, indicates the
eb142d8e
TG
378 64-bit interface part of SLAAC IPv6 addresses for this link. Note that
379 the token is only ever used for SLAAC, and not for DHCPv6 addresses, even
3708bd46 380 in the case DHCP is requested by router advertisement. By default, the
eb142d8e 381 token is autogenerated.</para>
113bfde1
TG
382 </listitem>
383 </varlistentry>
384 <varlistentry>
798d3a52
ZJS
385 <term><varname>LLMNR=</varname></term>
386 <listitem>
9b6ffef3 387 <para>Takes a boolean or <literal>resolve</literal>. When true,
aaa297d4
LP
388 enables <ulink
389 url="https://tools.ietf.org/html/rfc4795">Link-Local
390 Multicast Name Resolution</ulink> on the link. When set to
391 <literal>resolve</literal>, only resolution is enabled,
392 but not host registration and announcement. Defaults to
393 true. This setting is read by
394 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
395 </listitem>
396 </varlistentry>
397 <varlistentry>
398 <term><varname>MulticastDNS=</varname></term>
399 <listitem>
9b6ffef3 400 <para>Takes a boolean or <literal>resolve</literal>. When true,
aaa297d4
LP
401 enables <ulink
402 url="https://tools.ietf.org/html/rfc6762">Multicast
403 DNS</ulink> support on the link. When set to
404 <literal>resolve</literal>, only resolution is enabled,
405 but not host or service registration and
406 announcement. Defaults to false. This setting is read by
407 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
798d3a52
ZJS
408 </listitem>
409 </varlistentry>
30e59c84 410 <varlistentry>
c9299be2 411 <term><varname>DNSOverTLS=</varname></term>
30e59c84 412 <listitem>
4310bfc2
IT
413 <para>Takes a boolean or <literal>opportunistic</literal>.
414 When true, enables
30e59c84
IT
415 <ulink
416 url="https://tools.ietf.org/html/rfc7858">DNS-over-TLS</ulink>
4310bfc2
IT
417 support on the link.
418 When set to <literal>opportunistic</literal>, compatibility with
419 non-DNS-over-TLS servers is increased, by automatically
420 turning off DNS-over-TLS servers in this case.
421 This option defines a per-interface setting for
30e59c84 422 <citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>'s
c9299be2 423 global <varname>DNSOverTLS=</varname> option. Defaults to
30e59c84
IT
424 false. This setting is read by
425 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
426 </listitem>
427 </varlistentry>
ad6c0475
LP
428 <varlistentry>
429 <term><varname>DNSSEC=</varname></term>
430 <listitem>
9b6ffef3 431 <para>Takes a boolean. or
ad6c0475
LP
432 <literal>allow-downgrade</literal>. When true, enables
433 <ulink
434 url="https://tools.ietf.org/html/rfc4033">DNSSEC</ulink>
435 DNS validation support on the link. When set to
436 <literal>allow-downgrade</literal>, compatibility with
437 non-DNSSEC capable networks is increased, by automatically
785889e5 438 turning off DNSSEC in this case. This option defines a
ad6c0475
LP
439 per-interface setting for
440 <citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>'s
441 global <varname>DNSSEC=</varname> option. Defaults to
442 false. This setting is read by
443 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
444 </listitem>
445 </varlistentry>
8a516214
LP
446 <varlistentry>
447 <term><varname>DNSSECNegativeTrustAnchors=</varname></term>
448 <listitem><para>A space-separated list of DNSSEC negative
449 trust anchor domains. If specified and DNSSEC is enabled,
450 look-ups done via the interface's DNS server will be subject
451 to the list of negative trust anchors, and not require
452 authentication for the specified domains, or anything below
453 it. Use this to disable DNSSEC authentication for specific
454 private domains, that cannot be proven valid using the
455 Internet DNS hierarchy. Defaults to the empty list. This
456 setting is read by
457 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
458 </listitem>
459 </varlistentry>
798d3a52
ZJS
460 <varlistentry>
461 <term><varname>LLDP=</varname></term>
462 <listitem>
da6c766d
LP
463 <para>Controls support for Ethernet LLDP packet reception. LLDP is a link-layer protocol commonly
464 implemented on professional routers and bridges which announces which physical port a system is connected
465 to, as well as other related data. Accepts a boolean or the special value
34437b4f
LP
466 <literal>routers-only</literal>. When true, incoming LLDP packets are accepted and a database of all LLDP
467 neighbors maintained. If <literal>routers-only</literal> is set only LLDP data of various types of routers
468 is collected and LLDP data about other types of devices ignored (such as stations, telephones and
7cececb2 469 others). If false, LLDP reception is disabled. Defaults to <literal>routers-only</literal>. Use
34437b4f 470 <citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> to query the
da6c766d
LP
471 collected neighbor data. LLDP is only available on Ethernet links. See <varname>EmitLLDP=</varname> below
472 for enabling LLDP packet emission from the local system.
798d3a52
ZJS
473 </para>
474 </listitem>
475 </varlistentry>
da6c766d
LP
476 <varlistentry>
477 <term><varname>EmitLLDP=</varname></term>
478 <listitem>
7272b25e
LP
479 <para>Controls support for Ethernet LLDP packet emission. Accepts a boolean parameter or the special values
480 <literal>nearest-bridge</literal>, <literal>non-tpmr-bridge</literal> and
481 <literal>customer-bridge</literal>. Defaults to false, which turns off LLDP packet emission. If not false,
482 a short LLDP packet with information about the local system is sent out in regular intervals on the
483 link. The LLDP packet will contain information about the local host name, the local machine ID (as stored
484 in <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>) and the
da6c766d
LP
485 local interface name, as well as the pretty hostname of the system (as set in
486 <citerefentry><refentrytitle>machine-info</refentrytitle><manvolnum>5</manvolnum></citerefentry>). LLDP
7272b25e
LP
487 emission is only available on Ethernet links. Note that this setting passes data suitable for
488 identification of host to the network and should thus not be enabled on untrusted networks, where such
489 identification data should not be made available. Use this option to permit other systems to identify on
490 which interfaces they are connected to this system. The three special values control propagation of the
491 LLDP packets. The <literal>nearest-bridge</literal> setting permits propagation only to the nearest
492 connected bridge, <literal>non-tpmr-bridge</literal> permits propagation across Two-Port MAC Relays, but
493 not any other bridges, and <literal>customer-bridge</literal> permits propagation until a customer bridge
494 is reached. For details about these concepts, see <ulink
6a1bae83 495 url="https://standards.ieee.org/findstds/standard/802.1AB-2016.html">IEEE 802.1AB-2016</ulink>. Note that
7272b25e
LP
496 configuring this setting to true is equivalent to <literal>nearest-bridge</literal>, the recommended and
497 most restricted level of propagation. See <varname>LLDP=</varname> above for an option to enable LLDP
498 reception.</para>
da6c766d
LP
499 </listitem>
500 </varlistentry>
0d4ad91d
AR
501 <varlistentry>
502 <term><varname>BindCarrier=</varname></term>
503 <listitem>
2ae7505f
TG
504 <para>A link name or a list of link names. When set, controls the behavior of the current
505 link. When all links in the list are in an operational down state, the current link is brought
506 down. When at least one link has carrier, the current interface is brought up.
0d4ad91d
AR
507 </para>
508 </listitem>
509 </varlistentry>
798d3a52
ZJS
510 <varlistentry>
511 <term><varname>Address=</varname></term>
512 <listitem>
513 <para>A static IPv4 or IPv6 address and its prefix length,
514 separated by a <literal>/</literal> character. Specify
515 this key more than once to configure several addresses.
516 The format of the address must be as described in
3ba3a79d 517 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
798d3a52
ZJS
518 This is a short-hand for an [Address] section only
519 containing an Address key (see below). This option may be
520 specified more than once.
521 </para>
522
e6ef3a13
YW
523 <para>If the specified address is <literal>0.0.0.0</literal> (for IPv4) or <literal>::</literal>
524 (for IPv6), a new address range of the requested size is automatically allocated from a
525 system-wide pool of unused ranges. Note that the prefix length must be equal or larger than 8 for
526 IPv4, and 64 for IPv6. The allocated range is checked against all current network interfaces and
527 all known network configuration files to avoid address range conflicts. The default system-wide
528 pool consists of 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 for IPv4, and fd00::/8 for IPv6.
529 This functionality is useful to manage a large number of dynamically created network interfaces
530 with the same network configuration and automatic address range assignment.</para>
798d3a52
ZJS
531
532 </listitem>
533 </varlistentry>
534 <varlistentry>
535 <term><varname>Gateway=</varname></term>
536 <listitem>
537 <para>The gateway address, which must be in the format
538 described in
3ba3a79d 539 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
798d3a52
ZJS
540 This is a short-hand for a [Route] section only containing
541 a Gateway key. This option may be specified more than
542 once.</para>
543 </listitem>
544 </varlistentry>
545 <varlistentry>
546 <term><varname>DNS=</varname></term>
547 <listitem>
548 <para>A DNS server address, which must be in the format
549 described in
3ba3a79d 550 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
f41b446a 551 This option may be specified more than once. This setting is read by
3df9bec5 552 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
798d3a52
ZJS
553 </listitem>
554 </varlistentry>
555 <varlistentry>
556 <term><varname>Domains=</varname></term>
557 <listitem>
2df22529
ZJS
558 <para>A list of domains which should be resolved using the DNS servers on this link. Each item in the list
559 should be a domain name, optionally prefixed with a tilde (<literal>~</literal>). The domains with the
560 prefix are called "routing-only domains". The domains without the prefix are called "search domains" and
561 are first used as search suffixes for extending single-label host names (host names containing no dots) to
562 become fully qualified domain names (FQDNs). If a single-label host name is resolved on this interface,
563 each of the specified search domains are appended to it in turn, converting it into a fully qualified
564 domain name, until one of them may be successfully resolved.</para>
565
566 <para>Both "search" and "routing-only" domains are used for routing of DNS queries: look-ups for host names
567 ending in those domains (hence also single label names, if any "search domains" are listed), are routed to
568 the DNS servers configured for this interface. The domain routing logic is particularly useful on
569 multi-homed hosts with DNS servers serving particular private DNS zones on each interface.</para>
570
571 <para>The "routing-only" domain <literal>~.</literal> (the tilde indicating definition of a routing domain,
572 the dot referring to the DNS root domain which is the implied suffix of all valid DNS names) has special
573 effect. It causes all DNS traffic which does not match another configured domain routing entry to be routed
574 to DNS servers specified for this interface. This setting is useful to prefer a certain set of DNS servers
575 if a link on which they are connected is available.</para>
3df9bec5
LP
576
577 <para>This setting is read by
2df22529
ZJS
578 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
579 "Search domains" correspond to the <varname>domain</varname> and <varname>search</varname> entries in
98e9d710 580 <citerefentry project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
2df22529
ZJS
581 Domain name routing has no equivalent in the traditional glibc API, which has no concept of domain
582 name servers limited to a specific link.</para>
798d3a52
ZJS
583 </listitem>
584 </varlistentry>
7ece6f58
LP
585 <varlistentry>
586 <term><varname>DNSDefaultRoute=</varname></term>
587 <listitem>
588 <para>Takes a boolean argument. If true, this link's configured DNS servers are used for resolving domain
589 names that do not match any link's configured <varname>Domains=</varname> setting. If false, this link's
590 configured DNS servers are never used for such domains, and are exclusively used for resolving names that
591 match at least one of the domains configured on this link. If not specified defaults to an automatic mode:
592 queries not matching any link's configured domains will be routed to this link if it has no routing-only
593 domains configured.</para>
594 </listitem>
595 </varlistentry>
798d3a52
ZJS
596 <varlistentry>
597 <term><varname>NTP=</varname></term>
598 <listitem>
f41b446a 599 <para>An NTP server address. This option may be specified more than once. This setting is read by
3df9bec5 600 <citerefentry><refentrytitle>systemd-timesyncd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
798d3a52
ZJS
601 </listitem>
602 </varlistentry>
603 <varlistentry>
604 <term><varname>IPForward=</varname></term>
765afd5c
LP
605 <listitem><para>Configures IP packet forwarding for the
606 system. If enabled, incoming packets on any network
607 interface will be forwarded to any other interfaces
9b6ffef3
YW
608 according to the routing table. Takes a boolean,
609 or the values <literal>ipv4</literal> or
765afd5c
LP
610 <literal>ipv6</literal>, which only enable IP packet
611 forwarding for the specified address family. This controls
612 the <filename>net.ipv4.ip_forward</filename> and
613 <filename>net.ipv6.conf.all.forwarding</filename> sysctl
614 options of the network interface (see <ulink
4046d836
LP
615 url="https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt">ip-sysctl.txt</ulink>
616 for details about sysctl options). Defaults to
617 <literal>no</literal>.</para>
618
765afd5c
LP
619 <para>Note: this setting controls a global kernel option,
620 and does so one way only: if a network that has this setting
621 enabled is set up the global setting is turned on. However,
622 it is never turned off again, even after all networks with
623 this setting enabled are shut down again.</para>
624
625 <para>To allow IP packet forwarding only between specific
626 network interfaces use a firewall.</para>
4046d836 627 </listitem>
798d3a52
ZJS
628 </varlistentry>
629 <varlistentry>
630 <term><varname>IPMasquerade=</varname></term>
631 <listitem><para>Configures IP masquerading for the network
b938cb90 632 interface. If enabled, packets forwarded from the network
798d3a52
ZJS
633 interface will be appear as coming from the local host.
634 Takes a boolean argument. Implies
5c82dd13 635 <varname>IPForward=ipv4</varname>. Defaults to
4046d836 636 <literal>no</literal>.</para></listitem>
798d3a52 637 </varlistentry>
a46e37cb
SS
638 <varlistentry>
639 <term><varname>IPv6PrivacyExtensions=</varname></term>
1f0d9695
LP
640 <listitem><para>Configures use of stateless temporary
641 addresses that change over time (see <ulink
642 url="https://tools.ietf.org/html/rfc4941">RFC 4941</ulink>,
643 Privacy Extensions for Stateless Address Autoconfiguration
644 in IPv6). Takes a boolean or the special values
645 <literal>prefer-public</literal> and
b938cb90 646 <literal>kernel</literal>. When true, enables the privacy
1f0d9695 647 extensions and prefers temporary addresses over public
b938cb90 648 addresses. When <literal>prefer-public</literal>, enables the
1f0d9695
LP
649 privacy extensions, but prefers public addresses over
650 temporary addresses. When false, the privacy extensions
b938cb90 651 remain disabled. When <literal>kernel</literal>, the kernel's
1f0d9695 652 default setting will be left in place. Defaults to
a46e37cb
SS
653 <literal>no</literal>.</para></listitem>
654 </varlistentry>
941d0aa8 655 <varlistentry>
f921f573 656 <term><varname>IPv6AcceptRA=</varname></term>
b3454e1e
YW
657 <listitem><para>Takes a boolean. Controls IPv6 Router Advertisement (RA) reception support
658 for the interface. If true, RAs are accepted; if false, RAs are ignored, independently of the
659 local forwarding state. When RAs are accepted, they may trigger the start of the DHCPv6
660 client if the relevant flags are set in the RA data, or if no routers are found on the link.</para>
1e7a0e21
LP
661
662 <para>Further settings for the IPv6 RA support may be configured in the
f921f573 663 <literal>[IPv6AcceptRA]</literal> section, see below.</para>
1e7a0e21
LP
664
665 <para>Also see <ulink
666 url="https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt">ip-sysctl.txt</ulink> in the kernel
667 documentation regarding <literal>accept_ra</literal>, but note that systemd's setting of
668 <constant>1</constant> (i.e. true) corresponds to kernel's setting of <constant>2</constant>.</para>
c4a05aa1 669
b3454e1e
YW
670 <para>Note that kernel's implementation of the IPv6 RA protocol is always disabled,
671 regardless of this setting. If this option is enabled, a userspace implementation of the IPv6
672 RA protocol is used, and the kernel's own implementation remains disabled, since
673 <command>systemd-networkd</command> needs to know all details supplied in the advertisements,
674 and these are not available from the kernel if the kernel's own implementation is used.</para>
ebf98081 675 </listitem>
941d0aa8 676 </varlistentry>
44de7fb1
SS
677 <varlistentry>
678 <term><varname>IPv6DuplicateAddressDetection=</varname></term>
a8eaaee7 679 <listitem><para>Configures the amount of IPv6 Duplicate
025314d9 680 Address Detection (DAD) probes to send. When unset, the kernel's default will be used.
44de7fb1
SS
681 </para></listitem>
682 </varlistentry>
a86cba89
SS
683 <varlistentry>
684 <term><varname>IPv6HopLimit=</varname></term>
685 <listitem><para>Configures IPv6 Hop Limit. For each router that
686 forwards the packet, the hop limit is decremented by 1. When the
687 hop limit field reaches zero, the packet is discarded.
025314d9 688 When unset, the kernel's default will be used.
a86cba89
SS
689 </para></listitem>
690 </varlistentry>
23d8b221 691 <varlistentry>
8f9a206b 692 <term><varname>IPv4ProxyARP=</varname></term>
9b6ffef3 693 <listitem><para>Takes a boolean. Configures proxy ARP for IPv4. Proxy ARP is the technique in which one host,
23d8b221
SS
694 usually a router, answers ARP requests intended for another machine. By "faking" its identity,
695 the router accepts responsibility for routing packets to the "real" destination. (see <ulink
696 url="https://tools.ietf.org/html/rfc1027">RFC 1027</ulink>.
025314d9 697 When unset, the kernel's default will be used.
23d8b221
SS
698 </para></listitem>
699 </varlistentry>
a0e5c15d 700 <varlistentry>
465dfe59 701 <term><varname>IPv6ProxyNDP=</varname></term>
9b6ffef3 702 <listitem><para>Takes a boolean. Configures proxy NDP for IPv6. Proxy NDP (Neighbor Discovery
465dfe59
HV
703 Protocol) is a technique for IPv6 to allow routing of addresses to a different
704 destination when peers expect them to be present on a certain physical link.
a0e5c15d
FK
705 In this case a router answers Neighbour Advertisement messages intended for
706 another machine by offering its own MAC address as destination.
465dfe59 707 Unlike proxy ARP for IPv4, it is not enabled globally, but will only send Neighbour
a0e5c15d 708 Advertisement messages for addresses in the IPv6 neighbor proxy table,
465dfe59
HV
709 which can also be shown by <command>ip -6 neighbour show proxy</command>.
710 systemd-networkd will control the per-interface `proxy_ndp` switch for each configured
711 interface depending on this option.
025314d9 712 When unset, the kernel's default will be used.
465dfe59
HV
713 </para></listitem>
714 </varlistentry>
715 <varlistentry>
716 <term><varname>IPv6ProxyNDPAddress=</varname></term>
717 <listitem><para>An IPv6 address, for which Neighbour Advertisement messages will be
718 proxied. This option may be specified more than once. systemd-networkd will add the
719 <option>IPv6ProxyNDPAddress=</option> entries to the kernel's IPv6 neighbor proxy table.
964c4eda 720 This option implies <option>IPv6ProxyNDP=yes</option> but has no effect if
025314d9 721 <option>IPv6ProxyNDP</option> has been set to false. When unset, the kernel's default will be used.
a0e5c15d
FK
722 </para></listitem>
723 </varlistentry>
3f9e0236
PF
724 <varlistentry>
725 <term><varname>IPv6PrefixDelegation=</varname></term>
726 <listitem><para>Whether to enable or disable Router Advertisement sending on a link.
982be97c
PF
727 Allowed values are <literal>static</literal> which distributes prefixes as defined in
728 the <literal>[IPv6PrefixDelegation]</literal> and any <literal>[IPv6Prefix]</literal>
729 sections, <literal>dhcpv6</literal> which requests prefixes using a DHCPv6 client
730 configured for another link and any values configured in the
731 <literal>[IPv6PrefixDelegation]</literal> section while ignoring all static prefix
732 configuration sections, <literal>yes</literal> which uses both static configuration
733 and DHCPv6, and <literal>false</literal> which turns off IPv6 prefix delegation
734 altogether. Defaults to <literal>false</literal>. See the
735 <literal>[IPv6PrefixDelegation]</literal> and the <literal>[IPv6Prefix]</literal>
736 sections for more configuration options.
3f9e0236
PF
737 </para></listitem>
738 </varlistentry>
11102cba
SS
739 <varlistentry>
740 <term><varname>IPv6MTUBytes=</varname></term>
741 <listitem><para>Configures IPv6 maximum transmission unit (MTU).
025314d9 742 An integer greater than or equal to 1280 bytes. When unset, the kernel's default will be used.
11102cba
SS
743 </para></listitem>
744 </varlistentry>
798d3a52
ZJS
745 <varlistentry>
746 <term><varname>Bridge=</varname></term>
747 <listitem>
9e35b3de
ZJS
748 <para>The name of the bridge to add the link to. See
749 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
750 </para>
798d3a52
ZJS
751 </listitem>
752 </varlistentry>
753 <varlistentry>
754 <term><varname>Bond=</varname></term>
755 <listitem>
9e35b3de
ZJS
756 <para>The name of the bond to add the link to. See
757 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
758 </para>
798d3a52
ZJS
759 </listitem>
760 </varlistentry>
6cb955c6
AR
761 <varlistentry>
762 <term><varname>VRF=</varname></term>
763 <listitem>
9e35b3de
ZJS
764 <para>The name of the VRF to add the link to. See
765 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
766 </para>
6cb955c6
AR
767 </listitem>
768 </varlistentry>
798d3a52
ZJS
769 <varlistentry>
770 <term><varname>VLAN=</varname></term>
771 <listitem>
9e35b3de
ZJS
772 <para>The name of a VLAN to create on the link. See
773 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
774 This option may be specified more than once.</para>
798d3a52
ZJS
775 </listitem>
776 </varlistentry>
2479c4fe 777 <varlistentry>
778 <term><varname>IPVLAN=</varname></term>
779 <listitem>
780 <para>The name of a IPVLAN to create on the link. See
781 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
782 This option may be specified more than once.</para>
783 </listitem>
784 </varlistentry>
798d3a52
ZJS
785 <varlistentry>
786 <term><varname>MACVLAN=</varname></term>
787 <listitem>
9e35b3de
ZJS
788 <para>The name of a MACVLAN to create on the link. See
789 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
790 This option may be specified more than once.</para>
798d3a52
ZJS
791 </listitem>
792 </varlistentry>
793 <varlistentry>
794 <term><varname>VXLAN=</varname></term>
795 <listitem>
9e35b3de
ZJS
796 <para>The name of a VXLAN to create on the link. See
797 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
798 This option may be specified more than once.</para>
798d3a52
ZJS
799 </listitem>
800 </varlistentry>
801 <varlistentry>
802 <term><varname>Tunnel=</varname></term>
803 <listitem>
9e35b3de
ZJS
804 <para>The name of a Tunnel to create on the link. See
805 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
806 This option may be specified more than once.</para>
798d3a52
ZJS
807 </listitem>
808 </varlistentry>
81962db7
SS
809 <varlistentry>
810 <term><varname>MACsec=</varname></term>
811 <listitem>
812 <para>The name of a MACsec device to create on the link. See
813 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
814 This option may be specified more than once.</para>
815 </listitem>
816 </varlistentry>
dd5f3175
SS
817 <varlistentry>
818 <term><varname>ActiveSlave=</varname></term>
819 <listitem>
9b6ffef3 820 <para>Takes a boolean. Specifies the new active slave. The <literal>ActiveSlave=</literal>
dd5f3175
SS
821 option is only valid for following modes:
822 <literal>active-backup</literal>,
823 <literal>balance-alb</literal> and
824 <literal>balance-tlb</literal>. Defaults to false.
825 </para>
826 </listitem>
827 </varlistentry>
828 <varlistentry>
829 <term><varname>PrimarySlave=</varname></term>
830 <listitem>
9b6ffef3 831 <para>Takes a boolean. Specifies which slave is the primary device. The specified
dd5f3175
SS
832 device will always be the active slave while it is available. Only when the
833 primary is off-line will alternate devices be used. This is useful when
834 one slave is preferred over another, e.g. when one slave has higher throughput
835 than another. The <literal>PrimarySlave=</literal> option is only valid for
836 following modes:
837 <literal>active-backup</literal>,
838 <literal>balance-alb</literal> and
839 <literal>balance-tlb</literal>. Defaults to false.
840 </para>
841 </listitem>
842 </varlistentry>
dad2d78e
SS
843 <varlistentry>
844 <term><varname>ConfigureWithoutCarrier=</varname></term>
845 <listitem>
9b6ffef3 846 <para>Takes a boolean. Allows networkd to configure a specific link even if it has no carrier.
dad2d78e
SS
847 Defaults to false.
848 </para>
849 </listitem>
850 </varlistentry>
93b4dab5
SS
851 <varlistentry>
852 <term><varname>IgnoreCarrierLoss=</varname></term>
853 <listitem>
854 <para>A boolean. Allows networkd to retain both the static and dynamic configuration of the
855 interface even if its carrier is lost. Defaults to false.
856 </para>
857 </listitem>
858 </varlistentry>
98d20a17 859 <varlistentry>
860 <term><varname>Xfrm=</varname></term>
861 <listitem>
862 <para>The name of the xfrm to create on the link. See
863 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
864 This option may be specified more than once.</para>
865 </listitem>
866 </varlistentry>
c98d78d3
YW
867 <varlistentry>
868 <term><varname>KeepConfiguration=</varname></term>
869 <listitem>
870 <para>Takes a boolean or one of <literal>static</literal>, <literal>dhcp-on-stop</literal>,
871 <literal>dhcp</literal>. When <literal>static</literal>, <command>systemd-networkd</command>
872 will not drop static addresses and routes on starting up process. When set to
873 <literal>dhcp-on-stop</literal>, <command>systemd-networkd</command> will not drop addresses
874 and routes on stopping the daemon. When <literal>dhcp</literal>,
875 the addresses and routes provided by a DHCP server will never be dropped even if the DHCP
876 lease expires. This is contrary to the DHCP specification, but may be the best choice if,
877 e.g., the root filesystem relies on this connection. The setting <literal>dhcp</literal>
878 implies <literal>dhcp-on-stop</literal>, and <literal>yes</literal> implies
879 <literal>dhcp</literal> and <literal>static</literal>. Defaults to
880 <literal>dhcp-on-stop</literal>.</para>
881 </listitem>
882 </varlistentry>
93b4dab5 883
798d3a52
ZJS
884 </variablelist>
885
886 </refsect1>
887
888 <refsect1>
889 <title>[Address] Section Options</title>
890
891 <para>An <literal>[Address]</literal> section accepts the
892 following keys. Specify several <literal>[Address]</literal>
893 sections to configure several addresses.</para>
894
895 <variablelist class='network-directives'>
896 <varlistentry>
897 <term><varname>Address=</varname></term>
898 <listitem>
4e68898e
YW
899 <para>As in the <literal>[Network]</literal> section. This key is mandatory. Each
900 <literal>[Address]</literal> section can contain one <varname>Address=</varname> setting.</para>
798d3a52
ZJS
901 </listitem>
902 </varlistentry>
903 <varlistentry>
904 <term><varname>Peer=</varname></term>
905 <listitem>
906 <para>The peer address in a point-to-point connection.
4e68898e 907 Accepts the same format as the <varname>Address=</varname>
798d3a52
ZJS
908 key.</para>
909 </listitem>
910 </varlistentry>
911 <varlistentry>
912 <term><varname>Broadcast=</varname></term>
913 <listitem>
914 <para>The broadcast address, which must be in the format
915 described in
3ba3a79d 916 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
798d3a52 917 This key only applies to IPv4 addresses. If it is not
4e68898e 918 given, it is derived from the <varname>Address=</varname>
798d3a52
ZJS
919 key.</para>
920 </listitem>
921 </varlistentry>
922 <varlistentry>
923 <term><varname>Label=</varname></term>
924 <listitem>
925 <para>An address label.</para>
926 </listitem>
927 </varlistentry>
b5834a0b
SS
928 <varlistentry>
929 <term><varname>PreferredLifetime=</varname></term>
930 <listitem>
931 <para>Allows the default "preferred lifetime" of the address to be overridden.
932 Only three settings are accepted: <literal>forever</literal> or <literal>infinity</literal>
933 which is the default and means that the address never expires, and <literal>0</literal> which means
934 that the address is considered immediately "expired" and will not be used,
935 unless explicitly requested. A setting of PreferredLifetime=0 is useful for
936 addresses which are added to be used only by a specific application,
937 which is then configured to use them explicitly.</para>
938 </listitem>
939 </varlistentry>
2959fb07
SS
940 <varlistentry>
941 <term><varname>Scope=</varname></term>
942 <listitem>
943 <para>The scope of the address, which can be <literal>global</literal>,
944 <literal>link</literal> or <literal>host</literal> or an unsigned integer ranges 0 to 255.
945 Defaults to <literal>global</literal>.</para>
946 </listitem>
947 </varlistentry>
e63be084
SS
948 <varlistentry>
949 <term><varname>HomeAddress=</varname></term>
950 <listitem>
9b6ffef3 951 <para>Takes a boolean. Designates this address the "home address" as defined in
e63be084
SS
952 <ulink url="https://tools.ietf.org/html/rfc6275">RFC 6275</ulink>.
953 Supported only on IPv6. Defaults to false.</para>
954 </listitem>
955 </varlistentry>
956 <varlistentry>
957 <term><varname>DuplicateAddressDetection=</varname></term>
958 <listitem>
9b6ffef3 959 <para>Takes a boolean. Do not perform Duplicate Address Detection
e63be084
SS
960 <ulink url="https://tools.ietf.org/html/rfc4862">RFC 4862</ulink> when adding this address.
961 Supported only on IPv6. Defaults to false.</para>
962 </listitem>
963 </varlistentry>
964 <varlistentry>
965 <term><varname>ManageTemporaryAddress=</varname></term>
966 <listitem>
9b6ffef3 967 <para>Takes a boolean. If true the kernel manage temporary addresses created
e63be084
SS
968 from this one as template on behalf of Privacy Extensions
969 <ulink url="https://tools.ietf.org/html/rfc3041">RFC 3041</ulink>. For this to become
970 active, the use_tempaddr sysctl setting has to be set to a value greater than zero.
971 The given address needs to have a prefix length of 64. This flag allows to use privacy
972 extensions in a manually configured network, just like if stateless auto-configuration
973 was active. Defaults to false. </para>
974 </listitem>
975 </varlistentry>
976 <varlistentry>
977 <term><varname>PrefixRoute=</varname></term>
978 <listitem>
9b6ffef3 979 <para>Takes a boolean. When adding or modifying an IPv6 address, the userspace
e63be084
SS
980 application needs a way to suppress adding a prefix route. This is for example relevant
981 together with IFA_F_MANAGERTEMPADDR, where userspace creates autoconf generated addresses,
982 but depending on on-link, no route for the prefix should be added. Defaults to false.</para>
983 </listitem>
984 </varlistentry>
985 <varlistentry>
986 <term><varname>AutoJoin=</varname></term>
987 <listitem>
9b6ffef3 988 <para>Takes a boolean. Joining multicast group on ethernet level via
e63be084
SS
989 <command>ip maddr</command> command would not work if we have an Ethernet switch that does
990 IGMP snooping since the switch would not replicate multicast packets on ports that did not
991 have IGMP reports for the multicast addresses. Linux vxlan interfaces created via
992 <command>ip link add vxlan</command> or networkd's netdev kind vxlan have the group option
993 that enables then to do the required join. By extending ip address command with option
994 <literal>autojoin</literal> we can get similar functionality for openvswitch (OVS) vxlan
995 interfaces as well as other tunneling mechanisms that need to receive multicast traffic.
996 Defaults to <literal>no</literal>.</para>
997 </listitem>
998 </varlistentry>
798d3a52
ZJS
999 </variablelist>
1000 </refsect1>
1001
e4a71bf3
WKI
1002 <refsect1>
1003 <title>[Neighbor] Section Options</title>
1004 <para>A <literal>[Neighbor]</literal> section accepts the
1005 following keys. The neighbor section adds a permanent, static
1006 entry to the neighbor table (IPv6) or ARP table (IPv4) for
1007 the given hardware address on the links matched for the network.
1008 Specify several <literal>[Neighbor]</literal> sections to configure
1009 several static neighbors.</para>
1010
1011 <variablelist class='network-directives'>
1012 <varlistentry>
1013 <term><varname>Address=</varname></term>
1014 <listitem>
1015 <para>The IP address of the neighbor.</para>
1016 </listitem>
1017 </varlistentry>
1018 <varlistentry>
b956364d 1019 <term><varname>LinkLayerAddress=</varname></term>
e4a71bf3 1020 <listitem>
b956364d 1021 <para>The link layer address (MAC address or IP address) of the neighbor.</para>
e4a71bf3
WKI
1022 </listitem>
1023 </varlistentry>
1024 </variablelist>
1025 </refsect1>
1026
95b74ef6
SS
1027 <refsect1>
1028 <title>[IPv6AddressLabel] Section Options</title>
1029
1030 <para>An <literal>[IPv6AddressLabel]</literal> section accepts the
1031 following keys. Specify several <literal>[IPv6AddressLabel]</literal>
785889e5 1032 sections to configure several address labels. IPv6 address labels are
95b74ef6
SS
1033 used for address selection. See <ulink url="https://tools.ietf.org/html/rfc3484">RFC 3484</ulink>.
1034 Precedence is managed by userspace, and only the label itself is stored in the kernel</para>
1035
1036 <variablelist class='network-directives'>
1037 <varlistentry>
1038 <term><varname>Label=</varname></term>
1039 <listitem>
1040 <para> The label for the prefix (an unsigned integer) ranges 0 to 4294967294.
1041 0xffffffff is reserved. This key is mandatory.</para>
1042 </listitem>
1043 </varlistentry>
1044 <varlistentry>
1045 <term><varname>Prefix=</varname></term>
1046 <listitem>
1047 <para>IPv6 prefix is an address with a prefix length, separated by a slash <literal>/</literal> character.
1048 This key is mandatory. </para>
1049 </listitem>
1050 </varlistentry>
1051 </variablelist>
1052 </refsect1>
1053
bce67bbe
SS
1054 <refsect1>
1055 <title>[RoutingPolicyRule] Section Options</title>
1056
1057 <para>An <literal>[RoutingPolicyRule]</literal> section accepts the
1058 following keys. Specify several <literal>[RoutingPolicyRule]</literal>
1059 sections to configure several rules.</para>
1060
1061 <variablelist class='network-directives'>
1062 <varlistentry>
1063 <term><varname>TypeOfService=</varname></term>
1064 <listitem>
1065 <para>Specifies the type of service to match a number between 0 to 255.</para>
1066 </listitem>
1067 </varlistentry>
1068 <varlistentry>
1069 <term><varname>From=</varname></term>
1070 <listitem>
1071 <para>Specifies the source address prefix to match. Possibly followed by a slash and the prefix length.</para>
1072 </listitem>
1073 </varlistentry>
1074 <varlistentry>
1075 <term><varname>To=</varname></term>
1076 <listitem>
1077 <para>Specifies the destination address prefix to match. Possibly followed by a slash and the prefix length.</para>
1078 </listitem>
1079 </varlistentry>
1080 <varlistentry>
1081 <term><varname>FirewallMark=</varname></term>
1082 <listitem>
1083 <para>Specifies the iptables firewall mark value to match (a number between 1 and 4294967295).</para>
1084 </listitem>
1085 </varlistentry>
1086 <varlistentry>
1087 <term><varname>Table=</varname></term>
1088 <listitem>
41b90a1e
YW
1089 <para>Specifies the routing table identifier to lookup if the rule selector matches. Takes
1090 one of <literal>default</literal>, <literal>main</literal>, and <literal>local</literal>,
1091 or a number between 1 and 4294967295. Defaults to <literal>main</literal>.</para>
bce67bbe
SS
1092 </listitem>
1093 </varlistentry>
1094 <varlistentry>
1095 <term><varname>Priority=</varname></term>
1096 <listitem>
1097 <para>Specifies the priority of this rule. <varname>Priority=</varname> is an unsigned
1098 integer. Higher number means lower priority, and rules get processed in order of increasing number.</para>
1099 </listitem>
1100 </varlistentry>
762e2659
SS
1101 <varlistentry>
1102 <term><varname>IncomingInterface=</varname></term>
1103 <listitem>
1104 <para>Specifies incoming device to match. If the interface is loopback, the rule only matches packets originating from this host.</para>
1105 </listitem>
1106 </varlistentry>
1107 <varlistentry>
1108 <term><varname>OutgoingInterface=</varname></term>
1109 <listitem>
1110 <para>Specifies the outgoing device to match. The outgoing interface is only available for packets originating from local sockets that are bound to a device.</para>
1111 </listitem>
1112 </varlistentry>
926062f0
SS
1113 <varlistentry>
1114 <term><varname>SourcePort=</varname></term>
1115 <listitem>
1116 <para>Specifies the source IP port or IP port range match in forwarding information base (FIB) rules.
1117 A port range is specified by the lower and upper port separated by a dash. Defaults to unset.</para>
1118 </listitem>
1119 </varlistentry>
1120 <varlistentry>
1121 <term><varname>DestinationPort=</varname></term>
1122 <listitem>
1123 <para>Specifies the destination IP port or IP port range match in forwarding information base (FIB) rules.
1124 A port range is specified by the lower and upper port separated by a dash. Defaults to unset.</para>
1125 </listitem>
1126 </varlistentry>
1127 <varlistentry>
97f9df9e 1128 <term><varname>IPProtocol=</varname></term>
926062f0 1129 <listitem>
3a269dcf
YW
1130 <para>Specifies the IP protocol to match in forwarding information base (FIB) rules. Takes IP protocol name such as <literal>tcp</literal>,
1131 <literal>udp</literal> or <literal>sctp</literal>, or IP protocol number such as <literal>6</literal> for <literal>tcp</literal> or
1132 <literal>17</literal> for <literal>udp</literal>.
926062f0
SS
1133 Defaults to unset.</para>
1134 </listitem>
1135 </varlistentry>
8b220643
SS
1136 <varlistentry>
1137 <term><varname>InvertRule=</varname></term>
1138 <listitem>
5238e957 1139 <para>A boolean. Specifies whether the rule to be inverted. Defaults to false.</para>
8b220643
SS
1140 </listitem>
1141 </varlistentry>
bce67bbe
SS
1142 </variablelist>
1143 </refsect1>
1144
798d3a52
ZJS
1145 <refsect1>
1146 <title>[Route] Section Options</title>
1147 <para>The <literal>[Route]</literal> section accepts the
1148 following keys. Specify several <literal>[Route]</literal>
1149 sections to configure several routes.</para>
1150
1151 <variablelist class='network-directives'>
1152 <varlistentry>
1153 <term><varname>Gateway=</varname></term>
1154 <listitem>
1155 <para>As in the <literal>[Network]</literal> section.</para>
1156 </listitem>
1157 </varlistentry>
28959f7d 1158 <varlistentry>
9cb8c559 1159 <term><varname>GatewayOnLink=</varname></term>
28959f7d 1160 <listitem>
9b6ffef3 1161 <para>Takes a boolean. If set to true, the kernel does not have
28959f7d
SS
1162 to check if the gateway is reachable directly by the current machine (i.e., the kernel does
1163 not need to check if the gateway is attached to the local network), so that we can insert the
9b6ffef3 1164 route in the kernel table without it being complained about. Defaults to <literal>no</literal>.
28959f7d
SS
1165 </para>
1166 </listitem>
1167 </varlistentry>
798d3a52
ZJS
1168 <varlistentry>
1169 <term><varname>Destination=</varname></term>
1170 <listitem>
1171 <para>The destination prefix of the route. Possibly
b938cb90 1172 followed by a slash and the prefix length. If omitted, a
798d3a52
ZJS
1173 full-length host route is assumed.</para>
1174 </listitem>
1175 </varlistentry>
1176 <varlistentry>
1177 <term><varname>Source=</varname></term>
1178 <listitem>
1179 <para>The source prefix of the route. Possibly followed by
b938cb90 1180 a slash and the prefix length. If omitted, a full-length
798d3a52
ZJS
1181 host route is assumed.</para>
1182 </listitem>
1183 </varlistentry>
1184 <varlistentry>
1185 <term><varname>Metric=</varname></term>
1186 <listitem>
b938cb90 1187 <para>The metric of the route (an unsigned integer).</para>
798d3a52
ZJS
1188 </listitem>
1189 </varlistentry>
b5bf6f64
SS
1190 <varlistentry>
1191 <term><varname>IPv6Preference=</varname></term>
1192 <listitem>
1193 <para>Specifies the route preference as defined in <ulink
1194 url="https://tools.ietf.org/html/rfc4191">RFC4191</ulink> for Router Discovery messages.
1195 Which can be one of <literal>low</literal> the route has a lowest priority,
1196 <literal>medium</literal> the route has a default priority or
1197 <literal>high</literal> the route has a highest priority.</para>
1198 </listitem>
1199 </varlistentry>
769b56a3
TG
1200 <varlistentry>
1201 <term><varname>Scope=</varname></term>
1202 <listitem>
a8eaaee7 1203 <para>The scope of the route, which can be <literal>global</literal>,
769b56a3
TG
1204 <literal>link</literal> or <literal>host</literal>. Defaults to
1205 <literal>global</literal>.</para>
1206 </listitem>
0d07e595
JK
1207 </varlistentry>
1208 <varlistentry>
1209 <term><varname>PreferredSource=</varname></term>
1210 <listitem>
1211 <para>The preferred source address of the route. The address
1212 must be in the format described in
1213 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.</para>
1214 </listitem>
769b56a3 1215 </varlistentry>
c953b24c
SS
1216 <varlistentry>
1217 <term><varname>Table=<replaceable>num</replaceable></varname></term>
1218 <listitem>
1219 <para>The table identifier for the route (a number between 1 and 4294967295, or 0 to unset).
1220 The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
1221 </para>
1222 </listitem>
1223 </varlistentry>
c83ecc04
SS
1224 <varlistentry>
1225 <term><varname>Protocol=</varname></term>
1226 <listitem>
88925d2f 1227 <para>The protocol identifier for the route. Takes a number between 0 and 255 or the special values
ca420b62
YW
1228 <literal>kernel</literal>, <literal>boot</literal>, <literal>static</literal>,
1229 <literal>ra</literal> and <literal>dhcp</literal>. Defaults to <literal>static</literal>.
c83ecc04
SS
1230 </para>
1231 </listitem>
1232 </varlistentry>
983226f3
SS
1233 <varlistentry>
1234 <term><varname>Type=</varname></term>
1235 <listitem>
94d6e299
YW
1236 <para>Specifies the type for the route. Takes one of <literal>unicast</literal>,
1237 <literal>local</literal>, <literal>broadcast</literal>, <literal>anycast</literal>,
1238 <literal>multicast</literal>, <literal>blackhole</literal>, <literal>unreachable</literal>,
1239 <literal>prohibit</literal>, <literal>throw</literal>, <literal>nat</literal>, and
1240 <literal>xresolve</literal>. If <literal>unicast</literal>, a regular route is defined, i.e. a
66d7235e
LP
1241 route indicating the path to take to a destination network address. If <literal>blackhole</literal>, packets
1242 to the defined route are discarded silently. If <literal>unreachable</literal>, packets to the defined route
1243 are discarded and the ICMP message "Host Unreachable" is generated. If <literal>prohibit</literal>, packets
1244 to the defined route are discarded and the ICMP message "Communication Administratively Prohibited" is
1245 generated. If <literal>throw</literal>, route lookup in the current routing table will fail and the route
1246 selection process will return to Routing Policy Database (RPDB). Defaults to <literal>unicast</literal>.
983226f3
SS
1247 </para>
1248 </listitem>
1249 </varlistentry>
323d9329
SS
1250 <varlistentry>
1251 <term><varname>InitialCongestionWindow=</varname></term>
1252 <listitem>
6b21ad33
SS
1253 <para>The TCP initial congestion window is used during the start of a TCP connection. During the start of a TCP
1254 session, when a client requests a resource, the server's initial congestion window determines how many data bytes
1255 will be sent during the initial burst of data. Takes a size in bytes between 1 and 4294967295 (2^32 - 1). The usual
025314d9 1256 suffixes K, M, G are supported and are understood to the base of 1024. When unset, the kernel's default will be used.
323d9329
SS
1257 </para>
1258 </listitem>
1259 </varlistentry>
1260 <varlistentry>
1261 <term><varname>InitialAdvertisedReceiveWindow=</varname></term>
1262 <listitem>
5238e957 1263 <para>The TCP initial advertised receive window is the amount of receive data (in bytes) that can initially be buffered at one time
6b21ad33
SS
1264 on a connection. The sending host can send only that amount of data before waiting for an acknowledgment and window update
1265 from the receiving host. Takes a size in bytes between 1 and 4294967295 (2^32 - 1). The usual suffixes K, M, G are supported
025314d9 1266 and are understood to the base of 1024. When unset, the kernel's default will be used.
323d9329
SS
1267 </para>
1268 </listitem>
1269 </varlistentry>
09f5dfad
SS
1270 <varlistentry>
1271 <term><varname>QuickAck=</varname></term>
1272 <listitem>
9b6ffef3 1273 <para>Takes a boolean. When true enables TCP quick ack mode for the route. When unset, the kernel's default will be used.
09f5dfad
SS
1274 </para>
1275 </listitem>
1276 </varlistentry>
633c7258
SS
1277 <varlistentry>
1278 <term><varname>FastOpenNoCookie=</varname></term>
1279 <listitem>
1280 <para>Takes a boolean. When true enables TCP fastopen without a cookie on a per-route basis.
1281 When unset, the kernel's default will be used.
1282 </para>
1283 </listitem>
09f5dfad 1284 </varlistentry>
9b88f20a
SS
1285 <varlistentry>
1286 <term><varname>TTLPropagate=</varname></term>
1287 <listitem>
1288 <para>Takes a boolean. When true enables TTL propagation at Label Switched Path (LSP) egress.
1289 When unset, the kernel's default will be used.
1290 </para>
1291 </listitem>
1292 </varlistentry>
cea79e66
SS
1293 <varlistentry>
1294 <term><varname>MTUBytes=</varname></term>
1295 <listitem>
1296 <para>The maximum transmission unit in bytes to set for the
1297 route. The usual suffixes K, M, G, are supported and are
1298 understood to the base of 1024.</para>
1299 <para>Note that if IPv6 is enabled on the interface, and the MTU is chosen
1300 below 1280 (the minimum MTU for IPv6) it will automatically be increased to this value.</para>
1301 </listitem>
1302 </varlistentry>
798d3a52
ZJS
1303 </variablelist>
1304 </refsect1>
1305
1306 <refsect1>
4f7331a8
YW
1307 <title>[DHCPv4] Section Options</title>
1308 <para>The <literal>[DHCPv4]</literal> section configures the
caa8ca42 1309 DHCPv4 client, if it is enabled with the
ad943783 1310 <varname>DHCP=</varname> setting described above:</para>
798d3a52
ZJS
1311
1312 <variablelist class='network-directives'>
1313 <varlistentry>
1314 <term><varname>UseDNS=</varname></term>
1315 <listitem>
1316 <para>When true (the default), the DNS servers received
1317 from the DHCP server will be used and take precedence over
1318 any statically configured ones.</para>
e88d8021
ZJS
1319
1320 <para>This corresponds to the <option>nameserver</option>
ad943783
LP
1321 option in <citerefentry
1322 project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
798d3a52
ZJS
1323 </listitem>
1324 </varlistentry>
a24e12f0
YW
1325 <varlistentry>
1326 <term><varname>RoutesToDNS=</varname></term>
1327 <listitem>
1328 <para>When true, the routes to the DNS servers received from the DHCP server will be
1329 configured. When <varname>UseDNS=</varname> is disabled, this setting is ignored.
f7e7bb65 1330 Defaults to false.</para>
a24e12f0
YW
1331 </listitem>
1332 </varlistentry>
301f4073
MM
1333 <varlistentry>
1334 <term><varname>UseNTP=</varname></term>
1335 <listitem>
1336 <para>When true (the default), the NTP servers received
1337 from the DHCP server will be used by systemd-timesyncd
1338 and take precedence over any statically configured ones.</para>
1339 </listitem>
1340 </varlistentry>
798d3a52
ZJS
1341 <varlistentry>
1342 <term><varname>UseMTU=</varname></term>
1343 <listitem>
1344 <para>When true, the interface maximum transmission unit
1345 from the DHCP server will be used on the current link.
7169cdc8 1346 If <varname>MTUBytes=</varname> is set, then this setting is ignored.
95ab9eff 1347 Defaults to false.</para>
798d3a52
ZJS
1348 </listitem>
1349 </varlistentry>
7585baa0 1350 <varlistentry>
1351 <term><varname>Anonymize=</varname></term>
1352 <listitem>
9b6ffef3 1353 <para>Takes a boolean. When true, the options sent to the DHCP server will
7585baa0 1354 follow the <ulink url="https://tools.ietf.org/html/rfc7844">RFC 7844</ulink>
1355 (Anonymity Profiles for DHCP Clients) to minimize disclosure of identifying information.
1356 Defaults to false.</para>
1357
1358 <para>This option should only be set to true when
1359 <varname>MACAddressPolicy=</varname> is set to <literal>random</literal>
1360 (see <citerefentry
1361 project='man-pages'><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>).</para>
1362
1363 <para>Note that this configuration will overwrite others.
1364 In concrete, the following variables will be ignored:
1365 <varname>SendHostname=</varname>, <varname>ClientIdentifier=</varname>,
1366 <varname>UseRoutes=</varname>, <varname>SendHostname=</varname>,
1367 <varname>UseMTU=</varname>, <varname>VendorClassIdentifier=</varname>,
1368 <varname>UseTimezone=</varname>.</para>
fba10579
LP
1369
1370 <para>With this option enabled DHCP requests will mimic those generated by Microsoft Windows, in
1371 order to reduce the ability to fingerprint and recognize installations. This means DHCP request
1372 sizes will grow and lease data will be more comprehensive than normally, though most of the
1373 requested data is not actually used.</para>
7585baa0 1374 </listitem>
1375 </varlistentry>
798d3a52
ZJS
1376 <varlistentry>
1377 <term><varname>SendHostname=</varname></term>
1378 <listitem>
31ee3973
YW
1379 <para>When true (the default), the machine's hostname will be sent to the DHCP server.
1380 Note that the machine's hostname must consist only of 7-bit ASCII lower-case characters and
1381 no spaces or dots, and be formatted as a valid DNS domain name. Otherwise, the hostname is not
cad8d671 1382 sent even if this is set to true.</para>
798d3a52
ZJS
1383 </listitem>
1384 </varlistentry>
1385 <varlistentry>
1386 <term><varname>UseHostname=</varname></term>
1387 <listitem>
1388 <para>When true (the default), the hostname received from
31ee3973 1389 the DHCP server will be set as the transient hostname of the system.
d59be2cf 1390 </para>
798d3a52
ZJS
1391 </listitem>
1392 </varlistentry>
1adc5d0b 1393 <varlistentry>
31ee3973
YW
1394 <term><varname>Hostname=</varname></term>
1395 <listitem>
1396 <para>Use this value for the hostname which is sent to the DHCP server, instead of machine's hostname.
1397 Note that the specified hostname must consist only of 7-bit ASCII lower-case characters and
1398 no spaces or dots, and be formatted as a valid DNS domain name.</para>
1399 </listitem>
1400 </varlistentry>
798d3a52
ZJS
1401 <varlistentry>
1402 <term><varname>UseDomains=</varname></term>
1403 <listitem>
9b6ffef3 1404 <para>Takes a boolean, or the special value <literal>route</literal>. When true, the domain name
b2a81c0b
LP
1405 received from the DHCP server will be used as DNS search domain over this link, similar to the effect of
1406 the <option>Domains=</option> setting. If set to <literal>route</literal>, the domain name received from
1407 the DHCP server will be used for routing DNS queries only, but not for searching, similar to the effect of
1408 the <option>Domains=</option> setting when the argument is prefixed with <literal>~</literal>. Defaults to
1409 false.</para>
1410
1411 <para>It is recommended to enable this option only on trusted networks, as setting this affects resolution
1e7a0e21 1412 of all host names, in particular of single-label names. It is generally safer to use the supplied domain
b2a81c0b
LP
1413 only as routing domain, rather than as search domain, in order to not have it affect local resolution of
1414 single-label names.</para>
1415
1416 <para>When set to true, this setting corresponds to the <option>domain</option> option in <citerefentry
1417 project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
798d3a52
ZJS
1418 </listitem>
1419 </varlistentry>
1420 <varlistentry>
1421 <term><varname>UseRoutes=</varname></term>
1422 <listitem>
d6eac9bd
DW
1423 <para>When true (the default), the static routes will be requested from the DHCP server and added to the
1424 routing table with a metric of 1024, and a scope of "global", "link" or "host", depending on the route's
1425 destination and gateway. If the destination is on the local host, e.g., 127.x.x.x, or the same as the
1426 link's own address, the scope will be set to "host". Otherwise if the gateway is null (a direct route), a
1427 "link" scope will be used. For anything else, scope defaults to "global".</para>
798d3a52
ZJS
1428 </listitem>
1429 </varlistentry>
ad943783
LP
1430
1431 <varlistentry>
1432 <term><varname>UseTimezone=</varname></term>
1433
1434 <listitem><para>When true, the timezone received from the
7f3fdb7f 1435 DHCP server will be set as timezone of the local
ad943783
LP
1436 system. Defaults to <literal>no</literal>.</para></listitem>
1437 </varlistentry>
1438
3e43b2cd
JJ
1439 <varlistentry>
1440 <term><varname>ClientIdentifier=</varname></term>
1441 <listitem>
dace710c
YW
1442 <para>The DHCPv4 client identifier to use. Takes one of <literal>mac</literal>, <literal>duid</literal> or <literal>duid-only</literal>.
1443 If set to <literal>mac</literal>, the MAC address of the link is used.
1444 If set to <literal>duid</literal>, an RFC4361-compliant Client ID, which is the combination of IAID and DUID (see below), is used.
1445 If set to <literal>duid-only</literal>, only DUID is used, this may not be RFC compliant, but some setups may require to use this.
1446 Defaults to <literal>duid</literal>.</para>
3e43b2cd
JJ
1447 </listitem>
1448 </varlistentry>
e2e08e77 1449
798d3a52
ZJS
1450 <varlistentry>
1451 <term><varname>VendorClassIdentifier=</varname></term>
1452 <listitem>
1453 <para>The vendor class identifier used to identify vendor
1454 type and configuration.</para>
1455 </listitem>
1456 </varlistentry>
076ea6f6 1457
af1c0de0
SS
1458 <varlistentry>
1459 <term><varname>UserClass=</varname></term>
1460 <listitem>
1461 <para>A DHCPv4 client can use UserClass option to identify the type or category of user or applications
1462 it represents. The information contained in this option is a string that represents the user class of which
1463 the client is a member. Each class sets an identifying string of information to be used by the DHCP
1464 service to classify clients. Takes a whitespace-separated list of strings.</para>
1465 </listitem>
1466 </varlistentry>
1467
715cedfb
SS
1468 <varlistentry>
1469 <term><varname>MaxAttempts=</varname></term>
1470 <listitem>
1471 <para>Specifies how many times the DHCPv4 client configuration should be attempted. Takes a
1472 number or <literal>infinity</literal>. Defaults to <literal>infinity</literal>.
1473 Note that the time between retries is increased exponentially, so the network will not be
1474 overloaded even if this number is high.</para>
1475 </listitem>
1476 </varlistentry>
1477
e2e08e77
ZJS
1478 <varlistentry>
1479 <term><varname>DUIDType=</varname></term>
1480 <listitem>
1481 <para>Override the global <varname>DUIDType</varname> setting for this network. See
1482 <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1483 for a description of possible values.</para>
1484 </listitem>
1485 </varlistentry>
076ea6f6 1486
e2e08e77
ZJS
1487 <varlistentry>
1488 <term><varname>DUIDRawData=</varname></term>
1489 <listitem>
1490 <para>Override the global <varname>DUIDRawData</varname> setting for this network. See
1491 <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1492 for a description of possible values.</para>
076ea6f6
LP
1493 </listitem>
1494 </varlistentry>
e2e08e77 1495
d05def16
LP
1496 <varlistentry>
1497 <term><varname>IAID=</varname></term>
1498 <listitem>
1499 <para>The DHCP Identity Association Identifier (IAID) for the interface, a 32-bit unsigned integer.</para>
1500 </listitem>
1501 </varlistentry>
1502
798d3a52
ZJS
1503 <varlistentry>
1504 <term><varname>RequestBroadcast=</varname></term>
1505 <listitem>
1506 <para>Request the server to use broadcast messages before
1507 the IP address has been configured. This is necessary for
1508 devices that cannot receive RAW packets, or that cannot
1509 receive packets at all before an IP address has been
1510 configured. On the other hand, this must not be enabled on
1511 networks where broadcasts are filtered out.</para>
1512 </listitem>
1513 </varlistentry>
e2e08e77 1514
798d3a52
ZJS
1515 <varlistentry>
1516 <term><varname>RouteMetric=</varname></term>
1517 <listitem>
1518 <para>Set the routing metric for routes specified by the
1519 DHCP server.</para>
1520 </listitem>
1521 </varlistentry>
f594276b
JK
1522
1523 <varlistentry>
1524 <term><varname>RouteTable=<replaceable>num</replaceable></varname></term>
1525 <listitem>
d11e656a 1526 <para>The table identifier for DHCP routes (a number between 1 and 4294967295, or 0 to unset).
f594276b
JK
1527 The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
1528 </para>
917b2260
AR
1529 <para>When used in combination with <varname>VRF=</varname> the
1530 VRF's routing table is used unless this parameter is specified.
1531 </para>
f594276b
JK
1532 </listitem>
1533 </varlistentry>
9faed222
SS
1534
1535 <varlistentry>
1536 <term><varname>ListenPort=</varname></term>
1537 <listitem>
1538 <para>Allow setting custom port for the DHCP client to listen on.</para>
1539 </listitem>
1540 </varlistentry>
fb5c8216 1541
1501b429
SS
1542 <varlistentry>
1543 <term><varname>SendRelease=</varname></term>
1544 <listitem>
1545 <para>When true, the DHCPv4 client sends a DHCP release packet when it stops.
1546 Defaults to false.</para>
1547 </listitem>
1548 </varlistentry>
1549
caa8ca42
SS
1550 <varlistentry>
1551 <term><varname>BlackList=</varname></term>
1552 <listitem>
1553 <para>A whitespace-separated list of IPv4 addresses. DHCP offers from servers in the list are rejected.</para>
1554 </listitem>
1555 </varlistentry>
1556
1557 </variablelist>
1558 </refsect1>
1559
1560 <refsect1>
1561 <title>[DHCPv6] Section Options</title>
1562 <para>The <literal>[DHCPv6]</literal> section configures the DHCPv6 client, if it is enabled with the
4f7331a8 1563 <varname>DHCP=</varname> setting described above, or invoked by the IPv6 Router Advertisement:</para>
caa8ca42
SS
1564
1565 <variablelist class='network-directives'>
1566 <varlistentry>
1567 <term><varname>UseDNS=</varname></term>
1568 <term><varname>UseNTP=</varname></term>
1569 <listitem>
9fdae8d5 1570 <para>As in the <literal>[DHCPv4]</literal> section.</para>
caa8ca42
SS
1571 </listitem>
1572 </varlistentry>
1573
fb5c8216
SS
1574 <varlistentry>
1575 <term><varname>RapidCommit=</varname></term>
1576 <listitem>
9b6ffef3 1577 <para>Takes a boolean. The DHCPv6 client can obtain configuration parameters from a DHCPv6 server through
fb5c8216
SS
1578 a rapid two-message exchange (solicit and reply). When the rapid commit option is enabled by both
1579 the DHCPv6 client and the DHCPv6 server, the two-message exchange is used, rather than the default
1580 four-method exchange (solicit, advertise, request, and reply). The two-message exchange provides
1581 faster client configuration and is beneficial in environments in which networks are under a heavy load.
1582 See <ulink url="https://tools.ietf.org/html/rfc3315#section-17.2.1">RFC 3315</ulink> for details.
1583 Defaults to true.</para>
1584 </listitem>
1585 </varlistentry>
1586
125f20b4
PF
1587 <varlistentry>
1588 <term><varname>ForceDHCPv6PDOtherInformation=</varname></term>
1589 <listitem>
9b6ffef3 1590 <para>Takes a boolean that enforces DHCPv6 stateful mode when the 'Other information' bit is set in
125f20b4
PF
1591 Router Advertisement messages. By default setting only the 'O' bit in Router Advertisements
1592 makes DHCPv6 request network information in a stateless manner using a two-message Information
1593 Request and Information Reply message exchange.
1594 <ulink url="https://tools.ietf.org/html/rfc7084">RFC 7084</ulink>, requirement WPD-4, updates
1595 this behavior for a Customer Edge router so that stateful DHCPv6 Prefix Delegation is also
1596 requested when only the 'O' bit is set in Router Advertisements. This option enables such a CE
1597 behavior as it is impossible to automatically distinguish the intention of the 'O' bit otherwise.
1598 By default this option is set to 'false', enable it if no prefixes are delegated when the device
1599 should be acting as a CE router.</para>
1600 </listitem>
1601 </varlistentry>
1602
ad943783 1603 </variablelist>
caa8ca42 1604 </refsect1>
413708d1 1605
1e7a0e21 1606 <refsect1>
f921f573
LP
1607 <title>[IPv6AcceptRA] Section Options</title>
1608 <para>The <literal>[IPv6AcceptRA]</literal> section configures the IPv6 Router Advertisement
1609 (RA) client, if it is enabled with the <varname>IPv6AcceptRA=</varname> setting described
1e7a0e21
LP
1610 above:</para>
1611
1612 <variablelist class='network-directives'>
1613 <varlistentry>
1614 <term><varname>UseDNS=</varname></term>
1615 <listitem>
1616 <para>When true (the default), the DNS servers received in the Router Advertisement will be used and take
1617 precedence over any statically configured ones.</para>
1618
1619 <para>This corresponds to the <option>nameserver</option> option in <citerefentry
1620 project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
1621 </listitem>
1622 </varlistentry>
1623
1624 <varlistentry>
1625 <term><varname>UseDomains=</varname></term>
1626 <listitem>
9b6ffef3 1627 <para>Takes a boolean, or the special value <literal>route</literal>. When true, the domain name
1e7a0e21
LP
1628 received via IPv6 Router Advertisement (RA) will be used as DNS search domain over this link, similar to
1629 the effect of the <option>Domains=</option> setting. If set to <literal>route</literal>, the domain name
1630 received via IPv6 RA will be used for routing DNS queries only, but not for searching, similar to the
1631 effect of the <option>Domains=</option> setting when the argument is prefixed with
1632 <literal>~</literal>. Defaults to false.</para>
1633
1634 <para>It is recommended to enable this option only on trusted networks, as setting this affects resolution
1635 of all host names, in particular of single-label names. It is generally safer to use the supplied domain
1636 only as routing domain, rather than as search domain, in order to not have it affect local resolution of
1637 single-label names.</para>
1638
1639 <para>When set to true, this setting corresponds to the <option>domain</option> option in <citerefentry
1640 project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
1641 </listitem>
1642 </varlistentry>
2ba31d29
JK
1643
1644 <varlistentry>
1645 <term><varname>RouteTable=<replaceable>num</replaceable></varname></term>
1646 <listitem>
d11e656a
ZJS
1647 <para>The table identifier for the routes received in the Router Advertisement
1648 (a number between 1 and 4294967295, or 0 to unset).
2ba31d29
JK
1649 The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
1650 </para>
1651 </listitem>
1652 </varlistentry>
062c2eea
SS
1653
1654 <varlistentry>
1655 <term><varname>UseAutonomousPrefix=</varname></term>
1656 <listitem>
1657 <para>When true (the default), the autonomous prefix received in the Router Advertisement will be used and take
1658 precedence over any statically configured ones.</para>
1659 </listitem>
1660 </varlistentry>
1661
1662 <varlistentry>
1663 <term><varname>UseOnLinkPrefix=</varname></term>
1664 <listitem>
1665 <para>When true (the default), the onlink prefix received in the Router Advertisement will be used and take
1666 precedence over any statically configured ones.</para>
1667 </listitem>
1668 </varlistentry>
1669
e520ce64
SS
1670 <varlistentry>
1671 <term><varname>BlackList=</varname></term>
1672 <listitem>
1673 <para>A whitespace-separated list of IPv6 prefixes. IPv6 prefixes supplied via router advertisements in the list are ignored.</para>
1674 </listitem>
1675 </varlistentry>
1676
1e7a0e21
LP
1677 </variablelist>
1678 </refsect1>
1679
ad943783
LP
1680 <refsect1>
1681 <title>[DHCPServer] Section Options</title>
1682 <para>The <literal>[DHCPServer]</literal> section contains
1683 settings for the DHCP server, if enabled via the
1684 <varname>DHCPServer=</varname> option described above:</para>
1685
1686 <variablelist class='network-directives'>
1687
9b3a67c5
TG
1688 <varlistentry>
1689 <term><varname>PoolOffset=</varname></term>
1690 <term><varname>PoolSize=</varname></term>
1691
1692 <listitem><para>Configures the pool of addresses to hand out. The pool
1693 is a contiguous sequence of IP addresses in the subnet configured for
1694 the server address, which does not include the subnet nor the broadcast
1695 address. <varname>PoolOffset=</varname> takes the offset of the pool
1696 from the start of subnet, or zero to use the default value.
1697 <varname>PoolSize=</varname> takes the number of IP addresses in the
b938cb90 1698 pool or zero to use the default value. By default, the pool starts at
9b3a67c5
TG
1699 the first address after the subnet address and takes up the rest of
1700 the subnet, excluding the broadcast address. If the pool includes
1701 the server address (the default), this is reserved and not handed
1702 out to clients.</para></listitem>
1703 </varlistentry>
1704
ad943783
LP
1705 <varlistentry>
1706 <term><varname>DefaultLeaseTimeSec=</varname></term>
1707 <term><varname>MaxLeaseTimeSec=</varname></term>
1708
1709 <listitem><para>Control the default and maximum DHCP lease
1710 time to pass to clients. These settings take time values in seconds or
1711 another common time unit, depending on the suffix. The default
1712 lease time is used for clients that did not ask for a specific
1713 lease time. If a client asks for a lease time longer than the
b938cb90 1714 maximum lease time, it is automatically shortened to the
ad943783
LP
1715 specified time. The default lease time defaults to 1h, the
1716 maximum lease time to 12h. Shorter lease times are beneficial
1717 if the configuration data in DHCP leases changes frequently
1718 and clients shall learn the new settings with shorter
1719 latencies. Longer lease times reduce the generated DHCP
1720 network traffic.</para></listitem>
1721 </varlistentry>
1722
1723 <varlistentry>
1724 <term><varname>EmitDNS=</varname></term>
1725 <term><varname>DNS=</varname></term>
1726
9b6ffef3
YW
1727 <listitem><para>Takes a boolean. Configures whether the DHCP leases handed out
1728 to clients shall contain DNS server information. Defaults to <literal>yes</literal>.
1729 The DNS servers to pass to clients may be configured with the
ad943783
LP
1730 <varname>DNS=</varname> option, which takes a list of IPv4
1731 addresses. If the <varname>EmitDNS=</varname> option is
b938cb90 1732 enabled but no servers configured, the servers are
ad943783
LP
1733 automatically propagated from an "uplink" interface that has
1734 appropriate servers set. The "uplink" interface is determined
1735 by the default route of the system with the highest
1736 priority. Note that this information is acquired at the time
1737 the lease is handed out, and does not take uplink interfaces
1738 into account that acquire DNS or NTP server information at a
1739 later point. DNS server propagation does not take
1740 <filename>/etc/resolv.conf</filename> into account. Also, note
a8eaaee7 1741 that the leases are not refreshed if the uplink network
ad943783 1742 configuration changes. To ensure clients regularly acquire the
b938cb90 1743 most current uplink DNS server information, it is thus
ad943783
LP
1744 advisable to shorten the DHCP lease time via
1745 <varname>MaxLeaseTimeSec=</varname> described
1746 above.</para></listitem>
1747 </varlistentry>
1748
1749 <varlistentry>
1750 <term><varname>EmitNTP=</varname></term>
1751 <term><varname>NTP=</varname></term>
1752
1753 <listitem><para>Similar to the <varname>EmitDNS=</varname> and
b938cb90 1754 <varname>DNS=</varname> settings described above, these
ad943783
LP
1755 settings configure whether and what NTP server information
1756 shall be emitted as part of the DHCP lease. The same syntax,
1757 propagation semantics and defaults apply as for
1758 <varname>EmitDNS=</varname> and
1759 <varname>DNS=</varname>.</para></listitem>
1760 </varlistentry>
1761
77ff6022
CG
1762 <varlistentry>
1763 <term><varname>EmitRouter=</varname></term>
1764
1765 <listitem><para>Similar to the <varname>EmitDNS=</varname>
1766 setting described above, this setting configures whether the
1767 DHCP lease should contain the router option. The same syntax,
1768 propagation semantics and defaults apply as for
1769 <varname>EmitDNS=</varname>.</para></listitem>
1770 </varlistentry>
1771
ad943783
LP
1772 <varlistentry>
1773 <term><varname>EmitTimezone=</varname></term>
1774 <term><varname>Timezone=</varname></term>
1775
9b6ffef3
YW
1776 <listitem><para>Takes a boolean. Configures whether the DHCP leases handed out
1777 to clients shall contain timezone information. Defaults to <literal>yes</literal>. The
ad943783
LP
1778 <varname>Timezone=</varname> setting takes a timezone string
1779 (such as <literal>Europe/Berlin</literal> or
1780 <literal>UTC</literal>) to pass to clients. If no explicit
b938cb90 1781 timezone is set, the system timezone of the local host is
ad943783
LP
1782 propagated, as determined by the
1783 <filename>/etc/localtime</filename> symlink.</para></listitem>
1784 </varlistentry>
1785
1786 </variablelist>
1787 </refsect1>
1788
798d3a52 1789 <refsect1>
3f9e0236
PF
1790 <title>[IPv6PrefixDelegation] Section Options</title>
1791 <para>The <literal>[IPv6PrefixDelegation]</literal> section contains
1792 settings for sending IPv6 Router Advertisements and whether to act as
1793 a router, if enabled via the <varname>IPv6PrefixDelegation=</varname>
1794 option described above. IPv6 network prefixes are defined with one or
1795 more <literal>[IPv6Prefix]</literal> sections.</para>
1796
1797 <variablelist class='network-directives'>
1798
1799 <varlistentry>
1800 <term><varname>Managed=</varname></term>
1801 <term><varname>OtherInformation=</varname></term>
1802
9b6ffef3
YW
1803 <listitem><para>Takes a boolean. Controls whether a DHCPv6 server is used to acquire IPv6
1804 addresses on the network link when <varname>Managed=</varname>
3f9e0236
PF
1805 is set to <literal>true</literal> or if only additional network
1806 information can be obtained via DHCPv6 for the network link when
9b6ffef3 1807 <varname>OtherInformation=</varname> is set to
3f9e0236
PF
1808 <literal>true</literal>. Both settings default to
1809 <literal>false</literal>, which means that a DHCPv6 server is not being
1810 used.</para></listitem>
1811 </varlistentry>
1812
1813 <varlistentry>
1814 <term><varname>RouterLifetimeSec=</varname></term>
1815
9b6ffef3 1816 <listitem><para>Takes a timespan. Configures the IPv6 router lifetime in seconds. If set,
3f9e0236 1817 this host also announces itself in Router Advertisements as an IPv6
025314d9 1818 router for the network link. When unset, the host is not acting as a router.</para>
3f9e0236
PF
1819 </listitem>
1820 </varlistentry>
1821
1822 <varlistentry>
1823 <term><varname>RouterPreference=</varname></term>
1824
1825 <listitem><para>Configures IPv6 router preference if
1826 <varname>RouterLifetimeSec=</varname> is non-zero. Valid values are
1827 <literal>high</literal>, <literal>medium</literal> and
1828 <literal>low</literal>, with <literal>normal</literal> and
1829 <literal>default</literal> added as synonyms for
1830 <literal>medium</literal> just to make configuration easier. See
1831 <ulink url="https://tools.ietf.org/html/rfc4191">RFC 4191</ulink>
1832 for details. Defaults to <literal>medium</literal>.</para></listitem>
1833 </varlistentry>
1834
1835 <varlistentry>
4cb8478c 1836 <term><varname>EmitDNS=</varname></term>
3f9e0236
PF
1837 <term><varname>DNS=</varname></term>
1838
4cb8478c
PF
1839 <listitem><para><varname>DNS=</varname> specifies a list of recursive
1840 DNS server IPv6 addresses that distributed via Router Advertisement
1841 messages when <varname>EmitDNS=</varname> is true. If <varname>DNS=
1842 </varname> is empty, DNS servers are read from the
1843 <literal>[Network]</literal> section. If the
1844 <literal>[Network]</literal> section does not contain any DNS servers
1845 either, DNS servers from the uplink with the highest priority default
1846 route are used. When <varname>EmitDNS=</varname> is false, no DNS server
1847 information is sent in Router Advertisement messages.
1848 <varname>EmitDNS=</varname> defaults to true.
3f9e0236
PF
1849 </para></listitem>
1850 </varlistentry>
1851
760021c0 1852 <varlistentry>
4cb8478c 1853 <term><varname>EmitDomains=</varname></term>
760021c0
PF
1854 <term><varname>Domains=</varname></term>
1855
4cb8478c
PF
1856 <listitem><para>A list of DNS search domains distributed via Router
1857 Advertisement messages when <varname>EmitDomains=</varname> is true. If
1858 <varname>Domains=</varname> is empty, DNS search domains are read from the
1859 <literal>[Network]</literal> section. If the <literal>[Network]</literal>
1860 section does not contain any DNS search domains either, DNS search
1861 domains from the uplink with the highest priority default route are
1862 used. When <varname>EmitDomains=</varname> is false, no DNS search domain
1863 information is sent in Router Advertisement messages.
1864 <varname>EmitDomains=</varname> defaults to true.
1865 </para></listitem>
760021c0
PF
1866 </varlistentry>
1867
3f9e0236
PF
1868 <varlistentry>
1869 <term><varname>DNSLifetimeSec=</varname></term>
1870
1871 <listitem><para>Lifetime in seconds for the DNS server addresses listed
760021c0
PF
1872 in <varname>DNS=</varname> and search domains listed in
1873 <varname>Domains=</varname>.</para></listitem>
3f9e0236
PF
1874 </varlistentry>
1875
1876 </variablelist>
1877 </refsect1>
1878
1879 <refsect1>
1880 <title>[IPv6Prefix] Section Options</title>
1881 <para>One or more <literal>[IPv6Prefix]</literal> sections contain the IPv6
1882 prefixes that are announced via Router Advertisements. See
1883 <ulink url="https://tools.ietf.org/html/rfc4861">RFC 4861</ulink>
1884 for further details.</para>
1885
1886 <variablelist class='network-directives'>
1887
1888 <varlistentry>
1889 <term><varname>AddressAutoconfiguration=</varname></term>
1890 <term><varname>OnLink=</varname></term>
1891
9b6ffef3 1892 <listitem><para>Takes a boolean to specify whether IPv6 addresses can be
3f9e0236
PF
1893 autoconfigured with this prefix and whether the prefix can be used for
1894 onlink determination. Both settings default to <literal>true</literal>
1895 in order to ease configuration.
1896 </para></listitem>
1897 </varlistentry>
1898
1899 <varlistentry>
1900 <term><varname>Prefix=</varname></term>
1901
1902 <listitem><para>The IPv6 prefix that is to be distributed to hosts.
1903 Similarly to configuring static IPv6 addresses, the setting is
1904 configured as an IPv6 prefix and its prefix length, separated by a
1905 <literal>/</literal> character. Use multiple
1906 <literal>[IPv6Prefix]</literal> sections to configure multiple IPv6
1907 prefixes since prefix lifetimes, address autoconfiguration and onlink
1908 status may differ from one prefix to another.</para></listitem>
1909 </varlistentry>
1910
1911 <varlistentry>
1912 <term><varname>PreferredLifetimeSec=</varname></term>
1913 <term><varname>ValidLifetimeSec=</varname></term>
1914
1915 <listitem><para>Preferred and valid lifetimes for the prefix measured in
1916 seconds. <varname>PreferredLifetimeSec=</varname> defaults to 604800
1917 seconds (one week) and <varname>ValidLifetimeSec=</varname> defaults
1918 to 2592000 seconds (30 days).</para></listitem>
1919 </varlistentry>
1920
1921 </variablelist>
1922 </refsect1>
1923
1924 <refsect1>
798d3a52
ZJS
1925 <title>[Bridge] Section Options</title>
1926 <para>The <literal>[Bridge]</literal> section accepts the
1927 following keys.</para>
1928 <variablelist class='network-directives'>
165c41a9
SS
1929 <varlistentry>
1930 <term><varname>UnicastFlood=</varname></term>
1931 <listitem>
9b6ffef3 1932 <para>Takes a boolean. Controls whether the bridge should flood
072f9e4a 1933 traffic for which an FDB entry is missing and the destination
025314d9 1934 is unknown through this port. When unset, the kernel's default will be used.
47c7dfe2 1935 </para>
165c41a9
SS
1936 </listitem>
1937 </varlistentry>
7f15b714
TJ
1938 <varlistentry>
1939 <term><varname>MulticastFlood=</varname></term>
1940 <listitem>
1941 <para>Takes a boolean. Controls whether the bridge should flood
1942 traffic for which an MDB entry is missing and the destination
1943 is unknown through this port. When unset, the kernel's default will be used.
1944 </para>
1945 </listitem>
1946 </varlistentry>
d3aa8b49
SS
1947 <varlistentry>
1948 <term><varname>MulticastToUnicast=</varname></term>
1949 <listitem>
1950 <para>Takes a boolean. Multicast to unicast works on top of the multicast snooping feature of
1951 the bridge. Which means unicast copies are only delivered to hosts which are interested in it.
1952 When unset, the kernel's default will be used.
1953 </para>
1954 </listitem>
1955 </varlistentry>
7f15b714
TJ
1956 <varlistentry>
1957 <term><varname>NeighborSuppression=</varname></term>
1958 <listitem>
1959 <para>Takes a boolean. Configures whether ARP and ND neighbor suppression is enabled for
1960 this port. When unset, the kernel's default will be used.
1961 </para>
1962 </listitem>
1963 </varlistentry>
1964 <varlistentry>
1965 <term><varname>Learning=</varname></term>
1966 <listitem>
1967 <para>Takes a boolean. Configures whether MAC address learning is enabled for
1968 this port. When unset, the kernel's default will be used.
1969 </para>
1970 </listitem>
1971 </varlistentry>
165c41a9
SS
1972 <varlistentry>
1973 <term><varname>HairPin=</varname></term>
1974 <listitem>
9b6ffef3 1975 <para>Takes a boolean. Configures whether traffic may be sent back
025314d9
YW
1976 out of the port on which it was received. When this flag is false, and the bridge
1977 will not forward traffic back out of the receiving port.
1978 When unset, the kernel's default will be used.</para>
165c41a9
SS
1979 </listitem>
1980 </varlistentry>
1981 <varlistentry>
84c34096 1982 <term><varname>UseBPDU=</varname></term>
165c41a9 1983 <listitem>
9b6ffef3 1984 <para>Takes a boolean. Configures whether STP Bridge Protocol Data Units will be
025314d9 1985 processed by the bridge port. When unset, the kernel's default will be used.</para>
165c41a9
SS
1986 </listitem>
1987 </varlistentry>
1988 <varlistentry>
1989 <term><varname>FastLeave=</varname></term>
1990 <listitem>
9b6ffef3 1991 <para>Takes a boolean. This flag allows the bridge to immediately stop multicast
a8eaaee7 1992 traffic on a port that receives an IGMP Leave message. It is only used with
025314d9 1993 IGMP snooping if enabled on the bridge. When unset, the kernel's default will be used.</para>
165c41a9
SS
1994 </listitem>
1995 </varlistentry>
1996 <varlistentry>
23da66bb 1997 <term><varname>AllowPortToBeRoot=</varname></term>
165c41a9 1998 <listitem>
9b6ffef3 1999 <para>Takes a boolean. Configures whether a given port is allowed to
47c7dfe2 2000 become a root port. Only used when STP is enabled on the bridge.
025314d9 2001 When unset, the kernel's default will be used.</para>
165c41a9
SS
2002 </listitem>
2003 </varlistentry>
1087623b
SS
2004 <varlistentry>
2005 <term><varname>ProxyARP=</varname></term>
2006 <listitem>
2007 <para>Takes a boolean. Configures whether proxy ARP to be enabled on this port.
2008 When unset, the kernel's default will be used.</para>
2009 </listitem>
2010 </varlistentry>
2011 <varlistentry>
2012 <term><varname>ProxyARPWiFi=</varname></term>
2013 <listitem>
2014 <para>Takes a boolean. Configures whether proxy ARP to be enabled on this port
2015 which meets extended requirements by IEEE 802.11 and Hotspot 2.0 specifications.
2016 When unset, the kernel's default will be used.</para>
2017 </listitem>
2018 </varlistentry>
0fadb2a4
SS
2019 <varlistentry>
2020 <term><varname>MulticastRouter=</varname></term>
2021 <listitem>
2022 <para>Configures this port for having multicast routers attached. A port with a multicast
2023 router will receive all multicast traffic. Takes one of <literal>no</literal>
2024 to disable multicast routers on this port, <literal>query</literal> to let the system detect
2025 the presence of routers, <literal>permanent</literal> to permanently enable multicast traffic
2026 forwarding on this port, or <literal>temporary</literal> to enable multicast routers temporarily
2027 on this port, not depending on incoming queries. When unset, the kernel's default will be used.</para>
2028 </listitem>
2029 </varlistentry>
798d3a52
ZJS
2030 <varlistentry>
2031 <term><varname>Cost=</varname></term>
2032 <listitem>
47c7dfe2 2033 <para>Sets the "cost" of sending packets of this interface.
a8eaaee7 2034 Each port in a bridge may have a different speed and the cost
798d3a52 2035 is used to decide which link to use. Faster interfaces
785889e5 2036 should have lower costs. It is an integer value between 1 and
b56be296
DJL
2037 65535.</para>
2038 </listitem>
2039 </varlistentry>
2040 <varlistentry>
2041 <term><varname>Priority=</varname></term>
2042 <listitem>
2043 <para>Sets the "priority" of sending packets on this interface.
2044 Each port in a bridge may have a different priority which is used
2045 to decide which link to use. Lower value means higher priority.
785889e5 2046 It is an integer value between 0 to 63. Networkd does not set any
b56be296 2047 default, meaning the kernel default value of 32 is used.</para>
798d3a52
ZJS
2048 </listitem>
2049 </varlistentry>
2050 </variablelist>
2051 </refsect1>
798d3a52
ZJS
2052 <refsect1>
2053 <title>[BridgeFDB] Section Options</title>
2054 <para>The <literal>[BridgeFDB]</literal> section manages the
2055 forwarding database table of a port and accepts the following
2056 keys. Specify several <literal>[BridgeFDB]</literal> sections to
2057 configure several static MAC table entries.</para>
2058
2059 <variablelist class='network-directives'>
2060 <varlistentry>
2061 <term><varname>MACAddress=</varname></term>
2062 <listitem>
2063 <para>As in the <literal>[Network]</literal> section. This
2064 key is mandatory.</para>
2065 </listitem>
2066 </varlistentry>
c2c2793f
SS
2067 <varlistentry>
2068 <term><varname>Destination=</varname></term>
2069 <listitem>
2070 <para>Takes an IP address of the destination VXLAN tunnel endpoint.</para>
2071 </listitem>
2072 </varlistentry>
798d3a52
ZJS
2073 <varlistentry>
2074 <term><varname>VLANId=</varname></term>
2075 <listitem>
a8eaaee7 2076 <para>The VLAN ID for the new static MAC table entry. If
db9b9fb9 2077 omitted, no VLAN ID information is appended to the new static MAC
798d3a52
ZJS
2078 table entry.</para>
2079 </listitem>
2080 </varlistentry>
61b824c5
SS
2081 <varlistentry>
2082 <term><varname>VNI=</varname></term>
2083 <listitem>
2084 <para>The VXLAN Network Identifier (or VXLAN Segment ID) to use to connect to
2085 the remote VXLAN tunnel endpoint. Takes a number in the range 1-16777215.
2086 Defaults to unset.</para>
2087 </listitem>
2088 </varlistentry>
bdb397ed
SS
2089 <varlistentry>
2090 <term><varname>AssociatedWith=</varname></term>
2091 <listitem>
2092 <para>Specifies where the address is associated with. Takes one of <literal>use</literal>,
2093 <literal>self</literal>, <literal>master</literal> or <literal>router</literal>.
2094 <literal>use</literal> means the address is in use. User space can use this option to
2095 indicate to the kernel that the fdb entry is in use. <literal>self</literal> means
2096 the address is associated with the port drivers fdb. Usually hardware. <literal>master</literal>
2097 means the address is associated with master devices fdb. <literal>router</literal> means
2098 the destination address is associated with a router. Note that it's valid if the referenced
2099 device is a VXLAN type device and has route shortcircuit enabled. Defaults to <literal>self</literal>.</para>
2100 </listitem>
2101 </varlistentry>
798d3a52
ZJS
2102 </variablelist>
2103 </refsect1>
06828bb6
HP
2104
2105 <refsect1>
2106 <title>[CAN] Section Options</title>
2107 <para>The <literal>[CAN]</literal> section manages the Controller Area Network (CAN bus) and accepts the
2108 following keys.</para>
2109 <variablelist class='network-directives'>
2110 <varlistentry>
2111 <term><varname>BitRate=</varname></term>
2112 <listitem>
2113 <para>The bitrate of CAN device in bits per second. The usual SI prefixes (K, M) with the base of 1000 can
2114 be used here.</para>
2115 </listitem>
2116 </varlistentry>
2117 <varlistentry>
2118 <term><varname>SamplePoint=</varname></term>
2119 <listitem>
2120 <para>Optional sample point in percent with one decimal (e.g. <literal>75%</literal>,
2121 <literal>87.5%</literal>) or permille (e.g. <literal>875‰</literal>).</para>
2122 </listitem>
2123 </varlistentry>
2124 <varlistentry>
2125 <term><varname>RestartSec=</varname></term>
2126 <listitem>
2127 <para>Automatic restart delay time. If set to a non-zero value, a restart of the CAN controller will be
2128 triggered automatically in case of a bus-off condition after the specified delay time. Subsecond delays can
2129 be specified using decimals (e.g. <literal>0.1s</literal>) or a <literal>ms</literal> or
2130 <literal>us</literal> postfix. Using <literal>infinity</literal> or <literal>0</literal> will turn the
2131 automatic restart off. By default automatic restart is disabled.</para>
2132 </listitem>
2133 </varlistentry>
c423be28
CG
2134 <varlistentry>
2135 <term><varname>TripleSampling=</varname></term>
2136 <listitem>
2137 <para>Takes a boolean. When <literal>yes</literal>, three samples (instead of one) are used to determine
2138 the value of a received bit by majority rule. When unset, the kernel's default will be used.</para>
2139 </listitem>
2140 </varlistentry>
06828bb6
HP
2141 </variablelist>
2142 </refsect1>
2143
13b498f9
TJ
2144 <refsect1>
2145 <title>[BridgeVLAN] Section Options</title>
2146 <para>The <literal>[BridgeVLAN]</literal> section manages the VLAN ID configuration of a bridge port and accepts
2147 the following keys. Specify several <literal>[BridgeVLAN]</literal> sections to configure several VLAN entries.
2148 The <varname>VLANFiltering=</varname> option has to be enabled, see <literal>[Bridge]</literal> section in
2149 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
2150
2151 <variablelist class='network-directives'>
2152 <varlistentry>
2153 <term><varname>VLAN=</varname></term>
2154 <listitem>
2155 <para>The VLAN ID allowed on the port. This can be either a single ID or a range M-N. VLAN IDs are valid
2156 from 1 to 4094.</para>
2157 </listitem>
2158 </varlistentry>
2159 <varlistentry>
2160 <term><varname>EgressUntagged=</varname></term>
2161 <listitem>
2162 <para>The VLAN ID specified here will be used to untag frames on egress. Configuring
2163 <varname>EgressUntagged=</varname> implicates the use of <varname>VLAN=</varname> above and will enable the
2164 VLAN ID for ingress as well. This can be either a single ID or a range M-N.</para>
2165 </listitem>
2166 </varlistentry>
2167 <varlistentry>
2168 <term><varname>PVID=</varname></term>
2169 <listitem>
2170 <para>The Port VLAN ID specified here is assigned to all untagged frames at ingress.
2171 <varname>PVID=</varname> can be used only once. Configuring <varname>PVID=</varname> implicates the use of
2172 <varname>VLAN=</varname> above and will enable the VLAN ID for ingress as well.</para>
2173 </listitem>
2174 </varlistentry>
2175 </variablelist>
2176 </refsect1>
798d3a52
ZJS
2177
2178 <refsect1>
9e35b3de 2179 <title>Examples</title>
798d3a52 2180 <example>
9e35b3de 2181 <title>Static network configuration</title>
798d3a52 2182
9e35b3de
ZJS
2183 <programlisting># /etc/systemd/network/50-static.network
2184[Match]
eac684ef
TG
2185Name=enp2s0
2186
2187[Network]
2188Address=192.168.0.15/24
2189Gateway=192.168.0.1</programlisting>
9e35b3de
ZJS
2190
2191 <para>This brings interface <literal>enp2s0</literal> up with a static address. The
2192 specified gateway will be used for a default route.</para>
798d3a52 2193 </example>
eac684ef 2194
798d3a52 2195 <example>
9e35b3de 2196 <title>DHCP on ethernet links</title>
eac684ef 2197
9e35b3de
ZJS
2198 <programlisting># /etc/systemd/network/80-dhcp.network
2199[Match]
eac684ef
TG
2200Name=en*
2201
2202[Network]
9c8ca3f7 2203DHCP=yes</programlisting>
9e35b3de
ZJS
2204
2205 <para>This will enable DHCPv4 and DHCPv6 on all interfaces with names starting with
2206 <literal>en</literal> (i.e. ethernet interfaces).</para>
798d3a52 2207 </example>
eac684ef 2208
4c94a4c2 2209 <example>
2210 <title>IPv6 Prefix Delegation</title>
2211
2212 <programlisting># /etc/systemd/network/55-ipv6-pd-upstream.network
2213[Match]
2214Name=enp1s0
2215
2216[Network]
2217DHCP=ipv6</programlisting>
2218
2219 <programlisting># /etc/systemd/network/56-ipv6-pd-downstream.network
2220[Match]
2221Name=enp2s0
2222
2223[Network]
2224IPv6PrefixDelegation=dhcpv6</programlisting>
2225
2226 <para>This will enable IPv6 PD on the interface enp1s0 as an upstream interface where the
2227 DHCPv6 client is running and enp2s0 as a downstream interface where the prefix is delegated to.</para>
2228 </example>
2229
798d3a52 2230 <example>
9e35b3de 2231 <title>A bridge with two enslaved links</title>
f47c5c47 2232
9e35b3de
ZJS
2233 <programlisting># /etc/systemd/network/25-bridge-static.network
2234[Match]
f47c5c47 2235Name=bridge0
2236
2237[Network]
2238Address=192.168.0.15/24
2239Gateway=192.168.0.1
2240DNS=192.168.0.1</programlisting>
f47c5c47 2241
9e35b3de
ZJS
2242 <programlisting># /etc/systemd/network/25-bridge-slave-interface-1.network
2243[Match]
f47c5c47 2244Name=enp2s0
2245
2246[Network]
2247Bridge=bridge0</programlisting>
9e35b3de
ZJS
2248
2249 <programlisting># /etc/systemd/network/25-bridge-slave-interface-2.network
2250[Match]
2251Name=wlp3s0
2252
2253[Network]
2254Bridge=bridge0</programlisting>
2255
2256 <para>This creates a bridge and attaches devices <literal>enp2s0</literal> and
2257 <literal>wlp3s0</literal> to it. The bridge will have the specified static address
2258 and network assigned, and a default route via the specified gateway will be
2259 added. The specified DNS server will be added to the global list of DNS resolvers.
2260 </para>
13b498f9 2261 </example>
9e35b3de 2262
13b498f9 2263 <example>
9e35b3de 2264 <title></title>
13b498f9 2265
9e35b3de
ZJS
2266 <programlisting>
2267# /etc/systemd/network/20-bridge-slave-interface-vlan.network
2268[Match]
13b498f9
TJ
2269Name=enp2s0
2270
2271[Network]
2272Bridge=bridge0
2273
2274[BridgeVLAN]
2275VLAN=1-32
2276PVID=42
2277EgressUntagged=42
2278
2279[BridgeVLAN]
2280VLAN=100-200
2281
2282[BridgeVLAN]
2283EgressUntagged=300-400</programlisting>
0a8a0fad 2284
9e35b3de
ZJS
2285 <para>This overrides the configuration specified in the previous example for the
2286 interface <literal>enp2s0</literal>, and enables VLAN on that bridge port. VLAN IDs
2287 1-32, 42, 100-400 will be allowed. Packets tagged with VLAN IDs 42, 300-400 will be
2288 untagged when they leave on this interface. Untagged packets which arrive on this
2289 interface will be assigned VLAN ID 42.</para>
798d3a52 2290 </example>
0a8a0fad 2291
798d3a52 2292 <example>
9e35b3de 2293 <title>Various tunnels</title>
0a8a0fad 2294
9e35b3de
ZJS
2295 <programlisting>/etc/systemd/network/25-tunnels.network
2296[Match]
2297Name=ens1
0a8a0fad
TG
2298
2299[Network]
9e35b3de
ZJS
2300Tunnel=ipip-tun
2301Tunnel=sit-tun
2302Tunnel=gre-tun
2303Tunnel=vti-tun
2304 </programlisting>
2305
2306 <programlisting>/etc/systemd/network/25-tunnel-ipip.netdev
2307[NetDev]
2308Name=ipip-tun
2309Kind=ipip
2310 </programlisting>
2311
2312 <programlisting>/etc/systemd/network/25-tunnel-sit.netdev
2313[NetDev]
2314Name=sit-tun
2315Kind=sit
2316 </programlisting>
2317
2318 <programlisting>/etc/systemd/network/25-tunnel-gre.netdev
2319[NetDev]
2320Name=gre-tun
2321Kind=gre
2322 </programlisting>
2323
2324 <programlisting>/etc/systemd/network/25-tunnel-vti.netdev
2325[NetDev]
2326Name=vti-tun
2327Kind=vti
2328 </programlisting>
2329
2330 <para>This will bring interface <literal>ens1</literal> up and create an IPIP tunnel,
2331 a SIT tunnel, a GRE tunnel, and a VTI tunnel using it.</para>
798d3a52 2332 </example>
0a8a0fad 2333
798d3a52 2334 <example>
9e35b3de 2335 <title>A bond device</title>
0a8a0fad 2336
9e35b3de
ZJS
2337 <programlisting># /etc/systemd/network/30-bond1.network
2338[Match]
2339Name=bond1
0a8a0fad
TG
2340
2341[Network]
9e35b3de
ZJS
2342DHCP=ipv6
2343</programlisting>
0a8a0fad 2344
9e35b3de
ZJS
2345 <programlisting># /etc/systemd/network/30-bond1.netdev
2346[NetDev]
2347Name=bond1
2348Kind=bond
2349</programlisting>
0a8a0fad 2350
301a21a8 2351 <programlisting># /etc/systemd/network/30-bond1-dev1.network
9e35b3de
ZJS
2352[Match]
2353MACAddress=52:54:00:e9:64:41
0a8a0fad
TG
2354
2355[Network]
9e35b3de
ZJS
2356Bond=bond1
2357</programlisting>
d94facdc 2358
301a21a8 2359 <programlisting># /etc/systemd/network/30-bond1-dev2.network
9e35b3de
ZJS
2360[Match]
2361MACAddress=52:54:00:e9:64:42
d94facdc
MH
2362
2363[Network]
9e35b3de 2364Bond=bond1
6cb955c6 2365</programlisting>
9e35b3de
ZJS
2366
2367 <para>This will create a bond device <literal>bond1</literal> and enslave the two
2368 devices with MAC addresses 52:54:00:e9:64:41 and 52:54:00:e9:64:42 to it. IPv6 DHCP
2369 will be used to acquire an address.</para>
6cb955c6
AR
2370 </example>
2371
2372 <example>
9e35b3de
ZJS
2373 <title>Virtual Routing and Forwarding (VRF)</title>
2374 <para>Add the <literal>bond1</literal> interface to the VRF master interface
2375 <literal>vrf1</literal>. This will redirect routes generated on this interface to be
11d38b90
AR
2376 within the routing table defined during VRF creation. For kernels before 4.8 traffic
2377 won't be redirected towards the VRFs routing table unless specific ip-rules are added.
2378 </para>
9e35b3de
ZJS
2379 <programlisting># /etc/systemd/network/25-vrf.network
2380[Match]
6cb955c6
AR
2381Name=bond1
2382
2383[Network]
9e35b3de 2384VRF=vrf1
d94facdc
MH
2385</programlisting>
2386 </example>
2387
42125eda
SS
2388 <example>
2389 <title>MacVTap</title>
2390 <para>This brings up a network interface <literal>macvtap-test</literal>
2391 and attaches it to <literal>enp0s25</literal>.</para>
83ddf5d3 2392 <programlisting># /usr/lib/systemd/network/25-macvtap.network
42125eda
SS
2393[Match]
2394Name=enp0s25
2395
2396[Network]
2397MACVTAP=macvtap-test
2398</programlisting>
2399 </example>
98d20a17 2400
2401 <example>
2402 <title>A Xfrm interface with physical underlying device.</title>
2403
2404 <programlisting># /etc/systemd/network/27-xfrm.netdev
2405[NetDev]
2406Name=xfrm0
2407
2408[Xfrm]
2409InterfaceId=7</programlisting>
2410
2411 <programlisting># /etc/systemd/network/27-eth0.network
2412[Match]
2413Name=eth0
2414
2415[Network]
2416Xfrm=xfrm0</programlisting>
2417
2418 <para>This creates a <literal>xfrm0</literal> interface and binds it to the <literal>eth0</literal> device.
2419 This allows hardware based ipsec offloading to the <literal>eth0</literal> nic.
2420 If offloading is not needed, xfrm interfaces can be assigned to the <literal>lo</literal> device.
2421 </para>
2422 </example>
798d3a52
ZJS
2423 </refsect1>
2424
2425 <refsect1>
2426 <title>See Also</title>
2427 <para>
2428 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
f41b446a 2429 <citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
798d3a52 2430 <citerefentry><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
aaa297d4
LP
2431 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
2432 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
798d3a52
ZJS
2433 </para>
2434 </refsect1>
eac684ef
TG
2435
2436</refentry>