man/systemd.network.xml

   1 <?xml version='1.0'?>
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4 <!-- SPDX-License-Identifier: LGPL-2.1+ -->
   5
   6 <refentry id="systemd.network" conditional='ENABLE_NETWORKD'>
   7
   8   <refentryinfo>
   9     <title>systemd.network</title>
  10     <productname>systemd</productname>
  11   </refentryinfo>
  12
  13   <refmeta>
  14     <refentrytitle>systemd.network</refentrytitle>
  15     <manvolnum>5</manvolnum>
  16   </refmeta>
  17
  18   <refnamediv>
  19     <refname>systemd.network</refname>
  20     <refpurpose>Network configuration</refpurpose>
  21   </refnamediv>
  22
  23   <refsynopsisdiv>
  24     <para><filename><replaceable>network</replaceable>.network</filename></para>
  25   </refsynopsisdiv>
  26
  27   <refsect1>
  28     <title>Description</title>
  29
  30     <para>Network setup is performed by
  31     <citerefentry><refentrytitle>systemd-networkd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
  32     </para>
  33
  34     <para>The main network file must have the extension <filename>.network</filename>; other
  35     extensions are ignored. Networks are applied to links whenever the links appear.</para>
  36
  37     <para>The <filename>.network</filename> files are read from the files located in the system network
  38     directories <filename>/usr/lib/systemd/network</filename> and
  39     <filename>/usr/local/lib/systemd/network</filename>, the volatile runtime network directory
  40     <filename>/run/systemd/network</filename> and the local administration network directory
  41     <filename>/etc/systemd/network</filename>. All configuration files are collectively sorted and processed
  42     in lexical order, regardless of the directories in which they live. However, files with identical
  43     filenames replace each other. Files in <filename>/etc</filename> have the highest priority, files in
  44     <filename>/run</filename> take precedence over files with the same name under
  45     <filename>/usr</filename>. This can be used to override a system-supplied configuration file with a local
  46     file if needed. As a special case, an empty file (file size 0) or symlink with the same name pointing to
  47     <filename>/dev/null</filename> disables the configuration file entirely (it is "masked").</para>
  48
  49     <para>Along with the network file <filename>foo.network</filename>, a "drop-in" directory
  50     <filename>foo.network.d/</filename> may exist. All files with the suffix
  51     <literal>.conf</literal> from this directory will be parsed after the file itself is
  52     parsed. This is useful to alter or add configuration settings, without having to modify the main
  53     configuration file. Each drop-in file must have appropriate section headers.</para>
  54
  55     <para>In addition to <filename>/etc/systemd/network</filename>, drop-in <literal>.d</literal>
  56     directories can be placed in <filename>/usr/lib/systemd/network</filename> or
  57     <filename>/run/systemd/network</filename> directories. Drop-in files in
  58     <filename>/etc</filename> take precedence over those in <filename>/run</filename> which in turn
  59     take precedence over those in <filename>/usr/lib</filename>. Drop-in files under any of these
  60     directories take precedence over the main netdev file wherever located.</para>
  61
  62     <para>Note that an interface without any static IPv6 addresses configured, and neither DHCPv6
  63     nor IPv6LL enabled, shall be considered to have no IPv6 support. IPv6 will be automatically
  64     disabled for that interface by writing "1" to
  65     <filename>/proc/sys/net/ipv6/conf/<replaceable>ifname</replaceable>/disable_ipv6</filename>.
  66     </para>
  67   </refsect1>
  68
  69   <refsect1>
  70     <title>[Match] Section Options</title>
  71
  72       <para>The network file contains a <literal>[Match]</literal>
  73       section, which determines if a given network file may be applied
  74       to a given device; and a <literal>[Network]</literal> section
  75       specifying how the device should be configured. The first (in
  76       lexical order) of the network files that matches a given device
  77       is applied, all later files are ignored, even if they match as
  78       well.</para>
  79
  80       <para>A network file is said to match a device if each of the
  81       entries in the <literal>[Match]</literal> section matches, or if
  82       the section is empty. The following keys are accepted:</para>
  83
  84       <variablelist class='network-directives'>
  85         <varlistentry>
  86           <term><varname>MACAddress=</varname></term>
  87           <listitem>
  88             <para>A whitespace-separated list of hardware addresses. Use full colon-, hyphen- or dot-delimited hexadecimal. See the example below.
  89             This option may appear more than one, in which case the lists are merged. If the empty string is assigned to this option, the list
  90             of hardware addresses defined prior to this is reset.</para>
  91
  92             <para>Example:
  93             <programlisting>MACAddress=01:23:45:67:89:ab 00-11-22-33-44-55 AABB.CCDD.EEFF</programlisting></para>
  94           </listitem>
  95         </varlistentry>
  96         <varlistentry>
  97           <term><varname>Path=</varname></term>
  98           <listitem>
  99             <para>A whitespace-separated list of shell-style globs
 100             matching the persistent path, as exposed by the udev
 101             property <literal>ID_PATH</literal>. If the list is
 102             prefixed with a "!", the test is inverted; i.e. it is
 103             true when <literal>ID_PATH</literal> does not match any
 104             item in the list.</para>
 105           </listitem>
 106         </varlistentry>
 107         <varlistentry>
 108           <term><varname>Driver=</varname></term>
 109           <listitem>
 110             <para>A whitespace-separated list of shell-style globs
 111             matching the driver currently bound to the device, as
 112             exposed by the udev property <literal>DRIVER</literal>
 113             of its parent device, or if that is not set the driver
 114             as exposed by <literal>ethtool -i</literal> of the
 115             device itself. If the list is prefixed with a "!", the
 116             test is inverted.</para>
 117           </listitem>
 118         </varlistentry>
 119         <varlistentry>
 120           <term><varname>Type=</varname></term>
 121           <listitem>
 122             <para>A whitespace-separated list of shell-style globs
 123             matching the device type, as exposed by the udev property
 124             <literal>DEVTYPE</literal>. If the list is prefixed with
 125             a "!", the test is inverted.</para>
 126           </listitem>
 127         </varlistentry>
 128         <varlistentry>
 129           <term><varname>Name=</varname></term>
 130           <listitem>
 131             <para>A whitespace-separated list of shell-style globs
 132             matching the device name, as exposed by the udev property
 133             <literal>INTERFACE</literal>. If the list is prefixed
 134             with a "!", the test is inverted.</para>
 135           </listitem>
 136         </varlistentry>
 137         <varlistentry>
 138           <term><varname>Host=</varname></term>
 139           <listitem>
 140             <para>Matches against the hostname or machine ID of the host. See
 141             <literal>ConditionHost=</literal> in
 142             <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 143             for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
 144             If an empty string is assigned, then previously assigned value is cleared.
 145             </para>
 146           </listitem>
 147         </varlistentry>
 148         <varlistentry>
 149           <term><varname>Virtualization=</varname></term>
 150           <listitem>
 151             <para>Checks whether the system is executed in a virtualized environment and optionally test
 152             whether it is a specific implementation. See <literal>ConditionVirtualization=</literal> in
 153             <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 154             for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
 155             If an empty string is assigned, then previously assigned value is cleared.
 156             </para>
 157           </listitem>
 158         </varlistentry>
 159         <varlistentry>
 160           <term><varname>KernelCommandLine=</varname></term>
 161           <listitem>
 162             <para>Checks whether a specific kernel command line option is set. See
 163             <literal>ConditionKernelCommandLine=</literal> in
 164             <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 165             for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
 166             If an empty string is assigned, then previously assigned value is cleared.
 167             </para>
 168           </listitem>
 169         </varlistentry>
 170         <varlistentry>
 171           <term><varname>KernelVersion=</varname></term>
 172           <listitem>
 173             <para>Checks whether the kernel version (as reported by <command>uname -r</command>) matches a
 174             certain expression. See <literal>ConditionKernelVersion=</literal> in
 175             <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 176             for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
 177             If an empty string is assigned, then previously assigned value is cleared.
 178             </para>
 179           </listitem>
 180         </varlistentry>
 181         <varlistentry>
 182           <term><varname>Architecture=</varname></term>
 183           <listitem>
 184             <para>Checks whether the system is running on a specific architecture. See
 185             <literal>ConditionArchitecture=</literal> in
 186             <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 187             for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
 188             If an empty string is assigned, then previously assigned value is cleared.
 189             </para>
 190           </listitem>
 191         </varlistentry>
 192       </variablelist>
 193
 194   </refsect1>
 195
 196   <refsect1>
 197     <title>[Link] Section Options</title>
 198
 199     <para> The <literal>[Link]</literal> section accepts the following keys:</para>
 200
 201     <variablelist class='network-directives'>
 202       <varlistentry>
 203         <term><varname>MACAddress=</varname></term>
 204         <listitem>
 205           <para>The hardware address to set for the device.</para>
 206         </listitem>
 207       </varlistentry>
 208       <varlistentry>
 209         <term><varname>MTUBytes=</varname></term>
 210         <listitem>
 211           <para>The maximum transmission unit in bytes to set for the
 212           device. The usual suffixes K, M, G, are supported and are
 213           understood to the base of 1024.</para>
 214           <para>Note that if IPv6 is enabled on the interface, and the MTU is chosen
 215           below 1280 (the minimum MTU for IPv6) it will automatically be increased to this value.</para>
 216         </listitem>
 217       </varlistentry>
 218       <varlistentry>
 219         <term><varname>ARP=</varname></term>
 220         <listitem>
 221           <para>Takes a boolean. If set to true, the ARP (low-level Address Resolution Protocol)
 222           for this interface is enabled. When unset, the kernel's default will be used.</para>
 223           <para> For example, disabling ARP is useful when creating multiple MACVLAN or VLAN virtual
 224           interfaces atop a single lower-level physical interface, which will then only serve as a
 225           link/"bridge" device aggregating traffic to the same physical link and not participate in
 226           the network otherwise.</para>
 227         </listitem>
 228       </varlistentry>
 229       <varlistentry>
 230         <term><varname>Multicast=</varname></term>
 231         <listitem>
 232           <para>Takes a boolean. If set to true, the multicast flag on the device is enabled.</para>
 233         </listitem>
 234       </varlistentry>
 235       <varlistentry>
 236         <term><varname>AllMulticast=</varname></term>
 237         <listitem>
 238           <para>Takes a boolean. If set to true, the driver retrieves all multicast packets from the network.
 239           This happens when multicast routing is enabled.</para>
 240         </listitem>
 241       </varlistentry>
 242       <varlistentry>
 243         <term><varname>Unmanaged=</varname></term>
 244         <listitem>
 245           <para>Takes a boolean. When <literal>yes</literal>, no attempts are
 246           made to bring up or configure matching links, equivalent to
 247           when there are no matching network files. Defaults to
 248           <literal>no</literal>.</para>
 249           <para>This is useful for preventing later matching network
 250           files from interfering with certain interfaces that are fully
 251           controlled by other applications.</para>
 252         </listitem>
 253       </varlistentry>
 254       <varlistentry>
 255         <term><varname>RequiredForOnline=</varname></term>
 256         <listitem>
 257           <para>Takes a boolean or operational state. Please see
 258           <citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 259           for possible operational states. When <literal>yes</literal>, the network is deemed required when
 260           determining whether the system is online when running
 261           <command>systemd-networkd-wait-online</command>. When <literal>no</literal>, the network is ignored
 262           when checking for online state. When an operational state is set, <literal>yes</literal> is implied,
 263           and this controls the operational state required for the network interface to be considered online.
 264           Defaults to <literal>yes</literal>.</para>
 265
 266           <para>The network will be brought up normally in all cases, but in
 267           the event that there is no address being assigned by DHCP or the
 268           cable is not plugged in, the link will simply remain offline and be
 269           skipped automatically by <command>systemd-networkd-wait-online</command>
 270           if <literal>RequiredForOnline=no</literal>.</para>
 271         </listitem>
 272       </varlistentry>
 273     </variablelist>
 274   </refsect1>
 275
 276   <refsect1>
 277     <title>[Network] Section Options</title>
 278
 279       <para>The <literal>[Network]</literal> section accepts the following keys:</para>
 280
 281       <variablelist class='network-directives'>
 282         <varlistentry>
 283           <term><varname>Description=</varname></term>
 284           <listitem>
 285             <para>A description of the device. This is only used for
 286             presentation purposes.</para>
 287           </listitem>
 288         </varlistentry>
 289         <varlistentry>
 290           <term><varname>DHCP=</varname></term>
 291           <listitem>
 292             <para>Enables DHCPv4 and/or DHCPv6 client support. Accepts
 293             <literal>yes</literal>, <literal>no</literal>,
 294             <literal>ipv4</literal>, or <literal>ipv6</literal>. Defaults
 295             to <literal>no</literal>.</para>
 296
 297             <para>Note that DHCPv6 will by default be triggered by Router
 298             Advertisement, if that is enabled, regardless of this parameter.
 299             By enabling DHCPv6 support explicitly, the DHCPv6 client will
 300             be started regardless of the presence of routers on the link,
 301             or what flags the routers pass. See
 302             <literal>IPv6AcceptRA=</literal>.</para>
 303
 304             <para>Furthermore, note that by default the domain name
 305             specified through DHCP is not used for name resolution.
 306             See option <option>UseDomains=</option> below.</para>
 307
 308             <para>See the <literal>[DHCP]</literal> section below for further configuration options for the DHCP client
 309             support.</para>
 310           </listitem>
 311         </varlistentry>
 312         <varlistentry>
 313           <term><varname>DHCPServer=</varname></term>
 314           <listitem>
 315             <para>Takes a boolean. If set to <literal>yes</literal>, DHCPv4 server will be started. Defaults
 316             to <literal>no</literal>. Further settings for the DHCP
 317             server may be set in the <literal>[DHCPServer]</literal>
 318             section described below.</para>
 319           </listitem>
 320         </varlistentry>
 321         <varlistentry>
 322           <term><varname>LinkLocalAddressing=</varname></term>
 323           <listitem>
 324             <para>Enables link-local address autoconfiguration. Accepts <literal>yes</literal>,
 325             <literal>no</literal>, <literal>ipv4</literal>, or <literal>ipv6</literal>. If
 326             <varname>Bridge=</varname> is set, defaults to <literal>no</literal>, and if not,
 327             defaults to <literal>ipv6</literal>.</para>
 328           </listitem>
 329         </varlistentry>
 330         <varlistentry>
 331           <term><varname>IPv4LLRoute=</varname></term>
 332           <listitem>
 333             <para>Takes a boolean. If set to true, sets up the route needed for
 334             non-IPv4LL hosts to communicate with IPv4LL-only hosts. Defaults
 335             to false.
 336             </para>
 337           </listitem>
 338         </varlistentry>
 339         <varlistentry>
 340           <term><varname>IPv6Token=</varname></term>
 341           <listitem>
 342             <para>An IPv6 address with the top 64 bits unset. When set, indicates the
 343             64-bit interface part of SLAAC IPv6 addresses for this link. Note that
 344             the token is only ever used for SLAAC, and not for DHCPv6 addresses, even
 345             in the case DHCP is requested by router advertisement. By default, the
 346             token is autogenerated.</para>
 347           </listitem>
 348         </varlistentry>
 349         <varlistentry>
 350           <term><varname>LLMNR=</varname></term>
 351           <listitem>
 352             <para>Takes a boolean or <literal>resolve</literal>. When true,
 353             enables <ulink
 354             url="https://tools.ietf.org/html/rfc4795">Link-Local
 355             Multicast Name Resolution</ulink> on the link. When set to
 356             <literal>resolve</literal>, only resolution is enabled,
 357             but not host registration and announcement. Defaults to
 358             true. This setting is read by
 359             <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 360           </listitem>
 361         </varlistentry>
 362         <varlistentry>
 363           <term><varname>MulticastDNS=</varname></term>
 364           <listitem>
 365             <para>Takes a boolean or <literal>resolve</literal>. When true,
 366             enables <ulink
 367             url="https://tools.ietf.org/html/rfc6762">Multicast
 368             DNS</ulink> support on the link. When set to
 369             <literal>resolve</literal>, only resolution is enabled,
 370             but not host or service registration and
 371             announcement. Defaults to false. This setting is read by
 372             <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 373           </listitem>
 374         </varlistentry>
 375         <varlistentry>
 376           <term><varname>DNSOverTLS=</varname></term>
 377           <listitem>
 378             <para>Takes false or
 379             <literal>opportunistic</literal>. When set to <literal>opportunistic</literal>, enables
 380             <ulink
 381             url="https://tools.ietf.org/html/rfc7858">DNS-over-TLS</ulink>
 382             support on the link. This option defines a
 383             per-interface setting for
 384             <citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>'s
 385             global <varname>DNSOverTLS=</varname> option. Defaults to
 386             false. This setting is read by
 387             <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 388           </listitem>
 389         </varlistentry>
 390         <varlistentry>
 391           <term><varname>DNSSEC=</varname></term>
 392           <listitem>
 393             <para>Takes a boolean. or
 394             <literal>allow-downgrade</literal>. When true, enables
 395             <ulink
 396             url="https://tools.ietf.org/html/rfc4033">DNSSEC</ulink>
 397             DNS validation support on the link. When set to
 398             <literal>allow-downgrade</literal>, compatibility with
 399             non-DNSSEC capable networks is increased, by automatically
 400             turning off DNSSEC in this case. This option defines a
 401             per-interface setting for
 402             <citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>'s
 403             global <varname>DNSSEC=</varname> option. Defaults to
 404             false. This setting is read by
 405             <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 406           </listitem>
 407         </varlistentry>
 408         <varlistentry>
 409           <term><varname>DNSSECNegativeTrustAnchors=</varname></term>
 410           <listitem><para>A space-separated list of DNSSEC negative
 411           trust anchor domains. If specified and DNSSEC is enabled,
 412           look-ups done via the interface's DNS server will be subject
 413           to the list of negative trust anchors, and not require
 414           authentication for the specified domains, or anything below
 415           it. Use this to disable DNSSEC authentication for specific
 416           private domains, that cannot be proven valid using the
 417           Internet DNS hierarchy. Defaults to the empty list. This
 418           setting is read by
 419           <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 420           </listitem>
 421         </varlistentry>
 422         <varlistentry>
 423           <term><varname>LLDP=</varname></term>
 424           <listitem>
 425             <para>Controls support for Ethernet LLDP packet reception. LLDP is a link-layer protocol commonly
 426             implemented on professional routers and bridges which announces which physical port a system is connected
 427             to, as well as other related data. Accepts a boolean or the special value
 428             <literal>routers-only</literal>. When true, incoming LLDP packets are accepted and a database of all LLDP
 429             neighbors maintained. If <literal>routers-only</literal> is set only LLDP data of various types of routers
 430             is collected and LLDP data about other types of devices ignored (such as stations, telephones and
 431             others). If false, LLDP reception is disabled. Defaults to <literal>routers-only</literal>. Use
 432             <citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> to query the
 433             collected neighbor data. LLDP is only available on Ethernet links. See <varname>EmitLLDP=</varname> below
 434             for enabling LLDP packet emission from the local system.
 435             </para>
 436           </listitem>
 437         </varlistentry>
 438         <varlistentry>
 439           <term><varname>EmitLLDP=</varname></term>
 440           <listitem>
 441             <para>Controls support for Ethernet LLDP packet emission. Accepts a boolean parameter or the special values
 442             <literal>nearest-bridge</literal>, <literal>non-tpmr-bridge</literal> and
 443             <literal>customer-bridge</literal>.  Defaults to false, which turns off LLDP packet emission. If not false,
 444             a short LLDP packet with information about the local system is sent out in regular intervals on the
 445             link. The LLDP packet will contain information about the local host name, the local machine ID (as stored
 446             in <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>) and the
 447             local interface name, as well as the pretty hostname of the system (as set in
 448             <citerefentry><refentrytitle>machine-info</refentrytitle><manvolnum>5</manvolnum></citerefentry>). LLDP
 449             emission is only available on Ethernet links. Note that this setting passes data suitable for
 450             identification of host to the network and should thus not be enabled on untrusted networks, where such
 451             identification data should not be made available. Use this option to permit other systems to identify on
 452             which interfaces they are connected to this system. The three special values control propagation of the
 453             LLDP packets. The <literal>nearest-bridge</literal> setting permits propagation only to the nearest
 454             connected bridge, <literal>non-tpmr-bridge</literal> permits propagation across Two-Port MAC Relays, but
 455             not any other bridges, and <literal>customer-bridge</literal> permits propagation until a customer bridge
 456             is reached. For details about these concepts, see <ulink
 457             url="https://standards.ieee.org/findstds/standard/802.1AB-2016.html">IEEE 802.1AB-2016</ulink>. Note that
 458             configuring this setting to true is equivalent to <literal>nearest-bridge</literal>, the recommended and
 459             most restricted level of propagation. See <varname>LLDP=</varname> above for an option to enable LLDP
 460             reception.</para>
 461           </listitem>
 462         </varlistentry>
 463         <varlistentry>
 464           <term><varname>BindCarrier=</varname></term>
 465           <listitem>
 466             <para>A link name or a list of link names. When set, controls the behavior of the current
 467             link. When all links in the list are in an operational down state, the current link is brought
 468             down. When at least one link has carrier, the current interface is brought up.
 469             </para>
 470           </listitem>
 471         </varlistentry>
 472         <varlistentry>
 473           <term><varname>Address=</varname></term>
 474           <listitem>
 475             <para>A static IPv4 or IPv6 address and its prefix length,
 476             separated by a <literal>/</literal> character. Specify
 477             this key more than once to configure several addresses.
 478             The format of the address must be as described in
 479             <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 480             This is a short-hand for an [Address] section only
 481             containing an Address key (see below). This option may be
 482             specified more than once.
 483             </para>
 484
 485             <para>If the specified address is <literal>0.0.0.0</literal> (for IPv4) or <literal>::</literal>
 486             (for IPv6), a new address range of the requested size is automatically allocated from a
 487             system-wide pool of unused ranges. Note that the prefix length must be equal or larger than 8 for
 488             IPv4, and 64 for IPv6. The allocated range is checked against all current network interfaces and
 489             all known network configuration files to avoid address range conflicts. The default system-wide
 490             pool consists of 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 for IPv4, and fd00::/8 for IPv6.
 491             This functionality is useful to manage a large number of dynamically created network interfaces
 492             with the same network configuration and automatic address range assignment.</para>
 493
 494           </listitem>
 495         </varlistentry>
 496         <varlistentry>
 497           <term><varname>Gateway=</varname></term>
 498           <listitem>
 499             <para>The gateway address, which must be in the format
 500             described in
 501             <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 502             This is a short-hand for a [Route] section only containing
 503             a Gateway key. This option may be specified more than
 504             once.</para>
 505           </listitem>
 506         </varlistentry>
 507         <varlistentry>
 508           <term><varname>DNS=</varname></term>
 509           <listitem>
 510             <para>A DNS server address, which must be in the format
 511             described in
 512             <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 513             This option may be specified more than once. This setting is read by
 514             <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 515           </listitem>
 516         </varlistentry>
 517         <varlistentry>
 518           <term><varname>Domains=</varname></term>
 519           <listitem>
 520             <para>A list of domains which should be resolved using the DNS servers on this link. Each item in the list
 521             should be a domain name, optionally prefixed with a tilde (<literal>~</literal>). The domains with the
 522             prefix are called "routing-only domains". The domains without the prefix are called "search domains" and
 523             are first used as search suffixes for extending single-label host names (host names containing no dots) to
 524             become fully qualified domain names (FQDNs). If a single-label host name is resolved on this interface,
 525             each of the specified search domains are appended to it in turn, converting it into a fully qualified
 526             domain name, until one of them may be successfully resolved.</para>
 527
 528             <para>Both "search" and "routing-only" domains are used for routing of DNS queries: look-ups for host names
 529             ending in those domains (hence also single label names, if any "search domains" are listed), are routed to
 530             the DNS servers configured for this interface. The domain routing logic is particularly useful on
 531             multi-homed hosts with DNS servers serving particular private DNS zones on each interface.</para>
 532
 533             <para>The "routing-only" domain <literal>~.</literal> (the tilde indicating definition of a routing domain,
 534             the dot referring to the DNS root domain which is the implied suffix of all valid DNS names) has special
 535             effect. It causes all DNS traffic which does not match another configured domain routing entry to be routed
 536             to DNS servers specified for this interface. This setting is useful to prefer a certain set of DNS servers
 537             if a link on which they are connected is available.</para>
 538
 539             <para>This setting is read by
 540             <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
 541             "Search domains" correspond to the <varname>domain</varname> and <varname>search</varname> entries in
 542             <citerefentry project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 543             Domain name routing has no equivalent in the traditional glibc API, which has no concept of domain
 544             name servers limited to a specific link.</para>
 545           </listitem>
 546         </varlistentry>
 547         <varlistentry>
 548           <term><varname>DNSDefaultRoute=</varname></term>
 549           <listitem>
 550             <para>Takes a boolean argument. If true, this link's configured DNS servers are used for resolving domain
 551             names that do not match any link's configured <varname>Domains=</varname> setting. If false, this link's
 552             configured DNS servers are never used for such domains, and are exclusively used for resolving names that
 553             match at least one of the domains configured on this link. If not specified defaults to an automatic mode:
 554             queries not matching any link's configured domains will be routed to this link if it has no routing-only
 555             domains configured.</para>
 556           </listitem>
 557         </varlistentry>
 558         <varlistentry>
 559           <term><varname>NTP=</varname></term>
 560           <listitem>
 561             <para>An NTP server address. This option may be specified more than once. This setting is read by
 562             <citerefentry><refentrytitle>systemd-timesyncd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 563           </listitem>
 564         </varlistentry>
 565         <varlistentry>
 566           <term><varname>IPForward=</varname></term>
 567           <listitem><para>Configures IP packet forwarding for the
 568           system. If enabled, incoming packets on any network
 569           interface will be forwarded to any other interfaces
 570           according to the routing table. Takes a boolean,
 571           or the values <literal>ipv4</literal> or
 572           <literal>ipv6</literal>, which only enable IP packet
 573           forwarding for the specified address family.  This controls
 574           the <filename>net.ipv4.ip_forward</filename> and
 575           <filename>net.ipv6.conf.all.forwarding</filename> sysctl
 576           options of the network interface (see <ulink
 577           url="https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt">ip-sysctl.txt</ulink>
 578           for details about sysctl options). Defaults to
 579           <literal>no</literal>.</para>
 580
 581           <para>Note: this setting controls a global kernel option,
 582           and does so one way only: if a network that has this setting
 583           enabled is set up the global setting is turned on.  However,
 584           it is never turned off again, even after all networks with
 585           this setting enabled are shut down again.</para>
 586
 587           <para>To allow IP packet forwarding only between specific
 588           network interfaces use a firewall.</para>
 589           </listitem>
 590         </varlistentry>
 591         <varlistentry>
 592           <term><varname>IPMasquerade=</varname></term>
 593           <listitem><para>Configures IP masquerading for the network
 594           interface. If enabled, packets forwarded from the network
 595           interface will be appear as coming from the local host.
 596           Takes a boolean argument. Implies
 597           <varname>IPForward=ipv4</varname>. Defaults to
 598           <literal>no</literal>.</para></listitem>
 599         </varlistentry>
 600         <varlistentry>
 601           <term><varname>IPv6PrivacyExtensions=</varname></term>
 602           <listitem><para>Configures use of stateless temporary
 603           addresses that change over time (see <ulink
 604           url="https://tools.ietf.org/html/rfc4941">RFC 4941</ulink>,
 605           Privacy Extensions for Stateless Address Autoconfiguration
 606           in IPv6). Takes a boolean or the special values
 607           <literal>prefer-public</literal> and
 608           <literal>kernel</literal>. When true, enables the privacy
 609           extensions and prefers temporary addresses over public
 610           addresses. When <literal>prefer-public</literal>, enables the
 611           privacy extensions, but prefers public addresses over
 612           temporary addresses. When false, the privacy extensions
 613           remain disabled. When <literal>kernel</literal>, the kernel's
 614           default setting will be left in place.  Defaults to
 615           <literal>no</literal>.</para></listitem>
 616         </varlistentry>
 617         <varlistentry>
 618           <term><varname>IPv6AcceptRA=</varname></term>
 619           <listitem><para>Takes a boolean. Controls IPv6 Router Advertisement (RA) reception support for the interface.
 620           If true, RAs are accepted; if false, RAs are ignored, independently of the local forwarding state.
 621           If unset, the kernel's default is used, and RAs are accepted only when local forwarding
 622           is disabled for that interface.  When RAs are accepted, they may trigger the start of the DHCPv6 client if
 623           the relevant flags are set in the RA data, or if no routers are found on the link.</para>
 624
 625           <para>Further settings for the IPv6 RA support may be configured in the
 626           <literal>[IPv6AcceptRA]</literal> section, see below.</para>
 627
 628           <para>Also see <ulink
 629           url="https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt">ip-sysctl.txt</ulink> in the kernel
 630           documentation regarding <literal>accept_ra</literal>, but note that systemd's setting of
 631           <constant>1</constant> (i.e. true) corresponds to kernel's setting of <constant>2</constant>.</para>
 632
 633           <para>Note that if this option is enabled a userspace implementation of the IPv6 RA protocol is
 634           used, and the kernel's own implementation remains disabled, since `networkd` needs to know all
 635           details supplied in the advertisements, and these are not available from the kernel if the kernel's
 636           own implemenation is used.</para>
 637         </listitem>
 638         </varlistentry>
 639         <varlistentry>
 640           <term><varname>IPv6DuplicateAddressDetection=</varname></term>
 641           <listitem><para>Configures the amount of IPv6 Duplicate
 642           Address Detection (DAD) probes to send. When unset, the kernel's default will be used.
 643         </para></listitem>
 644         </varlistentry>
 645         <varlistentry>
 646           <term><varname>IPv6HopLimit=</varname></term>
 647           <listitem><para>Configures IPv6 Hop Limit. For each router that
 648           forwards the packet, the hop limit is decremented by 1. When the
 649           hop limit field reaches zero, the packet is discarded.
 650           When unset, the kernel's default will be used.
 651         </para></listitem>
 652         </varlistentry>
 653         <varlistentry>
 654           <term><varname>IPv4ProxyARP=</varname></term>
 655           <listitem><para>Takes a boolean. Configures proxy ARP for IPv4. Proxy ARP is the technique in which one host,
 656           usually a router, answers ARP requests intended for another machine. By "faking" its identity,
 657           the router accepts responsibility for routing packets to the "real" destination. (see <ulink
 658           url="https://tools.ietf.org/html/rfc1027">RFC 1027</ulink>.
 659           When unset, the kernel's default will be used.
 660         </para></listitem>
 661         </varlistentry>
 662         <varlistentry>
 663           <term><varname>IPv6ProxyNDP=</varname></term>
 664           <listitem><para>Takes a boolean. Configures proxy NDP for IPv6. Proxy NDP (Neighbor Discovery
 665           Protocol) is a technique for IPv6 to allow routing of addresses to a different
 666           destination when peers expect them to be present on a certain physical link.
 667           In this case a router answers Neighbour Advertisement messages intended for
 668           another machine by offering its own MAC address as destination.
 669           Unlike proxy ARP for IPv4, it is not enabled globally, but will only send Neighbour
 670           Advertisement messages for addresses in the IPv6 neighbor proxy table,
 671           which can also be shown by <command>ip -6 neighbour show proxy</command>.
 672           systemd-networkd will control the per-interface `proxy_ndp` switch for each configured
 673           interface depending on this option.
 674           When unset, the kernel's default will be used.
 675         </para></listitem>
 676         </varlistentry>
 677         <varlistentry>
 678           <term><varname>IPv6ProxyNDPAddress=</varname></term>
 679           <listitem><para>An IPv6 address, for which Neighbour Advertisement messages will be
 680           proxied. This option may be specified more than once. systemd-networkd will add the
 681           <option>IPv6ProxyNDPAddress=</option> entries to the kernel's IPv6 neighbor proxy table.
 682           This option implies <option>IPv6ProxyNDP=yes</option> but has no effect if
 683           <option>IPv6ProxyNDP</option> has been set to false. When unset, the kernel's default will be used.
 684         </para></listitem>
 685         </varlistentry>
 686         <varlistentry>
 687           <term><varname>IPv6PrefixDelegation=</varname></term>
 688           <listitem><para>Whether to enable or disable Router Advertisement sending on a link.
 689           Allowed values are <literal>static</literal> which distributes prefixes as defined in
 690           the <literal>[IPv6PrefixDelegation]</literal> and any <literal>[IPv6Prefix]</literal>
 691           sections, <literal>dhcpv6</literal> which requests prefixes using a DHCPv6 client
 692           configured for another link and any values configured in the
 693           <literal>[IPv6PrefixDelegation]</literal> section while ignoring all static prefix
 694           configuration sections, <literal>yes</literal> which uses both static configuration
 695           and DHCPv6, and <literal>false</literal> which turns off IPv6 prefix delegation
 696           altogether. Defaults to <literal>false</literal>. See the
 697           <literal>[IPv6PrefixDelegation]</literal> and the <literal>[IPv6Prefix]</literal>
 698           sections for more configuration options.
 699           </para></listitem>
 700         </varlistentry>
 701         <varlistentry>
 702           <term><varname>IPv6MTUBytes=</varname></term>
 703           <listitem><para>Configures IPv6 maximum transmission unit (MTU).
 704           An integer greater than or equal to 1280 bytes. When unset, the kernel's default will be used.
 705           </para></listitem>
 706         </varlistentry>
 707         <varlistentry>
 708           <term><varname>Bridge=</varname></term>
 709           <listitem>
 710             <para>The name of the bridge to add the link to. See
 711             <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 712             </para>
 713           </listitem>
 714         </varlistentry>
 715         <varlistentry>
 716           <term><varname>Bond=</varname></term>
 717           <listitem>
 718             <para>The name of the bond to add the link to. See
 719             <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 720             </para>
 721           </listitem>
 722         </varlistentry>
 723         <varlistentry>
 724           <term><varname>VRF=</varname></term>
 725           <listitem>
 726             <para>The name of the VRF to add the link to. See
 727             <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 728             </para>
 729           </listitem>
 730         </varlistentry>
 731         <varlistentry>
 732           <term><varname>VLAN=</varname></term>
 733           <listitem>
 734             <para>The name of a VLAN to create on the link. See
 735             <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 736             This option may be specified more than once.</para>
 737           </listitem>
 738         </varlistentry>
 739         <varlistentry>
 740           <term><varname>IPVLAN=</varname></term>
 741           <listitem>
 742             <para>The name of a IPVLAN to create on the link. See
 743             <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 744             This option may be specified more than once.</para>
 745           </listitem>
 746         </varlistentry>
 747         <varlistentry>
 748           <term><varname>MACVLAN=</varname></term>
 749           <listitem>
 750             <para>The name of a MACVLAN to create on the link. See
 751             <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 752             This option may be specified more than once.</para>
 753           </listitem>
 754         </varlistentry>
 755         <varlistentry>
 756           <term><varname>VXLAN=</varname></term>
 757           <listitem>
 758             <para>The name of a VXLAN to create on the link. See
 759             <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 760             This option may be specified more than once.</para>
 761           </listitem>
 762         </varlistentry>
 763         <varlistentry>
 764           <term><varname>Tunnel=</varname></term>
 765           <listitem>
 766             <para>The name of a Tunnel to create on the link. See
 767             <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 768             This option may be specified more than once.</para>
 769           </listitem>
 770         </varlistentry>
 771         <varlistentry>
 772           <term><varname>MACsec=</varname></term>
 773           <listitem>
 774             <para>The name of a MACsec device to create on the link. See
 775             <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 776             This option may be specified more than once.</para>
 777           </listitem>
 778         </varlistentry>
 779       <varlistentry>
 780         <term><varname>ActiveSlave=</varname></term>
 781         <listitem>
 782           <para>Takes a boolean. Specifies the new active slave. The <literal>ActiveSlave=</literal>
 783           option is only valid for following modes:
 784           <literal>active-backup</literal>,
 785           <literal>balance-alb</literal> and
 786           <literal>balance-tlb</literal>. Defaults to false.
 787           </para>
 788         </listitem>
 789       </varlistentry>
 790       <varlistentry>
 791         <term><varname>PrimarySlave=</varname></term>
 792         <listitem>
 793           <para>Takes a boolean. Specifies which slave is the primary device. The specified
 794           device will always be the active slave while it is available. Only when the
 795           primary is off-line will alternate devices be used.  This is useful when
 796           one slave is preferred over another, e.g. when one slave has higher throughput
 797           than another. The <literal>PrimarySlave=</literal> option is only valid for
 798           following modes:
 799           <literal>active-backup</literal>,
 800           <literal>balance-alb</literal> and
 801           <literal>balance-tlb</literal>. Defaults to false.
 802           </para>
 803         </listitem>
 804       </varlistentry>
 805       <varlistentry>
 806         <term><varname>ConfigureWithoutCarrier=</varname></term>
 807         <listitem>
 808           <para>Takes a boolean. Allows networkd to configure a specific link even if it has no carrier.
 809           Defaults to false.
 810           </para>
 811         </listitem>
 812       </varlistentry>
 813       <varlistentry>
 814         <term><varname>IgnoreCarrierLoss=</varname></term>
 815         <listitem>
 816           <para>A boolean. Allows networkd to retain both the static and dynamic configuration of the
 817           interface even if its carrier is lost. Defaults to false.
 818           </para>
 819         </listitem>
 820       </varlistentry>
 821
 822       </variablelist>
 823
 824   </refsect1>
 825
 826   <refsect1>
 827     <title>[Address] Section Options</title>
 828
 829       <para>An <literal>[Address]</literal> section accepts the
 830       following keys. Specify several <literal>[Address]</literal>
 831       sections to configure several addresses.</para>
 832
 833       <variablelist class='network-directives'>
 834         <varlistentry>
 835           <term><varname>Address=</varname></term>
 836           <listitem>
 837             <para>As in the <literal>[Network]</literal> section. This key is mandatory. Each
 838             <literal>[Address]</literal> section can contain one <varname>Address=</varname> setting.</para>
 839           </listitem>
 840         </varlistentry>
 841         <varlistentry>
 842           <term><varname>Peer=</varname></term>
 843           <listitem>
 844             <para>The peer address in a point-to-point connection.
 845             Accepts the same format as the <varname>Address=</varname>
 846             key.</para>
 847           </listitem>
 848         </varlistentry>
 849         <varlistentry>
 850           <term><varname>Broadcast=</varname></term>
 851           <listitem>
 852             <para>The broadcast address, which must be in the format
 853             described in
 854             <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 855             This key only applies to IPv4 addresses. If it is not
 856             given, it is derived from the <varname>Address=</varname>
 857             key.</para>
 858           </listitem>
 859         </varlistentry>
 860         <varlistentry>
 861           <term><varname>Label=</varname></term>
 862           <listitem>
 863             <para>An address label.</para>
 864           </listitem>
 865         </varlistentry>
 866         <varlistentry>
 867           <term><varname>PreferredLifetime=</varname></term>
 868           <listitem>
 869             <para>Allows the default "preferred lifetime" of the address to be overridden.
 870             Only three settings are accepted: <literal>forever</literal> or <literal>infinity</literal>
 871             which is the default and means that the address never expires, and <literal>0</literal> which means
 872             that the address is considered immediately "expired" and will not be used,
 873             unless explicitly requested. A setting of PreferredLifetime=0 is useful for
 874             addresses which are added to be used only by a specific application,
 875             which is then configured to use them explicitly.</para>
 876           </listitem>
 877         </varlistentry>
 878         <varlistentry>
 879           <term><varname>Scope=</varname></term>
 880           <listitem>
 881             <para>The scope of the address, which can be <literal>global</literal>,
 882             <literal>link</literal> or <literal>host</literal> or an unsigned integer ranges 0 to 255.
 883             Defaults to <literal>global</literal>.</para>
 884           </listitem>
 885         </varlistentry>
 886         <varlistentry>
 887           <term><varname>HomeAddress=</varname></term>
 888           <listitem>
 889             <para>Takes a boolean. Designates this address the "home address" as defined in
 890             <ulink url="https://tools.ietf.org/html/rfc6275">RFC 6275</ulink>.
 891             Supported only on IPv6. Defaults to false.</para>
 892           </listitem>
 893         </varlistentry>
 894         <varlistentry>
 895           <term><varname>DuplicateAddressDetection=</varname></term>
 896           <listitem>
 897             <para>Takes a boolean. Do not perform Duplicate Address Detection
 898             <ulink url="https://tools.ietf.org/html/rfc4862">RFC 4862</ulink> when adding this address.
 899             Supported only on IPv6. Defaults to false.</para>
 900           </listitem>
 901         </varlistentry>
 902         <varlistentry>
 903           <term><varname>ManageTemporaryAddress=</varname></term>
 904           <listitem>
 905             <para>Takes a boolean. If true the kernel manage temporary addresses created
 906             from this one as template on behalf of Privacy Extensions
 907             <ulink url="https://tools.ietf.org/html/rfc3041">RFC 3041</ulink>.  For this to become
 908             active, the use_tempaddr sysctl setting has to be set to a value greater than zero.
 909             The given address needs to have a prefix length of 64. This flag allows to use privacy
 910             extensions in a manually configured network, just like if stateless auto-configuration
 911             was active. Defaults to false. </para>
 912           </listitem>
 913         </varlistentry>
 914         <varlistentry>
 915           <term><varname>PrefixRoute=</varname></term>
 916           <listitem>
 917             <para>Takes a boolean. When adding or modifying an IPv6 address, the userspace
 918             application needs a way to suppress adding a prefix route. This is for example relevant
 919             together with IFA_F_MANAGERTEMPADDR, where userspace creates autoconf generated addresses,
 920             but depending on on-link, no route for the prefix should be added. Defaults to false.</para>
 921           </listitem>
 922         </varlistentry>
 923         <varlistentry>
 924           <term><varname>AutoJoin=</varname></term>
 925           <listitem>
 926             <para>Takes a boolean. Joining multicast group on ethernet level via
 927             <command>ip maddr</command> command would not work if we have an Ethernet switch that does
 928             IGMP snooping since the switch would not replicate multicast packets on  ports that did not
 929             have IGMP reports for the multicast addresses. Linux vxlan interfaces created via
 930             <command>ip link add vxlan</command> or networkd's netdev kind vxlan have the group option
 931             that enables then to do the required join. By extending ip address command with option
 932             <literal>autojoin</literal> we can get similar functionality for openvswitch (OVS) vxlan
 933             interfaces as well as other tunneling mechanisms that need to receive multicast traffic.
 934             Defaults to <literal>no</literal>.</para>
 935           </listitem>
 936         </varlistentry>
 937       </variablelist>
 938   </refsect1>
 939
 940   <refsect1>
 941     <title>[Neighbor] Section Options</title>
 942       <para>A <literal>[Neighbor]</literal> section accepts the
 943       following keys. The neighbor section adds a permanent, static
 944       entry to the neighbor table (IPv6) or ARP table (IPv4) for
 945       the given hardware address on the links matched for the network.
 946       Specify several <literal>[Neighbor]</literal> sections to configure
 947       several static neighbors.</para>
 948
 949       <variablelist class='network-directives'>
 950         <varlistentry>
 951           <term><varname>Address=</varname></term>
 952           <listitem>
 953             <para>The IP address of the neighbor.</para>
 954           </listitem>
 955         </varlistentry>
 956         <varlistentry>
 957           <term><varname>MACAddress=</varname></term>
 958           <listitem>
 959             <para>The hardware address of the neighbor.</para>
 960           </listitem>
 961         </varlistentry>
 962       </variablelist>
 963   </refsect1>
 964
 965     <refsect1>
 966     <title>[IPv6AddressLabel] Section Options</title>
 967
 968       <para>An <literal>[IPv6AddressLabel]</literal> section accepts the
 969       following keys. Specify several <literal>[IPv6AddressLabel]</literal>
 970       sections to configure several address labels. IPv6 address labels are
 971       used for address selection. See <ulink url="https://tools.ietf.org/html/rfc3484">RFC 3484</ulink>.
 972       Precedence is managed by userspace, and only the label itself is stored in the kernel</para>
 973
 974       <variablelist class='network-directives'>
 975         <varlistentry>
 976           <term><varname>Label=</varname></term>
 977           <listitem>
 978             <para> The label for the prefix (an unsigned integer) ranges 0 to 4294967294.
 979             0xffffffff is reserved. This key is mandatory.</para>
 980           </listitem>
 981         </varlistentry>
 982         <varlistentry>
 983           <term><varname>Prefix=</varname></term>
 984           <listitem>
 985             <para>IPv6 prefix is an address with a prefix length, separated by a slash <literal>/</literal> character.
 986             This key is mandatory. </para>
 987           </listitem>
 988         </varlistentry>
 989       </variablelist>
 990   </refsect1>
 991
 992  <refsect1>
 993     <title>[RoutingPolicyRule] Section Options</title>
 994
 995       <para>An <literal>[RoutingPolicyRule]</literal> section accepts the
 996       following keys. Specify several <literal>[RoutingPolicyRule]</literal>
 997       sections to configure several rules.</para>
 998
 999       <variablelist class='network-directives'>
1000         <varlistentry>
1001           <term><varname>TypeOfService=</varname></term>
1002           <listitem>
1003             <para>Specifies the type of service to match a number between 0 to 255.</para>
1004           </listitem>
1005         </varlistentry>
1006         <varlistentry>
1007           <term><varname>From=</varname></term>
1008           <listitem>
1009             <para>Specifies the source address prefix to match. Possibly followed by a slash and the prefix length.</para>
1010           </listitem>
1011         </varlistentry>
1012         <varlistentry>
1013           <term><varname>To=</varname></term>
1014           <listitem>
1015             <para>Specifies the destination address prefix to match. Possibly followed by a slash and the prefix length.</para>
1016           </listitem>
1017         </varlistentry>
1018         <varlistentry>
1019           <term><varname>FirewallMark=</varname></term>
1020           <listitem>
1021             <para>Specifies the iptables firewall mark value to match (a number between 1 and 4294967295).</para>
1022           </listitem>
1023         </varlistentry>
1024         <varlistentry>
1025           <term><varname>Table=</varname></term>
1026           <listitem>
1027             <para>Specifies the routing table identifier to lookup if the rule
1028             selector matches. The table identifier for a route (a number between 1 and 4294967295).</para>
1029           </listitem>
1030         </varlistentry>
1031         <varlistentry>
1032           <term><varname>Priority=</varname></term>
1033           <listitem>
1034             <para>Specifies the priority of this rule. <varname>Priority=</varname> is an unsigned
1035             integer. Higher number means lower priority, and rules get processed in order of increasing number.</para>
1036           </listitem>
1037         </varlistentry>
1038         <varlistentry>
1039           <term><varname>IncomingInterface=</varname></term>
1040           <listitem>
1041             <para>Specifies incoming device to match. If the interface is loopback, the rule only matches packets originating from this host.</para>
1042           </listitem>
1043         </varlistentry>
1044         <varlistentry>
1045           <term><varname>OutgoingInterface=</varname></term>
1046           <listitem>
1047             <para>Specifies the outgoing device to match. The outgoing interface is only available for packets originating from local sockets that are bound to a device.</para>
1048           </listitem>
1049         </varlistentry>
1050         <varlistentry>
1051           <term><varname>SourcePort=</varname></term>
1052           <listitem>
1053             <para>Specifies the source IP port or IP port range match in forwarding information base (FIB) rules.
1054             A port range is specified by the lower and upper port separated by a dash. Defaults to unset.</para>
1055           </listitem>
1056         </varlistentry>
1057         <varlistentry>
1058           <term><varname>DestinationPort=</varname></term>
1059           <listitem>
1060             <para>Specifies the destination IP port or IP port range match in forwarding information base (FIB) rules.
1061             A port range is specified by the lower and upper port separated by a dash. Defaults to unset.</para>
1062           </listitem>
1063         </varlistentry>
1064         <varlistentry>
1065           <term><varname>IPProtocol=</varname></term>
1066           <listitem>
1067             <para>Specifies the IP protocol to match in forwarding information base (FIB) rules. Takes IP protocol name such as <literal>tcp</literal>,
1068             <literal>udp</literal> or <literal>sctp</literal>, or IP protocol number such as <literal>6</literal> for <literal>tcp</literal> or
1069             <literal>17</literal> for <literal>udp</literal>.
1070             Defaults to unset.</para>
1071           </listitem>
1072         </varlistentry>
1073         <varlistentry>
1074           <term><varname>InvertRule=</varname></term>
1075           <listitem>
1076             <para>A boolean. Specifies wheather the rule to be inverted. Defaults to false.</para>
1077           </listitem>
1078         </varlistentry>
1079       </variablelist>
1080   </refsect1>
1081
1082   <refsect1>
1083     <title>[Route] Section Options</title>
1084       <para>The <literal>[Route]</literal> section accepts the
1085       following keys. Specify several <literal>[Route]</literal>
1086       sections to configure several routes.</para>
1087
1088       <variablelist class='network-directives'>
1089         <varlistentry>
1090           <term><varname>Gateway=</varname></term>
1091           <listitem>
1092             <para>As in the <literal>[Network]</literal> section.</para>
1093           </listitem>
1094         </varlistentry>
1095          <varlistentry>
1096            <term><varname>GatewayOnLink=</varname></term>
1097            <listitem>
1098              <para>Takes a boolean. If set to true, the kernel does not have
1099              to check if the gateway is reachable directly by the current machine (i.e., the kernel does
1100              not need to check if the gateway is attached to the local network), so that we can insert the
1101              route in the kernel table without it being complained about. Defaults to <literal>no</literal>.
1102              </para>
1103            </listitem>
1104          </varlistentry>
1105         <varlistentry>
1106           <term><varname>Destination=</varname></term>
1107           <listitem>
1108             <para>The destination prefix of the route. Possibly
1109             followed by a slash and the prefix length. If omitted, a
1110             full-length host route is assumed.</para>
1111           </listitem>
1112         </varlistentry>
1113         <varlistentry>
1114           <term><varname>Source=</varname></term>
1115           <listitem>
1116             <para>The source prefix of the route. Possibly followed by
1117             a slash and the prefix length. If omitted, a full-length
1118             host route is assumed.</para>
1119           </listitem>
1120         </varlistentry>
1121         <varlistentry>
1122           <term><varname>Metric=</varname></term>
1123           <listitem>
1124             <para>The metric of the route (an unsigned integer).</para>
1125           </listitem>
1126         </varlistentry>
1127         <varlistentry>
1128           <term><varname>IPv6Preference=</varname></term>
1129           <listitem>
1130             <para>Specifies the route preference as defined in <ulink
1131             url="https://tools.ietf.org/html/rfc4191">RFC4191</ulink> for Router Discovery messages.
1132             Which can be one of <literal>low</literal> the route has a lowest priority,
1133             <literal>medium</literal> the route has a default priority or
1134             <literal>high</literal> the route has a highest priority.</para>
1135           </listitem>
1136         </varlistentry>
1137         <varlistentry>
1138           <term><varname>Scope=</varname></term>
1139           <listitem>
1140             <para>The scope of the route, which can be <literal>global</literal>,
1141             <literal>link</literal> or <literal>host</literal>. Defaults to
1142             <literal>global</literal>.</para>
1143           </listitem>
1144         </varlistentry>
1145         <varlistentry>
1146           <term><varname>PreferredSource=</varname></term>
1147           <listitem>
1148             <para>The preferred source address of the route. The address
1149             must be in the format described in
1150             <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.</para>
1151           </listitem>
1152         </varlistentry>
1153         <varlistentry>
1154           <term><varname>Table=<replaceable>num</replaceable></varname></term>
1155           <listitem>
1156           <para>The table identifier for the route (a number between 1 and 4294967295, or 0 to unset).
1157           The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
1158           </para>
1159           </listitem>
1160         </varlistentry>
1161         <varlistentry>
1162           <term><varname>Protocol=</varname></term>
1163           <listitem>
1164             <para>The protocol identifier for the route. Takes a number between 0 and 255 or the special values
1165             <literal>kernel</literal>, <literal>boot</literal> and <literal>static</literal>. Defaults to
1166             <literal>static</literal>.
1167             </para>
1168           </listitem>
1169         </varlistentry>
1170         <varlistentry>
1171           <term><varname>Type=</varname></term>
1172           <listitem>
1173             <para>Specifies the type for the route. If <literal>unicast</literal>, a regular route is defined, i.e. a
1174             route indicating the path to take to a destination network address. If <literal>blackhole</literal>, packets
1175             to the defined route are discarded silently. If <literal>unreachable</literal>, packets to the defined route
1176             are discarded and the ICMP message "Host Unreachable" is generated. If <literal>prohibit</literal>, packets
1177             to the defined route are discarded and the ICMP message "Communication Administratively Prohibited" is
1178             generated. If <literal>throw</literal>, route lookup in the current routing table will fail and the route
1179             selection process will return to Routing Policy Database (RPDB). Defaults to <literal>unicast</literal>.
1180             </para>
1181           </listitem>
1182         </varlistentry>
1183         <varlistentry>
1184           <term><varname>InitialCongestionWindow=</varname></term>
1185           <listitem>
1186             <para>The TCP initial congestion window is used during the start of a TCP connection. During the start of a TCP
1187             session, when a client requests a resource, the server's initial congestion window determines how many data bytes
1188             will be sent during the initial burst of data. Takes a size in bytes between 1 and 4294967295 (2^32 - 1). The usual
1189             suffixes K, M, G are supported and are understood to the base of 1024. When unset, the kernel's default will be used.
1190             </para>
1191           </listitem>
1192         </varlistentry>
1193         <varlistentry>
1194           <term><varname>InitialAdvertisedReceiveWindow=</varname></term>
1195           <listitem>
1196             <para>The TCP initial advertised receive window is the amount of receive data (in bytes) that can initally be buffered at one time
1197             on a connection. The sending host can send only that amount of data before waiting for an acknowledgment and window update
1198             from the receiving host. Takes a size in bytes between 1 and 4294967295 (2^32 - 1). The usual suffixes K, M, G are supported
1199             and are understood to the base of 1024. When unset, the kernel's default will be used.
1200             </para>
1201           </listitem>
1202         </varlistentry>
1203         <varlistentry>
1204           <term><varname>QuickAck=</varname></term>
1205           <listitem>
1206             <para>Takes a boolean. When true enables TCP quick ack mode for the route. When unset, the kernel's default will be used.
1207             </para>
1208           </listitem>
1209         </varlistentry>
1210         <varlistentry>
1211         <term><varname>MTUBytes=</varname></term>
1212         <listitem>
1213           <para>The maximum transmission unit in bytes to set for the
1214           route. The usual suffixes K, M, G, are supported and are
1215           understood to the base of 1024.</para>
1216           <para>Note that if IPv6 is enabled on the interface, and the MTU is chosen
1217           below 1280 (the minimum MTU for IPv6) it will automatically be increased to this value.</para>
1218         </listitem>
1219       </varlistentry>
1220       </variablelist>
1221   </refsect1>
1222
1223   <refsect1>
1224     <title>[DHCP] Section Options</title>
1225       <para>The <literal>[DHCP]</literal> section configures the
1226       DHCPv4 and DHCP6 client, if it is enabled with the
1227       <varname>DHCP=</varname> setting described above:</para>
1228
1229       <variablelist class='network-directives'>
1230         <varlistentry>
1231           <term><varname>UseDNS=</varname></term>
1232           <listitem>
1233             <para>When true (the default), the DNS servers received
1234             from the DHCP server will be used and take precedence over
1235             any statically configured ones.</para>
1236
1237             <para>This corresponds to the <option>nameserver</option>
1238             option in <citerefentry
1239             project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
1240           </listitem>
1241         </varlistentry>
1242         <varlistentry>
1243           <term><varname>UseNTP=</varname></term>
1244           <listitem>
1245             <para>When true (the default), the NTP servers received
1246             from the DHCP server will be used by systemd-timesyncd
1247             and take precedence over any statically configured ones.</para>
1248           </listitem>
1249         </varlistentry>
1250         <varlistentry>
1251           <term><varname>UseMTU=</varname></term>
1252           <listitem>
1253             <para>When true, the interface maximum transmission unit
1254             from the DHCP server will be used on the current link.
1255             If <varname>MTUBytes=</varname> is set, then this setting is ignored.
1256             Defaults to false.</para>
1257           </listitem>
1258         </varlistentry>
1259         <varlistentry>
1260           <term><varname>Anonymize=</varname></term>
1261           <listitem>
1262             <para>Takes a boolean. When true, the options sent to the DHCP server will
1263             follow the <ulink url="https://tools.ietf.org/html/rfc7844">RFC 7844</ulink>
1264             (Anonymity Profiles for DHCP Clients) to minimize disclosure of identifying information.
1265             Defaults to false.</para>
1266
1267             <para>This option should only be set to true when
1268             <varname>MACAddressPolicy=</varname> is set to <literal>random</literal>
1269             (see <citerefentry
1270             project='man-pages'><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>).</para>
1271
1272             <para>Note that this configuration will overwrite others.
1273             In concrete, the following variables will be ignored:
1274             <varname>SendHostname=</varname>, <varname>ClientIdentifier=</varname>,
1275             <varname>UseRoutes=</varname>, <varname>SendHostname=</varname>,
1276             <varname>UseMTU=</varname>, <varname>VendorClassIdentifier=</varname>,
1277             <varname>UseTimezone=</varname>.</para>
1278
1279             <para>With this option enabled DHCP requests will mimic those generated by Microsoft Windows, in
1280             order to reduce the ability to fingerprint and recognize installations. This means DHCP request
1281             sizes will grow and lease data will be more comprehensive than normally, though most of the
1282             requested data is not actually used.</para>
1283           </listitem>
1284         </varlistentry>
1285         <varlistentry>
1286           <term><varname>SendHostname=</varname></term>
1287           <listitem>
1288             <para>When true (the default), the machine's hostname will be sent to the DHCP server.
1289             Note that the machine's hostname must consist only of 7-bit ASCII lower-case characters and
1290             no spaces or dots, and be formatted as a valid DNS domain name. Otherwise, the hostname is not
1291             sent even if this is set to true.</para>
1292           </listitem>
1293         </varlistentry>
1294         <varlistentry>
1295           <term><varname>UseHostname=</varname></term>
1296           <listitem>
1297             <para>When true (the default), the hostname received from
1298             the DHCP server will be set as the transient hostname of the system.
1299             </para>
1300           </listitem>
1301         </varlistentry>
1302         <varlistentry>
1303           <term><varname>Hostname=</varname></term>
1304           <listitem>
1305             <para>Use this value for the hostname which is sent to the DHCP server, instead of machine's hostname.
1306             Note that the specified hostname must consist only of 7-bit ASCII lower-case characters and
1307             no spaces or dots, and be formatted as a valid DNS domain name.</para>
1308           </listitem>
1309         </varlistentry>
1310         <varlistentry>
1311           <term><varname>UseDomains=</varname></term>
1312           <listitem>
1313             <para>Takes a boolean, or the special value <literal>route</literal>. When true, the domain name
1314             received from the DHCP server will be used as DNS search domain over this link, similar to the effect of
1315             the <option>Domains=</option> setting. If set to <literal>route</literal>, the domain name received from
1316             the DHCP server will be used for routing DNS queries only, but not for searching, similar to the effect of
1317             the <option>Domains=</option> setting when the argument is prefixed with <literal>~</literal>. Defaults to
1318             false.</para>
1319
1320             <para>It is recommended to enable this option only on trusted networks, as setting this affects resolution
1321             of all host names, in particular of single-label names. It is generally safer to use the supplied domain
1322             only as routing domain, rather than as search domain, in order to not have it affect local resolution of
1323             single-label names.</para>
1324
1325             <para>When set to true, this setting corresponds to the <option>domain</option> option in <citerefentry
1326             project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
1327           </listitem>
1328         </varlistentry>
1329         <varlistentry>
1330           <term><varname>UseRoutes=</varname></term>
1331           <listitem>
1332             <para>When true (the default), the static routes will be requested from the DHCP server and added to the
1333               routing table with a metric of 1024, and a scope of "global", "link" or "host", depending on the route's
1334               destination and gateway. If the destination is on the local host, e.g., 127.x.x.x, or the same as the
1335               link's own address, the scope will be set to "host". Otherwise if the gateway is null (a direct route), a
1336               "link" scope will be used. For anything else, scope defaults to "global".</para>
1337           </listitem>
1338         </varlistentry>
1339
1340         <varlistentry>
1341           <term><varname>UseTimezone=</varname></term>
1342
1343           <listitem><para>When true, the timezone received from the
1344           DHCP server will be set as timezone of the local
1345           system. Defaults to <literal>no</literal>.</para></listitem>
1346         </varlistentry>
1347
1348         <varlistentry>
1349           <term><varname>CriticalConnection=</varname></term>
1350           <listitem>
1351             <para>When true, the connection will never be torn down
1352             even if the DHCP lease expires. This is contrary to the
1353             DHCP specification, but may be the best choice if, say,
1354             the root filesystem relies on this connection. Defaults to
1355             false.</para>
1356           </listitem>
1357         </varlistentry>
1358
1359         <varlistentry>
1360           <term><varname>ClientIdentifier=</varname></term>
1361           <listitem>
1362             <para>The DHCPv4 client identifier to use. Takes one of <literal>mac</literal>, <literal>duid</literal> or <literal>duid-only</literal>.
1363             If set to <literal>mac</literal>, the MAC address of the link is used.
1364             If set to <literal>duid</literal>, an RFC4361-compliant Client ID, which is the combination of IAID and DUID (see below), is used.
1365             If set to <literal>duid-only</literal>, only DUID is used, this may not be RFC compliant, but some setups may require to use this.
1366             Defaults to <literal>duid</literal>.</para>
1367           </listitem>
1368         </varlistentry>
1369
1370         <varlistentry>
1371           <term><varname>VendorClassIdentifier=</varname></term>
1372           <listitem>
1373             <para>The vendor class identifier used to identify vendor
1374             type and configuration.</para>
1375           </listitem>
1376         </varlistentry>
1377
1378         <varlistentry>
1379           <term><varname>UserClass=</varname></term>
1380           <listitem>
1381             <para>A DHCPv4 client can use UserClass option to identify the type or category of user or applications
1382             it represents. The information contained in this option is a string that represents the user class of which
1383             the client is a member. Each class sets an identifying string of information to be used by the DHCP
1384             service to classify clients. Takes a whitespace-separated list of strings.</para>
1385           </listitem>
1386         </varlistentry>
1387
1388         <varlistentry>
1389           <term><varname>DUIDType=</varname></term>
1390           <listitem>
1391             <para>Override the global <varname>DUIDType</varname> setting for this network. See
1392             <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1393             for a description of possible values.</para>
1394           </listitem>
1395         </varlistentry>
1396
1397         <varlistentry>
1398           <term><varname>DUIDRawData=</varname></term>
1399           <listitem>
1400             <para>Override the global <varname>DUIDRawData</varname> setting for this network. See
1401             <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1402             for a description of possible values.</para>
1403           </listitem>
1404         </varlistentry>
1405
1406         <varlistentry>
1407           <term><varname>IAID=</varname></term>
1408           <listitem>
1409             <para>The DHCP Identity Association Identifier (IAID) for the interface, a 32-bit unsigned integer.</para>
1410           </listitem>
1411         </varlistentry>
1412
1413         <varlistentry>
1414           <term><varname>RequestBroadcast=</varname></term>
1415           <listitem>
1416             <para>Request the server to use broadcast messages before
1417             the IP address has been configured. This is necessary for
1418             devices that cannot receive RAW packets, or that cannot
1419             receive packets at all before an IP address has been
1420             configured. On the other hand, this must not be enabled on
1421             networks where broadcasts are filtered out.</para>
1422           </listitem>
1423         </varlistentry>
1424
1425         <varlistentry>
1426           <term><varname>RouteMetric=</varname></term>
1427           <listitem>
1428             <para>Set the routing metric for routes specified by the
1429             DHCP server.</para>
1430           </listitem>
1431         </varlistentry>
1432
1433         <varlistentry>
1434           <term><varname>RouteTable=<replaceable>num</replaceable></varname></term>
1435           <listitem>
1436             <para>The table identifier for DHCP routes (a number between 1 and 4294967295, or 0 to unset).
1437             The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
1438             </para>
1439             <para>When used in combination with <varname>VRF=</varname> the
1440             VRF's routing table is used unless this parameter is specified.
1441             </para>
1442           </listitem>
1443         </varlistentry>
1444
1445         <varlistentry>
1446           <term><varname>ListenPort=</varname></term>
1447           <listitem>
1448             <para>Allow setting custom port for the DHCP client to listen on.</para>
1449           </listitem>
1450         </varlistentry>
1451
1452         <varlistentry>
1453           <term><varname>RapidCommit=</varname></term>
1454           <listitem>
1455             <para>Takes a boolean. The DHCPv6 client can obtain configuration parameters from a DHCPv6 server through
1456             a rapid two-message exchange (solicit and reply). When the rapid commit option is enabled by both
1457             the DHCPv6 client and the DHCPv6 server, the two-message exchange is used, rather than the default
1458             four-method exchange (solicit, advertise, request, and reply). The two-message exchange provides
1459             faster client configuration and is beneficial in environments in which networks are under a heavy load.
1460             See <ulink url="https://tools.ietf.org/html/rfc3315#section-17.2.1">RFC 3315</ulink> for details.
1461             Defaults to true.</para>
1462           </listitem>
1463         </varlistentry>
1464
1465         <varlistentry>
1466           <term><varname>ForceDHCPv6PDOtherInformation=</varname></term>
1467           <listitem>
1468             <para>Takes a boolean that enforces DHCPv6 stateful mode when the 'Other information' bit is set in
1469             Router Advertisement messages. By default setting only the 'O' bit in Router Advertisements
1470             makes DHCPv6 request network information in a stateless manner using a two-message Information
1471             Request and Information Reply message exchange.
1472             <ulink url="https://tools.ietf.org/html/rfc7084">RFC 7084</ulink>, requirement WPD-4, updates
1473             this behavior for a Customer Edge router so that stateful DHCPv6 Prefix Delegation is also
1474             requested when only the 'O' bit is set in Router Advertisements. This option enables such a CE
1475             behavior as it is impossible to automatically distinguish the intention of the 'O' bit otherwise.
1476             By default this option is set to 'false', enable it if no prefixes are delegated when the device
1477             should be acting as a CE router.</para>
1478           </listitem>
1479         </varlistentry>
1480
1481       </variablelist>
1482     </refsect1>
1483
1484   <refsect1>
1485     <title>[IPv6AcceptRA] Section Options</title>
1486       <para>The <literal>[IPv6AcceptRA]</literal> section configures the IPv6 Router Advertisement
1487       (RA) client, if it is enabled with the <varname>IPv6AcceptRA=</varname> setting described
1488       above:</para>
1489
1490       <variablelist class='network-directives'>
1491         <varlistentry>
1492           <term><varname>UseDNS=</varname></term>
1493           <listitem>
1494             <para>When true (the default), the DNS servers received in the Router Advertisement will be used and take
1495             precedence over any statically configured ones.</para>
1496
1497             <para>This corresponds to the <option>nameserver</option> option in <citerefentry
1498             project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
1499           </listitem>
1500         </varlistentry>
1501
1502         <varlistentry>
1503           <term><varname>UseDomains=</varname></term>
1504           <listitem>
1505             <para>Takes a boolean, or the special value <literal>route</literal>. When true, the domain name
1506             received via IPv6 Router Advertisement (RA) will be used as DNS search domain over this link, similar to
1507             the effect of the <option>Domains=</option> setting. If set to <literal>route</literal>, the domain name
1508             received via IPv6 RA will be used for routing DNS queries only, but not for searching, similar to the
1509             effect of the <option>Domains=</option> setting when the argument is prefixed with
1510             <literal>~</literal>. Defaults to false.</para>
1511
1512             <para>It is recommended to enable this option only on trusted networks, as setting this affects resolution
1513             of all host names, in particular of single-label names. It is generally safer to use the supplied domain
1514             only as routing domain, rather than as search domain, in order to not have it affect local resolution of
1515             single-label names.</para>
1516
1517             <para>When set to true, this setting corresponds to the <option>domain</option> option in <citerefentry
1518             project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
1519           </listitem>
1520         </varlistentry>
1521
1522         <varlistentry>
1523           <term><varname>RouteTable=<replaceable>num</replaceable></varname></term>
1524           <listitem>
1525             <para>The table identifier for the routes received in the Router Advertisement
1526             (a number between 1 and 4294967295, or 0 to unset).
1527             The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
1528             </para>
1529           </listitem>
1530         </varlistentry>
1531
1532         <varlistentry>
1533           <term><varname>UseAutonomousPrefix=</varname></term>
1534           <listitem>
1535             <para>When true (the default), the autonomous prefix received in the Router Advertisement will be used and take
1536             precedence over any statically configured ones.</para>
1537           </listitem>
1538         </varlistentry>
1539
1540         <varlistentry>
1541           <term><varname>UseOnLinkPrefix=</varname></term>
1542           <listitem>
1543             <para>When true (the default), the onlink prefix received in the Router Advertisement will be used and take
1544             precedence over any statically configured ones.</para>
1545           </listitem>
1546         </varlistentry>
1547
1548       </variablelist>
1549   </refsect1>
1550
1551   <refsect1>
1552     <title>[DHCPServer] Section Options</title>
1553     <para>The <literal>[DHCPServer]</literal> section contains
1554     settings for the DHCP server, if enabled via the
1555     <varname>DHCPServer=</varname> option described above:</para>
1556
1557     <variablelist class='network-directives'>
1558
1559       <varlistentry>
1560         <term><varname>PoolOffset=</varname></term>
1561         <term><varname>PoolSize=</varname></term>
1562
1563         <listitem><para>Configures the pool of addresses to hand out. The pool
1564         is a contiguous sequence of IP addresses in the subnet configured for
1565         the server address, which does not include the subnet nor the broadcast
1566         address. <varname>PoolOffset=</varname> takes the offset of the pool
1567         from the start of subnet, or zero to use the default value.
1568         <varname>PoolSize=</varname> takes the number of IP addresses in the
1569         pool or zero to use the default value. By default, the pool starts at
1570         the first address after the subnet address and takes up the rest of
1571         the subnet, excluding the broadcast address. If the pool includes
1572         the server address (the default), this is reserved and not handed
1573         out to clients.</para></listitem>
1574       </varlistentry>
1575
1576       <varlistentry>
1577         <term><varname>DefaultLeaseTimeSec=</varname></term>
1578         <term><varname>MaxLeaseTimeSec=</varname></term>
1579
1580         <listitem><para>Control the default and maximum DHCP lease
1581         time to pass to clients. These settings take time values in seconds or
1582         another common time unit, depending on the suffix. The default
1583         lease time is used for clients that did not ask for a specific
1584         lease time. If a client asks for a lease time longer than the
1585         maximum lease time, it is automatically shortened to the
1586         specified time. The default lease time defaults to 1h, the
1587         maximum lease time to 12h. Shorter lease times are beneficial
1588         if the configuration data in DHCP leases changes frequently
1589         and clients shall learn the new settings with shorter
1590         latencies. Longer lease times reduce the generated DHCP
1591         network traffic.</para></listitem>
1592       </varlistentry>
1593
1594       <varlistentry>
1595         <term><varname>EmitDNS=</varname></term>
1596         <term><varname>DNS=</varname></term>
1597
1598         <listitem><para>Takes a boolean. Configures whether the DHCP leases handed out
1599         to clients shall contain DNS server information. Defaults to <literal>yes</literal>.
1600         The DNS servers to pass to clients may be configured with the
1601         <varname>DNS=</varname> option, which takes a list of IPv4
1602         addresses. If the <varname>EmitDNS=</varname> option is
1603         enabled but no servers configured, the servers are
1604         automatically propagated from an "uplink" interface that has
1605         appropriate servers set. The "uplink" interface is determined
1606         by the default route of the system with the highest
1607         priority. Note that this information is acquired at the time
1608         the lease is handed out, and does not take uplink interfaces
1609         into account that acquire DNS or NTP server information at a
1610         later point. DNS server propagation does not take
1611         <filename>/etc/resolv.conf</filename> into account. Also, note
1612         that the leases are not refreshed if the uplink network
1613         configuration changes. To ensure clients regularly acquire the
1614         most current uplink DNS server information, it is thus
1615         advisable to shorten the DHCP lease time via
1616         <varname>MaxLeaseTimeSec=</varname> described
1617         above.</para></listitem>
1618       </varlistentry>
1619
1620       <varlistentry>
1621         <term><varname>EmitNTP=</varname></term>
1622         <term><varname>NTP=</varname></term>
1623
1624         <listitem><para>Similar to the <varname>EmitDNS=</varname> and
1625         <varname>DNS=</varname> settings described above, these
1626         settings configure whether and what NTP server information
1627         shall be emitted as part of the DHCP lease. The same syntax,
1628         propagation semantics and defaults apply as for
1629         <varname>EmitDNS=</varname> and
1630         <varname>DNS=</varname>.</para></listitem>
1631       </varlistentry>
1632
1633       <varlistentry>
1634         <term><varname>EmitRouter=</varname></term>
1635
1636         <listitem><para>Similar to the <varname>EmitDNS=</varname>
1637         setting described above, this setting configures whether the
1638         DHCP lease should contain the router option. The same syntax,
1639         propagation semantics and defaults apply as for
1640         <varname>EmitDNS=</varname>.</para></listitem>
1641       </varlistentry>
1642
1643       <varlistentry>
1644         <term><varname>EmitTimezone=</varname></term>
1645         <term><varname>Timezone=</varname></term>
1646
1647         <listitem><para>Takes a boolean. Configures whether the DHCP leases handed out
1648         to clients shall contain timezone information. Defaults to <literal>yes</literal>. The
1649         <varname>Timezone=</varname> setting takes a timezone string
1650         (such as <literal>Europe/Berlin</literal> or
1651         <literal>UTC</literal>) to pass to clients. If no explicit
1652         timezone is set, the system timezone of the local host is
1653         propagated, as determined by the
1654         <filename>/etc/localtime</filename> symlink.</para></listitem>
1655       </varlistentry>
1656
1657     </variablelist>
1658   </refsect1>
1659
1660   <refsect1>
1661     <title>[IPv6PrefixDelegation] Section Options</title>
1662     <para>The <literal>[IPv6PrefixDelegation]</literal> section contains
1663     settings for sending IPv6 Router Advertisements and whether to act as
1664     a router, if enabled via the <varname>IPv6PrefixDelegation=</varname>
1665     option described above. IPv6 network prefixes are defined with one or
1666     more <literal>[IPv6Prefix]</literal> sections.</para>
1667
1668     <variablelist class='network-directives'>
1669
1670       <varlistentry>
1671         <term><varname>Managed=</varname></term>
1672         <term><varname>OtherInformation=</varname></term>
1673
1674         <listitem><para>Takes a boolean. Controls whether a DHCPv6 server is used to acquire IPv6
1675         addresses on the network link when <varname>Managed=</varname>
1676         is set to <literal>true</literal> or if only additional network
1677         information can be obtained via DHCPv6 for the network link when
1678         <varname>OtherInformation=</varname> is set to
1679         <literal>true</literal>. Both settings default to
1680         <literal>false</literal>, which means that a DHCPv6 server is not being
1681         used.</para></listitem>
1682       </varlistentry>
1683
1684       <varlistentry>
1685         <term><varname>RouterLifetimeSec=</varname></term>
1686
1687         <listitem><para>Takes a timespan. Configures the IPv6 router lifetime in seconds. If set,
1688         this host also announces itself in Router Advertisements as an IPv6
1689         router for the network link. When unset, the host is not acting as a router.</para>
1690         </listitem>
1691       </varlistentry>
1692
1693       <varlistentry>
1694         <term><varname>RouterPreference=</varname></term>
1695
1696         <listitem><para>Configures IPv6 router preference if
1697         <varname>RouterLifetimeSec=</varname> is non-zero. Valid values are
1698         <literal>high</literal>, <literal>medium</literal> and
1699         <literal>low</literal>, with <literal>normal</literal> and
1700         <literal>default</literal> added as synonyms for
1701         <literal>medium</literal> just to make configuration easier. See
1702         <ulink url="https://tools.ietf.org/html/rfc4191">RFC 4191</ulink>
1703         for details. Defaults to <literal>medium</literal>.</para></listitem>
1704       </varlistentry>
1705
1706       <varlistentry>
1707         <term><varname>EmitDNS=</varname></term>
1708         <term><varname>DNS=</varname></term>
1709
1710         <listitem><para><varname>DNS=</varname> specifies a list of recursive
1711         DNS server IPv6 addresses that distributed via Router Advertisement
1712         messages when <varname>EmitDNS=</varname> is true. If <varname>DNS=
1713         </varname> is empty, DNS servers are read from the
1714         <literal>[Network]</literal> section. If the
1715         <literal>[Network]</literal> section does not contain any DNS servers
1716         either, DNS servers from the uplink with the highest priority default
1717         route are used. When <varname>EmitDNS=</varname> is false, no DNS server
1718         information is sent in Router Advertisement messages.
1719         <varname>EmitDNS=</varname> defaults to true.
1720         </para></listitem>
1721       </varlistentry>
1722
1723       <varlistentry>
1724         <term><varname>EmitDomains=</varname></term>
1725         <term><varname>Domains=</varname></term>
1726
1727         <listitem><para>A list of DNS search domains distributed via Router
1728         Advertisement messages when <varname>EmitDomains=</varname> is true. If
1729         <varname>Domains=</varname> is empty, DNS search domains are read from the
1730         <literal>[Network]</literal> section. If the <literal>[Network]</literal>
1731         section does not contain any DNS search domains either, DNS search
1732         domains from the uplink with the highest priority default route are
1733         used. When <varname>EmitDomains=</varname> is false, no DNS search domain
1734         information is sent in Router Advertisement messages.
1735         <varname>EmitDomains=</varname> defaults to true.
1736         </para></listitem>
1737       </varlistentry>
1738
1739       <varlistentry>
1740         <term><varname>DNSLifetimeSec=</varname></term>
1741
1742         <listitem><para>Lifetime in seconds for the DNS server addresses listed
1743         in <varname>DNS=</varname> and search domains listed in
1744         <varname>Domains=</varname>.</para></listitem>
1745       </varlistentry>
1746
1747     </variablelist>
1748     </refsect1>
1749
1750       <refsect1>
1751     <title>[IPv6Prefix] Section Options</title>
1752     <para>One or more <literal>[IPv6Prefix]</literal> sections contain the IPv6
1753     prefixes that are announced via Router Advertisements. See
1754     <ulink url="https://tools.ietf.org/html/rfc4861">RFC 4861</ulink>
1755     for further details.</para>
1756
1757     <variablelist class='network-directives'>
1758
1759       <varlistentry>
1760         <term><varname>AddressAutoconfiguration=</varname></term>
1761         <term><varname>OnLink=</varname></term>
1762
1763         <listitem><para>Takes a boolean to specify whether IPv6 addresses can be
1764         autoconfigured with this prefix and whether the prefix can be used for
1765         onlink determination. Both settings default to <literal>true</literal>
1766         in order to ease configuration.
1767         </para></listitem>
1768       </varlistentry>
1769
1770       <varlistentry>
1771         <term><varname>Prefix=</varname></term>
1772
1773         <listitem><para>The IPv6 prefix that is to be distributed to hosts.
1774         Similarly to configuring static IPv6 addresses, the setting is
1775         configured as an IPv6 prefix and its prefix length, separated by a
1776         <literal>/</literal> character. Use multiple
1777         <literal>[IPv6Prefix]</literal> sections to configure multiple IPv6
1778         prefixes since prefix lifetimes, address autoconfiguration and onlink
1779         status may differ from one prefix to another.</para></listitem>
1780       </varlistentry>
1781
1782       <varlistentry>
1783         <term><varname>PreferredLifetimeSec=</varname></term>
1784         <term><varname>ValidLifetimeSec=</varname></term>
1785
1786         <listitem><para>Preferred and valid lifetimes for the prefix measured in
1787         seconds. <varname>PreferredLifetimeSec=</varname> defaults to 604800
1788         seconds (one week) and <varname>ValidLifetimeSec=</varname> defaults
1789         to 2592000 seconds (30 days).</para></listitem>
1790       </varlistentry>
1791
1792     </variablelist>
1793     </refsect1>
1794
1795     <refsect1>
1796     <title>[Bridge] Section Options</title>
1797       <para>The <literal>[Bridge]</literal> section accepts the
1798       following keys.</para>
1799       <variablelist class='network-directives'>
1800         <varlistentry>
1801           <term><varname>UnicastFlood=</varname></term>
1802           <listitem>
1803             <para>Takes a boolean. Controls whether the bridge should flood
1804             traffic for which an FDB entry is missing and the destination
1805             is unknown through this port. When unset, the kernel's default will be used.
1806             </para>
1807           </listitem>
1808         </varlistentry>
1809         <varlistentry>
1810           <term><varname>MulticastFlood=</varname></term>
1811           <listitem>
1812             <para>Takes a boolean. Controls whether the bridge should flood
1813             traffic for which an MDB entry is missing and the destination
1814             is unknown through this port. When unset, the kernel's default will be used.
1815             </para>
1816           </listitem>
1817         </varlistentry>
1818         <varlistentry>
1819           <term><varname>MulticastToUnicast=</varname></term>
1820           <listitem>
1821             <para>Takes a boolean. Multicast to unicast works on top of the multicast snooping feature of
1822             the bridge. Which means unicast copies are only delivered to hosts which are interested in it.
1823             When unset, the kernel's default will be used.
1824             </para>
1825           </listitem>
1826         </varlistentry>
1827         <varlistentry>
1828           <term><varname>NeighborSuppression=</varname></term>
1829           <listitem>
1830             <para>Takes a boolean. Configures whether ARP and ND neighbor suppression is enabled for
1831             this port. When unset, the kernel's default will be used.
1832             </para>
1833           </listitem>
1834         </varlistentry>
1835         <varlistentry>
1836           <term><varname>Learning=</varname></term>
1837           <listitem>
1838             <para>Takes a boolean. Configures whether MAC address learning is enabled for
1839             this port. When unset, the kernel's default will be used.
1840             </para>
1841           </listitem>
1842         </varlistentry>
1843         <varlistentry>
1844           <term><varname>HairPin=</varname></term>
1845           <listitem>
1846             <para>Takes a boolean. Configures whether traffic may be sent back
1847             out of the port on which it was received. When this flag is false, and the bridge
1848             will not forward traffic back out of the receiving port.
1849             When unset, the kernel's default will be used.</para>
1850           </listitem>
1851         </varlistentry>
1852         <varlistentry>
1853           <term><varname>UseBPDU=</varname></term>
1854           <listitem>
1855             <para>Takes a boolean. Configures whether STP Bridge Protocol Data Units will be
1856             processed by the bridge port. When unset, the kernel's default will be used.</para>
1857           </listitem>
1858         </varlistentry>
1859         <varlistentry>
1860           <term><varname>FastLeave=</varname></term>
1861           <listitem>
1862             <para>Takes a boolean. This flag allows the bridge to immediately stop multicast
1863             traffic on a port that receives an IGMP Leave message. It is only used with
1864             IGMP snooping if enabled on the bridge. When unset, the kernel's default will be used.</para>
1865           </listitem>
1866         </varlistentry>
1867         <varlistentry>
1868           <term><varname>AllowPortToBeRoot=</varname></term>
1869           <listitem>
1870             <para>Takes a boolean. Configures whether a given port is allowed to
1871             become a root port. Only used when STP is enabled on the bridge.
1872             When unset, the kernel's default will be used.</para>
1873           </listitem>
1874         </varlistentry>
1875         <varlistentry>
1876           <term><varname>Cost=</varname></term>
1877           <listitem>
1878             <para>Sets the "cost" of sending packets of this interface.
1879             Each port in a bridge may have a different speed and the cost
1880             is used to decide which link to use. Faster interfaces
1881             should have lower costs. It is an integer value between 1 and
1882             65535.</para>
1883           </listitem>
1884         </varlistentry>
1885         <varlistentry>
1886           <term><varname>Priority=</varname></term>
1887           <listitem>
1888             <para>Sets the "priority" of sending packets on this interface.
1889             Each port in a bridge may have a different priority which is used
1890             to decide which link to use. Lower value means higher priority.
1891             It is an integer value between 0 to 63. Networkd does not set any
1892             default, meaning the kernel default value of 32 is used.</para>
1893           </listitem>
1894         </varlistentry>
1895       </variablelist>
1896   </refsect1>
1897   <refsect1>
1898     <title>[BridgeFDB] Section Options</title>
1899       <para>The <literal>[BridgeFDB]</literal> section manages the
1900       forwarding database table of a port and accepts the following
1901       keys. Specify several <literal>[BridgeFDB]</literal> sections to
1902       configure several static MAC table entries.</para>
1903
1904       <variablelist class='network-directives'>
1905         <varlistentry>
1906           <term><varname>MACAddress=</varname></term>
1907           <listitem>
1908             <para>As in the <literal>[Network]</literal> section. This
1909             key is mandatory.</para>
1910           </listitem>
1911         </varlistentry>
1912         <varlistentry>
1913           <term><varname>VLANId=</varname></term>
1914           <listitem>
1915             <para>The VLAN ID for the new static MAC table entry. If
1916             omitted, no VLAN ID information is appended to the new static MAC
1917             table entry.</para>
1918           </listitem>
1919         </varlistentry>
1920       </variablelist>
1921   </refsect1>
1922
1923   <refsect1>
1924     <title>[CAN] Section Options</title>
1925       <para>The <literal>[CAN]</literal> section manages the Controller Area Network (CAN bus) and accepts the
1926       following keys.</para>
1927       <variablelist class='network-directives'>
1928         <varlistentry>
1929           <term><varname>BitRate=</varname></term>
1930           <listitem>
1931             <para>The bitrate of CAN device in bits per second. The usual SI prefixes (K, M) with the base of 1000 can
1932             be used here.</para>
1933           </listitem>
1934         </varlistentry>
1935         <varlistentry>
1936           <term><varname>SamplePoint=</varname></term>
1937           <listitem>
1938             <para>Optional sample point in percent with one decimal (e.g. <literal>75%</literal>,
1939             <literal>87.5%</literal>) or permille (e.g. <literal>875‰</literal>).</para>
1940           </listitem>
1941         </varlistentry>
1942         <varlistentry>
1943           <term><varname>RestartSec=</varname></term>
1944           <listitem>
1945             <para>Automatic restart delay time. If set to a non-zero value, a restart of the CAN controller will be
1946             triggered automatically in case of a bus-off condition after the specified delay time. Subsecond delays can
1947             be specified using decimals (e.g. <literal>0.1s</literal>) or a <literal>ms</literal> or
1948             <literal>us</literal> postfix. Using <literal>infinity</literal> or <literal>0</literal> will turn the
1949             automatic restart off. By default automatic restart is disabled.</para>
1950           </listitem>
1951         </varlistentry>
1952         <varlistentry>
1953           <term><varname>TripleSampling=</varname></term>
1954           <listitem>
1955             <para>Takes a boolean. When <literal>yes</literal>, three samples (instead of one) are used to determine
1956             the value of a received bit by majority rule. When unset, the kernel's default will be used.</para>
1957           </listitem>
1958         </varlistentry>
1959       </variablelist>
1960   </refsect1>
1961
1962   <refsect1>
1963     <title>[BridgeVLAN] Section Options</title>
1964       <para>The <literal>[BridgeVLAN]</literal> section manages the VLAN ID configuration of a bridge port and accepts
1965       the following keys. Specify several <literal>[BridgeVLAN]</literal> sections to configure several VLAN entries.
1966       The <varname>VLANFiltering=</varname> option has to be enabled, see <literal>[Bridge]</literal> section in
1967       <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
1968
1969       <variablelist class='network-directives'>
1970         <varlistentry>
1971           <term><varname>VLAN=</varname></term>
1972           <listitem>
1973             <para>The VLAN ID allowed on the port. This can be either a single ID or a range M-N. VLAN IDs are valid
1974             from 1 to 4094.</para>
1975           </listitem>
1976         </varlistentry>
1977         <varlistentry>
1978           <term><varname>EgressUntagged=</varname></term>
1979           <listitem>
1980             <para>The VLAN ID specified here will be used to untag frames on egress. Configuring
1981             <varname>EgressUntagged=</varname> implicates the use of <varname>VLAN=</varname> above and will enable the
1982             VLAN ID for ingress as well. This can be either a single ID or a range M-N.</para>
1983           </listitem>
1984         </varlistentry>
1985         <varlistentry>
1986           <term><varname>PVID=</varname></term>
1987           <listitem>
1988             <para>The Port VLAN ID specified here is assigned to all untagged frames at ingress.
1989             <varname>PVID=</varname> can be used only once. Configuring <varname>PVID=</varname> implicates the use of
1990             <varname>VLAN=</varname> above and will enable the VLAN ID for ingress as well.</para>
1991           </listitem>
1992         </varlistentry>
1993       </variablelist>
1994   </refsect1>
1995
1996   <refsect1>
1997     <title>Examples</title>
1998     <example>
1999       <title>Static network configuration</title>
2000
2001       <programlisting># /etc/systemd/network/50-static.network
2002 [Match]
2003 Name=enp2s0
2004
2005 [Network]
2006 Address=192.168.0.15/24
2007 Gateway=192.168.0.1</programlisting>
2008
2009       <para>This brings interface <literal>enp2s0</literal> up with a static address. The
2010       specified gateway will be used for a default route.</para>
2011     </example>
2012
2013     <example>
2014       <title>DHCP on ethernet links</title>
2015
2016       <programlisting># /etc/systemd/network/80-dhcp.network
2017 [Match]
2018 Name=en*
2019
2020 [Network]
2021 DHCP=yes</programlisting>
2022
2023       <para>This will enable DHCPv4 and DHCPv6 on all interfaces with names starting with
2024       <literal>en</literal> (i.e. ethernet interfaces).</para>
2025     </example>
2026
2027     <example>
2028       <title>A bridge with two enslaved links</title>
2029
2030       <programlisting># /etc/systemd/network/25-bridge-static.network
2031 [Match]
2032 Name=bridge0
2033
2034 [Network]
2035 Address=192.168.0.15/24
2036 Gateway=192.168.0.1
2037 DNS=192.168.0.1</programlisting>
2038
2039       <programlisting># /etc/systemd/network/25-bridge-slave-interface-1.network
2040 [Match]
2041 Name=enp2s0
2042
2043 [Network]
2044 Bridge=bridge0</programlisting>
2045
2046       <programlisting># /etc/systemd/network/25-bridge-slave-interface-2.network
2047 [Match]
2048 Name=wlp3s0
2049
2050 [Network]
2051 Bridge=bridge0</programlisting>
2052
2053       <para>This creates a bridge and attaches devices <literal>enp2s0</literal> and
2054       <literal>wlp3s0</literal> to it. The bridge will have the specified static address
2055       and network assigned, and a default route via the specified gateway will be
2056       added. The specified DNS server will be added to the global list of DNS resolvers.
2057       </para>
2058     </example>
2059
2060     <example>
2061       <title></title>
2062
2063       <programlisting>
2064 # /etc/systemd/network/20-bridge-slave-interface-vlan.network
2065 [Match]
2066 Name=enp2s0
2067
2068 [Network]
2069 Bridge=bridge0
2070
2071 [BridgeVLAN]
2072 VLAN=1-32
2073 PVID=42
2074 EgressUntagged=42
2075
2076 [BridgeVLAN]
2077 VLAN=100-200
2078
2079 [BridgeVLAN]
2080 EgressUntagged=300-400</programlisting>
2081
2082     <para>This overrides the configuration specified in the previous example for the
2083     interface <literal>enp2s0</literal>, and enables VLAN on that bridge port. VLAN IDs
2084     1-32, 42, 100-400 will be allowed. Packets tagged with VLAN IDs 42, 300-400 will be
2085     untagged when they leave on this interface. Untagged packets which arrive on this
2086     interface will be assigned VLAN ID 42.</para>
2087     </example>
2088
2089     <example>
2090       <title>Various tunnels</title>
2091
2092       <programlisting>/etc/systemd/network/25-tunnels.network
2093 [Match]
2094 Name=ens1
2095
2096 [Network]
2097 Tunnel=ipip-tun
2098 Tunnel=sit-tun
2099 Tunnel=gre-tun
2100 Tunnel=vti-tun
2101       </programlisting>
2102
2103       <programlisting>/etc/systemd/network/25-tunnel-ipip.netdev
2104 [NetDev]
2105 Name=ipip-tun
2106 Kind=ipip
2107       </programlisting>
2108
2109       <programlisting>/etc/systemd/network/25-tunnel-sit.netdev
2110 [NetDev]
2111 Name=sit-tun
2112 Kind=sit
2113       </programlisting>
2114
2115       <programlisting>/etc/systemd/network/25-tunnel-gre.netdev
2116 [NetDev]
2117 Name=gre-tun
2118 Kind=gre
2119       </programlisting>
2120
2121       <programlisting>/etc/systemd/network/25-tunnel-vti.netdev
2122 [NetDev]
2123 Name=vti-tun
2124 Kind=vti
2125       </programlisting>
2126
2127       <para>This will bring interface <literal>ens1</literal> up and create an IPIP tunnel,
2128       a SIT tunnel, a GRE tunnel, and a VTI tunnel using it.</para>
2129     </example>
2130
2131     <example>
2132       <title>A bond device</title>
2133
2134       <programlisting># /etc/systemd/network/30-bond1.network
2135 [Match]
2136 Name=bond1
2137
2138 [Network]
2139 DHCP=ipv6
2140 </programlisting>
2141
2142       <programlisting># /etc/systemd/network/30-bond1.netdev
2143 [NetDev]
2144 Name=bond1
2145 Kind=bond
2146 </programlisting>
2147
2148       <programlisting># /etc/systemd/network/30-bond1-dev1.network
2149 [Match]
2150 MACAddress=52:54:00:e9:64:41
2151
2152 [Network]
2153 Bond=bond1
2154 </programlisting>
2155
2156       <programlisting># /etc/systemd/network/30-bond1-dev2.network
2157 [Match]
2158 MACAddress=52:54:00:e9:64:42
2159
2160 [Network]
2161 Bond=bond1
2162 </programlisting>
2163
2164     <para>This will create a bond device <literal>bond1</literal> and enslave the two
2165     devices with MAC addresses 52:54:00:e9:64:41 and 52:54:00:e9:64:42 to it. IPv6 DHCP
2166     will be used to acquire an address.</para>
2167     </example>
2168
2169     <example>
2170       <title>Virtual Routing and Forwarding (VRF)</title>
2171       <para>Add the <literal>bond1</literal> interface to the VRF master interface
2172       <literal>vrf1</literal>. This will redirect routes generated on this interface to be
2173       within the routing table defined during VRF creation. For kernels before 4.8 traffic
2174       won't be redirected towards the VRFs routing table unless specific ip-rules are added.
2175       </para>
2176       <programlisting># /etc/systemd/network/25-vrf.network
2177 [Match]
2178 Name=bond1
2179
2180 [Network]
2181 VRF=vrf1
2182 </programlisting>
2183     </example>
2184
2185     <example>
2186       <title>MacVTap</title>
2187       <para>This brings up a network interface <literal>macvtap-test</literal>
2188       and attaches it to <literal>enp0s25</literal>.</para>
2189       <programlisting># /usr/lib/systemd/network/25-macvtap.network
2190 [Match]
2191 Name=enp0s25
2192
2193 [Network]
2194 MACVTAP=macvtap-test
2195 </programlisting>
2196     </example>
2197   </refsect1>
2198
2199   <refsect1>
2200     <title>See Also</title>
2201     <para>
2202       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
2203       <citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
2204       <citerefentry><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
2205       <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
2206       <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
2207     </para>
2208   </refsect1>
2209
2210 </refentry>