]> git.ipfire.org Git - thirdparty/systemd.git/blob - man/systemd.network.xml
travis: add more ASan options
[thirdparty/systemd.git] / man / systemd.network.xml
1 <?xml version='1.0'?>
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
4 <!-- SPDX-License-Identifier: LGPL-2.1+ -->
5
6 <refentry id="systemd.network" conditional='ENABLE_NETWORKD'>
7
8 <refentryinfo>
9 <title>systemd.network</title>
10 <productname>systemd</productname>
11 </refentryinfo>
12
13 <refmeta>
14 <refentrytitle>systemd.network</refentrytitle>
15 <manvolnum>5</manvolnum>
16 </refmeta>
17
18 <refnamediv>
19 <refname>systemd.network</refname>
20 <refpurpose>Network configuration</refpurpose>
21 </refnamediv>
22
23 <refsynopsisdiv>
24 <para><filename><replaceable>network</replaceable>.network</filename></para>
25 </refsynopsisdiv>
26
27 <refsect1>
28 <title>Description</title>
29
30 <para>Network setup is performed by
31 <citerefentry><refentrytitle>systemd-networkd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
32 </para>
33
34 <para>The main network file must have the extension <filename>.network</filename>; other
35 extensions are ignored. Networks are applied to links whenever the links appear.</para>
36
37 <para>The <filename>.network</filename> files are read from the files located in the system network
38 directories <filename>/usr/lib/systemd/network</filename> and
39 <filename>/usr/local/lib/systemd/network</filename>, the volatile runtime network directory
40 <filename>/run/systemd/network</filename> and the local administration network directory
41 <filename>/etc/systemd/network</filename>. All configuration files are collectively sorted and processed
42 in lexical order, regardless of the directories in which they live. However, files with identical
43 filenames replace each other. Files in <filename>/etc</filename> have the highest priority, files in
44 <filename>/run</filename> take precedence over files with the same name under
45 <filename>/usr</filename>. This can be used to override a system-supplied configuration file with a local
46 file if needed. As a special case, an empty file (file size 0) or symlink with the same name pointing to
47 <filename>/dev/null</filename> disables the configuration file entirely (it is "masked").</para>
48
49 <para>Along with the network file <filename>foo.network</filename>, a "drop-in" directory
50 <filename>foo.network.d/</filename> may exist. All files with the suffix
51 <literal>.conf</literal> from this directory will be parsed after the file itself is
52 parsed. This is useful to alter or add configuration settings, without having to modify the main
53 configuration file. Each drop-in file must have appropriate section headers.</para>
54
55 <para>In addition to <filename>/etc/systemd/network</filename>, drop-in <literal>.d</literal>
56 directories can be placed in <filename>/usr/lib/systemd/network</filename> or
57 <filename>/run/systemd/network</filename> directories. Drop-in files in
58 <filename>/etc</filename> take precedence over those in <filename>/run</filename> which in turn
59 take precedence over those in <filename>/usr/lib</filename>. Drop-in files under any of these
60 directories take precedence over the main netdev file wherever located.</para>
61
62 <para>Note that an interface without any static IPv6 addresses configured, and neither DHCPv6
63 nor IPv6LL enabled, shall be considered to have no IPv6 support. IPv6 will be automatically
64 disabled for that interface by writing "1" to
65 <filename>/proc/sys/net/ipv6/conf/<replaceable>ifname</replaceable>/disable_ipv6</filename>.
66 </para>
67 </refsect1>
68
69 <refsect1>
70 <title>[Match] Section Options</title>
71
72 <para>The network file contains a <literal>[Match]</literal>
73 section, which determines if a given network file may be applied
74 to a given device; and a <literal>[Network]</literal> section
75 specifying how the device should be configured. The first (in
76 lexical order) of the network files that matches a given device
77 is applied, all later files are ignored, even if they match as
78 well.</para>
79
80 <para>A network file is said to match a network interface if all matches specified by the
81 <literal>[Match]</literal> section are satisfied. When a network file does not contain valid
82 settings in <literal>[Match]</literal> section, then the file will match all interfaces and
83 <command>systemd-networkd</command> warns about that. Hint: to avoid the warning and to make it
84 clear that all interfaces shall be matched, add the following:
85 <programlisting>Name=*</programlisting>
86 The following keys are accepted:</para>
87
88 <variablelist class='network-directives'>
89 <varlistentry>
90 <term><varname>MACAddress=</varname></term>
91 <listitem>
92 <para>A whitespace-separated list of hardware addresses. Use full colon-, hyphen- or dot-delimited hexadecimal. See the example below.
93 This option may appear more than one, in which case the lists are merged. If the empty string is assigned to this option, the list
94 of hardware addresses defined prior to this is reset.</para>
95
96 <para>Example:
97 <programlisting>MACAddress=01:23:45:67:89:ab 00-11-22-33-44-55 AABB.CCDD.EEFF</programlisting></para>
98 </listitem>
99 </varlistentry>
100 <varlistentry>
101 <term><varname>Path=</varname></term>
102 <listitem>
103 <para>A whitespace-separated list of shell-style globs
104 matching the persistent path, as exposed by the udev
105 property <literal>ID_PATH</literal>. If the list is
106 prefixed with a "!", the test is inverted; i.e. it is
107 true when <literal>ID_PATH</literal> does not match any
108 item in the list.</para>
109 </listitem>
110 </varlistentry>
111 <varlistentry>
112 <term><varname>Driver=</varname></term>
113 <listitem>
114 <para>A whitespace-separated list of shell-style globs
115 matching the driver currently bound to the device, as
116 exposed by the udev property <literal>DRIVER</literal>
117 of its parent device, or if that is not set the driver
118 as exposed by <literal>ethtool -i</literal> of the
119 device itself. If the list is prefixed with a "!", the
120 test is inverted.</para>
121 </listitem>
122 </varlistentry>
123 <varlistentry>
124 <term><varname>Type=</varname></term>
125 <listitem>
126 <para>A whitespace-separated list of shell-style globs
127 matching the device type, as exposed by the udev property
128 <literal>DEVTYPE</literal>. If the list is prefixed with
129 a "!", the test is inverted.</para>
130 </listitem>
131 </varlistentry>
132 <varlistentry>
133 <term><varname>Name=</varname></term>
134 <listitem>
135 <para>A whitespace-separated list of shell-style globs
136 matching the device name, as exposed by the udev property
137 <literal>INTERFACE</literal>. If the list is prefixed
138 with a "!", the test is inverted.</para>
139 </listitem>
140 </varlistentry>
141 <varlistentry>
142 <term><varname>Host=</varname></term>
143 <listitem>
144 <para>Matches against the hostname or machine ID of the host. See
145 <literal>ConditionHost=</literal> in
146 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
147 for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
148 If an empty string is assigned, then previously assigned value is cleared.
149 </para>
150 </listitem>
151 </varlistentry>
152 <varlistentry>
153 <term><varname>Virtualization=</varname></term>
154 <listitem>
155 <para>Checks whether the system is executed in a virtualized environment and optionally test
156 whether it is a specific implementation. See <literal>ConditionVirtualization=</literal> in
157 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
158 for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
159 If an empty string is assigned, then previously assigned value is cleared.
160 </para>
161 </listitem>
162 </varlistentry>
163 <varlistentry>
164 <term><varname>KernelCommandLine=</varname></term>
165 <listitem>
166 <para>Checks whether a specific kernel command line option is set. See
167 <literal>ConditionKernelCommandLine=</literal> in
168 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
169 for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
170 If an empty string is assigned, then previously assigned value is cleared.
171 </para>
172 </listitem>
173 </varlistentry>
174 <varlistentry>
175 <term><varname>KernelVersion=</varname></term>
176 <listitem>
177 <para>Checks whether the kernel version (as reported by <command>uname -r</command>) matches a
178 certain expression. See <literal>ConditionKernelVersion=</literal> in
179 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
180 for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
181 If an empty string is assigned, then previously assigned value is cleared.
182 </para>
183 </listitem>
184 </varlistentry>
185 <varlistentry>
186 <term><varname>Architecture=</varname></term>
187 <listitem>
188 <para>Checks whether the system is running on a specific architecture. See
189 <literal>ConditionArchitecture=</literal> in
190 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
191 for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
192 If an empty string is assigned, then previously assigned value is cleared.
193 </para>
194 </listitem>
195 </varlistentry>
196 </variablelist>
197
198 </refsect1>
199
200 <refsect1>
201 <title>[Link] Section Options</title>
202
203 <para> The <literal>[Link]</literal> section accepts the following keys:</para>
204
205 <variablelist class='network-directives'>
206 <varlistentry>
207 <term><varname>MACAddress=</varname></term>
208 <listitem>
209 <para>The hardware address to set for the device.</para>
210 </listitem>
211 </varlistentry>
212 <varlistentry>
213 <term><varname>MTUBytes=</varname></term>
214 <listitem>
215 <para>The maximum transmission unit in bytes to set for the
216 device. The usual suffixes K, M, G, are supported and are
217 understood to the base of 1024.</para>
218 <para>Note that if IPv6 is enabled on the interface, and the MTU is chosen
219 below 1280 (the minimum MTU for IPv6) it will automatically be increased to this value.</para>
220 </listitem>
221 </varlistentry>
222 <varlistentry>
223 <term><varname>ARP=</varname></term>
224 <listitem>
225 <para>Takes a boolean. If set to true, the ARP (low-level Address Resolution Protocol)
226 for this interface is enabled. When unset, the kernel's default will be used.</para>
227 <para> For example, disabling ARP is useful when creating multiple MACVLAN or VLAN virtual
228 interfaces atop a single lower-level physical interface, which will then only serve as a
229 link/"bridge" device aggregating traffic to the same physical link and not participate in
230 the network otherwise.</para>
231 </listitem>
232 </varlistentry>
233 <varlistentry>
234 <term><varname>Multicast=</varname></term>
235 <listitem>
236 <para>Takes a boolean. If set to true, the multicast flag on the device is enabled.</para>
237 </listitem>
238 </varlistentry>
239 <varlistentry>
240 <term><varname>AllMulticast=</varname></term>
241 <listitem>
242 <para>Takes a boolean. If set to true, the driver retrieves all multicast packets from the network.
243 This happens when multicast routing is enabled.</para>
244 </listitem>
245 </varlistentry>
246 <varlistentry>
247 <term><varname>Unmanaged=</varname></term>
248 <listitem>
249 <para>Takes a boolean. When <literal>yes</literal>, no attempts are
250 made to bring up or configure matching links, equivalent to
251 when there are no matching network files. Defaults to
252 <literal>no</literal>.</para>
253 <para>This is useful for preventing later matching network
254 files from interfering with certain interfaces that are fully
255 controlled by other applications.</para>
256 </listitem>
257 </varlistentry>
258 <varlistentry>
259 <term><varname>RequiredForOnline=</varname></term>
260 <listitem>
261 <para>Takes a boolean or operational state. Please see
262 <citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
263 for possible operational states. When <literal>yes</literal>, the network is deemed required when
264 determining whether the system is online when running
265 <command>systemd-networkd-wait-online</command>. When <literal>no</literal>, the network is ignored
266 when checking for online state. When an operational state is set, <literal>yes</literal> is implied,
267 and this controls the operational state required for the network interface to be considered online.
268 Defaults to <literal>yes</literal>.</para>
269
270 <para>The network will be brought up normally in all cases, but in
271 the event that there is no address being assigned by DHCP or the
272 cable is not plugged in, the link will simply remain offline and be
273 skipped automatically by <command>systemd-networkd-wait-online</command>
274 if <literal>RequiredForOnline=no</literal>.</para>
275 </listitem>
276 </varlistentry>
277 </variablelist>
278 </refsect1>
279
280 <refsect1>
281 <title>[Network] Section Options</title>
282
283 <para>The <literal>[Network]</literal> section accepts the following keys:</para>
284
285 <variablelist class='network-directives'>
286 <varlistentry>
287 <term><varname>Description=</varname></term>
288 <listitem>
289 <para>A description of the device. This is only used for
290 presentation purposes.</para>
291 </listitem>
292 </varlistentry>
293 <varlistentry>
294 <term><varname>DHCP=</varname></term>
295 <listitem>
296 <para>Enables DHCPv4 and/or DHCPv6 client support. Accepts
297 <literal>yes</literal>, <literal>no</literal>,
298 <literal>ipv4</literal>, or <literal>ipv6</literal>. Defaults
299 to <literal>no</literal>.</para>
300
301 <para>Note that DHCPv6 will by default be triggered by Router
302 Advertisement, if that is enabled, regardless of this parameter.
303 By enabling DHCPv6 support explicitly, the DHCPv6 client will
304 be started regardless of the presence of routers on the link,
305 or what flags the routers pass. See
306 <literal>IPv6AcceptRA=</literal>.</para>
307
308 <para>Furthermore, note that by default the domain name
309 specified through DHCP is not used for name resolution.
310 See option <option>UseDomains=</option> below.</para>
311
312 <para>See the <literal>[DHCP]</literal> section below for further configuration options for the DHCP client
313 support.</para>
314 </listitem>
315 </varlistentry>
316 <varlistentry>
317 <term><varname>DHCPServer=</varname></term>
318 <listitem>
319 <para>Takes a boolean. If set to <literal>yes</literal>, DHCPv4 server will be started. Defaults
320 to <literal>no</literal>. Further settings for the DHCP
321 server may be set in the <literal>[DHCPServer]</literal>
322 section described below.</para>
323 </listitem>
324 </varlistentry>
325 <varlistentry>
326 <term><varname>LinkLocalAddressing=</varname></term>
327 <listitem>
328 <para>Enables link-local address autoconfiguration. Accepts <literal>yes</literal>,
329 <literal>no</literal>, <literal>ipv4</literal>, <literal>ipv6</literal>,
330 <literal>fallback</literal>, or <literal>ipv4-fallback</literal>. If
331 <literal>fallback</literal> or <literal>ipv4-fallback</literal> is specified, then an IPv4
332 link-local address is configured only when DHCPv4 fails. If <literal>fallback</literal>,
333 an IPv6 link-local address is always configured, and if <literal>ipv4-fallback</literal>,
334 the address is not configured. Note that, the fallback mechanism works only when DHCPv4
335 client is enabled, that is, it requires <literal>DHCP=yes</literal> or
336 <literal>DHCP=ipv4</literal>. If <varname>Bridge=</varname> is set, defaults to
337 <literal>no</literal>, and if not, defaults to <literal>ipv6</literal>.
338 </para>
339 </listitem>
340 </varlistentry>
341 <varlistentry>
342 <term><varname>IPv4LLRoute=</varname></term>
343 <listitem>
344 <para>Takes a boolean. If set to true, sets up the route needed for
345 non-IPv4LL hosts to communicate with IPv4LL-only hosts. Defaults
346 to false.
347 </para>
348 </listitem>
349 </varlistentry>
350 <varlistentry>
351 <term><varname>DefaultRouteOnDevice=</varname></term>
352 <listitem>
353 <para>Takes a boolean. If set to true, sets up the default route bound to the interface.
354 Defaults to false. This is useful when creating routes on point-to-point interfaces.
355 This is equivalent to e.g. the following.
356 <programlisting>ip route add default dev veth99</programlisting></para>
357 </listitem>
358 </varlistentry>
359 <varlistentry>
360 <term><varname>IPv6Token=</varname></term>
361 <listitem>
362 <para>An IPv6 address with the top 64 bits unset. When set, indicates the
363 64-bit interface part of SLAAC IPv6 addresses for this link. Note that
364 the token is only ever used for SLAAC, and not for DHCPv6 addresses, even
365 in the case DHCP is requested by router advertisement. By default, the
366 token is autogenerated.</para>
367 </listitem>
368 </varlistentry>
369 <varlistentry>
370 <term><varname>LLMNR=</varname></term>
371 <listitem>
372 <para>Takes a boolean or <literal>resolve</literal>. When true,
373 enables <ulink
374 url="https://tools.ietf.org/html/rfc4795">Link-Local
375 Multicast Name Resolution</ulink> on the link. When set to
376 <literal>resolve</literal>, only resolution is enabled,
377 but not host registration and announcement. Defaults to
378 true. This setting is read by
379 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
380 </listitem>
381 </varlistentry>
382 <varlistentry>
383 <term><varname>MulticastDNS=</varname></term>
384 <listitem>
385 <para>Takes a boolean or <literal>resolve</literal>. When true,
386 enables <ulink
387 url="https://tools.ietf.org/html/rfc6762">Multicast
388 DNS</ulink> support on the link. When set to
389 <literal>resolve</literal>, only resolution is enabled,
390 but not host or service registration and
391 announcement. Defaults to false. This setting is read by
392 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
393 </listitem>
394 </varlistentry>
395 <varlistentry>
396 <term><varname>DNSOverTLS=</varname></term>
397 <listitem>
398 <para>Takes false or
399 <literal>opportunistic</literal>. When set to <literal>opportunistic</literal>, enables
400 <ulink
401 url="https://tools.ietf.org/html/rfc7858">DNS-over-TLS</ulink>
402 support on the link. This option defines a
403 per-interface setting for
404 <citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>'s
405 global <varname>DNSOverTLS=</varname> option. Defaults to
406 false. This setting is read by
407 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
408 </listitem>
409 </varlistentry>
410 <varlistentry>
411 <term><varname>DNSSEC=</varname></term>
412 <listitem>
413 <para>Takes a boolean. or
414 <literal>allow-downgrade</literal>. When true, enables
415 <ulink
416 url="https://tools.ietf.org/html/rfc4033">DNSSEC</ulink>
417 DNS validation support on the link. When set to
418 <literal>allow-downgrade</literal>, compatibility with
419 non-DNSSEC capable networks is increased, by automatically
420 turning off DNSSEC in this case. This option defines a
421 per-interface setting for
422 <citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>'s
423 global <varname>DNSSEC=</varname> option. Defaults to
424 false. This setting is read by
425 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
426 </listitem>
427 </varlistentry>
428 <varlistentry>
429 <term><varname>DNSSECNegativeTrustAnchors=</varname></term>
430 <listitem><para>A space-separated list of DNSSEC negative
431 trust anchor domains. If specified and DNSSEC is enabled,
432 look-ups done via the interface's DNS server will be subject
433 to the list of negative trust anchors, and not require
434 authentication for the specified domains, or anything below
435 it. Use this to disable DNSSEC authentication for specific
436 private domains, that cannot be proven valid using the
437 Internet DNS hierarchy. Defaults to the empty list. This
438 setting is read by
439 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
440 </listitem>
441 </varlistentry>
442 <varlistentry>
443 <term><varname>LLDP=</varname></term>
444 <listitem>
445 <para>Controls support for Ethernet LLDP packet reception. LLDP is a link-layer protocol commonly
446 implemented on professional routers and bridges which announces which physical port a system is connected
447 to, as well as other related data. Accepts a boolean or the special value
448 <literal>routers-only</literal>. When true, incoming LLDP packets are accepted and a database of all LLDP
449 neighbors maintained. If <literal>routers-only</literal> is set only LLDP data of various types of routers
450 is collected and LLDP data about other types of devices ignored (such as stations, telephones and
451 others). If false, LLDP reception is disabled. Defaults to <literal>routers-only</literal>. Use
452 <citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> to query the
453 collected neighbor data. LLDP is only available on Ethernet links. See <varname>EmitLLDP=</varname> below
454 for enabling LLDP packet emission from the local system.
455 </para>
456 </listitem>
457 </varlistentry>
458 <varlistentry>
459 <term><varname>EmitLLDP=</varname></term>
460 <listitem>
461 <para>Controls support for Ethernet LLDP packet emission. Accepts a boolean parameter or the special values
462 <literal>nearest-bridge</literal>, <literal>non-tpmr-bridge</literal> and
463 <literal>customer-bridge</literal>. Defaults to false, which turns off LLDP packet emission. If not false,
464 a short LLDP packet with information about the local system is sent out in regular intervals on the
465 link. The LLDP packet will contain information about the local host name, the local machine ID (as stored
466 in <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>) and the
467 local interface name, as well as the pretty hostname of the system (as set in
468 <citerefentry><refentrytitle>machine-info</refentrytitle><manvolnum>5</manvolnum></citerefentry>). LLDP
469 emission is only available on Ethernet links. Note that this setting passes data suitable for
470 identification of host to the network and should thus not be enabled on untrusted networks, where such
471 identification data should not be made available. Use this option to permit other systems to identify on
472 which interfaces they are connected to this system. The three special values control propagation of the
473 LLDP packets. The <literal>nearest-bridge</literal> setting permits propagation only to the nearest
474 connected bridge, <literal>non-tpmr-bridge</literal> permits propagation across Two-Port MAC Relays, but
475 not any other bridges, and <literal>customer-bridge</literal> permits propagation until a customer bridge
476 is reached. For details about these concepts, see <ulink
477 url="https://standards.ieee.org/findstds/standard/802.1AB-2016.html">IEEE 802.1AB-2016</ulink>. Note that
478 configuring this setting to true is equivalent to <literal>nearest-bridge</literal>, the recommended and
479 most restricted level of propagation. See <varname>LLDP=</varname> above for an option to enable LLDP
480 reception.</para>
481 </listitem>
482 </varlistentry>
483 <varlistentry>
484 <term><varname>BindCarrier=</varname></term>
485 <listitem>
486 <para>A link name or a list of link names. When set, controls the behavior of the current
487 link. When all links in the list are in an operational down state, the current link is brought
488 down. When at least one link has carrier, the current interface is brought up.
489 </para>
490 </listitem>
491 </varlistentry>
492 <varlistentry>
493 <term><varname>Address=</varname></term>
494 <listitem>
495 <para>A static IPv4 or IPv6 address and its prefix length,
496 separated by a <literal>/</literal> character. Specify
497 this key more than once to configure several addresses.
498 The format of the address must be as described in
499 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
500 This is a short-hand for an [Address] section only
501 containing an Address key (see below). This option may be
502 specified more than once.
503 </para>
504
505 <para>If the specified address is <literal>0.0.0.0</literal> (for IPv4) or <literal>::</literal>
506 (for IPv6), a new address range of the requested size is automatically allocated from a
507 system-wide pool of unused ranges. Note that the prefix length must be equal or larger than 8 for
508 IPv4, and 64 for IPv6. The allocated range is checked against all current network interfaces and
509 all known network configuration files to avoid address range conflicts. The default system-wide
510 pool consists of 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 for IPv4, and fd00::/8 for IPv6.
511 This functionality is useful to manage a large number of dynamically created network interfaces
512 with the same network configuration and automatic address range assignment.</para>
513
514 </listitem>
515 </varlistentry>
516 <varlistentry>
517 <term><varname>Gateway=</varname></term>
518 <listitem>
519 <para>The gateway address, which must be in the format
520 described in
521 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
522 This is a short-hand for a [Route] section only containing
523 a Gateway key. This option may be specified more than
524 once.</para>
525 </listitem>
526 </varlistentry>
527 <varlistentry>
528 <term><varname>DNS=</varname></term>
529 <listitem>
530 <para>A DNS server address, which must be in the format
531 described in
532 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
533 This option may be specified more than once. This setting is read by
534 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
535 </listitem>
536 </varlistentry>
537 <varlistentry>
538 <term><varname>Domains=</varname></term>
539 <listitem>
540 <para>A list of domains which should be resolved using the DNS servers on this link. Each item in the list
541 should be a domain name, optionally prefixed with a tilde (<literal>~</literal>). The domains with the
542 prefix are called "routing-only domains". The domains without the prefix are called "search domains" and
543 are first used as search suffixes for extending single-label host names (host names containing no dots) to
544 become fully qualified domain names (FQDNs). If a single-label host name is resolved on this interface,
545 each of the specified search domains are appended to it in turn, converting it into a fully qualified
546 domain name, until one of them may be successfully resolved.</para>
547
548 <para>Both "search" and "routing-only" domains are used for routing of DNS queries: look-ups for host names
549 ending in those domains (hence also single label names, if any "search domains" are listed), are routed to
550 the DNS servers configured for this interface. The domain routing logic is particularly useful on
551 multi-homed hosts with DNS servers serving particular private DNS zones on each interface.</para>
552
553 <para>The "routing-only" domain <literal>~.</literal> (the tilde indicating definition of a routing domain,
554 the dot referring to the DNS root domain which is the implied suffix of all valid DNS names) has special
555 effect. It causes all DNS traffic which does not match another configured domain routing entry to be routed
556 to DNS servers specified for this interface. This setting is useful to prefer a certain set of DNS servers
557 if a link on which they are connected is available.</para>
558
559 <para>This setting is read by
560 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
561 "Search domains" correspond to the <varname>domain</varname> and <varname>search</varname> entries in
562 <citerefentry project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
563 Domain name routing has no equivalent in the traditional glibc API, which has no concept of domain
564 name servers limited to a specific link.</para>
565 </listitem>
566 </varlistentry>
567 <varlistentry>
568 <term><varname>DNSDefaultRoute=</varname></term>
569 <listitem>
570 <para>Takes a boolean argument. If true, this link's configured DNS servers are used for resolving domain
571 names that do not match any link's configured <varname>Domains=</varname> setting. If false, this link's
572 configured DNS servers are never used for such domains, and are exclusively used for resolving names that
573 match at least one of the domains configured on this link. If not specified defaults to an automatic mode:
574 queries not matching any link's configured domains will be routed to this link if it has no routing-only
575 domains configured.</para>
576 </listitem>
577 </varlistentry>
578 <varlistentry>
579 <term><varname>NTP=</varname></term>
580 <listitem>
581 <para>An NTP server address. This option may be specified more than once. This setting is read by
582 <citerefentry><refentrytitle>systemd-timesyncd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
583 </listitem>
584 </varlistentry>
585 <varlistentry>
586 <term><varname>IPForward=</varname></term>
587 <listitem><para>Configures IP packet forwarding for the
588 system. If enabled, incoming packets on any network
589 interface will be forwarded to any other interfaces
590 according to the routing table. Takes a boolean,
591 or the values <literal>ipv4</literal> or
592 <literal>ipv6</literal>, which only enable IP packet
593 forwarding for the specified address family. This controls
594 the <filename>net.ipv4.ip_forward</filename> and
595 <filename>net.ipv6.conf.all.forwarding</filename> sysctl
596 options of the network interface (see <ulink
597 url="https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt">ip-sysctl.txt</ulink>
598 for details about sysctl options). Defaults to
599 <literal>no</literal>.</para>
600
601 <para>Note: this setting controls a global kernel option,
602 and does so one way only: if a network that has this setting
603 enabled is set up the global setting is turned on. However,
604 it is never turned off again, even after all networks with
605 this setting enabled are shut down again.</para>
606
607 <para>To allow IP packet forwarding only between specific
608 network interfaces use a firewall.</para>
609 </listitem>
610 </varlistentry>
611 <varlistentry>
612 <term><varname>IPMasquerade=</varname></term>
613 <listitem><para>Configures IP masquerading for the network
614 interface. If enabled, packets forwarded from the network
615 interface will be appear as coming from the local host.
616 Takes a boolean argument. Implies
617 <varname>IPForward=ipv4</varname>. Defaults to
618 <literal>no</literal>.</para></listitem>
619 </varlistentry>
620 <varlistentry>
621 <term><varname>IPv6PrivacyExtensions=</varname></term>
622 <listitem><para>Configures use of stateless temporary
623 addresses that change over time (see <ulink
624 url="https://tools.ietf.org/html/rfc4941">RFC 4941</ulink>,
625 Privacy Extensions for Stateless Address Autoconfiguration
626 in IPv6). Takes a boolean or the special values
627 <literal>prefer-public</literal> and
628 <literal>kernel</literal>. When true, enables the privacy
629 extensions and prefers temporary addresses over public
630 addresses. When <literal>prefer-public</literal>, enables the
631 privacy extensions, but prefers public addresses over
632 temporary addresses. When false, the privacy extensions
633 remain disabled. When <literal>kernel</literal>, the kernel's
634 default setting will be left in place. Defaults to
635 <literal>no</literal>.</para></listitem>
636 </varlistentry>
637 <varlistentry>
638 <term><varname>IPv6AcceptRA=</varname></term>
639 <listitem><para>Takes a boolean. Controls IPv6 Router Advertisement (RA) reception support for the interface.
640 If true, RAs are accepted; if false, RAs are ignored, independently of the local forwarding state.
641 If unset, the kernel's default is used, and RAs are accepted only when local forwarding
642 is disabled for that interface. When RAs are accepted, they may trigger the start of the DHCPv6 client if
643 the relevant flags are set in the RA data, or if no routers are found on the link.</para>
644
645 <para>Further settings for the IPv6 RA support may be configured in the
646 <literal>[IPv6AcceptRA]</literal> section, see below.</para>
647
648 <para>Also see <ulink
649 url="https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt">ip-sysctl.txt</ulink> in the kernel
650 documentation regarding <literal>accept_ra</literal>, but note that systemd's setting of
651 <constant>1</constant> (i.e. true) corresponds to kernel's setting of <constant>2</constant>.</para>
652
653 <para>Note that if this option is enabled a userspace implementation of the IPv6 RA protocol is
654 used, and the kernel's own implementation remains disabled, since `networkd` needs to know all
655 details supplied in the advertisements, and these are not available from the kernel if the kernel's
656 own implementation is used.</para>
657 </listitem>
658 </varlistentry>
659 <varlistentry>
660 <term><varname>IPv6DuplicateAddressDetection=</varname></term>
661 <listitem><para>Configures the amount of IPv6 Duplicate
662 Address Detection (DAD) probes to send. When unset, the kernel's default will be used.
663 </para></listitem>
664 </varlistentry>
665 <varlistentry>
666 <term><varname>IPv6HopLimit=</varname></term>
667 <listitem><para>Configures IPv6 Hop Limit. For each router that
668 forwards the packet, the hop limit is decremented by 1. When the
669 hop limit field reaches zero, the packet is discarded.
670 When unset, the kernel's default will be used.
671 </para></listitem>
672 </varlistentry>
673 <varlistentry>
674 <term><varname>IPv4ProxyARP=</varname></term>
675 <listitem><para>Takes a boolean. Configures proxy ARP for IPv4. Proxy ARP is the technique in which one host,
676 usually a router, answers ARP requests intended for another machine. By "faking" its identity,
677 the router accepts responsibility for routing packets to the "real" destination. (see <ulink
678 url="https://tools.ietf.org/html/rfc1027">RFC 1027</ulink>.
679 When unset, the kernel's default will be used.
680 </para></listitem>
681 </varlistentry>
682 <varlistentry>
683 <term><varname>IPv6ProxyNDP=</varname></term>
684 <listitem><para>Takes a boolean. Configures proxy NDP for IPv6. Proxy NDP (Neighbor Discovery
685 Protocol) is a technique for IPv6 to allow routing of addresses to a different
686 destination when peers expect them to be present on a certain physical link.
687 In this case a router answers Neighbour Advertisement messages intended for
688 another machine by offering its own MAC address as destination.
689 Unlike proxy ARP for IPv4, it is not enabled globally, but will only send Neighbour
690 Advertisement messages for addresses in the IPv6 neighbor proxy table,
691 which can also be shown by <command>ip -6 neighbour show proxy</command>.
692 systemd-networkd will control the per-interface `proxy_ndp` switch for each configured
693 interface depending on this option.
694 When unset, the kernel's default will be used.
695 </para></listitem>
696 </varlistentry>
697 <varlistentry>
698 <term><varname>IPv6ProxyNDPAddress=</varname></term>
699 <listitem><para>An IPv6 address, for which Neighbour Advertisement messages will be
700 proxied. This option may be specified more than once. systemd-networkd will add the
701 <option>IPv6ProxyNDPAddress=</option> entries to the kernel's IPv6 neighbor proxy table.
702 This option implies <option>IPv6ProxyNDP=yes</option> but has no effect if
703 <option>IPv6ProxyNDP</option> has been set to false. When unset, the kernel's default will be used.
704 </para></listitem>
705 </varlistentry>
706 <varlistentry>
707 <term><varname>IPv6PrefixDelegation=</varname></term>
708 <listitem><para>Whether to enable or disable Router Advertisement sending on a link.
709 Allowed values are <literal>static</literal> which distributes prefixes as defined in
710 the <literal>[IPv6PrefixDelegation]</literal> and any <literal>[IPv6Prefix]</literal>
711 sections, <literal>dhcpv6</literal> which requests prefixes using a DHCPv6 client
712 configured for another link and any values configured in the
713 <literal>[IPv6PrefixDelegation]</literal> section while ignoring all static prefix
714 configuration sections, <literal>yes</literal> which uses both static configuration
715 and DHCPv6, and <literal>false</literal> which turns off IPv6 prefix delegation
716 altogether. Defaults to <literal>false</literal>. See the
717 <literal>[IPv6PrefixDelegation]</literal> and the <literal>[IPv6Prefix]</literal>
718 sections for more configuration options.
719 </para></listitem>
720 </varlistentry>
721 <varlistentry>
722 <term><varname>IPv6MTUBytes=</varname></term>
723 <listitem><para>Configures IPv6 maximum transmission unit (MTU).
724 An integer greater than or equal to 1280 bytes. When unset, the kernel's default will be used.
725 </para></listitem>
726 </varlistentry>
727 <varlistentry>
728 <term><varname>Bridge=</varname></term>
729 <listitem>
730 <para>The name of the bridge to add the link to. See
731 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
732 </para>
733 </listitem>
734 </varlistentry>
735 <varlistentry>
736 <term><varname>Bond=</varname></term>
737 <listitem>
738 <para>The name of the bond to add the link to. See
739 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
740 </para>
741 </listitem>
742 </varlistentry>
743 <varlistentry>
744 <term><varname>VRF=</varname></term>
745 <listitem>
746 <para>The name of the VRF to add the link to. See
747 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
748 </para>
749 </listitem>
750 </varlistentry>
751 <varlistentry>
752 <term><varname>VLAN=</varname></term>
753 <listitem>
754 <para>The name of a VLAN to create on the link. See
755 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
756 This option may be specified more than once.</para>
757 </listitem>
758 </varlistentry>
759 <varlistentry>
760 <term><varname>IPVLAN=</varname></term>
761 <listitem>
762 <para>The name of a IPVLAN to create on the link. See
763 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
764 This option may be specified more than once.</para>
765 </listitem>
766 </varlistentry>
767 <varlistentry>
768 <term><varname>MACVLAN=</varname></term>
769 <listitem>
770 <para>The name of a MACVLAN to create on the link. See
771 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
772 This option may be specified more than once.</para>
773 </listitem>
774 </varlistentry>
775 <varlistentry>
776 <term><varname>VXLAN=</varname></term>
777 <listitem>
778 <para>The name of a VXLAN to create on the link. See
779 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
780 This option may be specified more than once.</para>
781 </listitem>
782 </varlistentry>
783 <varlistentry>
784 <term><varname>Tunnel=</varname></term>
785 <listitem>
786 <para>The name of a Tunnel to create on the link. See
787 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
788 This option may be specified more than once.</para>
789 </listitem>
790 </varlistentry>
791 <varlistentry>
792 <term><varname>MACsec=</varname></term>
793 <listitem>
794 <para>The name of a MACsec device to create on the link. See
795 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
796 This option may be specified more than once.</para>
797 </listitem>
798 </varlistentry>
799 <varlistentry>
800 <term><varname>ActiveSlave=</varname></term>
801 <listitem>
802 <para>Takes a boolean. Specifies the new active slave. The <literal>ActiveSlave=</literal>
803 option is only valid for following modes:
804 <literal>active-backup</literal>,
805 <literal>balance-alb</literal> and
806 <literal>balance-tlb</literal>. Defaults to false.
807 </para>
808 </listitem>
809 </varlistentry>
810 <varlistentry>
811 <term><varname>PrimarySlave=</varname></term>
812 <listitem>
813 <para>Takes a boolean. Specifies which slave is the primary device. The specified
814 device will always be the active slave while it is available. Only when the
815 primary is off-line will alternate devices be used. This is useful when
816 one slave is preferred over another, e.g. when one slave has higher throughput
817 than another. The <literal>PrimarySlave=</literal> option is only valid for
818 following modes:
819 <literal>active-backup</literal>,
820 <literal>balance-alb</literal> and
821 <literal>balance-tlb</literal>. Defaults to false.
822 </para>
823 </listitem>
824 </varlistentry>
825 <varlistentry>
826 <term><varname>ConfigureWithoutCarrier=</varname></term>
827 <listitem>
828 <para>Takes a boolean. Allows networkd to configure a specific link even if it has no carrier.
829 Defaults to false.
830 </para>
831 </listitem>
832 </varlistentry>
833 <varlistentry>
834 <term><varname>IgnoreCarrierLoss=</varname></term>
835 <listitem>
836 <para>A boolean. Allows networkd to retain both the static and dynamic configuration of the
837 interface even if its carrier is lost. Defaults to false.
838 </para>
839 </listitem>
840 </varlistentry>
841 <varlistentry>
842 <term><varname>KeepConfiguration=</varname></term>
843 <listitem>
844 <para>Takes a boolean or one of <literal>static</literal>, <literal>dhcp-on-stop</literal>,
845 <literal>dhcp</literal>. When <literal>static</literal>, <command>systemd-networkd</command>
846 will not drop static addresses and routes on starting up process. When set to
847 <literal>dhcp-on-stop</literal>, <command>systemd-networkd</command> will not drop addresses
848 and routes on stopping the daemon. When <literal>dhcp</literal>,
849 the addresses and routes provided by a DHCP server will never be dropped even if the DHCP
850 lease expires. This is contrary to the DHCP specification, but may be the best choice if,
851 e.g., the root filesystem relies on this connection. The setting <literal>dhcp</literal>
852 implies <literal>dhcp-on-stop</literal>, and <literal>yes</literal> implies
853 <literal>dhcp</literal> and <literal>static</literal>. Defaults to
854 <literal>dhcp-on-stop</literal>.</para>
855 </listitem>
856 </varlistentry>
857
858 </variablelist>
859
860 </refsect1>
861
862 <refsect1>
863 <title>[Address] Section Options</title>
864
865 <para>An <literal>[Address]</literal> section accepts the
866 following keys. Specify several <literal>[Address]</literal>
867 sections to configure several addresses.</para>
868
869 <variablelist class='network-directives'>
870 <varlistentry>
871 <term><varname>Address=</varname></term>
872 <listitem>
873 <para>As in the <literal>[Network]</literal> section. This key is mandatory. Each
874 <literal>[Address]</literal> section can contain one <varname>Address=</varname> setting.</para>
875 </listitem>
876 </varlistentry>
877 <varlistentry>
878 <term><varname>Peer=</varname></term>
879 <listitem>
880 <para>The peer address in a point-to-point connection.
881 Accepts the same format as the <varname>Address=</varname>
882 key.</para>
883 </listitem>
884 </varlistentry>
885 <varlistentry>
886 <term><varname>Broadcast=</varname></term>
887 <listitem>
888 <para>The broadcast address, which must be in the format
889 described in
890 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
891 This key only applies to IPv4 addresses. If it is not
892 given, it is derived from the <varname>Address=</varname>
893 key.</para>
894 </listitem>
895 </varlistentry>
896 <varlistentry>
897 <term><varname>Label=</varname></term>
898 <listitem>
899 <para>An address label.</para>
900 </listitem>
901 </varlistentry>
902 <varlistentry>
903 <term><varname>PreferredLifetime=</varname></term>
904 <listitem>
905 <para>Allows the default "preferred lifetime" of the address to be overridden.
906 Only three settings are accepted: <literal>forever</literal> or <literal>infinity</literal>
907 which is the default and means that the address never expires, and <literal>0</literal> which means
908 that the address is considered immediately "expired" and will not be used,
909 unless explicitly requested. A setting of PreferredLifetime=0 is useful for
910 addresses which are added to be used only by a specific application,
911 which is then configured to use them explicitly.</para>
912 </listitem>
913 </varlistentry>
914 <varlistentry>
915 <term><varname>Scope=</varname></term>
916 <listitem>
917 <para>The scope of the address, which can be <literal>global</literal>,
918 <literal>link</literal> or <literal>host</literal> or an unsigned integer ranges 0 to 255.
919 Defaults to <literal>global</literal>.</para>
920 </listitem>
921 </varlistentry>
922 <varlistentry>
923 <term><varname>HomeAddress=</varname></term>
924 <listitem>
925 <para>Takes a boolean. Designates this address the "home address" as defined in
926 <ulink url="https://tools.ietf.org/html/rfc6275">RFC 6275</ulink>.
927 Supported only on IPv6. Defaults to false.</para>
928 </listitem>
929 </varlistentry>
930 <varlistentry>
931 <term><varname>DuplicateAddressDetection=</varname></term>
932 <listitem>
933 <para>Takes a boolean. Do not perform Duplicate Address Detection
934 <ulink url="https://tools.ietf.org/html/rfc4862">RFC 4862</ulink> when adding this address.
935 Supported only on IPv6. Defaults to false.</para>
936 </listitem>
937 </varlistentry>
938 <varlistentry>
939 <term><varname>ManageTemporaryAddress=</varname></term>
940 <listitem>
941 <para>Takes a boolean. If true the kernel manage temporary addresses created
942 from this one as template on behalf of Privacy Extensions
943 <ulink url="https://tools.ietf.org/html/rfc3041">RFC 3041</ulink>. For this to become
944 active, the use_tempaddr sysctl setting has to be set to a value greater than zero.
945 The given address needs to have a prefix length of 64. This flag allows to use privacy
946 extensions in a manually configured network, just like if stateless auto-configuration
947 was active. Defaults to false. </para>
948 </listitem>
949 </varlistentry>
950 <varlistentry>
951 <term><varname>PrefixRoute=</varname></term>
952 <listitem>
953 <para>Takes a boolean. When adding or modifying an IPv6 address, the userspace
954 application needs a way to suppress adding a prefix route. This is for example relevant
955 together with IFA_F_MANAGERTEMPADDR, where userspace creates autoconf generated addresses,
956 but depending on on-link, no route for the prefix should be added. Defaults to false.</para>
957 </listitem>
958 </varlistentry>
959 <varlistentry>
960 <term><varname>AutoJoin=</varname></term>
961 <listitem>
962 <para>Takes a boolean. Joining multicast group on ethernet level via
963 <command>ip maddr</command> command would not work if we have an Ethernet switch that does
964 IGMP snooping since the switch would not replicate multicast packets on ports that did not
965 have IGMP reports for the multicast addresses. Linux vxlan interfaces created via
966 <command>ip link add vxlan</command> or networkd's netdev kind vxlan have the group option
967 that enables then to do the required join. By extending ip address command with option
968 <literal>autojoin</literal> we can get similar functionality for openvswitch (OVS) vxlan
969 interfaces as well as other tunneling mechanisms that need to receive multicast traffic.
970 Defaults to <literal>no</literal>.</para>
971 </listitem>
972 </varlistentry>
973 </variablelist>
974 </refsect1>
975
976 <refsect1>
977 <title>[Neighbor] Section Options</title>
978 <para>A <literal>[Neighbor]</literal> section accepts the
979 following keys. The neighbor section adds a permanent, static
980 entry to the neighbor table (IPv6) or ARP table (IPv4) for
981 the given hardware address on the links matched for the network.
982 Specify several <literal>[Neighbor]</literal> sections to configure
983 several static neighbors.</para>
984
985 <variablelist class='network-directives'>
986 <varlistentry>
987 <term><varname>Address=</varname></term>
988 <listitem>
989 <para>The IP address of the neighbor.</para>
990 </listitem>
991 </varlistentry>
992 <varlistentry>
993 <term><varname>MACAddress=</varname></term>
994 <listitem>
995 <para>The hardware address of the neighbor.</para>
996 </listitem>
997 </varlistentry>
998 </variablelist>
999 </refsect1>
1000
1001 <refsect1>
1002 <title>[IPv6AddressLabel] Section Options</title>
1003
1004 <para>An <literal>[IPv6AddressLabel]</literal> section accepts the
1005 following keys. Specify several <literal>[IPv6AddressLabel]</literal>
1006 sections to configure several address labels. IPv6 address labels are
1007 used for address selection. See <ulink url="https://tools.ietf.org/html/rfc3484">RFC 3484</ulink>.
1008 Precedence is managed by userspace, and only the label itself is stored in the kernel</para>
1009
1010 <variablelist class='network-directives'>
1011 <varlistentry>
1012 <term><varname>Label=</varname></term>
1013 <listitem>
1014 <para> The label for the prefix (an unsigned integer) ranges 0 to 4294967294.
1015 0xffffffff is reserved. This key is mandatory.</para>
1016 </listitem>
1017 </varlistentry>
1018 <varlistentry>
1019 <term><varname>Prefix=</varname></term>
1020 <listitem>
1021 <para>IPv6 prefix is an address with a prefix length, separated by a slash <literal>/</literal> character.
1022 This key is mandatory. </para>
1023 </listitem>
1024 </varlistentry>
1025 </variablelist>
1026 </refsect1>
1027
1028 <refsect1>
1029 <title>[RoutingPolicyRule] Section Options</title>
1030
1031 <para>An <literal>[RoutingPolicyRule]</literal> section accepts the
1032 following keys. Specify several <literal>[RoutingPolicyRule]</literal>
1033 sections to configure several rules.</para>
1034
1035 <variablelist class='network-directives'>
1036 <varlistentry>
1037 <term><varname>TypeOfService=</varname></term>
1038 <listitem>
1039 <para>Specifies the type of service to match a number between 0 to 255.</para>
1040 </listitem>
1041 </varlistentry>
1042 <varlistentry>
1043 <term><varname>From=</varname></term>
1044 <listitem>
1045 <para>Specifies the source address prefix to match. Possibly followed by a slash and the prefix length.</para>
1046 </listitem>
1047 </varlistentry>
1048 <varlistentry>
1049 <term><varname>To=</varname></term>
1050 <listitem>
1051 <para>Specifies the destination address prefix to match. Possibly followed by a slash and the prefix length.</para>
1052 </listitem>
1053 </varlistentry>
1054 <varlistentry>
1055 <term><varname>FirewallMark=</varname></term>
1056 <listitem>
1057 <para>Specifies the iptables firewall mark value to match (a number between 1 and 4294967295).</para>
1058 </listitem>
1059 </varlistentry>
1060 <varlistentry>
1061 <term><varname>Table=</varname></term>
1062 <listitem>
1063 <para>Specifies the routing table identifier to lookup if the rule
1064 selector matches. The table identifier for a route (a number between 1 and 4294967295).</para>
1065 </listitem>
1066 </varlistentry>
1067 <varlistentry>
1068 <term><varname>Priority=</varname></term>
1069 <listitem>
1070 <para>Specifies the priority of this rule. <varname>Priority=</varname> is an unsigned
1071 integer. Higher number means lower priority, and rules get processed in order of increasing number.</para>
1072 </listitem>
1073 </varlistentry>
1074 <varlistentry>
1075 <term><varname>IncomingInterface=</varname></term>
1076 <listitem>
1077 <para>Specifies incoming device to match. If the interface is loopback, the rule only matches packets originating from this host.</para>
1078 </listitem>
1079 </varlistentry>
1080 <varlistentry>
1081 <term><varname>OutgoingInterface=</varname></term>
1082 <listitem>
1083 <para>Specifies the outgoing device to match. The outgoing interface is only available for packets originating from local sockets that are bound to a device.</para>
1084 </listitem>
1085 </varlistentry>
1086 <varlistentry>
1087 <term><varname>SourcePort=</varname></term>
1088 <listitem>
1089 <para>Specifies the source IP port or IP port range match in forwarding information base (FIB) rules.
1090 A port range is specified by the lower and upper port separated by a dash. Defaults to unset.</para>
1091 </listitem>
1092 </varlistentry>
1093 <varlistentry>
1094 <term><varname>DestinationPort=</varname></term>
1095 <listitem>
1096 <para>Specifies the destination IP port or IP port range match in forwarding information base (FIB) rules.
1097 A port range is specified by the lower and upper port separated by a dash. Defaults to unset.</para>
1098 </listitem>
1099 </varlistentry>
1100 <varlistentry>
1101 <term><varname>IPProtocol=</varname></term>
1102 <listitem>
1103 <para>Specifies the IP protocol to match in forwarding information base (FIB) rules. Takes IP protocol name such as <literal>tcp</literal>,
1104 <literal>udp</literal> or <literal>sctp</literal>, or IP protocol number such as <literal>6</literal> for <literal>tcp</literal> or
1105 <literal>17</literal> for <literal>udp</literal>.
1106 Defaults to unset.</para>
1107 </listitem>
1108 </varlistentry>
1109 <varlistentry>
1110 <term><varname>InvertRule=</varname></term>
1111 <listitem>
1112 <para>A boolean. Specifies whether the rule to be inverted. Defaults to false.</para>
1113 </listitem>
1114 </varlistentry>
1115 </variablelist>
1116 </refsect1>
1117
1118 <refsect1>
1119 <title>[Route] Section Options</title>
1120 <para>The <literal>[Route]</literal> section accepts the
1121 following keys. Specify several <literal>[Route]</literal>
1122 sections to configure several routes.</para>
1123
1124 <variablelist class='network-directives'>
1125 <varlistentry>
1126 <term><varname>Gateway=</varname></term>
1127 <listitem>
1128 <para>As in the <literal>[Network]</literal> section.</para>
1129 </listitem>
1130 </varlistentry>
1131 <varlistentry>
1132 <term><varname>GatewayOnLink=</varname></term>
1133 <listitem>
1134 <para>Takes a boolean. If set to true, the kernel does not have
1135 to check if the gateway is reachable directly by the current machine (i.e., the kernel does
1136 not need to check if the gateway is attached to the local network), so that we can insert the
1137 route in the kernel table without it being complained about. Defaults to <literal>no</literal>.
1138 </para>
1139 </listitem>
1140 </varlistentry>
1141 <varlistentry>
1142 <term><varname>Destination=</varname></term>
1143 <listitem>
1144 <para>The destination prefix of the route. Possibly
1145 followed by a slash and the prefix length. If omitted, a
1146 full-length host route is assumed.</para>
1147 </listitem>
1148 </varlistentry>
1149 <varlistentry>
1150 <term><varname>Source=</varname></term>
1151 <listitem>
1152 <para>The source prefix of the route. Possibly followed by
1153 a slash and the prefix length. If omitted, a full-length
1154 host route is assumed.</para>
1155 </listitem>
1156 </varlistentry>
1157 <varlistentry>
1158 <term><varname>Metric=</varname></term>
1159 <listitem>
1160 <para>The metric of the route (an unsigned integer).</para>
1161 </listitem>
1162 </varlistentry>
1163 <varlistentry>
1164 <term><varname>IPv6Preference=</varname></term>
1165 <listitem>
1166 <para>Specifies the route preference as defined in <ulink
1167 url="https://tools.ietf.org/html/rfc4191">RFC4191</ulink> for Router Discovery messages.
1168 Which can be one of <literal>low</literal> the route has a lowest priority,
1169 <literal>medium</literal> the route has a default priority or
1170 <literal>high</literal> the route has a highest priority.</para>
1171 </listitem>
1172 </varlistentry>
1173 <varlistentry>
1174 <term><varname>Scope=</varname></term>
1175 <listitem>
1176 <para>The scope of the route, which can be <literal>global</literal>,
1177 <literal>link</literal> or <literal>host</literal>. Defaults to
1178 <literal>global</literal>.</para>
1179 </listitem>
1180 </varlistentry>
1181 <varlistentry>
1182 <term><varname>PreferredSource=</varname></term>
1183 <listitem>
1184 <para>The preferred source address of the route. The address
1185 must be in the format described in
1186 <citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.</para>
1187 </listitem>
1188 </varlistentry>
1189 <varlistentry>
1190 <term><varname>Table=<replaceable>num</replaceable></varname></term>
1191 <listitem>
1192 <para>The table identifier for the route (a number between 1 and 4294967295, or 0 to unset).
1193 The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
1194 </para>
1195 </listitem>
1196 </varlistentry>
1197 <varlistentry>
1198 <term><varname>Protocol=</varname></term>
1199 <listitem>
1200 <para>The protocol identifier for the route. Takes a number between 0 and 255 or the special values
1201 <literal>kernel</literal>, <literal>boot</literal> and <literal>static</literal>. Defaults to
1202 <literal>static</literal>.
1203 </para>
1204 </listitem>
1205 </varlistentry>
1206 <varlistentry>
1207 <term><varname>Type=</varname></term>
1208 <listitem>
1209 <para>Specifies the type for the route. If <literal>unicast</literal>, a regular route is defined, i.e. a
1210 route indicating the path to take to a destination network address. If <literal>blackhole</literal>, packets
1211 to the defined route are discarded silently. If <literal>unreachable</literal>, packets to the defined route
1212 are discarded and the ICMP message "Host Unreachable" is generated. If <literal>prohibit</literal>, packets
1213 to the defined route are discarded and the ICMP message "Communication Administratively Prohibited" is
1214 generated. If <literal>throw</literal>, route lookup in the current routing table will fail and the route
1215 selection process will return to Routing Policy Database (RPDB). Defaults to <literal>unicast</literal>.
1216 </para>
1217 </listitem>
1218 </varlistentry>
1219 <varlistentry>
1220 <term><varname>InitialCongestionWindow=</varname></term>
1221 <listitem>
1222 <para>The TCP initial congestion window is used during the start of a TCP connection. During the start of a TCP
1223 session, when a client requests a resource, the server's initial congestion window determines how many data bytes
1224 will be sent during the initial burst of data. Takes a size in bytes between 1 and 4294967295 (2^32 - 1). The usual
1225 suffixes K, M, G are supported and are understood to the base of 1024. When unset, the kernel's default will be used.
1226 </para>
1227 </listitem>
1228 </varlistentry>
1229 <varlistentry>
1230 <term><varname>InitialAdvertisedReceiveWindow=</varname></term>
1231 <listitem>
1232 <para>The TCP initial advertised receive window is the amount of receive data (in bytes) that can initially be buffered at one time
1233 on a connection. The sending host can send only that amount of data before waiting for an acknowledgment and window update
1234 from the receiving host. Takes a size in bytes between 1 and 4294967295 (2^32 - 1). The usual suffixes K, M, G are supported
1235 and are understood to the base of 1024. When unset, the kernel's default will be used.
1236 </para>
1237 </listitem>
1238 </varlistentry>
1239 <varlistentry>
1240 <term><varname>QuickAck=</varname></term>
1241 <listitem>
1242 <para>Takes a boolean. When true enables TCP quick ack mode for the route. When unset, the kernel's default will be used.
1243 </para>
1244 </listitem>
1245 </varlistentry>
1246 <varlistentry>
1247 <term><varname>FastOpenNoCookie=</varname></term>
1248 <listitem>
1249 <para>Takes a boolean. When true enables TCP fastopen without a cookie on a per-route basis.
1250 When unset, the kernel's default will be used.
1251 </para>
1252 </listitem>
1253 </varlistentry>
1254 <varlistentry>
1255 <term><varname>TTLPropagate=</varname></term>
1256 <listitem>
1257 <para>Takes a boolean. When true enables TTL propagation at Label Switched Path (LSP) egress.
1258 When unset, the kernel's default will be used.
1259 </para>
1260 </listitem>
1261 </varlistentry>
1262 <varlistentry>
1263 <term><varname>MTUBytes=</varname></term>
1264 <listitem>
1265 <para>The maximum transmission unit in bytes to set for the
1266 route. The usual suffixes K, M, G, are supported and are
1267 understood to the base of 1024.</para>
1268 <para>Note that if IPv6 is enabled on the interface, and the MTU is chosen
1269 below 1280 (the minimum MTU for IPv6) it will automatically be increased to this value.</para>
1270 </listitem>
1271 </varlistentry>
1272 </variablelist>
1273 </refsect1>
1274
1275 <refsect1>
1276 <title>[DHCP] Section Options</title>
1277 <para>The <literal>[DHCP]</literal> section configures the
1278 DHCPv4 and DHCP6 client, if it is enabled with the
1279 <varname>DHCP=</varname> setting described above:</para>
1280
1281 <variablelist class='network-directives'>
1282 <varlistentry>
1283 <term><varname>UseDNS=</varname></term>
1284 <listitem>
1285 <para>When true (the default), the DNS servers received
1286 from the DHCP server will be used and take precedence over
1287 any statically configured ones.</para>
1288
1289 <para>This corresponds to the <option>nameserver</option>
1290 option in <citerefentry
1291 project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
1292 </listitem>
1293 </varlistentry>
1294 <varlistentry>
1295 <term><varname>UseNTP=</varname></term>
1296 <listitem>
1297 <para>When true (the default), the NTP servers received
1298 from the DHCP server will be used by systemd-timesyncd
1299 and take precedence over any statically configured ones.</para>
1300 </listitem>
1301 </varlistentry>
1302 <varlistentry>
1303 <term><varname>UseMTU=</varname></term>
1304 <listitem>
1305 <para>When true, the interface maximum transmission unit
1306 from the DHCP server will be used on the current link.
1307 If <varname>MTUBytes=</varname> is set, then this setting is ignored.
1308 Defaults to false.</para>
1309 </listitem>
1310 </varlistentry>
1311 <varlistentry>
1312 <term><varname>Anonymize=</varname></term>
1313 <listitem>
1314 <para>Takes a boolean. When true, the options sent to the DHCP server will
1315 follow the <ulink url="https://tools.ietf.org/html/rfc7844">RFC 7844</ulink>
1316 (Anonymity Profiles for DHCP Clients) to minimize disclosure of identifying information.
1317 Defaults to false.</para>
1318
1319 <para>This option should only be set to true when
1320 <varname>MACAddressPolicy=</varname> is set to <literal>random</literal>
1321 (see <citerefentry
1322 project='man-pages'><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>).</para>
1323
1324 <para>Note that this configuration will overwrite others.
1325 In concrete, the following variables will be ignored:
1326 <varname>SendHostname=</varname>, <varname>ClientIdentifier=</varname>,
1327 <varname>UseRoutes=</varname>, <varname>SendHostname=</varname>,
1328 <varname>UseMTU=</varname>, <varname>VendorClassIdentifier=</varname>,
1329 <varname>UseTimezone=</varname>.</para>
1330
1331 <para>With this option enabled DHCP requests will mimic those generated by Microsoft Windows, in
1332 order to reduce the ability to fingerprint and recognize installations. This means DHCP request
1333 sizes will grow and lease data will be more comprehensive than normally, though most of the
1334 requested data is not actually used.</para>
1335 </listitem>
1336 </varlistentry>
1337 <varlistentry>
1338 <term><varname>SendHostname=</varname></term>
1339 <listitem>
1340 <para>When true (the default), the machine's hostname will be sent to the DHCP server.
1341 Note that the machine's hostname must consist only of 7-bit ASCII lower-case characters and
1342 no spaces or dots, and be formatted as a valid DNS domain name. Otherwise, the hostname is not
1343 sent even if this is set to true.</para>
1344 </listitem>
1345 </varlistentry>
1346 <varlistentry>
1347 <term><varname>UseHostname=</varname></term>
1348 <listitem>
1349 <para>When true (the default), the hostname received from
1350 the DHCP server will be set as the transient hostname of the system.
1351 </para>
1352 </listitem>
1353 </varlistentry>
1354 <varlistentry>
1355 <term><varname>Hostname=</varname></term>
1356 <listitem>
1357 <para>Use this value for the hostname which is sent to the DHCP server, instead of machine's hostname.
1358 Note that the specified hostname must consist only of 7-bit ASCII lower-case characters and
1359 no spaces or dots, and be formatted as a valid DNS domain name.</para>
1360 </listitem>
1361 </varlistentry>
1362 <varlistentry>
1363 <term><varname>UseDomains=</varname></term>
1364 <listitem>
1365 <para>Takes a boolean, or the special value <literal>route</literal>. When true, the domain name
1366 received from the DHCP server will be used as DNS search domain over this link, similar to the effect of
1367 the <option>Domains=</option> setting. If set to <literal>route</literal>, the domain name received from
1368 the DHCP server will be used for routing DNS queries only, but not for searching, similar to the effect of
1369 the <option>Domains=</option> setting when the argument is prefixed with <literal>~</literal>. Defaults to
1370 false.</para>
1371
1372 <para>It is recommended to enable this option only on trusted networks, as setting this affects resolution
1373 of all host names, in particular of single-label names. It is generally safer to use the supplied domain
1374 only as routing domain, rather than as search domain, in order to not have it affect local resolution of
1375 single-label names.</para>
1376
1377 <para>When set to true, this setting corresponds to the <option>domain</option> option in <citerefentry
1378 project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
1379 </listitem>
1380 </varlistentry>
1381 <varlistentry>
1382 <term><varname>UseRoutes=</varname></term>
1383 <listitem>
1384 <para>When true (the default), the static routes will be requested from the DHCP server and added to the
1385 routing table with a metric of 1024, and a scope of "global", "link" or "host", depending on the route's
1386 destination and gateway. If the destination is on the local host, e.g., 127.x.x.x, or the same as the
1387 link's own address, the scope will be set to "host". Otherwise if the gateway is null (a direct route), a
1388 "link" scope will be used. For anything else, scope defaults to "global".</para>
1389 </listitem>
1390 </varlistentry>
1391
1392 <varlistentry>
1393 <term><varname>UseTimezone=</varname></term>
1394
1395 <listitem><para>When true, the timezone received from the
1396 DHCP server will be set as timezone of the local
1397 system. Defaults to <literal>no</literal>.</para></listitem>
1398 </varlistentry>
1399
1400 <varlistentry>
1401 <term><varname>ClientIdentifier=</varname></term>
1402 <listitem>
1403 <para>The DHCPv4 client identifier to use. Takes one of <literal>mac</literal>, <literal>duid</literal> or <literal>duid-only</literal>.
1404 If set to <literal>mac</literal>, the MAC address of the link is used.
1405 If set to <literal>duid</literal>, an RFC4361-compliant Client ID, which is the combination of IAID and DUID (see below), is used.
1406 If set to <literal>duid-only</literal>, only DUID is used, this may not be RFC compliant, but some setups may require to use this.
1407 Defaults to <literal>duid</literal>.</para>
1408 </listitem>
1409 </varlistentry>
1410
1411 <varlistentry>
1412 <term><varname>VendorClassIdentifier=</varname></term>
1413 <listitem>
1414 <para>The vendor class identifier used to identify vendor
1415 type and configuration.</para>
1416 </listitem>
1417 </varlistentry>
1418
1419 <varlistentry>
1420 <term><varname>UserClass=</varname></term>
1421 <listitem>
1422 <para>A DHCPv4 client can use UserClass option to identify the type or category of user or applications
1423 it represents. The information contained in this option is a string that represents the user class of which
1424 the client is a member. Each class sets an identifying string of information to be used by the DHCP
1425 service to classify clients. Takes a whitespace-separated list of strings.</para>
1426 </listitem>
1427 </varlistentry>
1428
1429 <varlistentry>
1430 <term><varname>MaxAttempts=</varname></term>
1431 <listitem>
1432 <para>Specifies how many times the DHCPv4 client configuration should be attempted. Takes a
1433 number or <literal>infinity</literal>. Defaults to <literal>infinity</literal>.
1434 Note that the time between retries is increased exponentially, so the network will not be
1435 overloaded even if this number is high.</para>
1436 </listitem>
1437 </varlistentry>
1438
1439 <varlistentry>
1440 <term><varname>DUIDType=</varname></term>
1441 <listitem>
1442 <para>Override the global <varname>DUIDType</varname> setting for this network. See
1443 <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1444 for a description of possible values.</para>
1445 </listitem>
1446 </varlistentry>
1447
1448 <varlistentry>
1449 <term><varname>DUIDRawData=</varname></term>
1450 <listitem>
1451 <para>Override the global <varname>DUIDRawData</varname> setting for this network. See
1452 <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1453 for a description of possible values.</para>
1454 </listitem>
1455 </varlistentry>
1456
1457 <varlistentry>
1458 <term><varname>IAID=</varname></term>
1459 <listitem>
1460 <para>The DHCP Identity Association Identifier (IAID) for the interface, a 32-bit unsigned integer.</para>
1461 </listitem>
1462 </varlistentry>
1463
1464 <varlistentry>
1465 <term><varname>RequestBroadcast=</varname></term>
1466 <listitem>
1467 <para>Request the server to use broadcast messages before
1468 the IP address has been configured. This is necessary for
1469 devices that cannot receive RAW packets, or that cannot
1470 receive packets at all before an IP address has been
1471 configured. On the other hand, this must not be enabled on
1472 networks where broadcasts are filtered out.</para>
1473 </listitem>
1474 </varlistentry>
1475
1476 <varlistentry>
1477 <term><varname>RouteMetric=</varname></term>
1478 <listitem>
1479 <para>Set the routing metric for routes specified by the
1480 DHCP server.</para>
1481 </listitem>
1482 </varlistentry>
1483
1484 <varlistentry>
1485 <term><varname>RouteTable=<replaceable>num</replaceable></varname></term>
1486 <listitem>
1487 <para>The table identifier for DHCP routes (a number between 1 and 4294967295, or 0 to unset).
1488 The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
1489 </para>
1490 <para>When used in combination with <varname>VRF=</varname> the
1491 VRF's routing table is used unless this parameter is specified.
1492 </para>
1493 </listitem>
1494 </varlistentry>
1495
1496 <varlistentry>
1497 <term><varname>ListenPort=</varname></term>
1498 <listitem>
1499 <para>Allow setting custom port for the DHCP client to listen on.</para>
1500 </listitem>
1501 </varlistentry>
1502
1503 <varlistentry>
1504 <term><varname>SendRelease=</varname></term>
1505 <listitem>
1506 <para>When true, the DHCPv4 client sends a DHCP release packet when it stops.
1507 Defaults to false.</para>
1508 </listitem>
1509 </varlistentry>
1510
1511 <varlistentry>
1512 <term><varname>RapidCommit=</varname></term>
1513 <listitem>
1514 <para>Takes a boolean. The DHCPv6 client can obtain configuration parameters from a DHCPv6 server through
1515 a rapid two-message exchange (solicit and reply). When the rapid commit option is enabled by both
1516 the DHCPv6 client and the DHCPv6 server, the two-message exchange is used, rather than the default
1517 four-method exchange (solicit, advertise, request, and reply). The two-message exchange provides
1518 faster client configuration and is beneficial in environments in which networks are under a heavy load.
1519 See <ulink url="https://tools.ietf.org/html/rfc3315#section-17.2.1">RFC 3315</ulink> for details.
1520 Defaults to true.</para>
1521 </listitem>
1522 </varlistentry>
1523
1524 <varlistentry>
1525 <term><varname>ForceDHCPv6PDOtherInformation=</varname></term>
1526 <listitem>
1527 <para>Takes a boolean that enforces DHCPv6 stateful mode when the 'Other information' bit is set in
1528 Router Advertisement messages. By default setting only the 'O' bit in Router Advertisements
1529 makes DHCPv6 request network information in a stateless manner using a two-message Information
1530 Request and Information Reply message exchange.
1531 <ulink url="https://tools.ietf.org/html/rfc7084">RFC 7084</ulink>, requirement WPD-4, updates
1532 this behavior for a Customer Edge router so that stateful DHCPv6 Prefix Delegation is also
1533 requested when only the 'O' bit is set in Router Advertisements. This option enables such a CE
1534 behavior as it is impossible to automatically distinguish the intention of the 'O' bit otherwise.
1535 By default this option is set to 'false', enable it if no prefixes are delegated when the device
1536 should be acting as a CE router.</para>
1537 </listitem>
1538 </varlistentry>
1539
1540 <varlistentry>
1541 <term><varname>BlackList=</varname></term>
1542 <listitem>
1543 <para>A whitespace-separated list of IPv4 addresses. DHCP offers from servers in the list are rejected.</para>
1544 </listitem>
1545 </varlistentry>
1546
1547 </variablelist>
1548 </refsect1>
1549
1550 <refsect1>
1551 <title>[IPv6AcceptRA] Section Options</title>
1552 <para>The <literal>[IPv6AcceptRA]</literal> section configures the IPv6 Router Advertisement
1553 (RA) client, if it is enabled with the <varname>IPv6AcceptRA=</varname> setting described
1554 above:</para>
1555
1556 <variablelist class='network-directives'>
1557 <varlistentry>
1558 <term><varname>UseDNS=</varname></term>
1559 <listitem>
1560 <para>When true (the default), the DNS servers received in the Router Advertisement will be used and take
1561 precedence over any statically configured ones.</para>
1562
1563 <para>This corresponds to the <option>nameserver</option> option in <citerefentry
1564 project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
1565 </listitem>
1566 </varlistentry>
1567
1568 <varlistentry>
1569 <term><varname>UseDomains=</varname></term>
1570 <listitem>
1571 <para>Takes a boolean, or the special value <literal>route</literal>. When true, the domain name
1572 received via IPv6 Router Advertisement (RA) will be used as DNS search domain over this link, similar to
1573 the effect of the <option>Domains=</option> setting. If set to <literal>route</literal>, the domain name
1574 received via IPv6 RA will be used for routing DNS queries only, but not for searching, similar to the
1575 effect of the <option>Domains=</option> setting when the argument is prefixed with
1576 <literal>~</literal>. Defaults to false.</para>
1577
1578 <para>It is recommended to enable this option only on trusted networks, as setting this affects resolution
1579 of all host names, in particular of single-label names. It is generally safer to use the supplied domain
1580 only as routing domain, rather than as search domain, in order to not have it affect local resolution of
1581 single-label names.</para>
1582
1583 <para>When set to true, this setting corresponds to the <option>domain</option> option in <citerefentry
1584 project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
1585 </listitem>
1586 </varlistentry>
1587
1588 <varlistentry>
1589 <term><varname>RouteTable=<replaceable>num</replaceable></varname></term>
1590 <listitem>
1591 <para>The table identifier for the routes received in the Router Advertisement
1592 (a number between 1 and 4294967295, or 0 to unset).
1593 The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
1594 </para>
1595 </listitem>
1596 </varlistentry>
1597
1598 <varlistentry>
1599 <term><varname>UseAutonomousPrefix=</varname></term>
1600 <listitem>
1601 <para>When true (the default), the autonomous prefix received in the Router Advertisement will be used and take
1602 precedence over any statically configured ones.</para>
1603 </listitem>
1604 </varlistentry>
1605
1606 <varlistentry>
1607 <term><varname>UseOnLinkPrefix=</varname></term>
1608 <listitem>
1609 <para>When true (the default), the onlink prefix received in the Router Advertisement will be used and take
1610 precedence over any statically configured ones.</para>
1611 </listitem>
1612 </varlistentry>
1613
1614 <varlistentry>
1615 <term><varname>BlackList=</varname></term>
1616 <listitem>
1617 <para>A whitespace-separated list of IPv6 prefixes. IPv6 prefixes supplied via router advertisements in the list are ignored.</para>
1618 </listitem>
1619 </varlistentry>
1620
1621 </variablelist>
1622 </refsect1>
1623
1624 <refsect1>
1625 <title>[DHCPServer] Section Options</title>
1626 <para>The <literal>[DHCPServer]</literal> section contains
1627 settings for the DHCP server, if enabled via the
1628 <varname>DHCPServer=</varname> option described above:</para>
1629
1630 <variablelist class='network-directives'>
1631
1632 <varlistentry>
1633 <term><varname>PoolOffset=</varname></term>
1634 <term><varname>PoolSize=</varname></term>
1635
1636 <listitem><para>Configures the pool of addresses to hand out. The pool
1637 is a contiguous sequence of IP addresses in the subnet configured for
1638 the server address, which does not include the subnet nor the broadcast
1639 address. <varname>PoolOffset=</varname> takes the offset of the pool
1640 from the start of subnet, or zero to use the default value.
1641 <varname>PoolSize=</varname> takes the number of IP addresses in the
1642 pool or zero to use the default value. By default, the pool starts at
1643 the first address after the subnet address and takes up the rest of
1644 the subnet, excluding the broadcast address. If the pool includes
1645 the server address (the default), this is reserved and not handed
1646 out to clients.</para></listitem>
1647 </varlistentry>
1648
1649 <varlistentry>
1650 <term><varname>DefaultLeaseTimeSec=</varname></term>
1651 <term><varname>MaxLeaseTimeSec=</varname></term>
1652
1653 <listitem><para>Control the default and maximum DHCP lease
1654 time to pass to clients. These settings take time values in seconds or
1655 another common time unit, depending on the suffix. The default
1656 lease time is used for clients that did not ask for a specific
1657 lease time. If a client asks for a lease time longer than the
1658 maximum lease time, it is automatically shortened to the
1659 specified time. The default lease time defaults to 1h, the
1660 maximum lease time to 12h. Shorter lease times are beneficial
1661 if the configuration data in DHCP leases changes frequently
1662 and clients shall learn the new settings with shorter
1663 latencies. Longer lease times reduce the generated DHCP
1664 network traffic.</para></listitem>
1665 </varlistentry>
1666
1667 <varlistentry>
1668 <term><varname>EmitDNS=</varname></term>
1669 <term><varname>DNS=</varname></term>
1670
1671 <listitem><para>Takes a boolean. Configures whether the DHCP leases handed out
1672 to clients shall contain DNS server information. Defaults to <literal>yes</literal>.
1673 The DNS servers to pass to clients may be configured with the
1674 <varname>DNS=</varname> option, which takes a list of IPv4
1675 addresses. If the <varname>EmitDNS=</varname> option is
1676 enabled but no servers configured, the servers are
1677 automatically propagated from an "uplink" interface that has
1678 appropriate servers set. The "uplink" interface is determined
1679 by the default route of the system with the highest
1680 priority. Note that this information is acquired at the time
1681 the lease is handed out, and does not take uplink interfaces
1682 into account that acquire DNS or NTP server information at a
1683 later point. DNS server propagation does not take
1684 <filename>/etc/resolv.conf</filename> into account. Also, note
1685 that the leases are not refreshed if the uplink network
1686 configuration changes. To ensure clients regularly acquire the
1687 most current uplink DNS server information, it is thus
1688 advisable to shorten the DHCP lease time via
1689 <varname>MaxLeaseTimeSec=</varname> described
1690 above.</para></listitem>
1691 </varlistentry>
1692
1693 <varlistentry>
1694 <term><varname>EmitNTP=</varname></term>
1695 <term><varname>NTP=</varname></term>
1696
1697 <listitem><para>Similar to the <varname>EmitDNS=</varname> and
1698 <varname>DNS=</varname> settings described above, these
1699 settings configure whether and what NTP server information
1700 shall be emitted as part of the DHCP lease. The same syntax,
1701 propagation semantics and defaults apply as for
1702 <varname>EmitDNS=</varname> and
1703 <varname>DNS=</varname>.</para></listitem>
1704 </varlistentry>
1705
1706 <varlistentry>
1707 <term><varname>EmitRouter=</varname></term>
1708
1709 <listitem><para>Similar to the <varname>EmitDNS=</varname>
1710 setting described above, this setting configures whether the
1711 DHCP lease should contain the router option. The same syntax,
1712 propagation semantics and defaults apply as for
1713 <varname>EmitDNS=</varname>.</para></listitem>
1714 </varlistentry>
1715
1716 <varlistentry>
1717 <term><varname>EmitTimezone=</varname></term>
1718 <term><varname>Timezone=</varname></term>
1719
1720 <listitem><para>Takes a boolean. Configures whether the DHCP leases handed out
1721 to clients shall contain timezone information. Defaults to <literal>yes</literal>. The
1722 <varname>Timezone=</varname> setting takes a timezone string
1723 (such as <literal>Europe/Berlin</literal> or
1724 <literal>UTC</literal>) to pass to clients. If no explicit
1725 timezone is set, the system timezone of the local host is
1726 propagated, as determined by the
1727 <filename>/etc/localtime</filename> symlink.</para></listitem>
1728 </varlistentry>
1729
1730 </variablelist>
1731 </refsect1>
1732
1733 <refsect1>
1734 <title>[IPv6PrefixDelegation] Section Options</title>
1735 <para>The <literal>[IPv6PrefixDelegation]</literal> section contains
1736 settings for sending IPv6 Router Advertisements and whether to act as
1737 a router, if enabled via the <varname>IPv6PrefixDelegation=</varname>
1738 option described above. IPv6 network prefixes are defined with one or
1739 more <literal>[IPv6Prefix]</literal> sections.</para>
1740
1741 <variablelist class='network-directives'>
1742
1743 <varlistentry>
1744 <term><varname>Managed=</varname></term>
1745 <term><varname>OtherInformation=</varname></term>
1746
1747 <listitem><para>Takes a boolean. Controls whether a DHCPv6 server is used to acquire IPv6
1748 addresses on the network link when <varname>Managed=</varname>
1749 is set to <literal>true</literal> or if only additional network
1750 information can be obtained via DHCPv6 for the network link when
1751 <varname>OtherInformation=</varname> is set to
1752 <literal>true</literal>. Both settings default to
1753 <literal>false</literal>, which means that a DHCPv6 server is not being
1754 used.</para></listitem>
1755 </varlistentry>
1756
1757 <varlistentry>
1758 <term><varname>RouterLifetimeSec=</varname></term>
1759
1760 <listitem><para>Takes a timespan. Configures the IPv6 router lifetime in seconds. If set,
1761 this host also announces itself in Router Advertisements as an IPv6
1762 router for the network link. When unset, the host is not acting as a router.</para>
1763 </listitem>
1764 </varlistentry>
1765
1766 <varlistentry>
1767 <term><varname>RouterPreference=</varname></term>
1768
1769 <listitem><para>Configures IPv6 router preference if
1770 <varname>RouterLifetimeSec=</varname> is non-zero. Valid values are
1771 <literal>high</literal>, <literal>medium</literal> and
1772 <literal>low</literal>, with <literal>normal</literal> and
1773 <literal>default</literal> added as synonyms for
1774 <literal>medium</literal> just to make configuration easier. See
1775 <ulink url="https://tools.ietf.org/html/rfc4191">RFC 4191</ulink>
1776 for details. Defaults to <literal>medium</literal>.</para></listitem>
1777 </varlistentry>
1778
1779 <varlistentry>
1780 <term><varname>EmitDNS=</varname></term>
1781 <term><varname>DNS=</varname></term>
1782
1783 <listitem><para><varname>DNS=</varname> specifies a list of recursive
1784 DNS server IPv6 addresses that distributed via Router Advertisement
1785 messages when <varname>EmitDNS=</varname> is true. If <varname>DNS=
1786 </varname> is empty, DNS servers are read from the
1787 <literal>[Network]</literal> section. If the
1788 <literal>[Network]</literal> section does not contain any DNS servers
1789 either, DNS servers from the uplink with the highest priority default
1790 route are used. When <varname>EmitDNS=</varname> is false, no DNS server
1791 information is sent in Router Advertisement messages.
1792 <varname>EmitDNS=</varname> defaults to true.
1793 </para></listitem>
1794 </varlistentry>
1795
1796 <varlistentry>
1797 <term><varname>EmitDomains=</varname></term>
1798 <term><varname>Domains=</varname></term>
1799
1800 <listitem><para>A list of DNS search domains distributed via Router
1801 Advertisement messages when <varname>EmitDomains=</varname> is true. If
1802 <varname>Domains=</varname> is empty, DNS search domains are read from the
1803 <literal>[Network]</literal> section. If the <literal>[Network]</literal>
1804 section does not contain any DNS search domains either, DNS search
1805 domains from the uplink with the highest priority default route are
1806 used. When <varname>EmitDomains=</varname> is false, no DNS search domain
1807 information is sent in Router Advertisement messages.
1808 <varname>EmitDomains=</varname> defaults to true.
1809 </para></listitem>
1810 </varlistentry>
1811
1812 <varlistentry>
1813 <term><varname>DNSLifetimeSec=</varname></term>
1814
1815 <listitem><para>Lifetime in seconds for the DNS server addresses listed
1816 in <varname>DNS=</varname> and search domains listed in
1817 <varname>Domains=</varname>.</para></listitem>
1818 </varlistentry>
1819
1820 </variablelist>
1821 </refsect1>
1822
1823 <refsect1>
1824 <title>[IPv6Prefix] Section Options</title>
1825 <para>One or more <literal>[IPv6Prefix]</literal> sections contain the IPv6
1826 prefixes that are announced via Router Advertisements. See
1827 <ulink url="https://tools.ietf.org/html/rfc4861">RFC 4861</ulink>
1828 for further details.</para>
1829
1830 <variablelist class='network-directives'>
1831
1832 <varlistentry>
1833 <term><varname>AddressAutoconfiguration=</varname></term>
1834 <term><varname>OnLink=</varname></term>
1835
1836 <listitem><para>Takes a boolean to specify whether IPv6 addresses can be
1837 autoconfigured with this prefix and whether the prefix can be used for
1838 onlink determination. Both settings default to <literal>true</literal>
1839 in order to ease configuration.
1840 </para></listitem>
1841 </varlistentry>
1842
1843 <varlistentry>
1844 <term><varname>Prefix=</varname></term>
1845
1846 <listitem><para>The IPv6 prefix that is to be distributed to hosts.
1847 Similarly to configuring static IPv6 addresses, the setting is
1848 configured as an IPv6 prefix and its prefix length, separated by a
1849 <literal>/</literal> character. Use multiple
1850 <literal>[IPv6Prefix]</literal> sections to configure multiple IPv6
1851 prefixes since prefix lifetimes, address autoconfiguration and onlink
1852 status may differ from one prefix to another.</para></listitem>
1853 </varlistentry>
1854
1855 <varlistentry>
1856 <term><varname>PreferredLifetimeSec=</varname></term>
1857 <term><varname>ValidLifetimeSec=</varname></term>
1858
1859 <listitem><para>Preferred and valid lifetimes for the prefix measured in
1860 seconds. <varname>PreferredLifetimeSec=</varname> defaults to 604800
1861 seconds (one week) and <varname>ValidLifetimeSec=</varname> defaults
1862 to 2592000 seconds (30 days).</para></listitem>
1863 </varlistentry>
1864
1865 </variablelist>
1866 </refsect1>
1867
1868 <refsect1>
1869 <title>[Bridge] Section Options</title>
1870 <para>The <literal>[Bridge]</literal> section accepts the
1871 following keys.</para>
1872 <variablelist class='network-directives'>
1873 <varlistentry>
1874 <term><varname>UnicastFlood=</varname></term>
1875 <listitem>
1876 <para>Takes a boolean. Controls whether the bridge should flood
1877 traffic for which an FDB entry is missing and the destination
1878 is unknown through this port. When unset, the kernel's default will be used.
1879 </para>
1880 </listitem>
1881 </varlistentry>
1882 <varlistentry>
1883 <term><varname>MulticastFlood=</varname></term>
1884 <listitem>
1885 <para>Takes a boolean. Controls whether the bridge should flood
1886 traffic for which an MDB entry is missing and the destination
1887 is unknown through this port. When unset, the kernel's default will be used.
1888 </para>
1889 </listitem>
1890 </varlistentry>
1891 <varlistentry>
1892 <term><varname>MulticastToUnicast=</varname></term>
1893 <listitem>
1894 <para>Takes a boolean. Multicast to unicast works on top of the multicast snooping feature of
1895 the bridge. Which means unicast copies are only delivered to hosts which are interested in it.
1896 When unset, the kernel's default will be used.
1897 </para>
1898 </listitem>
1899 </varlistentry>
1900 <varlistentry>
1901 <term><varname>NeighborSuppression=</varname></term>
1902 <listitem>
1903 <para>Takes a boolean. Configures whether ARP and ND neighbor suppression is enabled for
1904 this port. When unset, the kernel's default will be used.
1905 </para>
1906 </listitem>
1907 </varlistentry>
1908 <varlistentry>
1909 <term><varname>Learning=</varname></term>
1910 <listitem>
1911 <para>Takes a boolean. Configures whether MAC address learning is enabled for
1912 this port. When unset, the kernel's default will be used.
1913 </para>
1914 </listitem>
1915 </varlistentry>
1916 <varlistentry>
1917 <term><varname>HairPin=</varname></term>
1918 <listitem>
1919 <para>Takes a boolean. Configures whether traffic may be sent back
1920 out of the port on which it was received. When this flag is false, and the bridge
1921 will not forward traffic back out of the receiving port.
1922 When unset, the kernel's default will be used.</para>
1923 </listitem>
1924 </varlistentry>
1925 <varlistentry>
1926 <term><varname>UseBPDU=</varname></term>
1927 <listitem>
1928 <para>Takes a boolean. Configures whether STP Bridge Protocol Data Units will be
1929 processed by the bridge port. When unset, the kernel's default will be used.</para>
1930 </listitem>
1931 </varlistentry>
1932 <varlistentry>
1933 <term><varname>FastLeave=</varname></term>
1934 <listitem>
1935 <para>Takes a boolean. This flag allows the bridge to immediately stop multicast
1936 traffic on a port that receives an IGMP Leave message. It is only used with
1937 IGMP snooping if enabled on the bridge. When unset, the kernel's default will be used.</para>
1938 </listitem>
1939 </varlistentry>
1940 <varlistentry>
1941 <term><varname>AllowPortToBeRoot=</varname></term>
1942 <listitem>
1943 <para>Takes a boolean. Configures whether a given port is allowed to
1944 become a root port. Only used when STP is enabled on the bridge.
1945 When unset, the kernel's default will be used.</para>
1946 </listitem>
1947 </varlistentry>
1948 <varlistentry>
1949 <term><varname>ProxyARP=</varname></term>
1950 <listitem>
1951 <para>Takes a boolean. Configures whether proxy ARP to be enabled on this port.
1952 When unset, the kernel's default will be used.</para>
1953 </listitem>
1954 </varlistentry>
1955 <varlistentry>
1956 <term><varname>ProxyARPWiFi=</varname></term>
1957 <listitem>
1958 <para>Takes a boolean. Configures whether proxy ARP to be enabled on this port
1959 which meets extended requirements by IEEE 802.11 and Hotspot 2.0 specifications.
1960 When unset, the kernel's default will be used.</para>
1961 </listitem>
1962 </varlistentry>
1963 <varlistentry>
1964 <term><varname>MulticastRouter=</varname></term>
1965 <listitem>
1966 <para>Configures this port for having multicast routers attached. A port with a multicast
1967 router will receive all multicast traffic. Takes one of <literal>no</literal>
1968 to disable multicast routers on this port, <literal>query</literal> to let the system detect
1969 the presence of routers, <literal>permanent</literal> to permanently enable multicast traffic
1970 forwarding on this port, or <literal>temporary</literal> to enable multicast routers temporarily
1971 on this port, not depending on incoming queries. When unset, the kernel's default will be used.</para>
1972 </listitem>
1973 </varlistentry>
1974 <varlistentry>
1975 <term><varname>Cost=</varname></term>
1976 <listitem>
1977 <para>Sets the "cost" of sending packets of this interface.
1978 Each port in a bridge may have a different speed and the cost
1979 is used to decide which link to use. Faster interfaces
1980 should have lower costs. It is an integer value between 1 and
1981 65535.</para>
1982 </listitem>
1983 </varlistentry>
1984 <varlistentry>
1985 <term><varname>Priority=</varname></term>
1986 <listitem>
1987 <para>Sets the "priority" of sending packets on this interface.
1988 Each port in a bridge may have a different priority which is used
1989 to decide which link to use. Lower value means higher priority.
1990 It is an integer value between 0 to 63. Networkd does not set any
1991 default, meaning the kernel default value of 32 is used.</para>
1992 </listitem>
1993 </varlistentry>
1994 </variablelist>
1995 </refsect1>
1996 <refsect1>
1997 <title>[BridgeFDB] Section Options</title>
1998 <para>The <literal>[BridgeFDB]</literal> section manages the
1999 forwarding database table of a port and accepts the following
2000 keys. Specify several <literal>[BridgeFDB]</literal> sections to
2001 configure several static MAC table entries.</para>
2002
2003 <variablelist class='network-directives'>
2004 <varlistentry>
2005 <term><varname>MACAddress=</varname></term>
2006 <listitem>
2007 <para>As in the <literal>[Network]</literal> section. This
2008 key is mandatory.</para>
2009 </listitem>
2010 </varlistentry>
2011 <varlistentry>
2012 <term><varname>Destination=</varname></term>
2013 <listitem>
2014 <para>Takes an IP address of the destination VXLAN tunnel endpoint.</para>
2015 </listitem>
2016 </varlistentry>
2017 <varlistentry>
2018 <term><varname>VLANId=</varname></term>
2019 <listitem>
2020 <para>The VLAN ID for the new static MAC table entry. If
2021 omitted, no VLAN ID information is appended to the new static MAC
2022 table entry.</para>
2023 </listitem>
2024 </varlistentry>
2025 <varlistentry>
2026 <term><varname>VNI=</varname></term>
2027 <listitem>
2028 <para>The VXLAN Network Identifier (or VXLAN Segment ID) to use to connect to
2029 the remote VXLAN tunnel endpoint. Takes a number in the range 1-16777215.
2030 Defaults to unset.</para>
2031 </listitem>
2032 </varlistentry>
2033 <varlistentry>
2034 <term><varname>AssociatedWith=</varname></term>
2035 <listitem>
2036 <para>Specifies where the address is associated with. Takes one of <literal>use</literal>,
2037 <literal>self</literal>, <literal>master</literal> or <literal>router</literal>.
2038 <literal>use</literal> means the address is in use. User space can use this option to
2039 indicate to the kernel that the fdb entry is in use. <literal>self</literal> means
2040 the address is associated with the port drivers fdb. Usually hardware. <literal>master</literal>
2041 means the address is associated with master devices fdb. <literal>router</literal> means
2042 the destination address is associated with a router. Note that it's valid if the referenced
2043 device is a VXLAN type device and has route shortcircuit enabled. Defaults to <literal>self</literal>.</para>
2044 </listitem>
2045 </varlistentry>
2046 </variablelist>
2047 </refsect1>
2048
2049 <refsect1>
2050 <title>[CAN] Section Options</title>
2051 <para>The <literal>[CAN]</literal> section manages the Controller Area Network (CAN bus) and accepts the
2052 following keys.</para>
2053 <variablelist class='network-directives'>
2054 <varlistentry>
2055 <term><varname>BitRate=</varname></term>
2056 <listitem>
2057 <para>The bitrate of CAN device in bits per second. The usual SI prefixes (K, M) with the base of 1000 can
2058 be used here.</para>
2059 </listitem>
2060 </varlistentry>
2061 <varlistentry>
2062 <term><varname>SamplePoint=</varname></term>
2063 <listitem>
2064 <para>Optional sample point in percent with one decimal (e.g. <literal>75%</literal>,
2065 <literal>87.5%</literal>) or permille (e.g. <literal>875‰</literal>).</para>
2066 </listitem>
2067 </varlistentry>
2068 <varlistentry>
2069 <term><varname>RestartSec=</varname></term>
2070 <listitem>
2071 <para>Automatic restart delay time. If set to a non-zero value, a restart of the CAN controller will be
2072 triggered automatically in case of a bus-off condition after the specified delay time. Subsecond delays can
2073 be specified using decimals (e.g. <literal>0.1s</literal>) or a <literal>ms</literal> or
2074 <literal>us</literal> postfix. Using <literal>infinity</literal> or <literal>0</literal> will turn the
2075 automatic restart off. By default automatic restart is disabled.</para>
2076 </listitem>
2077 </varlistentry>
2078 <varlistentry>
2079 <term><varname>TripleSampling=</varname></term>
2080 <listitem>
2081 <para>Takes a boolean. When <literal>yes</literal>, three samples (instead of one) are used to determine
2082 the value of a received bit by majority rule. When unset, the kernel's default will be used.</para>
2083 </listitem>
2084 </varlistentry>
2085 </variablelist>
2086 </refsect1>
2087
2088 <refsect1>
2089 <title>[BridgeVLAN] Section Options</title>
2090 <para>The <literal>[BridgeVLAN]</literal> section manages the VLAN ID configuration of a bridge port and accepts
2091 the following keys. Specify several <literal>[BridgeVLAN]</literal> sections to configure several VLAN entries.
2092 The <varname>VLANFiltering=</varname> option has to be enabled, see <literal>[Bridge]</literal> section in
2093 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
2094
2095 <variablelist class='network-directives'>
2096 <varlistentry>
2097 <term><varname>VLAN=</varname></term>
2098 <listitem>
2099 <para>The VLAN ID allowed on the port. This can be either a single ID or a range M-N. VLAN IDs are valid
2100 from 1 to 4094.</para>
2101 </listitem>
2102 </varlistentry>
2103 <varlistentry>
2104 <term><varname>EgressUntagged=</varname></term>
2105 <listitem>
2106 <para>The VLAN ID specified here will be used to untag frames on egress. Configuring
2107 <varname>EgressUntagged=</varname> implicates the use of <varname>VLAN=</varname> above and will enable the
2108 VLAN ID for ingress as well. This can be either a single ID or a range M-N.</para>
2109 </listitem>
2110 </varlistentry>
2111 <varlistentry>
2112 <term><varname>PVID=</varname></term>
2113 <listitem>
2114 <para>The Port VLAN ID specified here is assigned to all untagged frames at ingress.
2115 <varname>PVID=</varname> can be used only once. Configuring <varname>PVID=</varname> implicates the use of
2116 <varname>VLAN=</varname> above and will enable the VLAN ID for ingress as well.</para>
2117 </listitem>
2118 </varlistentry>
2119 </variablelist>
2120 </refsect1>
2121
2122 <refsect1>
2123 <title>Examples</title>
2124 <example>
2125 <title>Static network configuration</title>
2126
2127 <programlisting># /etc/systemd/network/50-static.network
2128 [Match]
2129 Name=enp2s0
2130
2131 [Network]
2132 Address=192.168.0.15/24
2133 Gateway=192.168.0.1</programlisting>
2134
2135 <para>This brings interface <literal>enp2s0</literal> up with a static address. The
2136 specified gateway will be used for a default route.</para>
2137 </example>
2138
2139 <example>
2140 <title>DHCP on ethernet links</title>
2141
2142 <programlisting># /etc/systemd/network/80-dhcp.network
2143 [Match]
2144 Name=en*
2145
2146 [Network]
2147 DHCP=yes</programlisting>
2148
2149 <para>This will enable DHCPv4 and DHCPv6 on all interfaces with names starting with
2150 <literal>en</literal> (i.e. ethernet interfaces).</para>
2151 </example>
2152
2153 <example>
2154 <title>A bridge with two enslaved links</title>
2155
2156 <programlisting># /etc/systemd/network/25-bridge-static.network
2157 [Match]
2158 Name=bridge0
2159
2160 [Network]
2161 Address=192.168.0.15/24
2162 Gateway=192.168.0.1
2163 DNS=192.168.0.1</programlisting>
2164
2165 <programlisting># /etc/systemd/network/25-bridge-slave-interface-1.network
2166 [Match]
2167 Name=enp2s0
2168
2169 [Network]
2170 Bridge=bridge0</programlisting>
2171
2172 <programlisting># /etc/systemd/network/25-bridge-slave-interface-2.network
2173 [Match]
2174 Name=wlp3s0
2175
2176 [Network]
2177 Bridge=bridge0</programlisting>
2178
2179 <para>This creates a bridge and attaches devices <literal>enp2s0</literal> and
2180 <literal>wlp3s0</literal> to it. The bridge will have the specified static address
2181 and network assigned, and a default route via the specified gateway will be
2182 added. The specified DNS server will be added to the global list of DNS resolvers.
2183 </para>
2184 </example>
2185
2186 <example>
2187 <title></title>
2188
2189 <programlisting>
2190 # /etc/systemd/network/20-bridge-slave-interface-vlan.network
2191 [Match]
2192 Name=enp2s0
2193
2194 [Network]
2195 Bridge=bridge0
2196
2197 [BridgeVLAN]
2198 VLAN=1-32
2199 PVID=42
2200 EgressUntagged=42
2201
2202 [BridgeVLAN]
2203 VLAN=100-200
2204
2205 [BridgeVLAN]
2206 EgressUntagged=300-400</programlisting>
2207
2208 <para>This overrides the configuration specified in the previous example for the
2209 interface <literal>enp2s0</literal>, and enables VLAN on that bridge port. VLAN IDs
2210 1-32, 42, 100-400 will be allowed. Packets tagged with VLAN IDs 42, 300-400 will be
2211 untagged when they leave on this interface. Untagged packets which arrive on this
2212 interface will be assigned VLAN ID 42.</para>
2213 </example>
2214
2215 <example>
2216 <title>Various tunnels</title>
2217
2218 <programlisting>/etc/systemd/network/25-tunnels.network
2219 [Match]
2220 Name=ens1
2221
2222 [Network]
2223 Tunnel=ipip-tun
2224 Tunnel=sit-tun
2225 Tunnel=gre-tun
2226 Tunnel=vti-tun
2227 </programlisting>
2228
2229 <programlisting>/etc/systemd/network/25-tunnel-ipip.netdev
2230 [NetDev]
2231 Name=ipip-tun
2232 Kind=ipip
2233 </programlisting>
2234
2235 <programlisting>/etc/systemd/network/25-tunnel-sit.netdev
2236 [NetDev]
2237 Name=sit-tun
2238 Kind=sit
2239 </programlisting>
2240
2241 <programlisting>/etc/systemd/network/25-tunnel-gre.netdev
2242 [NetDev]
2243 Name=gre-tun
2244 Kind=gre
2245 </programlisting>
2246
2247 <programlisting>/etc/systemd/network/25-tunnel-vti.netdev
2248 [NetDev]
2249 Name=vti-tun
2250 Kind=vti
2251 </programlisting>
2252
2253 <para>This will bring interface <literal>ens1</literal> up and create an IPIP tunnel,
2254 a SIT tunnel, a GRE tunnel, and a VTI tunnel using it.</para>
2255 </example>
2256
2257 <example>
2258 <title>A bond device</title>
2259
2260 <programlisting># /etc/systemd/network/30-bond1.network
2261 [Match]
2262 Name=bond1
2263
2264 [Network]
2265 DHCP=ipv6
2266 </programlisting>
2267
2268 <programlisting># /etc/systemd/network/30-bond1.netdev
2269 [NetDev]
2270 Name=bond1
2271 Kind=bond
2272 </programlisting>
2273
2274 <programlisting># /etc/systemd/network/30-bond1-dev1.network
2275 [Match]
2276 MACAddress=52:54:00:e9:64:41
2277
2278 [Network]
2279 Bond=bond1
2280 </programlisting>
2281
2282 <programlisting># /etc/systemd/network/30-bond1-dev2.network
2283 [Match]
2284 MACAddress=52:54:00:e9:64:42
2285
2286 [Network]
2287 Bond=bond1
2288 </programlisting>
2289
2290 <para>This will create a bond device <literal>bond1</literal> and enslave the two
2291 devices with MAC addresses 52:54:00:e9:64:41 and 52:54:00:e9:64:42 to it. IPv6 DHCP
2292 will be used to acquire an address.</para>
2293 </example>
2294
2295 <example>
2296 <title>Virtual Routing and Forwarding (VRF)</title>
2297 <para>Add the <literal>bond1</literal> interface to the VRF master interface
2298 <literal>vrf1</literal>. This will redirect routes generated on this interface to be
2299 within the routing table defined during VRF creation. For kernels before 4.8 traffic
2300 won't be redirected towards the VRFs routing table unless specific ip-rules are added.
2301 </para>
2302 <programlisting># /etc/systemd/network/25-vrf.network
2303 [Match]
2304 Name=bond1
2305
2306 [Network]
2307 VRF=vrf1
2308 </programlisting>
2309 </example>
2310
2311 <example>
2312 <title>MacVTap</title>
2313 <para>This brings up a network interface <literal>macvtap-test</literal>
2314 and attaches it to <literal>enp0s25</literal>.</para>
2315 <programlisting># /usr/lib/systemd/network/25-macvtap.network
2316 [Match]
2317 Name=enp0s25
2318
2319 [Network]
2320 MACVTAP=macvtap-test
2321 </programlisting>
2322 </example>
2323 </refsect1>
2324
2325 <refsect1>
2326 <title>See Also</title>
2327 <para>
2328 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
2329 <citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
2330 <citerefentry><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
2331 <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
2332 <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
2333 </para>
2334 </refsect1>
2335
2336 </refentry>