Chapter 14. Getting started with IPVLAN IPVLAN is a driver for a virtual network device that can be used in container environment to access the host network. IPVLAN exposes a single MAC address to the external network regardless the number of IPVLAN device created inside the host network. This means that a user can have multiple IPVLAN devices in multiple containers and the corresponding switch reads a single MAC address. IPVLAN driver is useful when the local switch imposes constraints on the total number of MAC addresses that it can manage. 14.1. IPVLAN modes The following modes are available for IPVLAN: L2 mode In IPVLAN L2 mode , virtual devices receive and respond to address resolution protocol (ARP) requests. The netfilter framework runs only inside the container that owns the virtual device. No netfilter chains are executed in the default namespace on the containerized traffic. Using L2 mode provides good performance, but less control on the network traffic. L3 mode In L3 mode , virtual devices process only L3 traffic and above. Virtual devices do not respond to ARP request and users must configure the neighbour entries for the IPVLAN IP addresses on the relevant peers manually. The egress traffic of a relevant container is landed on the netfilter POSTROUTING and OUTPUT chains in the default namespace while the ingress traffic is threaded in the same way as L2 mode . Using L3 mode provides good control but decreases the network traffic performance. L3S mode In L3S mode , virtual devices process the same way as in L3 mode , except that both egress and ingress traffics of a relevant container are landed on netfilter chain in the default namespace. L3S mode behaves in a similar way to L3 mode but provides greater control of the network. Note The IPVLAN virtual device does not receive broadcast and multicast traffic in case of L3 and L3S modes. 14.2. Comparison of IPVLAN and MACVLAN The following table shows the major differences between MACVLAN and IPVLAN: MACVLAN IPVLAN Uses MAC address for each MACVLAN device. Note that, if a switch reaches the maximum number of MAC addresses it can store in its MAC table, connectivity can be lost. Uses single MAC address which does not limit the number of IPVLAN devices. Netfilter rules for a global namespace cannot affect traffic to or from a MACVLAN device in a child namespace. It is possible to control traffic to or from a IPVLAN device in L3 mode and L3S mode . Both IPVLAN and MACVLAN do not require any level of encapsulation. 14.3. Creating and configuring the IPVLAN device using iproute2 This procedure shows how to set up the IPVLAN device using iproute2 . Procedure To create an IPVLAN device, enter the following command: Note that network interface controller (NIC) is a hardware component which connects a computer to a network. Example 14.1. Creating an IPVLAN device To assign an IPv4 or IPv6 address to the interface, enter the following command: In case of configuring an IPVLAN device in L3 mode or L3S mode , make the following setups: Configure the neighbor setup for the remote peer on the remote host: where MAC_address is the MAC address of the real NIC on which an IPVLAN device is based on. Configure an IPVLAN device for L3 mode with the following command: For L3S mode : where IP-address represents the address of the remote peer. To set an IPVLAN device active, enter the following command: To check if the IPVLAN device is active, execute the following command on the remote host: where the IP_address uses the IP address of the IPVLAN device.

Commands:
ip link add link real_NIC_device name IPVLAN_device type ipvlan mode l2
ip link add link enp0s31f6 name my_ipvlan type ipvlan mode l2 ip link 47: my_ipvlan@enp0s31f6: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether e8:6a:6e:8a:a2:44 brd ff:ff:ff:ff:ff:ff
ip addr add dev IPVLAN_device IP_address/subnet_mask_prefix
ip neigh add dev peer_device IPVLAN_device_IP_address lladdr MAC_address
ip route add dev <real_NIC_device> <peer_IP_address/32>
ip route add dev real_NIC_device peer_IP_address/32
ip link set dev IPVLAN_device up
ping IP_address