Virtual Ethernet (veth) Interfaces in VyOS

Virtual Ethernet (veth) interfaces in VyOS are virtual network devices that are always created in pairs and behave like a virtual Ethernet cable. Packets sent to one end of the pair appear immediately at the other end.

Overview

Virtual Ethernet interfaces are used for:

VRF Interconnection: Connecting different VRF routing tables
Network Namespaces: Creating tunnels between isolated network spaces
Container Networking: Attaching containers to the physical network
Testing: Testing network configurations without physical hardware
Cross-Domain Routing: Routing between isolated domains
Service Chaining: Building chains of network services

Key Characteristics

Characteristic	Description
Creation	Always in pairs (peer interfaces)
OSI layer	L2 and L3 (supports both)
State	Depends on the peer interface
Use cases	VRF, namespaces, containers
Performance	Wire speed (kernel-level)
MTU	Configurable (default 1500)

veth vs Other Virtual Interfaces

Interface	Purpose	Paired	VRF Support
veth	Peer-to-peer tunnel	Yes	Yes
dummy	Always-up interface	No	Yes
loopback	Router ID, management	No	No
bridge	L2 switching	No	No
vlan	L2 segmentation	No	Yes

When to use veth:

Connecting VRF tables
Inter-network connectivity between isolated domains
Container/VM networking
Network function chaining

When to use other interfaces:

dummy: Testing, blackhole routing
loopback: Router ID, stable endpoint
bridge: L2 switching between ports
vlan: Segmentation on a single physical interface

Basic Configuration

Creating a veth Pair

The minimal configuration requires specifying the peer interface:

# Создание veth0 с peer veth1
set interfaces virtual-ethernet veth0 peer-name veth1
set interfaces virtual-ethernet veth0 address 192.0.2.1/24

# Автоматически создается veth1
set interfaces virtual-ethernet veth1 address 192.0.2.2/24

commit
save

veth0 and veth1 are now connected like a virtual cable. Packets sent to veth0 appear on veth1 and vice versa.

Verifying State

show interfaces virtual-ethernet

# Вывод:
# veth0@veth1: <BROADCAST,MULTICAST,UP,LOWER_UP>
#     inet 192.0.2.1/24
# veth1@veth0: <BROADCAST,MULTICAST,UP,LOWER_UP>
#     inet 192.0.2.2/24

Interface Descriptions

set interfaces virtual-ethernet veth0 description 'VRF RED side'
set interfaces virtual-ethernet veth1 description 'VRF BLUE side'

commit
save

Multiple IP Addresses

# veth0 с несколькими адресами
set interfaces virtual-ethernet veth0 address 192.0.2.1/24
set interfaces virtual-ethernet veth0 address 10.0.0.1/30
set interfaces virtual-ethernet veth0 address 2001:db8::1/64

commit
save

IPv6 Configuration

# Dual-stack veth пара
set interfaces virtual-ethernet veth0 address 192.0.2.1/24
set interfaces virtual-ethernet veth0 address 2001:db8:1::1/64

set interfaces virtual-ethernet veth1 address 192.0.2.2/24
set interfaces virtual-ethernet veth1 address 2001:db8:1::2/64

commit
save

VRF Interconnection

The primary use of veth is to connect different VRF routing tables.

Basic VRF Connection

# Создание VRF таблиц
set vrf name RED table 100
set vrf name BLUE table 200

# Создание veth пары для межсоединения
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.0.0/31
set interfaces virtual-ethernet veth10 description 'RED to BLUE link'

set interfaces virtual-ethernet veth11 address 100.64.0.1/31
set interfaces virtual-ethernet veth11 vrf RED
set interfaces virtual-ethernet veth11 description 'BLUE to RED link'

# Или поместить veth10 в BLUE VRF
set interfaces virtual-ethernet veth10 vrf BLUE

commit
save

VRF RED and BLUE are now connected through a veth pair using the addresses 100.64.0.0/31.

Routing Between VRFs

# VRF конфигурация
set vrf name RED table 100
set vrf name BLUE table 200

# veth пара
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.0.0/31
set interfaces virtual-ethernet veth10 vrf BLUE

set interfaces virtual-ethernet veth11 address 100.64.0.1/31
set interfaces virtual-ethernet veth11 vrf RED

# Сети в VRF RED
set interfaces ethernet eth1 vrf RED
set interfaces ethernet eth1 address 192.168.10.1/24

# Сети в VRF BLUE
set interfaces ethernet eth2 vrf BLUE
set interfaces ethernet eth2 address 192.168.20.1/24

# Статические маршруты для межсоединения
set protocols vrf RED static route 192.168.20.0/24 next-hop 100.64.0.0
set protocols vrf BLUE static route 192.168.10.0/24 next-hop 100.64.0.1

commit
save

The networks 192.168.10.0/24 (VRF RED) and 192.168.20.0/24 (VRF BLUE) can now communicate through the veth tunnel.

Verifying VRF Routing

# Проверка VRF таблиц
show vrf

# Таблица маршрутизации VRF RED
show ip route vrf RED

# Таблица маршрутизации VRF BLUE
show ip route vrf BLUE

# Ping между VRF (с указанием VRF)
ping 192.168.20.1 vrf RED
ping 192.168.10.1 vrf BLUE

# Traceroute между VRF
traceroute 192.168.20.1 vrf RED

Multiple VRF Connections

# Создание трех VRF
set vrf name CUSTOMER-A table 100
set vrf name CUSTOMER-B table 200
set vrf name SHARED-SERVICES table 300

# veth пары для соединения CUSTOMER-A <-> SHARED-SERVICES
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.0.0/31
set interfaces virtual-ethernet veth10 vrf CUSTOMER-A

set interfaces virtual-ethernet veth11 address 100.64.0.1/31
set interfaces virtual-ethernet veth11 vrf SHARED-SERVICES

# veth пары для соединения CUSTOMER-B <-> SHARED-SERVICES
set interfaces virtual-ethernet veth20 peer-name veth21
set interfaces virtual-ethernet veth20 address 100.64.0.2/31
set interfaces virtual-ethernet veth20 vrf CUSTOMER-B

set interfaces virtual-ethernet veth21 address 100.64.0.3/31
set interfaces virtual-ethernet veth21 vrf SHARED-SERVICES

# Маршруты в CUSTOMER-A для доступа к SHARED-SERVICES
set protocols vrf CUSTOMER-A static route 10.255.255.0/24 next-hop 100.64.0.1

# Маршруты в CUSTOMER-B для доступа к SHARED-SERVICES
set protocols vrf CUSTOMER-B static route 10.255.255.0/24 next-hop 100.64.0.3

# Обратные маршруты в SHARED-SERVICES
set protocols vrf SHARED-SERVICES static route 192.168.100.0/24 next-hop 100.64.0.0  # To CUSTOMER-A
set protocols vrf SHARED-SERVICES static route 192.168.200.0/24 next-hop 100.64.0.2  # To CUSTOMER-B

commit
save

CUSTOMER-A and CUSTOMER-B can now reach SHARED-SERVICES, but they remain isolated from each other.

Advanced Configuration

MTU Settings

# Установка MTU для veth пары
set interfaces virtual-ethernet veth0 mtu 9000
set interfaces virtual-ethernet veth1 mtu 9000

commit
save

The MTU must be the same on both ends of the pair.

DHCP on veth

# DHCP клиент на veth (необычное использование)
set interfaces virtual-ethernet veth0 address dhcp

# DHCP сервер для veth сети
set service dhcp-server shared-network-name VETH-NET subnet 100.64.0.0/31
set service dhcp-server shared-network-name VETH-NET subnet 100.64.0.0/31 range 0 start 100.64.0.1
set service dhcp-server shared-network-name VETH-NET subnet 100.64.0.0/31 range 0 stop 100.64.0.1

commit
save

Policy-Based Routing with veth

# PBR для трафика через veth
set policy route PBR-VETH rule 10 destination address 192.168.20.0/24
set policy route PBR-VETH rule 10 set table 100

# Применение к интерфейсу
set interfaces ethernet eth0 policy route PBR-VETH

# veth в VRF table 100
set interfaces virtual-ethernet veth0 vrf CUSTOM

commit
save

Firewall on veth

# Firewall для veth интерфейсов
set firewall ipv4 name VETH-IN default-action drop
set firewall ipv4 name VETH-IN rule 10 action accept
set firewall ipv4 name VETH-IN rule 10 state established
set firewall ipv4 name VETH-IN rule 10 state related

set firewall ipv4 name VETH-IN rule 20 action accept
set firewall ipv4 name VETH-IN rule 20 protocol icmp

set firewall ipv4 name VETH-IN rule 30 action accept
set firewall ipv4 name VETH-IN rule 30 source address 100.64.0.0/31

# Применение к veth0
set interfaces virtual-ethernet veth0 firewall in name VETH-IN

commit
save

QoS on veth

# Traffic shaping на veth
set traffic-policy shaper VETH-SHAPER bandwidth 100mbit
set traffic-policy shaper VETH-SHAPER default bandwidth 80mbit

# Применение к veth
set interfaces virtual-ethernet veth0 traffic-policy out VETH-SHAPER

commit
save

Cloud Platform Examples

Yandex Cloud: Multi-Tenant VRF with Shared Services

Scenario: Two tenants with isolated VRFs but shared access to common services (DNS, NTP, monitoring).

# VRF для клиентов
set vrf name TENANT-A table 100
set vrf name TENANT-B table 200
set vrf name SHARED table 300

# Физические интерфейсы клиентов
set interfaces ethernet eth1 vrf TENANT-A
set interfaces ethernet eth1 address 10.10.1.1/24
set interfaces ethernet eth1 description 'Tenant A - Yandex Cloud Subnet'

set interfaces ethernet eth2 vrf TENANT-B
set interfaces ethernet eth2 address 10.20.1.1/24
set interfaces ethernet eth2 description 'Tenant B - Yandex Cloud Subnet'

# Интерфейс для shared services
set interfaces ethernet eth3 vrf SHARED
set interfaces ethernet eth3 address 10.255.0.1/24
set interfaces ethernet eth3 description 'Shared Services - Yandex Cloud'

# veth пары для TENANT-A <-> SHARED
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.10.0/31
set interfaces virtual-ethernet veth10 vrf TENANT-A
set interfaces virtual-ethernet veth10 description 'Tenant A to Shared'

set interfaces virtual-ethernet veth11 address 100.64.10.1/31
set interfaces virtual-ethernet veth11 vrf SHARED
set interfaces virtual-ethernet veth11 description 'Shared to Tenant A'

# veth пары для TENANT-B <-> SHARED
set interfaces virtual-ethernet veth20 peer-name veth21
set interfaces virtual-ethernet veth20 address 100.64.20.0/31
set interfaces virtual-ethernet veth20 vrf TENANT-B
set interfaces virtual-ethernet veth20 description 'Tenant B to Shared'

set interfaces virtual-ethernet veth21 address 100.64.20.1/31
set interfaces virtual-ethernet veth21 vrf SHARED
set interfaces virtual-ethernet veth21 description 'Shared to Tenant B'

# Маршруты от клиентов к shared services
set protocols vrf TENANT-A static route 10.255.0.0/24 next-hop 100.64.10.1
set protocols vrf TENANT-B static route 10.255.0.0/24 next-hop 100.64.20.1

# Обратные маршруты от shared к клиентам
set protocols vrf SHARED static route 10.10.1.0/24 next-hop 100.64.10.0
set protocols vrf SHARED static route 10.20.1.0/24 next-hop 100.64.20.0

# Firewall для контроля доступа (только определенные сервисы)
set firewall ipv4 name SHARED-IN default-action drop
set firewall ipv4 name SHARED-IN rule 10 action accept
set firewall ipv4 name SHARED-IN rule 10 state established
set firewall ipv4 name SHARED-IN rule 10 state related

set firewall ipv4 name SHARED-IN rule 20 action accept
set firewall ipv4 name SHARED-IN rule 20 protocol udp
set firewall ipv4 name SHARED-IN rule 20 destination port 53  # DNS
set firewall ipv4 name SHARED-IN rule 20 destination address 10.255.0.10

set firewall ipv4 name SHARED-IN rule 30 action accept
set firewall ipv4 name SHARED-IN rule 30 protocol udp
set firewall ipv4 name SHARED-IN rule 30 destination port 123  # NTP
set firewall ipv4 name SHARED-IN rule 30 destination address 10.255.0.11

set interfaces virtual-ethernet veth11 firewall in name SHARED-IN
set interfaces virtual-ethernet veth21 firewall in name SHARED-IN

commit
save

VK Cloud: VRF for DMZ and Internal Networks

Scenario: Separating the DMZ (public services) and Internal (private services) through VRFs with controlled interaction.

# VRF для DMZ и Internal
set vrf name DMZ table 100
set vrf name INTERNAL table 200

# DMZ интерфейс (публичный)
set interfaces ethernet eth0 vrf DMZ
set interfaces ethernet eth0 address 203.0.113.1/24
set interfaces ethernet eth0 description 'DMZ - VK Cloud Public Subnet'

# Internal интерфейс (приватный)
set interfaces ethernet eth1 vrf INTERNAL
set interfaces ethernet eth1 address 10.0.1.1/24
set interfaces ethernet eth1 description 'Internal - VK Cloud Private Subnet'

# veth пара для контролируемого взаимодействия
set interfaces virtual-ethernet veth50 peer-name veth51
set interfaces virtual-ethernet veth50 address 100.64.50.0/31
set interfaces virtual-ethernet veth50 vrf DMZ
set interfaces virtual-ethernet veth50 description 'DMZ to Internal'

set interfaces virtual-ethernet veth51 address 100.64.50.1/31
set interfaces virtual-ethernet veth51 vrf INTERNAL
set interfaces virtual-ethernet veth51 description 'Internal to DMZ'

# Маршруты
# DMZ может инициировать соединения к Internal (для backend API)
set protocols vrf DMZ static route 10.0.1.0/24 next-hop 100.64.50.1

# Internal может получать ответы, но не инициировать
# (контролируется через firewall)

# Firewall - Internal принимает только established соединения от DMZ
set firewall ipv4 name INTERNAL-FROM-DMZ default-action drop
set firewall ipv4 name INTERNAL-FROM-DMZ rule 10 action accept
set firewall ipv4 name INTERNAL-FROM-DMZ rule 10 state established
set firewall ipv4 name INTERNAL-FROM-DMZ rule 10 state related

set firewall ipv4 name INTERNAL-FROM-DMZ rule 20 action accept
set firewall ipv4 name INTERNAL-FROM-DMZ rule 20 protocol tcp
set firewall ipv4 name INTERNAL-FROM-DMZ rule 20 destination port 5432  # PostgreSQL
set firewall ipv4 name INTERNAL-FROM-DMZ rule 20 destination address 10.0.1.10

set firewall ipv4 name INTERNAL-FROM-DMZ rule 30 action accept
set firewall ipv4 name INTERNAL-FROM-DMZ rule 30 protocol tcp
set firewall ipv4 name INTERNAL-FROM-DMZ rule 30 destination port 6379  # Redis
set firewall ipv4 name INTERNAL-FROM-DMZ rule 30 destination address 10.0.1.11

set interfaces virtual-ethernet veth51 firewall in name INTERNAL-FROM-DMZ

# NAT для DMZ интерфейса (выход в интернет)
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 203.0.113.0/24
set nat source rule 100 translation address masquerade

commit
save

Yandex Cloud: Development/Staging/Production VRF

Scenario: Three isolated environments with controlled access between them.

# VRF для сред
set vrf name DEV table 100
set vrf name STAGING table 200
set vrf name PRODUCTION table 300
set vrf name MANAGEMENT table 400

# Интерфейсы
set interfaces ethernet eth1 vrf DEV
set interfaces ethernet eth1 address 10.100.0.1/16
set interfaces ethernet eth1 description 'Development - Yandex Cloud'

set interfaces ethernet eth2 vrf STAGING
set interfaces ethernet eth2 address 10.200.0.1/16
set interfaces ethernet eth2 description 'Staging - Yandex Cloud'

set interfaces ethernet eth3 vrf PRODUCTION
set interfaces ethernet eth3 address 10.300.0.1/16
set interfaces ethernet eth3 description 'Production - Yandex Cloud'

set interfaces ethernet eth4 vrf MANAGEMENT
set interfaces ethernet eth4 address 10.255.0.1/24
set interfaces ethernet eth4 description 'Management - Yandex Cloud'

# veth для MANAGEMENT доступа ко всем средам
# MANAGEMENT <-> DEV
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.1.0/31
set interfaces virtual-ethernet veth10 vrf MANAGEMENT

set interfaces virtual-ethernet veth11 address 100.64.1.1/31
set interfaces virtual-ethernet veth11 vrf DEV

# MANAGEMENT <-> STAGING
set interfaces virtual-ethernet veth20 peer-name veth21
set interfaces virtual-ethernet veth20 address 100.64.2.0/31
set interfaces virtual-ethernet veth20 vrf MANAGEMENT

set interfaces virtual-ethernet veth21 address 100.64.2.1/31
set interfaces virtual-ethernet veth21 vrf STAGING

# MANAGEMENT <-> PRODUCTION
set interfaces virtual-ethernet veth30 peer-name veth31
set interfaces virtual-ethernet veth30 address 100.64.3.0/31
set interfaces virtual-ethernet veth30 vrf MANAGEMENT

set interfaces virtual-ethernet veth31 address 100.64.3.1/31
set interfaces virtual-ethernet veth31 vrf PRODUCTION

# Опционально: DEV <-> STAGING (для CI/CD)
set interfaces virtual-ethernet veth40 peer-name veth41
set interfaces virtual-ethernet veth40 address 100.64.4.0/31
set interfaces virtual-ethernet veth40 vrf DEV

set interfaces virtual-ethernet veth41 address 100.64.4.1/31
set interfaces virtual-ethernet veth41 vrf STAGING

# Маршруты от MANAGEMENT ко всем средам
set protocols vrf MANAGEMENT static route 10.100.0.0/16 next-hop 100.64.1.1
set protocols vrf MANAGEMENT static route 10.200.0.0/16 next-hop 100.64.2.1
set protocols vrf MANAGEMENT static route 10.300.0.0/16 next-hop 100.64.3.1

# Обратные маршруты (только для MANAGEMENT сети)
set protocols vrf DEV static route 10.255.0.0/24 next-hop 100.64.1.0
set protocols vrf STAGING static route 10.255.0.0/24 next-hop 100.64.2.0
set protocols vrf PRODUCTION static route 10.255.0.0/24 next-hop 100.64.3.0

# Маршрут от DEV к STAGING (для CI/CD)
set protocols vrf DEV static route 10.200.0.0/16 next-hop 100.64.4.1
set protocols vrf STAGING static route 10.100.0.0/16 next-hop 100.64.4.0

# Firewall - PRODUCTION принимает только SSH от MANAGEMENT
set firewall ipv4 name PROD-MGMT-IN default-action drop
set firewall ipv4 name PROD-MGMT-IN rule 10 action accept
set firewall ipv4 name PROD-MGMT-IN rule 10 state established
set firewall ipv4 name PROD-MGMT-IN rule 10 state related

set firewall ipv4 name PROD-MGMT-IN rule 20 action accept
set firewall ipv4 name PROD-MGMT-IN rule 20 protocol tcp
set firewall ipv4 name PROD-MGMT-IN rule 20 destination port 22
set firewall ipv4 name PROD-MGMT-IN rule 20 source address 10.255.0.0/24

set interfaces virtual-ethernet veth31 firewall in name PROD-MGMT-IN

commit
save

VK Cloud: Container Platform with VRF Isolation

Scenario: Kubernetes clusters in separate VRFs for different projects.

# VRF для Kubernetes кластеров
set vrf name K8S-CLUSTER-A table 100
set vrf name K8S-CLUSTER-B table 200
set vrf name K8S-SERVICES table 300  # Shared services (registry, monitoring)

# Интерфейсы для кластеров
set interfaces ethernet eth1 vrf K8S-CLUSTER-A
set interfaces ethernet eth1 address 10.10.0.1/16
set interfaces ethernet eth1 description 'K8s Cluster A - VK Cloud'

set interfaces ethernet eth2 vrf K8S-CLUSTER-B
set interfaces ethernet eth2 address 10.20.0.1/16
set interfaces ethernet eth2 description 'K8s Cluster B - VK Cloud'

set interfaces ethernet eth3 vrf K8S-SERVICES
set interfaces ethernet eth3 address 10.255.0.1/24
set interfaces ethernet eth3 description 'K8s Shared Services - VK Cloud'

# veth для доступа к shared services
# CLUSTER-A <-> SERVICES
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.10.0/31
set interfaces virtual-ethernet veth10 vrf K8S-CLUSTER-A

set interfaces virtual-ethernet veth11 address 100.64.10.1/31
set interfaces virtual-ethernet veth11 vrf K8S-SERVICES

# CLUSTER-B <-> SERVICES
set interfaces virtual-ethernet veth20 peer-name veth21
set interfaces virtual-ethernet veth20 address 100.64.20.0/31
set interfaces virtual-ethernet veth20 vrf K8S-CLUSTER-B

set interfaces virtual-ethernet veth21 address 100.64.20.1/31
set interfaces virtual-ethernet veth21 vrf K8S-SERVICES

# Маршруты к shared services
set protocols vrf K8S-CLUSTER-A static route 10.255.0.0/24 next-hop 100.64.10.1
set protocols vrf K8S-CLUSTER-B static route 10.255.0.0/24 next-hop 100.64.20.1

# Обратные маршруты
set protocols vrf K8S-SERVICES static route 10.10.0.0/16 next-hop 100.64.10.0
set protocols vrf K8S-SERVICES static route 10.20.0.0/16 next-hop 100.64.20.0

# Firewall для контроля доступа к services
set firewall ipv4 name K8S-SERVICES-IN default-action drop
set firewall ipv4 name K8S-SERVICES-IN rule 10 action accept
set firewall ipv4 name K8S-SERVICES-IN rule 10 state established
set firewall ipv4 name K8S-SERVICES-IN rule 10 state related

# Container registry (Harbor)
set firewall ipv4 name K8S-SERVICES-IN rule 20 action accept
set firewall ipv4 name K8S-SERVICES-IN rule 20 protocol tcp
set firewall ipv4 name K8S-SERVICES-IN rule 20 destination port 443
set firewall ipv4 name K8S-SERVICES-IN rule 20 destination address 10.255.0.10

# Monitoring (Prometheus)
set firewall ipv4 name K8S-SERVICES-IN rule 30 action accept
set firewall ipv4 name K8S-SERVICES-IN rule 30 protocol tcp
set firewall ipv4 name K8S-SERVICES-IN rule 30 destination port 9090
set firewall ipv4 name K8S-SERVICES-IN rule 30 destination address 10.255.0.20

set interfaces virtual-ethernet veth11 firewall in name K8S-SERVICES-IN
set interfaces virtual-ethernet veth21 firewall in name K8S-SERVICES-IN

commit
save

Monitoring and Diagnostics

Viewing veth Interfaces

# Все veth интерфейсы
show interfaces virtual-ethernet

# Детальная информация о конкретном veth
show interfaces virtual-ethernet veth0

# Статистика
show interfaces virtual-ethernet veth0 statistics

# Вывод:
# Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
# Interface        IP Address                        S/L  Description
# ---------        ----------                        ---  -----------
# veth0            192.0.2.1/24                      u/u  VRF RED side
# veth1            192.0.2.2/24                      u/u  VRF BLUE side

Checking Peer Links

# Проверка peer connections
ip link show type veth

# Вывод:
# 10: veth0@veth1: <BROADCAST,MULTICAST,UP,LOWER_UP>
# 11: veth1@veth0: <BROADCAST,MULTICAST,UP,LOWER_UP>

Checking VRF Assignments

# Показать все VRF
show vrf

# Детали конкретного VRF
show vrf RED

# Интерфейсы в VRF
show ip route vrf RED

# Вывод покажет veth интерфейсы в VRF

Testing Connectivity

# Ping между veth парой
ping 192.0.2.2 source-address 192.0.2.1

# Ping через VRF
ping 192.168.20.1 vrf RED

# Traceroute для проверки пути
traceroute 192.168.20.1 vrf RED

# Вывод покажет путь через veth

Monitoring Traffic

# tcpdump на veth интерфейсе
sudo tcpdump -i veth0

# Детальный вывод с заголовками
sudo tcpdump -i veth0 -v -e

# Фильтр по протоколу
sudo tcpdump -i veth0 icmp

# Сохранение в файл
sudo tcpdump -i veth0 -w /tmp/veth0.pcap

Checking Counters

# Статистика интерфейса
show interfaces virtual-ethernet veth0 statistics

# Вывод:
# RX:  bytes  packets  errors  dropped  overrun  mcast
#      12345   100      0       0        0        0
# TX:  bytes  packets  errors  dropped  carrier  collisions
#      54321   90       0       0        0        0

Logging

# Системные логи для veth
show log | match veth

# Kernel messages
dmesg | grep veth

# Firewall логи для veth трафика
show log firewall name VETH-IN

Troubleshooting

Problem: veth Interface in DOWN State

Diagnostics:

# Проверка состояния
show interfaces virtual-ethernet veth0

# Проверка peer интерфейса
show interfaces virtual-ethernet veth1

Causes and solutions:

The peer interface has not been created or was removed:

# Проверить конфигурацию peer
show configuration interfaces virtual-ethernet veth1

# Создать peer если отсутствует
set interfaces virtual-ethernet veth1 peer-name veth0
commit

The peer interface is administratively down:

# Включить peer интерфейс
delete interfaces virtual-ethernet veth1 disable
commit

Configuration conflict:

# Пересоздать veth пару
delete interfaces virtual-ethernet veth0
delete interfaces virtual-ethernet veth1

set interfaces virtual-ethernet veth0 peer-name veth1
set interfaces virtual-ethernet veth0 address 192.0.2.1/24
set interfaces virtual-ethernet veth1 address 192.0.2.2/24

commit
save

Problem: No Connectivity Between VRFs over veth

Diagnostics:

# Проверка VRF таблиц
show vrf RED
show vrf BLUE

# Проверка маршрутов в VRF
show ip route vrf RED
show ip route vrf BLUE

# Проверка назначения veth к VRF
show configuration interfaces virtual-ethernet veth10
show configuration interfaces virtual-ethernet veth11

Solutions:

Routes between the VRFs are missing:

# Добавить статические маршруты
set protocols vrf RED static route 192.168.20.0/24 next-hop 100.64.0.0
set protocols vrf BLUE static route 192.168.10.0/24 next-hop 100.64.0.1

commit
save

The firewall is blocking traffic:

# Проверить firewall правила
show firewall

# Разрешить трафик на veth
set interfaces virtual-ethernet veth10 firewall in name ALLOW-ALL
set firewall ipv4 name ALLOW-ALL default-action accept

commit
save

IP forwarding is disabled (unlikely in VyOS):

# Проверить IP forwarding
cat /proc/sys/net/ipv4/ip_forward

# Должен быть 1 (включен по умолчанию в VyOS)

Problem: High Latency on veth

Diagnostics:

# Ping тест с timestamp
ping 100.64.0.1 -D

# Проверка загрузки CPU
show system cpu

# Проверка памяти
show system memory

Causes:

veth interfaces operate at the kernel level and normally have minimal latency (microseconds). If you observe high latency:

High system load:

# Проверить процессы
top

# Проверить сетевую статистику
show interfaces

QoS/Traffic shaping:

# Проверить traffic policies
show traffic-policy

# Удалить QoS если не нужен
delete interfaces virtual-ethernet veth0 traffic-policy
commit

Problem: Packets Dropped on veth

Diagnostics:

# Проверка счетчиков ошибок
show interfaces virtual-ethernet veth0 statistics

# Поиск dropped пакетов
# RX dropped или TX dropped > 0 указывает на проблему

Solutions:

MTU mismatch:

# Проверить MTU
show interfaces virtual-ethernet veth0
show interfaces virtual-ethernet veth1

# Установить одинаковый MTU
set interfaces virtual-ethernet veth0 mtu 1500
set interfaces virtual-ethernet veth1 mtu 1500

commit
save

The firewall is dropping packets:

# Проверить firewall counters
show firewall statistics

# Временно отключить firewall для теста
delete interfaces virtual-ethernet veth0 firewall
commit

# Если проблема исчезла - пересмотреть firewall правила

Buffer overflow:

# Проверить ring buffer settings
ethtool -g veth0

# Увеличить buffers (если поддерживается)
ethtool -G veth0 rx 4096 tx 4096

Problem: veth Does Not Appear in the VRF

Diagnostics:

# Проверка VRF конфигурации
show vrf RED

# Проверка veth конфигурации
show configuration interfaces virtual-ethernet veth10

Solution:

# Убедиться что VRF создан
set vrf name RED table 100

# Назначить veth к VRF
set interfaces virtual-ethernet veth10 vrf RED

# Применить конфигурацию
commit
save

# Проверить результат
show vrf RED
show ip route vrf RED

Problem: Asymmetric Routing over veth

Diagnostics:

# Traceroute в обе стороны
traceroute 192.168.20.1 vrf RED
traceroute 192.168.10.1 vrf BLUE

# Проверка маршрутов
show ip route vrf RED 192.168.20.0/24
show ip route vrf BLUE 192.168.10.0/24

Solution:

Ensure symmetric routes:

# В VRF RED
set protocols vrf RED static route 192.168.20.0/24 next-hop 100.64.0.0

# В VRF BLUE
set protocols vrf BLUE static route 192.168.10.0/24 next-hop 100.64.0.1

commit
save

Performance and Optimization

MTU Optimization

# Jumbo frames для high-throughput
set interfaces virtual-ethernet veth0 mtu 9000
set interfaces virtual-ethernet veth1 mtu 9000

commit
save

The veth MTU must match the MTU of the physical interfaces along the path.

Offloading

veth interfaces run entirely in kernel space and do not require hardware offloading.

# Проверка текущих offload настроек
ethtool -k veth0

# Вывод покажет что большинство offload features N/A для veth

Performance Testing

# iperf3 тест через veth
# На одной стороне (veth1 - 192.0.2.2)
iperf3 -s -B 192.0.2.2

# На другой стороне (veth0 - 192.0.2.1)
iperf3 -c 192.0.2.2 -B 192.0.2.1

# Результат должен показывать multi-gigabit throughput

CPU Affinity

For high-performance systems you can configure CPU affinity for the veth IRQ:

# Найти IRQ для veth (если применимо)
grep veth /proc/interrupts

# Установить CPU affinity (пример)
echo 2 > /proc/irq/XX/smp_affinity_list

However, veth typically does not have a dedicated IRQ like a physical NIC.

Multiple veth Pairs

If you need high throughput between VRFs, use multiple veth pairs with ECMP:

# Первая veth пара
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.10.0/31
set interfaces virtual-ethernet veth10 vrf RED

set interfaces virtual-ethernet veth11 address 100.64.10.1/31
set interfaces virtual-ethernet veth11 vrf BLUE

# Вторая veth пара
set interfaces virtual-ethernet veth20 peer-name veth21
set interfaces virtual-ethernet veth20 address 100.64.20.0/31
set interfaces virtual-ethernet veth20 vrf RED

set interfaces virtual-ethernet veth21 address 100.64.20.1/31
set interfaces virtual-ethernet veth21 vrf BLUE

# ECMP маршруты в RED
set protocols vrf RED static route 192.168.20.0/24 next-hop 100.64.10.1
set protocols vrf RED static route 192.168.20.0/24 next-hop 100.64.20.1

# ECMP маршруты в BLUE
set protocols vrf BLUE static route 192.168.10.0/24 next-hop 100.64.10.0
set protocols vrf BLUE static route 192.168.10.0/24 next-hop 100.64.20.0

commit
save

Traffic is now distributed across the two veth pairs.

Security

Firewall Between VRFs

Always use a firewall to control traffic between VRFs:

# Строгий firewall - разрешить только необходимое
set firewall ipv4 name VRF-INTERCONNECT default-action drop

set firewall ipv4 name VRF-INTERCONNECT rule 10 action accept
set firewall ipv4 name VRF-INTERCONNECT rule 10 state established
set firewall ipv4 name VRF-INTERCONNECT rule 10 state related

set firewall ipv4 name VRF-INTERCONNECT rule 20 action accept
set firewall ipv4 name VRF-INTERCONNECT rule 20 protocol tcp
set firewall ipv4 name VRF-INTERCONNECT rule 20 destination port 443
set firewall ipv4 name VRF-INTERCONNECT rule 20 destination address 10.255.0.10

set interfaces virtual-ethernet veth11 firewall in name VRF-INTERCONNECT

commit
save

Access Logging

# Логирование firewall событий
set firewall ipv4 name VRF-INTERCONNECT rule 20 log
set firewall ipv4 name VRF-INTERCONNECT default-log

# Просмотр логов
show log firewall name VRF-INTERCONNECT

Rate Limiting

Protection against DoS attacks between VRFs:

# Rate limiting на veth
set firewall ipv4 name VRF-INTERCONNECT rule 30 action accept
set firewall ipv4 name VRF-INTERCONNECT rule 30 protocol icmp
set firewall ipv4 name VRF-INTERCONNECT rule 30 limit rate 100/second

commit
save

Access Control Lists

Granular access control:

# Разрешить только определенные источники
set firewall ipv4 name VRF-INTERCONNECT rule 40 action accept
set firewall ipv4 name VRF-INTERCONNECT rule 40 protocol tcp
set firewall ipv4 name VRF-INTERCONNECT rule 40 source address 192.168.10.100
set firewall ipv4 name VRF-INTERCONNECT rule 40 destination address 10.255.0.20
set firewall ipv4 name VRF-INTERCONNECT rule 40 destination port 5432

commit
save

Integration with Dynamic Routing

BGP over veth

# BGP peering через veth между VRF
set protocols vrf RED bgp local-as 65001
set protocols vrf RED bgp neighbor 100.64.0.1 remote-as 65002
set protocols vrf RED bgp neighbor 100.64.0.1 address-family ipv4-unicast

set protocols vrf BLUE bgp local-as 65002
set protocols vrf BLUE bgp neighbor 100.64.0.0 remote-as 65001
set protocols vrf BLUE bgp neighbor 100.64.0.0 address-family ipv4-unicast

commit
save

OSPF over veth

# OSPF между VRF
set protocols vrf RED ospf area 0 network 100.64.0.0/31
set protocols vrf RED ospf area 0 network 192.168.10.0/24

set protocols vrf BLUE ospf area 0 network 100.64.0.0/31
set protocols vrf BLUE ospf area 0 network 192.168.20.0/24

commit
save

Route Leaking with BGP

# Импорт/экспорт маршрутов между VRF через BGP
set protocols vrf RED bgp route-target export 65000:100
set protocols vrf RED bgp route-target import 65000:200

set protocols vrf BLUE bgp route-target export 65000:200
set protocols vrf BLUE bgp route-target import 65000:100

commit
save

Best Practices

1. Use a Consistent Naming Scheme

# veth10-veth11 для VRF interconnects
# veth20-veth21 для другой пары VRF
# vethXX-vethXX - peer suffix всегда +1

set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth20 peer-name veth21

2. Always Add Descriptions

set interfaces virtual-ethernet veth10 description 'TENANT-A to SHARED-SERVICES'
set interfaces virtual-ethernet veth11 description 'SHARED-SERVICES to TENANT-A'

3. Use /31 for Point-to-Point Links

# Экономия IP адресов для veth interconnects
set interfaces virtual-ethernet veth10 address 100.64.0.0/31
set interfaces virtual-ethernet veth11 address 100.64.0.1/31

4. Document the VRF Topology

Create a document describing the VRF interconnection topology:

TENANT-A (VRF RED, table 100)
  |
  +-- veth10 (100.64.0.0/31) <--> veth11 (100.64.0.1/31)
  |
SHARED-SERVICES (VRF SHARED, table 300)
  |
  +-- veth21 (100.64.0.3/31) <--> veth20 (100.64.0.2/31)
  |
TENANT-B (VRF BLUE, table 200)

5. Apply a Firewall on veth

Always control traffic between VRFs:

set interfaces virtual-ethernet veth11 firewall in name VRF-CONTROL

6. Monitor veth State

Check veth state regularly:

# Скрипт мониторинга (добавить в cron)
#!/bin/bash
vyos_cli -c "show interfaces virtual-ethernet" | grep -q "u/u" || echo "veth interface down!"

7. Use a Dedicated Subnet for veth Interconnects

# Выделенная подсеть 100.64.0.0/16 (Shared Address Space, RFC 6598)
# для veth interconnects
set interfaces virtual-ethernet veth10 address 100.64.0.0/31
set interfaces virtual-ethernet veth20 address 100.64.0.2/31
set interfaces virtual-ethernet veth30 address 100.64.0.4/31

8. Test Failover

Verify behavior during failures:

# Отключение veth для тестирования
set interfaces virtual-ethernet veth10 disable
commit

# Проверка маршрутизации
show ip route vrf RED

# Включение обратно
delete interfaces virtual-ethernet veth10 disable
commit

9. Log Changes

# Commit с комментарием
commit comment "Added veth10-veth11 for TENANT-A to SHARED interconnect"
save

10. Back Up the Configuration

Save the configuration regularly:

# Backup с veth конфигурацией
save /config/backup/config.boot.veth-$(date +%Y%m%d)

Useful Commands

# Создание veth пары
set interfaces virtual-ethernet veth0 peer-name veth1
set interfaces virtual-ethernet veth0 address 192.0.2.1/24
set interfaces virtual-ethernet veth1 address 192.0.2.2/24

# Просмотр veth
show interfaces virtual-ethernet
show interfaces virtual-ethernet veth0

# Назначение VRF
set interfaces virtual-ethernet veth0 vrf RED

# Просмотр VRF
show vrf
show vrf RED
show ip route vrf RED

# Удаление veth
delete interfaces virtual-ethernet veth0
delete interfaces virtual-ethernet veth1

# Статистика
show interfaces virtual-ethernet veth0 statistics

# Конфигурация
show configuration interfaces virtual-ethernet

# Тестирование
ping 192.0.2.2 source-address 192.0.2.1
ping 192.168.20.1 vrf RED

# Трассировка
traceroute 192.168.20.1 vrf RED

# Мониторинг трафика
sudo tcpdump -i veth0

# Логи
show log | match veth

Limitations

veth interfaces operate only in kernel space (no hardware offloading)
Correct peer interface configuration is required
Both ends of the pair must be UP for it to work
The MTU must be consistent on both ends
A single veth cannot be used in multiple VRFs at the same time
Performance is bounded by CPU capacity (usually not an issue)

Conclusion

Virtual Ethernet (veth) interfaces are a powerful tool for building flexible network topologies in VyOS. They are ideal for:

VRF interconnection in multi-tenant cloud environments
Isolation and controlled interaction between network domains
Building complex routing scenarios
Container and VM networking

Key benefits:

Simple configuration
High performance (kernel-level)
Flexible usage (VRF, namespaces, containers)
Full support for all VyOS network features
Excellent integration with the firewall and routing protocols

Recommendations for cloud platforms (Yandex Cloud, VK Cloud):

Use veth for multi-tenant VRF isolation
Apply strict firewall rules between VRFs
Document the VRF topology
Monitor the state of veth interfaces
Use /31 subnets to conserve address space
Test failover scenarios

veth interfaces provide a reliable, high-performance foundation for building complex network architectures in cloud environments.

Reviewed by OpenNix LLC · Last updated on 29 July 2026

Wireless (WLAN/WiFi) Interfaces in VyOS GENEVE - Generic Network Virtualization Encapsulation