# Virtual Ethernet (veth) Interfaces in VyOS

> Configure Virtual Ethernet pairs for inter-network connectivity, VRF interconnection, and network namespaces in VyOS on Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/interfaces/vyos-veth/



Virtual Ethernet (veth) interfaces in VyOS are virtual network devices that are always created in pairs and behave like a virtual Ethernet cable. Packets sent to one end of the pair appear immediately at the other end.

## Overview

Virtual Ethernet interfaces are used for:

- **VRF Interconnection**: Connecting different VRF routing tables
- **Network Namespaces**: Creating tunnels between isolated network spaces
- **Container Networking**: Attaching containers to the physical network
- **Testing**: Testing network configurations without physical hardware
- **Cross-Domain Routing**: Routing between isolated domains
- **Service Chaining**: Building chains of network services

### Key Characteristics

| Characteristic | Description |
|----------------|----------|
| Creation | Always in pairs (peer interfaces) |
| OSI layer | L2 and L3 (supports both) |
| State | Depends on the peer interface |
| Use cases | VRF, namespaces, containers |
| Performance | Wire speed (kernel-level) |
| MTU | Configurable (default 1500) |

### veth vs Other Virtual Interfaces

| Interface | Purpose | Paired | VRF Support |
|-----------|------------|--------|-------------|
| veth | Peer-to-peer tunnel | Yes | Yes |
| dummy | Always-up interface | No | Yes |
| loopback | Router ID, management | No | No |
| bridge | L2 switching | No | No |
| vlan | L2 segmentation | No | Yes |

**When to use veth**:
- Connecting VRF tables
- Inter-network connectivity between isolated domains
- Container/VM networking
- Network function chaining

**When to use other interfaces**:
- dummy: Testing, blackhole routing
- loopback: Router ID, stable endpoint
- bridge: L2 switching between ports
- vlan: Segmentation on a single physical interface

## Basic Configuration

### Creating a veth Pair

The minimal configuration requires specifying the peer interface:

```bash
# Создание veth0 с peer veth1
set interfaces virtual-ethernet veth0 peer-name veth1
set interfaces virtual-ethernet veth0 address 192.0.2.1/24

# Автоматически создается veth1
set interfaces virtual-ethernet veth1 address 192.0.2.2/24

commit
save
```

veth0 and veth1 are now connected like a virtual cable. Packets sent to veth0 appear on veth1 and vice versa.

### Verifying State

```bash
show interfaces virtual-ethernet

# Вывод:
# veth0@veth1: <BROADCAST,MULTICAST,UP,LOWER_UP>
#     inet 192.0.2.1/24
# veth1@veth0: <BROADCAST,MULTICAST,UP,LOWER_UP>
#     inet 192.0.2.2/24
```

### Interface Descriptions

```bash
set interfaces virtual-ethernet veth0 description 'VRF RED side'
set interfaces virtual-ethernet veth1 description 'VRF BLUE side'

commit
save
```

### Multiple IP Addresses

```bash
# veth0 с несколькими адресами
set interfaces virtual-ethernet veth0 address 192.0.2.1/24
set interfaces virtual-ethernet veth0 address 10.0.0.1/30
set interfaces virtual-ethernet veth0 address 2001:db8::1/64

commit
save
```

### IPv6 Configuration

```bash
# Dual-stack veth пара
set interfaces virtual-ethernet veth0 address 192.0.2.1/24
set interfaces virtual-ethernet veth0 address 2001:db8:1::1/64

set interfaces virtual-ethernet veth1 address 192.0.2.2/24
set interfaces virtual-ethernet veth1 address 2001:db8:1::2/64

commit
save
```

## VRF Interconnection

The primary use of veth is to connect different VRF routing tables.

### Basic VRF Connection

```bash
# Создание VRF таблиц
set vrf name RED table 100
set vrf name BLUE table 200

# Создание veth пары для межсоединения
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.0.0/31
set interfaces virtual-ethernet veth10 description 'RED to BLUE link'

set interfaces virtual-ethernet veth11 address 100.64.0.1/31
set interfaces virtual-ethernet veth11 vrf RED
set interfaces virtual-ethernet veth11 description 'BLUE to RED link'

# Или поместить veth10 в BLUE VRF
set interfaces virtual-ethernet veth10 vrf BLUE

commit
save
```

VRF RED and BLUE are now connected through a veth pair using the addresses 100.64.0.0/31.

### Routing Between VRFs

```bash
# VRF конфигурация
set vrf name RED table 100
set vrf name BLUE table 200

# veth пара
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.0.0/31
set interfaces virtual-ethernet veth10 vrf BLUE

set interfaces virtual-ethernet veth11 address 100.64.0.1/31
set interfaces virtual-ethernet veth11 vrf RED

# Сети в VRF RED
set interfaces ethernet eth1 vrf RED
set interfaces ethernet eth1 address 192.168.10.1/24

# Сети в VRF BLUE
set interfaces ethernet eth2 vrf BLUE
set interfaces ethernet eth2 address 192.168.20.1/24

# Статические маршруты для межсоединения
set protocols vrf RED static route 192.168.20.0/24 next-hop 100.64.0.0
set protocols vrf BLUE static route 192.168.10.0/24 next-hop 100.64.0.1

commit
save
```

The networks 192.168.10.0/24 (VRF RED) and 192.168.20.0/24 (VRF BLUE) can now communicate through the veth tunnel.

### Verifying VRF Routing

```bash
# Проверка VRF таблиц
show vrf

# Таблица маршрутизации VRF RED
show ip route vrf RED

# Таблица маршрутизации VRF BLUE
show ip route vrf BLUE

# Ping между VRF (с указанием VRF)
ping 192.168.20.1 vrf RED
ping 192.168.10.1 vrf BLUE

# Traceroute между VRF
traceroute 192.168.20.1 vrf RED
```

### Multiple VRF Connections

```bash
# Создание трех VRF
set vrf name CUSTOMER-A table 100
set vrf name CUSTOMER-B table 200
set vrf name SHARED-SERVICES table 300

# veth пары для соединения CUSTOMER-A <-> SHARED-SERVICES
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.0.0/31
set interfaces virtual-ethernet veth10 vrf CUSTOMER-A

set interfaces virtual-ethernet veth11 address 100.64.0.1/31
set interfaces virtual-ethernet veth11 vrf SHARED-SERVICES

# veth пары для соединения CUSTOMER-B <-> SHARED-SERVICES
set interfaces virtual-ethernet veth20 peer-name veth21
set interfaces virtual-ethernet veth20 address 100.64.0.2/31
set interfaces virtual-ethernet veth20 vrf CUSTOMER-B

set interfaces virtual-ethernet veth21 address 100.64.0.3/31
set interfaces virtual-ethernet veth21 vrf SHARED-SERVICES

# Маршруты в CUSTOMER-A для доступа к SHARED-SERVICES
set protocols vrf CUSTOMER-A static route 10.255.255.0/24 next-hop 100.64.0.1

# Маршруты в CUSTOMER-B для доступа к SHARED-SERVICES
set protocols vrf CUSTOMER-B static route 10.255.255.0/24 next-hop 100.64.0.3

# Обратные маршруты в SHARED-SERVICES
set protocols vrf SHARED-SERVICES static route 192.168.100.0/24 next-hop 100.64.0.0  # To CUSTOMER-A
set protocols vrf SHARED-SERVICES static route 192.168.200.0/24 next-hop 100.64.0.2  # To CUSTOMER-B

commit
save
```

CUSTOMER-A and CUSTOMER-B can now reach SHARED-SERVICES, but they remain isolated from each other.

## Advanced Configuration

### MTU Settings

```bash
# Установка MTU для veth пары
set interfaces virtual-ethernet veth0 mtu 9000
set interfaces virtual-ethernet veth1 mtu 9000

commit
save
```

The MTU must be the same on both ends of the pair.

### DHCP on veth

```bash
# DHCP клиент на veth (необычное использование)
set interfaces virtual-ethernet veth0 address dhcp

# DHCP сервер для veth сети
set service dhcp-server shared-network-name VETH-NET subnet 100.64.0.0/31
set service dhcp-server shared-network-name VETH-NET subnet 100.64.0.0/31 range 0 start 100.64.0.1
set service dhcp-server shared-network-name VETH-NET subnet 100.64.0.0/31 range 0 stop 100.64.0.1

commit
save
```

### Policy-Based Routing with veth

```bash
# PBR для трафика через veth
set policy route PBR-VETH rule 10 destination address 192.168.20.0/24
set policy route PBR-VETH rule 10 set table 100

# Применение к интерфейсу
set interfaces ethernet eth0 policy route PBR-VETH

# veth в VRF table 100
set interfaces virtual-ethernet veth0 vrf CUSTOM

commit
save
```

### Firewall on veth

```bash
# Firewall для veth интерфейсов
set firewall ipv4 name VETH-IN default-action drop
set firewall ipv4 name VETH-IN rule 10 action accept
set firewall ipv4 name VETH-IN rule 10 state established
set firewall ipv4 name VETH-IN rule 10 state related

set firewall ipv4 name VETH-IN rule 20 action accept
set firewall ipv4 name VETH-IN rule 20 protocol icmp

set firewall ipv4 name VETH-IN rule 30 action accept
set firewall ipv4 name VETH-IN rule 30 source address 100.64.0.0/31

# Применение к veth0
set interfaces virtual-ethernet veth0 firewall in name VETH-IN

commit
save
```

### QoS on veth

```bash
# Traffic shaping на veth
set traffic-policy shaper VETH-SHAPER bandwidth 100mbit
set traffic-policy shaper VETH-SHAPER default bandwidth 80mbit

# Применение к veth
set interfaces virtual-ethernet veth0 traffic-policy out VETH-SHAPER

commit
save
```

## Cloud Platform Examples

### Yandex Cloud: Multi-Tenant VRF with Shared Services

Scenario: Two tenants with isolated VRFs but shared access to common services (DNS, NTP, monitoring).

```bash
# VRF для клиентов
set vrf name TENANT-A table 100
set vrf name TENANT-B table 200
set vrf name SHARED table 300

# Физические интерфейсы клиентов
set interfaces ethernet eth1 vrf TENANT-A
set interfaces ethernet eth1 address 10.10.1.1/24
set interfaces ethernet eth1 description 'Tenant A - Yandex Cloud Subnet'

set interfaces ethernet eth2 vrf TENANT-B
set interfaces ethernet eth2 address 10.20.1.1/24
set interfaces ethernet eth2 description 'Tenant B - Yandex Cloud Subnet'

# Интерфейс для shared services
set interfaces ethernet eth3 vrf SHARED
set interfaces ethernet eth3 address 10.255.0.1/24
set interfaces ethernet eth3 description 'Shared Services - Yandex Cloud'

# veth пары для TENANT-A <-> SHARED
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.10.0/31
set interfaces virtual-ethernet veth10 vrf TENANT-A
set interfaces virtual-ethernet veth10 description 'Tenant A to Shared'

set interfaces virtual-ethernet veth11 address 100.64.10.1/31
set interfaces virtual-ethernet veth11 vrf SHARED
set interfaces virtual-ethernet veth11 description 'Shared to Tenant A'

# veth пары для TENANT-B <-> SHARED
set interfaces virtual-ethernet veth20 peer-name veth21
set interfaces virtual-ethernet veth20 address 100.64.20.0/31
set interfaces virtual-ethernet veth20 vrf TENANT-B
set interfaces virtual-ethernet veth20 description 'Tenant B to Shared'

set interfaces virtual-ethernet veth21 address 100.64.20.1/31
set interfaces virtual-ethernet veth21 vrf SHARED
set interfaces virtual-ethernet veth21 description 'Shared to Tenant B'

# Маршруты от клиентов к shared services
set protocols vrf TENANT-A static route 10.255.0.0/24 next-hop 100.64.10.1
set protocols vrf TENANT-B static route 10.255.0.0/24 next-hop 100.64.20.1

# Обратные маршруты от shared к клиентам
set protocols vrf SHARED static route 10.10.1.0/24 next-hop 100.64.10.0
set protocols vrf SHARED static route 10.20.1.0/24 next-hop 100.64.20.0

# Firewall для контроля доступа (только определенные сервисы)
set firewall ipv4 name SHARED-IN default-action drop
set firewall ipv4 name SHARED-IN rule 10 action accept
set firewall ipv4 name SHARED-IN rule 10 state established
set firewall ipv4 name SHARED-IN rule 10 state related

set firewall ipv4 name SHARED-IN rule 20 action accept
set firewall ipv4 name SHARED-IN rule 20 protocol udp
set firewall ipv4 name SHARED-IN rule 20 destination port 53  # DNS
set firewall ipv4 name SHARED-IN rule 20 destination address 10.255.0.10

set firewall ipv4 name SHARED-IN rule 30 action accept
set firewall ipv4 name SHARED-IN rule 30 protocol udp
set firewall ipv4 name SHARED-IN rule 30 destination port 123  # NTP
set firewall ipv4 name SHARED-IN rule 30 destination address 10.255.0.11

set interfaces virtual-ethernet veth11 firewall in name SHARED-IN
set interfaces virtual-ethernet veth21 firewall in name SHARED-IN

commit
save
```

### VK Cloud: VRF for DMZ and Internal Networks

Scenario: Separating the DMZ (public services) and Internal (private services) through VRFs with controlled interaction.

```bash
# VRF для DMZ и Internal
set vrf name DMZ table 100
set vrf name INTERNAL table 200

# DMZ интерфейс (публичный)
set interfaces ethernet eth0 vrf DMZ
set interfaces ethernet eth0 address 203.0.113.1/24
set interfaces ethernet eth0 description 'DMZ - VK Cloud Public Subnet'

# Internal интерфейс (приватный)
set interfaces ethernet eth1 vrf INTERNAL
set interfaces ethernet eth1 address 10.0.1.1/24
set interfaces ethernet eth1 description 'Internal - VK Cloud Private Subnet'

# veth пара для контролируемого взаимодействия
set interfaces virtual-ethernet veth50 peer-name veth51
set interfaces virtual-ethernet veth50 address 100.64.50.0/31
set interfaces virtual-ethernet veth50 vrf DMZ
set interfaces virtual-ethernet veth50 description 'DMZ to Internal'

set interfaces virtual-ethernet veth51 address 100.64.50.1/31
set interfaces virtual-ethernet veth51 vrf INTERNAL
set interfaces virtual-ethernet veth51 description 'Internal to DMZ'

# Маршруты
# DMZ может инициировать соединения к Internal (для backend API)
set protocols vrf DMZ static route 10.0.1.0/24 next-hop 100.64.50.1

# Internal может получать ответы, но не инициировать
# (контролируется через firewall)

# Firewall - Internal принимает только established соединения от DMZ
set firewall ipv4 name INTERNAL-FROM-DMZ default-action drop
set firewall ipv4 name INTERNAL-FROM-DMZ rule 10 action accept
set firewall ipv4 name INTERNAL-FROM-DMZ rule 10 state established
set firewall ipv4 name INTERNAL-FROM-DMZ rule 10 state related

set firewall ipv4 name INTERNAL-FROM-DMZ rule 20 action accept
set firewall ipv4 name INTERNAL-FROM-DMZ rule 20 protocol tcp
set firewall ipv4 name INTERNAL-FROM-DMZ rule 20 destination port 5432  # PostgreSQL
set firewall ipv4 name INTERNAL-FROM-DMZ rule 20 destination address 10.0.1.10

set firewall ipv4 name INTERNAL-FROM-DMZ rule 30 action accept
set firewall ipv4 name INTERNAL-FROM-DMZ rule 30 protocol tcp
set firewall ipv4 name INTERNAL-FROM-DMZ rule 30 destination port 6379  # Redis
set firewall ipv4 name INTERNAL-FROM-DMZ rule 30 destination address 10.0.1.11

set interfaces virtual-ethernet veth51 firewall in name INTERNAL-FROM-DMZ

# NAT для DMZ интерфейса (выход в интернет)
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 203.0.113.0/24
set nat source rule 100 translation address masquerade

commit
save
```

### Yandex Cloud: Development/Staging/Production VRF

Scenario: Three isolated environments with controlled access between them.

```bash
# VRF для сред
set vrf name DEV table 100
set vrf name STAGING table 200
set vrf name PRODUCTION table 300
set vrf name MANAGEMENT table 400

# Интерфейсы
set interfaces ethernet eth1 vrf DEV
set interfaces ethernet eth1 address 10.100.0.1/16
set interfaces ethernet eth1 description 'Development - Yandex Cloud'

set interfaces ethernet eth2 vrf STAGING
set interfaces ethernet eth2 address 10.200.0.1/16
set interfaces ethernet eth2 description 'Staging - Yandex Cloud'

set interfaces ethernet eth3 vrf PRODUCTION
set interfaces ethernet eth3 address 10.300.0.1/16
set interfaces ethernet eth3 description 'Production - Yandex Cloud'

set interfaces ethernet eth4 vrf MANAGEMENT
set interfaces ethernet eth4 address 10.255.0.1/24
set interfaces ethernet eth4 description 'Management - Yandex Cloud'

# veth для MANAGEMENT доступа ко всем средам
# MANAGEMENT <-> DEV
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.1.0/31
set interfaces virtual-ethernet veth10 vrf MANAGEMENT

set interfaces virtual-ethernet veth11 address 100.64.1.1/31
set interfaces virtual-ethernet veth11 vrf DEV

# MANAGEMENT <-> STAGING
set interfaces virtual-ethernet veth20 peer-name veth21
set interfaces virtual-ethernet veth20 address 100.64.2.0/31
set interfaces virtual-ethernet veth20 vrf MANAGEMENT

set interfaces virtual-ethernet veth21 address 100.64.2.1/31
set interfaces virtual-ethernet veth21 vrf STAGING

# MANAGEMENT <-> PRODUCTION
set interfaces virtual-ethernet veth30 peer-name veth31
set interfaces virtual-ethernet veth30 address 100.64.3.0/31
set interfaces virtual-ethernet veth30 vrf MANAGEMENT

set interfaces virtual-ethernet veth31 address 100.64.3.1/31
set interfaces virtual-ethernet veth31 vrf PRODUCTION

# Опционально: DEV <-> STAGING (для CI/CD)
set interfaces virtual-ethernet veth40 peer-name veth41
set interfaces virtual-ethernet veth40 address 100.64.4.0/31
set interfaces virtual-ethernet veth40 vrf DEV

set interfaces virtual-ethernet veth41 address 100.64.4.1/31
set interfaces virtual-ethernet veth41 vrf STAGING

# Маршруты от MANAGEMENT ко всем средам
set protocols vrf MANAGEMENT static route 10.100.0.0/16 next-hop 100.64.1.1
set protocols vrf MANAGEMENT static route 10.200.0.0/16 next-hop 100.64.2.1
set protocols vrf MANAGEMENT static route 10.300.0.0/16 next-hop 100.64.3.1

# Обратные маршруты (только для MANAGEMENT сети)
set protocols vrf DEV static route 10.255.0.0/24 next-hop 100.64.1.0
set protocols vrf STAGING static route 10.255.0.0/24 next-hop 100.64.2.0
set protocols vrf PRODUCTION static route 10.255.0.0/24 next-hop 100.64.3.0

# Маршрут от DEV к STAGING (для CI/CD)
set protocols vrf DEV static route 10.200.0.0/16 next-hop 100.64.4.1
set protocols vrf STAGING static route 10.100.0.0/16 next-hop 100.64.4.0

# Firewall - PRODUCTION принимает только SSH от MANAGEMENT
set firewall ipv4 name PROD-MGMT-IN default-action drop
set firewall ipv4 name PROD-MGMT-IN rule 10 action accept
set firewall ipv4 name PROD-MGMT-IN rule 10 state established
set firewall ipv4 name PROD-MGMT-IN rule 10 state related

set firewall ipv4 name PROD-MGMT-IN rule 20 action accept
set firewall ipv4 name PROD-MGMT-IN rule 20 protocol tcp
set firewall ipv4 name PROD-MGMT-IN rule 20 destination port 22
set firewall ipv4 name PROD-MGMT-IN rule 20 source address 10.255.0.0/24

set interfaces virtual-ethernet veth31 firewall in name PROD-MGMT-IN

commit
save
```

### VK Cloud: Container Platform with VRF Isolation

Scenario: Kubernetes clusters in separate VRFs for different projects.

```bash
# VRF для Kubernetes кластеров
set vrf name K8S-CLUSTER-A table 100
set vrf name K8S-CLUSTER-B table 200
set vrf name K8S-SERVICES table 300  # Shared services (registry, monitoring)

# Интерфейсы для кластеров
set interfaces ethernet eth1 vrf K8S-CLUSTER-A
set interfaces ethernet eth1 address 10.10.0.1/16
set interfaces ethernet eth1 description 'K8s Cluster A - VK Cloud'

set interfaces ethernet eth2 vrf K8S-CLUSTER-B
set interfaces ethernet eth2 address 10.20.0.1/16
set interfaces ethernet eth2 description 'K8s Cluster B - VK Cloud'

set interfaces ethernet eth3 vrf K8S-SERVICES
set interfaces ethernet eth3 address 10.255.0.1/24
set interfaces ethernet eth3 description 'K8s Shared Services - VK Cloud'

# veth для доступа к shared services
# CLUSTER-A <-> SERVICES
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.10.0/31
set interfaces virtual-ethernet veth10 vrf K8S-CLUSTER-A

set interfaces virtual-ethernet veth11 address 100.64.10.1/31
set interfaces virtual-ethernet veth11 vrf K8S-SERVICES

# CLUSTER-B <-> SERVICES
set interfaces virtual-ethernet veth20 peer-name veth21
set interfaces virtual-ethernet veth20 address 100.64.20.0/31
set interfaces virtual-ethernet veth20 vrf K8S-CLUSTER-B

set interfaces virtual-ethernet veth21 address 100.64.20.1/31
set interfaces virtual-ethernet veth21 vrf K8S-SERVICES

# Маршруты к shared services
set protocols vrf K8S-CLUSTER-A static route 10.255.0.0/24 next-hop 100.64.10.1
set protocols vrf K8S-CLUSTER-B static route 10.255.0.0/24 next-hop 100.64.20.1

# Обратные маршруты
set protocols vrf K8S-SERVICES static route 10.10.0.0/16 next-hop 100.64.10.0
set protocols vrf K8S-SERVICES static route 10.20.0.0/16 next-hop 100.64.20.0

# Firewall для контроля доступа к services
set firewall ipv4 name K8S-SERVICES-IN default-action drop
set firewall ipv4 name K8S-SERVICES-IN rule 10 action accept
set firewall ipv4 name K8S-SERVICES-IN rule 10 state established
set firewall ipv4 name K8S-SERVICES-IN rule 10 state related

# Container registry (Harbor)
set firewall ipv4 name K8S-SERVICES-IN rule 20 action accept
set firewall ipv4 name K8S-SERVICES-IN rule 20 protocol tcp
set firewall ipv4 name K8S-SERVICES-IN rule 20 destination port 443
set firewall ipv4 name K8S-SERVICES-IN rule 20 destination address 10.255.0.10

# Monitoring (Prometheus)
set firewall ipv4 name K8S-SERVICES-IN rule 30 action accept
set firewall ipv4 name K8S-SERVICES-IN rule 30 protocol tcp
set firewall ipv4 name K8S-SERVICES-IN rule 30 destination port 9090
set firewall ipv4 name K8S-SERVICES-IN rule 30 destination address 10.255.0.20

set interfaces virtual-ethernet veth11 firewall in name K8S-SERVICES-IN
set interfaces virtual-ethernet veth21 firewall in name K8S-SERVICES-IN

commit
save
```

## Monitoring and Diagnostics

### Viewing veth Interfaces

```bash
# Все veth интерфейсы
show interfaces virtual-ethernet

# Детальная информация о конкретном veth
show interfaces virtual-ethernet veth0

# Статистика
show interfaces virtual-ethernet veth0 statistics

# Вывод:
# Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
# Interface        IP Address                        S/L  Description
# ---------        ----------                        ---  -----------
# veth0            192.0.2.1/24                      u/u  VRF RED side
# veth1            192.0.2.2/24                      u/u  VRF BLUE side
```

### Checking Peer Links

```bash
# Проверка peer connections
ip link show type veth

# Вывод:
# 10: veth0@veth1: <BROADCAST,MULTICAST,UP,LOWER_UP>
# 11: veth1@veth0: <BROADCAST,MULTICAST,UP,LOWER_UP>
```

### Checking VRF Assignments

```bash
# Показать все VRF
show vrf

# Детали конкретного VRF
show vrf RED

# Интерфейсы в VRF
show ip route vrf RED

# Вывод покажет veth интерфейсы в VRF
```

### Testing Connectivity

```bash
# Ping между veth парой
ping 192.0.2.2 source-address 192.0.2.1

# Ping через VRF
ping 192.168.20.1 vrf RED

# Traceroute для проверки пути
traceroute 192.168.20.1 vrf RED

# Вывод покажет путь через veth
```

### Monitoring Traffic

```bash
# tcpdump на veth интерфейсе
sudo tcpdump -i veth0

# Детальный вывод с заголовками
sudo tcpdump -i veth0 -v -e

# Фильтр по протоколу
sudo tcpdump -i veth0 icmp

# Сохранение в файл
sudo tcpdump -i veth0 -w /tmp/veth0.pcap
```

### Checking Counters

```bash
# Статистика интерфейса
show interfaces virtual-ethernet veth0 statistics

# Вывод:
# RX:  bytes  packets  errors  dropped  overrun  mcast
#      12345   100      0       0        0        0
# TX:  bytes  packets  errors  dropped  carrier  collisions
#      54321   90       0       0        0        0
```

### Logging

```bash
# Системные логи для veth
show log | match veth

# Kernel messages
dmesg | grep veth

# Firewall логи для veth трафика
show log firewall name VETH-IN
```

## Troubleshooting

### Problem: veth Interface in DOWN State

**Diagnostics**:

```bash
# Проверка состояния
show interfaces virtual-ethernet veth0

# Проверка peer интерфейса
show interfaces virtual-ethernet veth1
```

**Causes and solutions**:

1. The peer interface has not been created or was removed:
```bash
# Проверить конфигурацию peer
show configuration interfaces virtual-ethernet veth1

# Создать peer если отсутствует
set interfaces virtual-ethernet veth1 peer-name veth0
commit
```

2. The peer interface is administratively down:
```bash
# Включить peer интерфейс
delete interfaces virtual-ethernet veth1 disable
commit
```

3. Configuration conflict:
```bash
# Пересоздать veth пару
delete interfaces virtual-ethernet veth0
delete interfaces virtual-ethernet veth1

set interfaces virtual-ethernet veth0 peer-name veth1
set interfaces virtual-ethernet veth0 address 192.0.2.1/24
set interfaces virtual-ethernet veth1 address 192.0.2.2/24

commit
save
```

### Problem: No Connectivity Between VRFs over veth

**Diagnostics**:

```bash
# Проверка VRF таблиц
show vrf RED
show vrf BLUE

# Проверка маршрутов в VRF
show ip route vrf RED
show ip route vrf BLUE

# Проверка назначения veth к VRF
show configuration interfaces virtual-ethernet veth10
show configuration interfaces virtual-ethernet veth11
```

**Solutions**:

1. Routes between the VRFs are missing:
```bash
# Добавить статические маршруты
set protocols vrf RED static route 192.168.20.0/24 next-hop 100.64.0.0
set protocols vrf BLUE static route 192.168.10.0/24 next-hop 100.64.0.1

commit
save
```

2. The firewall is blocking traffic:
```bash
# Проверить firewall правила
show firewall

# Разрешить трафик на veth
set interfaces virtual-ethernet veth10 firewall in name ALLOW-ALL
set firewall ipv4 name ALLOW-ALL default-action accept

commit
save
```

3. IP forwarding is disabled (unlikely in VyOS):
```bash
# Проверить IP forwarding
cat /proc/sys/net/ipv4/ip_forward

# Должен быть 1 (включен по умолчанию в VyOS)
```

### Problem: High Latency on veth

**Diagnostics**:

```bash
# Ping тест с timestamp
ping 100.64.0.1 -D

# Проверка загрузки CPU
show system cpu

# Проверка памяти
show system memory
```

**Causes**:

veth interfaces operate at the kernel level and normally have minimal latency (microseconds). If you observe high latency:

1. High system load:
```bash
# Проверить процессы
top

# Проверить сетевую статистику
show interfaces
```

2. QoS/Traffic shaping:
```bash
# Проверить traffic policies
show traffic-policy

# Удалить QoS если не нужен
delete interfaces virtual-ethernet veth0 traffic-policy
commit
```

### Problem: Packets Dropped on veth

**Diagnostics**:

```bash
# Проверка счетчиков ошибок
show interfaces virtual-ethernet veth0 statistics

# Поиск dropped пакетов
# RX dropped или TX dropped > 0 указывает на проблему
```

**Solutions**:

1. MTU mismatch:
```bash
# Проверить MTU
show interfaces virtual-ethernet veth0
show interfaces virtual-ethernet veth1

# Установить одинаковый MTU
set interfaces virtual-ethernet veth0 mtu 1500
set interfaces virtual-ethernet veth1 mtu 1500

commit
save
```

2. The firewall is dropping packets:
```bash
# Проверить firewall counters
show firewall statistics

# Временно отключить firewall для теста
delete interfaces virtual-ethernet veth0 firewall
commit

# Если проблема исчезла - пересмотреть firewall правила
```

3. Buffer overflow:
```bash
# Проверить ring buffer settings
ethtool -g veth0

# Увеличить buffers (если поддерживается)
ethtool -G veth0 rx 4096 tx 4096
```

### Problem: veth Does Not Appear in the VRF

**Diagnostics**:

```bash
# Проверка VRF конфигурации
show vrf RED

# Проверка veth конфигурации
show configuration interfaces virtual-ethernet veth10
```

**Solution**:

```bash
# Убедиться что VRF создан
set vrf name RED table 100

# Назначить veth к VRF
set interfaces virtual-ethernet veth10 vrf RED

# Применить конфигурацию
commit
save

# Проверить результат
show vrf RED
show ip route vrf RED
```

### Problem: Asymmetric Routing over veth

**Diagnostics**:

```bash
# Traceroute в обе стороны
traceroute 192.168.20.1 vrf RED
traceroute 192.168.10.1 vrf BLUE

# Проверка маршрутов
show ip route vrf RED 192.168.20.0/24
show ip route vrf BLUE 192.168.10.0/24
```

**Solution**:

Ensure symmetric routes:

```bash
# В VRF RED
set protocols vrf RED static route 192.168.20.0/24 next-hop 100.64.0.0

# В VRF BLUE
set protocols vrf BLUE static route 192.168.10.0/24 next-hop 100.64.0.1

commit
save
```

## Performance and Optimization

### MTU Optimization

```bash
# Jumbo frames для high-throughput
set interfaces virtual-ethernet veth0 mtu 9000
set interfaces virtual-ethernet veth1 mtu 9000

commit
save
```

The veth MTU must match the MTU of the physical interfaces along the path.

### Offloading

veth interfaces run entirely in kernel space and do not require hardware offloading.

```bash
# Проверка текущих offload настроек
ethtool -k veth0

# Вывод покажет что большинство offload features N/A для veth
```

### Performance Testing

```bash
# iperf3 тест через veth
# На одной стороне (veth1 - 192.0.2.2)
iperf3 -s -B 192.0.2.2

# На другой стороне (veth0 - 192.0.2.1)
iperf3 -c 192.0.2.2 -B 192.0.2.1

# Результат должен показывать multi-gigabit throughput
```

### CPU Affinity

For high-performance systems you can configure CPU affinity for the veth IRQ:

```bash
# Найти IRQ для veth (если применимо)
grep veth /proc/interrupts

# Установить CPU affinity (пример)
echo 2 > /proc/irq/XX/smp_affinity_list
```

However, veth typically does not have a dedicated IRQ like a physical NIC.

### Multiple veth Pairs

If you need high throughput between VRFs, use multiple veth pairs with ECMP:

```bash
# Первая veth пара
set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth10 address 100.64.10.0/31
set interfaces virtual-ethernet veth10 vrf RED

set interfaces virtual-ethernet veth11 address 100.64.10.1/31
set interfaces virtual-ethernet veth11 vrf BLUE

# Вторая veth пара
set interfaces virtual-ethernet veth20 peer-name veth21
set interfaces virtual-ethernet veth20 address 100.64.20.0/31
set interfaces virtual-ethernet veth20 vrf RED

set interfaces virtual-ethernet veth21 address 100.64.20.1/31
set interfaces virtual-ethernet veth21 vrf BLUE

# ECMP маршруты в RED
set protocols vrf RED static route 192.168.20.0/24 next-hop 100.64.10.1
set protocols vrf RED static route 192.168.20.0/24 next-hop 100.64.20.1

# ECMP маршруты в BLUE
set protocols vrf BLUE static route 192.168.10.0/24 next-hop 100.64.10.0
set protocols vrf BLUE static route 192.168.10.0/24 next-hop 100.64.20.0

commit
save
```

Traffic is now distributed across the two veth pairs.

## Security

### Firewall Between VRFs

Always use a firewall to control traffic between VRFs:

```bash
# Строгий firewall - разрешить только необходимое
set firewall ipv4 name VRF-INTERCONNECT default-action drop

set firewall ipv4 name VRF-INTERCONNECT rule 10 action accept
set firewall ipv4 name VRF-INTERCONNECT rule 10 state established
set firewall ipv4 name VRF-INTERCONNECT rule 10 state related

set firewall ipv4 name VRF-INTERCONNECT rule 20 action accept
set firewall ipv4 name VRF-INTERCONNECT rule 20 protocol tcp
set firewall ipv4 name VRF-INTERCONNECT rule 20 destination port 443
set firewall ipv4 name VRF-INTERCONNECT rule 20 destination address 10.255.0.10

set interfaces virtual-ethernet veth11 firewall in name VRF-INTERCONNECT

commit
save
```

### Access Logging

```bash
# Логирование firewall событий
set firewall ipv4 name VRF-INTERCONNECT rule 20 log
set firewall ipv4 name VRF-INTERCONNECT default-log

# Просмотр логов
show log firewall name VRF-INTERCONNECT
```

### Rate Limiting

Protection against DoS attacks between VRFs:

```bash
# Rate limiting на veth
set firewall ipv4 name VRF-INTERCONNECT rule 30 action accept
set firewall ipv4 name VRF-INTERCONNECT rule 30 protocol icmp
set firewall ipv4 name VRF-INTERCONNECT rule 30 limit rate 100/second

commit
save
```

### Access Control Lists

Granular access control:

```bash
# Разрешить только определенные источники
set firewall ipv4 name VRF-INTERCONNECT rule 40 action accept
set firewall ipv4 name VRF-INTERCONNECT rule 40 protocol tcp
set firewall ipv4 name VRF-INTERCONNECT rule 40 source address 192.168.10.100
set firewall ipv4 name VRF-INTERCONNECT rule 40 destination address 10.255.0.20
set firewall ipv4 name VRF-INTERCONNECT rule 40 destination port 5432

commit
save
```

## Integration with Dynamic Routing

### BGP over veth

```bash
# BGP peering через veth между VRF
set protocols vrf RED bgp local-as 65001
set protocols vrf RED bgp neighbor 100.64.0.1 remote-as 65002
set protocols vrf RED bgp neighbor 100.64.0.1 address-family ipv4-unicast

set protocols vrf BLUE bgp local-as 65002
set protocols vrf BLUE bgp neighbor 100.64.0.0 remote-as 65001
set protocols vrf BLUE bgp neighbor 100.64.0.0 address-family ipv4-unicast

commit
save
```

### OSPF over veth

```bash
# OSPF между VRF
set protocols vrf RED ospf area 0 network 100.64.0.0/31
set protocols vrf RED ospf area 0 network 192.168.10.0/24

set protocols vrf BLUE ospf area 0 network 100.64.0.0/31
set protocols vrf BLUE ospf area 0 network 192.168.20.0/24

commit
save
```

### Route Leaking with BGP

```bash
# Импорт/экспорт маршрутов между VRF через BGP
set protocols vrf RED bgp route-target export 65000:100
set protocols vrf RED bgp route-target import 65000:200

set protocols vrf BLUE bgp route-target export 65000:200
set protocols vrf BLUE bgp route-target import 65000:100

commit
save
```

## Best Practices

### 1. Use a Consistent Naming Scheme

```bash
# veth10-veth11 для VRF interconnects
# veth20-veth21 для другой пары VRF
# vethXX-vethXX - peer suffix всегда +1

set interfaces virtual-ethernet veth10 peer-name veth11
set interfaces virtual-ethernet veth20 peer-name veth21
```

### 2. Always Add Descriptions

```bash
set interfaces virtual-ethernet veth10 description 'TENANT-A to SHARED-SERVICES'
set interfaces virtual-ethernet veth11 description 'SHARED-SERVICES to TENANT-A'
```

### 3. Use /31 for Point-to-Point Links

```bash
# Экономия IP адресов для veth interconnects
set interfaces virtual-ethernet veth10 address 100.64.0.0/31
set interfaces virtual-ethernet veth11 address 100.64.0.1/31
```

### 4. Document the VRF Topology

Create a document describing the VRF interconnection topology:

```
TENANT-A (VRF RED, table 100)
  |
  +-- veth10 (100.64.0.0/31) <--> veth11 (100.64.0.1/31)
  |
SHARED-SERVICES (VRF SHARED, table 300)
  |
  +-- veth21 (100.64.0.3/31) <--> veth20 (100.64.0.2/31)
  |
TENANT-B (VRF BLUE, table 200)
```

### 5. Apply a Firewall on veth

Always control traffic between VRFs:

```bash
set interfaces virtual-ethernet veth11 firewall in name VRF-CONTROL
```

### 6. Monitor veth State

Check veth state regularly:

```bash
# Скрипт мониторинга (добавить в cron)
#!/bin/bash
vyos_cli -c "show interfaces virtual-ethernet" | grep -q "u/u" || echo "veth interface down!"
```

### 7. Use a Dedicated Subnet for veth Interconnects

```bash
# Выделенная подсеть 100.64.0.0/16 (Shared Address Space, RFC 6598)
# для veth interconnects
set interfaces virtual-ethernet veth10 address 100.64.0.0/31
set interfaces virtual-ethernet veth20 address 100.64.0.2/31
set interfaces virtual-ethernet veth30 address 100.64.0.4/31
```

### 8. Test Failover

Verify behavior during failures:

```bash
# Отключение veth для тестирования
set interfaces virtual-ethernet veth10 disable
commit

# Проверка маршрутизации
show ip route vrf RED

# Включение обратно
delete interfaces virtual-ethernet veth10 disable
commit
```

### 9. Log Changes

```bash
# Commit с комментарием
commit comment "Added veth10-veth11 for TENANT-A to SHARED interconnect"
save
```

### 10. Back Up the Configuration

Save the configuration regularly:

```bash
# Backup с veth конфигурацией
save /config/backup/config.boot.veth-$(date +%Y%m%d)
```

## Useful Commands

```bash
# Создание veth пары
set interfaces virtual-ethernet veth0 peer-name veth1
set interfaces virtual-ethernet veth0 address 192.0.2.1/24
set interfaces virtual-ethernet veth1 address 192.0.2.2/24

# Просмотр veth
show interfaces virtual-ethernet
show interfaces virtual-ethernet veth0

# Назначение VRF
set interfaces virtual-ethernet veth0 vrf RED

# Просмотр VRF
show vrf
show vrf RED
show ip route vrf RED

# Удаление veth
delete interfaces virtual-ethernet veth0
delete interfaces virtual-ethernet veth1

# Статистика
show interfaces virtual-ethernet veth0 statistics

# Конфигурация
show configuration interfaces virtual-ethernet

# Тестирование
ping 192.0.2.2 source-address 192.0.2.1
ping 192.168.20.1 vrf RED

# Трассировка
traceroute 192.168.20.1 vrf RED

# Мониторинг трафика
sudo tcpdump -i veth0

# Логи
show log | match veth
```

## Limitations

- veth interfaces operate only in kernel space (no hardware offloading)
- Correct peer interface configuration is required
- Both ends of the pair must be UP for it to work
- The MTU must be consistent on both ends
- A single veth cannot be used in multiple VRFs at the same time
- Performance is bounded by CPU capacity (usually not an issue)

## Conclusion

Virtual Ethernet (veth) interfaces are a powerful tool for building flexible network topologies in VyOS. They are ideal for:

- VRF interconnection in multi-tenant cloud environments
- Isolation and controlled interaction between network domains
- Building complex routing scenarios
- Container and VM networking

Key benefits:
- Simple configuration
- High performance (kernel-level)
- Flexible usage (VRF, namespaces, containers)
- Full support for all VyOS network features
- Excellent integration with the firewall and routing protocols

Recommendations for cloud platforms (Yandex Cloud, VK Cloud):
- Use veth for multi-tenant VRF isolation
- Apply strict firewall rules between VRFs
- Document the VRF topology
- Monitor the state of veth interfaces
- Use /31 subnets to conserve address space
- Test failover scenarios

veth interfaces provide a reliable, high-performance foundation for building complex network architectures in cloud environments.