Tunneling interface protocols

This page describes all available tunneling protocol usable in /etc/config/network and their options. Some example configurations are provided at the end of the page.

Note that, for most protocols, installing an opkg package is required for protocol support.

The package ppp-mod-pptp must be installed to use this protocol.

Common PPTP and PPP configuration locations:

PPTP options are configured using :

umask go=
cat << "EOF" > /etc/ppp/chap-secrets
[<domain>\\]<user> <peer_name> <password> *
EOF

umask go=
mkdir -p /etc/ppp/peers
cat << "EOF" > /etc/ppp/peers/<peer_name>
...
EOF

PPP script parameters:

An example script to invoke peer-specific code:

cat << "EOF" > /etc/ppp/ip-up
#!/bin/sh
case ${PEERNAME} in
(USERNAME1) ... ;;
(*) ... ;;
esac
EOF
chmod +x /etc/ppp/ip-up

The package relayd must be installed to use this protocol.

The package gre must be installed to use this protocol. Additionally, you need kmod-gre and/or kmod-gre6.

GRE support has been introduced in Barrier Breaker. Four protocols are defined (“gre”, “gretap”, grev6“, and “grev6tap”), which will generate GRE interfaces named:

All four protocols accept the following common options:

The following options are supported, in addition to all common options above:

The following options are supported, in addition to all common options above:

ipaddr may be required in some setups. Repeated log entries about “setting up now” and “now down” may be related to this.

Additionally, the resolveip package may also be needed. ./gre.sh: eval: line 1: resolveip: not found in the logs are an indication of the need.

The following options are supported, in addition to all common options above:

The following options are supported, in addition to all common options above:

The package ieee8021xclient must be installed to use this protocol.

See alse wpa_enterprise_client.

VTI Tunnels are IPsec policies with a fwmark set. The traffic is redirected to the matching VTI interface.

The following options are supported, in addition to all common options above:

A working VXLAN configuration consists of two interface definitions. One is the actual VXLAN interface, the other one is an alias interface. The following options can be used in the VXLAN interface definition (with option proto 'vxlan'):

ipaddr can be specified, but it does not have the effect of setting the IP address of the VXLAN interface. For correct configuration see the example VXLAN example configuration at the end of the page.

Multiple peers can be configured with config vxlan_peer entries:

config vxlan_peer
        option vxlan vxlan0
        option dst '10.0.0.2'
 
config vxlan_peer
        option vxlan vxlan0
        option dst '10.0.0.3'

All available options for config vxlan_peer:

XFRM Tunnel interfaces are bound to if_id set in the sa policy.

The package openconnect must be installed to use this protocol.

Most of these options are passed directly to the OpenConnect executive, so see openconnect for details.

Certificates and keys files must be in the PEM format and named as shown below where <ifname> is the name of the logical interface.

The package pppossh must be installed to use this protocol.

For configuration see current README.

The package vpnc must be installed to use this protocol.

For configuration see current README.

The package wireguard-tools must be installed to use this protocol.

Each WireGuard interface is configured in two parts:

• the configuration relative to the interface itself (private key, MTU, UDP port to bind to, etc.)
• configuration relative to each peer (public key, IP address, etc.)

Interface configuration (using proto wireguard):

The name of the network interface will be the name of the configuration section.

Peer configuration, for each peer:

The name of a peer section must be wireguard_<ifname> where <ifname> is the name of the logical interface.

Below are a few examples for special, non-standard interface configurations.

Avoid OpenVPN tunnel interface declaration to prevent the race condition with netifd service.

If you still want to manage VPN interface such as tun0 via UCI configuration and LuCI:

# /etc/config/network
config interface 'vpn'
	option device 'tun0'
	option proto 'none'

Follow IPv4/IPv6 Transition Technologies.

Support for L2TP is provided by xl2tpd package. The username and password are for PPP authentication.

config interface 'l2tpwan'
	option proto 'l2tp'
	option server '1.2.3.4'
	option username 'mylogin'
	option password 'mypassword'
	option keepalive '30'

This example establishes a Pseudowire Tunnel and bridges it to the LAN ports. The existing lan interface is reused with protocol l2tp instead of static.

config interface 'lan'
	option proto     'l2tp'
	option type      'bridge'
	option ifname    'eth0'
	option ipaddr    '192.168.1.1'
	option netmask   '255.255.255.0'
	option localaddr '178.24.154.19'
	option peeraddr  '89.44.33.61'
	option encap     'udp'
	option sport     '4000'
	option dport     '5410'

This example sets up a relayd pseudo bridge between a wireless client network and LAN, so that it works similarly to the Broadcom Bridged Client mode.

Wireless configuration (excerpt):

config wifi-iface
	option device     'radio0'
	option mode       'sta'
	option ssid       'Some Wireless Network'
	option encryption 'psk2'
	option key	'12345678'
	option network    'wwan'

Network configuration (excerpt):
Note that the LAN subnet must be different from the one used by wireless network's DHCP.

config interface 'lan'
	option ifname     'eth0.1'
	option proto      'static'
	option ipaddr     '192.168.1.1'
	option netmask    '255.255.255.0'
 
config interface 'wwan'
	option proto      'dhcp'
 
config interface 'stabridge'
	option proto      'relay'
	option network    'lan wwan'

In contrast to true bridging, traffic forwarded in this manner is affected by firewall rules, therefore both the wireless client network and the lan network should be covered by the same LAN firewall zone with forward policy set to accept to allow traffic flow between both interfaces:

config zone
	option name	'lan'
	option network     'lan wwan'  # Important
	option input       'ACCEPT'
	option forward     'ACCEPT'    # Important
	option output      'ACCEPT'

Create a GRE tunnel with static address 10.42.0.253/30, adding it to an existing firewall zone called tunnels:

See warning on top of page about interface-name length. Previous interface names here were too long and silently fail.

config interface 'tunA'
	option proto    'gre'
	option zone     'tunnels'
	option peeraddr '198.51.100.42'
 
config interface 'tunAA'
	option proto    'static'
	option ifname   '@tunA'
	option ipaddr   '10.42.0.253'
	option netmask  '255.255.255.252'
	# Fixes IPv6 multicast (long-standing bug in kernel).
	# Useful if you run Babel or OSPFv3.
	option ip6addr  'fe80::42/64'

This adds support for configuring VTI interfaces within /etc/config/network. VTI interfaces are used to create IPsec tunnel interfaces. These interfaces may be used for routing and other purposes.

config interface 'vti1'
	option proto 'vti'
	option mtu '1500'
	option tunlink 'wan'
	option peeraddr '192.168.5.16'
	option zone 'VPN'
	option ikey 2
	option okey 2
 
config interface 'vti1_static'
	option proto 'static'
	option ifname '@vti1'
	option ipaddr '192.168.7.2/24'

The options ikey and okey correspond to the fwmark value of an ipsec policy. This may be null if you do not want a fwmark. Also peeraddr may be 0.0.0.0 if you want all ESP packets go through the interface.

Example strongswan config:

conn vti
	left=%any
	leftcert=peer2.test.der
	leftid=@peer2.test
	right=192.168.5.16
	rightid=@peer3.test
	leftsubnet=0.0.0.0/0
	rightsubnet=0.0.0.0/0
	mark=2
	auto=route

An example of WireGuard server configuration.

config interface 'vpn'
	option proto 'wireguard'
	option private_key 'SERVER_PRIVATE_KEY'
	option listen_port '51820'
	list addresses '192.168.9.1/24'
	list addresses 'fd00:9::1/64'
 
config wireguard_vpn 'wgclient'
	option public_key 'CLIENT_PUBLIC_KEY'
	option preshared_key 'PRESHARED_KEY'
	list allowed_ips '192.168.9.2'
	list allowed_ips 'fd00:9::2'

An example of WireGuard client configuration.

config interface 'vpn'
	option proto 'wireguard'
	option private_key 'CLIENT_PRIVATE_KEY'
	list addresses '192.168.9.2/24'
	list addresses 'fd00:9::2/64'
 
config wireguard_vpn 'wgserver'
	option public_key 'SERVER_PUBLIC_KEY'
	option preshared_key 'PRESHARED_KEY'
	option endpoint_host 'SERVER_ADDRESS'
	option endpoint_port '51820'
	option route_allowed_ips '1'
	option persistent_keepalive '25'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::/0'

Create a WireGuard tunnel interface named foo that connects to one peer (VPN server at vpn.example.com) and allows another peer (e.g. road warrior) to connect. Peer configurations are managed via one or more wireguard_<ifname> sections.

config interface 'foo'
	option proto 'wireguard'
	option private_key 'qLvQnx5CpXPDo6oplzdIvXLNqkbgpXip3Yv4ouHWZ0Q='
	list addresses 'fd00:13:37:ffff::1/64'
 
config wireguard_foo
	option public_key '9mD+mTiOp7SGIkB4t3ZfWAcfp5iA/WwQRdVypKKwrjY='
	option route_allowed_ips '1'
	list allowed_ips 'fd00:13:37::/64'
	option endpoint_host 'vpn.example.com'
	option persistent_keepalive '25'
 
config wireguard_foo
	option public_key '4mLeSytW6/y4UcOT6rNorw1Ae9nXSxhXUjxsdzMWkUA='
	option preshared_key 'M1IbkkDVwXsQbFbURiMXiVe/iUCjC5TKHCmemVs+oLQ='
	list allowed_ips 'fd00:13:37:ffff::2'

Here is an example configuration for a VXLAN tunnel. Only the required options are used, optional ones can be specified additionally.

VXLAN interface definition:

config interface 'vxlan0'
	option proto 'vxlan'
	option peeraddr '10.10.222.1'
	option port '4789'
	option vid '8'
	option tunlink 'eth0'

Now it is necessary to create an alias interface for vxlan0 to assign an IP address as this is not possible with option ipaddr:

config interface 'l2vpn'
	option ifname '@vxlan0'
	option proto 'static'
	option ipaddr '10.10.0.1'
	option netmask '255.255.255.0'
	option layer '2'

An Ethernet adapter is being inserted into the port, its Ethernet frame is send to the distant br-lan.

It will obtain an IP address in the 192.168.200.x range from a distant DHCP server via a Layer 2 VPN.

Assuming you are using VLAN on your router.

Assuming you have setup site-to-site VPN with subnet routing with Wireguard or Tailscale.

VLAN ID 100 is native LAN.

VLAN ID 1000 is used to short circuit VXLAN to port and only avaliable on sender.

Sender :

• detach ethernet port from any VLAN ID
• create a new VLAN ID, not join to existing VLAN ID and short circuit Ethernet port to VXLAN interface

Overview of Bridge device br-lan:

--------------------------------------------------------------------------------------
| VLAN ID | Local | br-lan.100 | br-lan.1000 | lan1 | lan2 | lan3 | lan4 | vxlan100  |
--------------------------------------------------------------------------------------
|         |       | Connected  | Connected   |      |      |      |      | Connected |
--------------------------------------------------------------------------------------
| 100     | Yes   | T          | -           | U    | U    | U    | -    |           |
--------------------------------------------------------------------------------------
| 1000    | Yes   | -          | -           | -    | -    | -    | U    | U         |
--------------------------------------------------------------------------------------

Add vxlan100 interface to the br-lan bridge.

config device
	option name 'br-lan'
	option type 'bridge'
	option bridge_empty '1'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'vxlan100'
	list ports 'br-lan.100'

Don't use “option tunlink”, it is not working with Wireguard and Tailscale with VLAN/subnet routing.

config interface 'vxlan100'
	option proto 'vxlan'
	option peeraddr '192.168.200.1'
	option ipaddr '192.168.100.1'
	option port '4789'
	option vid '100'
 
config bridge-vlan
	option device 'br-lan'
	option vlan '1000'
	list ports 'lan4'
	list ports 'vxlan100'

Receiver:

• Join VXLAN datagram to destination VLAN ID.

Overview of Bridge device br-lan:

------------------------------------------------------------------------
| VLAN ID | Local | br-lan.100 | lan1 | lan2 | lan3 | lan4 | vxlan100  |
------------------------------------------------------------------------
|         |       | Connected  |      |      |      |      | Connected |
------------------------------------------------------------------------
| 100     | Yes   | T          | U    | U    | U    | U    | U         |
------------------------------------------------------------------------

Add vxlan100 interface to the br-lan bridge.

config device
	option name 'br-lan'
	option type 'bridge'
	option bridge_empty '1'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'vxlan100'
	list ports 'br-lan.100'

Join VXLAN datagram to the native LAN, VLAN ID 100

config bridge-vlan
	option device 'br-lan'
	option vlan '100'
	list ports 'br-lan.100:t'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'vxlan100'
 
config interface 'vxlan100'
	option proto 'vxlan'
	option peeraddr '192.168.100.1'
	option ipaddr '192.168.200.1'
	option port '4789'
	option vid '100'

You can set up bidirectional layer 2 VPN on port4 with the same approach and use difference VXLAN VNI.

Site one's port4 is send to site two's br-lan and site two's port4 is send to site one's br-lan.