Wireguard and VRFs?
florian.werner at dev.xod.de
Wed Sep 20 05:12:34 CEST 2017
does Wireguard support to bind to a specific interface?
For e.g. gre interface it is possible with
ip tunnel add name gre0 mode gre remote 220.127.116.11 dev eth0
to bind the gre0 interface to eth0.
bind the tunnel to the device NAME so that tunneled
packets will only be routed via this device and will
not be able to escape to another device when the route
to endpoint changes.
But I don't think ip link supports this.
The question is, why are there 2 commands to create new
interfaces (ip link add, ip tunnel add)...
With binding support one can simply bind to a vrf master
interface and all outer-traffic is sent to the associated
routing table. Using vrf instead of network namespace has
the advantage of allowing daemons to operate in multiple
vrf (e.g. routing daemons), where network namespace are
more separated but also don't allow much communication.
More information about the WireGuard