Linux VXLAN Configuration: ip link and Static VTEP Setup

VXLAN extends layer-2 segments over a layer-3 network by wrapping Ethernet frames in UDP (RFC 7348), and Linux has shipped a native VXLAN implementation in the kernel for years - no Open vSwitch required. With two ip link commands you can build a static VTEP pair that carries a whole L2 segment between servers or VMs across a routed fabric. This guide explains the Linux VXLAN device model and shows multicast and static-remote configurations with FDB management, based on the official kernel networking documentation.

The Linux VXLAN Device Model

A VXLAN device is a 1-to-N tunnel: unlike GRE it is not point-to-point. The device learns remote endpoint IPs either dynamically like a learning bridge (receiving encapsulated traffic teaches it where a MAC lives) or from statically configured FDB entries. Traffic for unknown destinations is sent to a multicast group when one is configured, or dropped in pure unicast mode.

Basic Device Creation (Multicast Mode)

ip link add vxlan0 type vxlan id 42 group 239.1.1.1 dev eth1 dstport 4789
ip link set dev vxlan0 up

This creates vxlan0 with VNI 42, using multicast group 239.1.1.1 on eth1 for flood traffic and the IANA destination port 4789. Older kernels defaulted to a different port, so always set dstport 4789 explicitly for interop with switches and other vendors.

Static VTEP (Unicast) Configuration

Without multicast you must add a static FDB entry pointing the remote VNI at the peer VTEP IP, plus give the vxlan interface an address in the bridged segment:

# Host A (VTEP 10.0.0.1)
ip link add vxlan10 type vxlan id 100 remote 10.0.0.2 dstport 4789 dev eth0
ip addr add 192.168.200.1/24 dev vxlan10
ip link set vxlan10 up

# Host B (VTEP 10.0.0.2)
ip link add vxlan10 type vxlan id 100 remote 10.0.0.1 dstport 4789 dev eth0
ip addr add 192.168.200.2/24 dev vxlan10
ip link set vxlan10 up

Both hosts can now ping each other over the VXLAN, including ARP. To carry VMs instead, slave vxlan0 to a Linux bridge (ip link set vxlan0 master br0) exactly like a VLAN trunk interface.

Managing the FDB

# add / delete / show forwarding entries
bridge fdb add to 00:17:42:8a:b4:05 dst 192.19.0.2 dev vxlan0
bridge fdb delete 00:17:42:8a:b4:05 dev vxlan0
bridge fdb show dev vxlan0
ip -d link show vxlan0

Practical Notes

By default the kernel hashes the UDP source port to spread entropy across ECMP paths - pinning is possible with the srcport parameter if a firewall or load balancer requires a fixed port, but avoid it on routed fabrics. Check NIC offload support (ethtool --show-tunnels eth0); rx-udp_tunnel-port-offload improves performance by parsing the inner frames in hardware.

Related Guides on This Site

VXLAN overlays pair naturally with Linux bridging and VLANs: see Open vSwitch bridges and VLANs, Linux VLAN tagging with ip link, and Docker overlay networking.

原文链接：https://www.kernel.org/doc/html/latest/networking/vxlan.html