How to Configure Linux VRF (Virtual Routing and Forwarding) for Network Tenant Isolation

In standard Linux networking, the kernel maintains a single, global routing table. If an application (like a web server or a database) wants to send a packet to 10.0.0.5, the kernel consults this singular table to determine the exit interface.

This flat architecture becomes a massive security and operational liability in multi-tenant environments, such as service provider networks, hypervisors hosting virtual machines for different clients, or massive Kubernetes clusters. If Tenant A uses the 10.0.0.0/24 subnet internally, and Tenant B also uses the exact same 10.0.0.0/24 subnet internally, a single Linux routing table cannot differentiate between the two. The traffic will collide, resulting in catastrophic cross-tenant data leaks or dropped packets.

The solution is Virtual Routing and Forwarding (VRF). Originally pioneered on enterprise Cisco and Juniper hardware routers, VRF allows a single physical router to maintain multiple, completely isolated routing tables simultaneously. The Linux kernel natively supports VRF, allowing you to segment network interfaces, IP addresses, and routing decisions into mathematically isolated domains on a standard Linux server.

This guide explains how to implement Linux VRF using the iproute2 toolkit.

Understanding the Linux VRF Architecture

In the Linux kernel, a VRF is treated as a specialized network interface (a master device).

1. The VRF Master: You create a VRF interface (e.g., vrf-tenant-a). This interface is bound to a specific, hidden routing table ID (e.g., Table 100).
2. The Slaves: You enslave physical or virtual network interfaces (like eth1 or a VLAN interface like eth0.10) to the VRF master.
3. The Isolation: Once an interface is enslaved to vrf-tenant-a, any packet arriving on that interface is only evaluated against Table 100. It physically cannot see the global routing table, and the global routing table cannot see it. You can have the IP 10.0.0.5 assigned to eth1 in VRF A, and the exact same IP 10.0.0.5 assigned to eth2 in VRF B, and the kernel will handle them perfectly independently.

Step 1: Enabling VRF in the Kernel

Modern Linux kernels (4.8+) support VRF out of the box, but you must ensure the vrf module is loaded and strict routing rules are enabled.

Load the kernel module:

sudo modprobe vrf

To enable strict L3 mode (which ensures sockets bound to a VRF are strictly isolated to that VRF’s routing table), configure sysctl:

sudo sysctl -w net.ipv4.tcp_l3mdev_accept=0
sudo sysctl -w net.ipv4.udp_l3mdev_accept=0

Step 2: Creating the VRF Interface

We will create a VRF named vrf-blue and associate it with routing table 100.

Use the standard ip command:

sudo ip link add dev vrf-blue type vrf table 100

Bring the VRF master interface up:

sudo ip link set dev vrf-blue up

Step 3: Enslaving Network Interfaces

Assume you have a physical network interface, eth1, that is connected to the “Blue Tenant” network. You must enslave it to the VRF.

First, bring the interface down (enslaving an active interface can cause state issues):

sudo ip link set dev eth1 down

Assign the interface to the VRF master:

sudo ip link set dev eth1 master vrf-blue

Bring the interface back up:

sudo ip link set dev eth1 up

Now, assign an IP address to eth1. (Even if this IP overlaps with the global routing table, it will not conflict):

sudo ip addr add 192.168.1.10/24 dev eth1

Step 4: Interacting with the VRF

Because eth1 is now isolated in vrf-blue (Table 100), standard Linux networking commands will fail to see it. If you run a standard ping 192.168.1.1 from the server, the kernel will check the global routing table, find no route, and return “Network is unreachable.”

To interact with devices inside the VRF, you must prepend your commands with the ip vrf exec context wrapper. This forces the executed process into the VRF’s routing domain.

To ping a host inside the Blue Tenant network:

sudo ip vrf exec vrf-blue ping 192.168.1.1

To view the isolated routing table for the VRF:

sudo ip route show table 100
# OR
sudo ip vrf exec vrf-blue ip route

Step 5: Running Applications inside a VRF

You can force entire daemons to operate exclusively within the VRF enclosure. For example, if you want to run an SSH server that only listens on the Blue Tenant network, you start the sshd binary inside the VRF context.

sudo ip vrf exec vrf-blue /usr/sbin/sshd -D -p 2222

That SSH daemon is now completely invisible to the global network and can only be accessed by clients arriving via interfaces enslaved to vrf-blue.

Conclusion

Virtual Routing and Forwarding is a mandatory architecture for modern Linux networking in multi-tenant environments. By utilizing the kernel’s native VRF subsystem and the iproute2 toolkit, systems engineers can instantly carve a single Linux server into multiple, cryptographically isolated routing planes, enabling complex overlapping IP topologies and ensuring absolute data segregation between competing tenants.