When deploying containers, virtual machines, or isolated test namespaces on a Linux host, standard network bridges can occasionally introduce unwanted packet overhead, STP delays, and MAC learning complexities. The Linux kernel provides an elegant alternative known as MACVLAN. A MACVLAN driver allows you to create multiple virtual network interfaces on top of a single physical Network Interface Card (NIC), giving each virtual interface its own unique MAC address and dedicated IP address directly on your local physical network subnet.
In this guide, you will learn how to create, configure, and manage MACVLAN interfaces in Linux using the standard ip link command from the iproute2 suite, understand the distinct operational modes, and solve the common host-to-macvlan communication challenge.
Understanding MACVLAN Operational Modes
When instantiating a MACVLAN device, you must choose an operational mode that dictates how virtual interfaces communicate with one another and external nodes:
- Bridge Mode (Most Common): Endpoints connected to the same physical interface communicate directly with each other through internal kernel switching without sending packets out through the physical wire.
- Private Mode: Drops all traffic between MACVLAN endpoints on the same host. Packets destined for external systems still transmit normally through the underlying NIC.
- VEPA Mode (Virtual Ethernet Port Aggregator): Directs all traffic out through the physical interface, relying on an external 802.1Qbg-capable physical switch to hair-pin turn and reflect packets back to sibling endpoints.
- Passthru Mode: Gives full, exclusive control of the underlying physical adapter to a single virtual device, often used to pass physical network interfaces directly into isolated network namespaces or containers.
Step 1: Check Your Physical Network Interface
Before attaching a virtual device, confirm the exact name and status of your physical Ethernet or wireless interface:
ip link showIdentify your primary interface from the output, such as eth0 or enp3s0. Ensure the interface is in an UP operational state.
Step 2: Create a MACVLAN Interface Using ip link
To create a MACVLAN interface in bridge mode linked to eth0, run the following command with root privileges:
sudo ip link add link eth0 name macvlan0 type macvlan mode bridgeHere is what each parameter accomplishes:
link eth0: Designates the parent physical network interface.name macvlan0: Specifies the arbitrary name for the new virtual network device.type macvlan: Informs the kernel to attach the MACVLAN driver.mode bridge: Selects the inter-endpoint communication mode. You can replacebridgewithprivateorvepaif required.
Step 3: Assign an IP Address and Activate the Interface
Once created, the MACVLAN interface is inactive and lacks network addressing. Assign an IPv4 address on your local subnet and bring the link up:
# Assign an IP address on your local subnet
sudo ip addr add 192.168.1.150/24 dev macvlan0
# Bring the interface online
sudo ip link set macvlan0 upIf your local network uses dynamic host configuration, you can instead spawn a DHCP client lease on the new device:
sudo dhclient macvlan0Verify that your new interface is active and has received a distinct MAC and IP address:
ip addr show macvlan0Step 4: Solving the Host-to-MACVLAN Communication Quirk
By architectural design in the Linux kernel, a host parent interface cannot communicate directly with child MACVLAN endpoints residing on it. While external devices on your physical LAN can ping and exchange data with macvlan0, the host OS itself will experience connection timeouts.
To establish bidirectional connectivity between the host and your MACVLAN interfaces, configure a dedicated MACVLAN sub-interface for the host itself:
# 1. Create a companion macvlan interface for the host
sudo ip link add link eth0 name macvlan-host type macvlan mode bridge
# 2. Assign an IP address to the host endpoint
sudo ip addr add 192.168.1.151/32 dev macvlan-host
# 3. Bring the host endpoint up
sudo ip link set macvlan-host up
# 4. Add a specific static route to reach the container MACVLAN
sudo ip route add 192.168.1.150 dev macvlan-hostThis routing rule forces host packets directed at 192.168.1.150 through the macvlan-host endpoint, completing the bridge loop internally.
Step 5: How to Delete a MACVLAN Interface
When an interface is no longer needed, tear it down cleanly using ip link delete:
sudo ip link set macvlan0 down
sudo ip link delete macvlan0To explore complementary virtualization networking approaches, read our tutorial on how to create and configure network bridges in Linux using ip link, or discover how to configure systemd-networkd MACVLAN interfaces for lightweight container isolation to make your virtual configurations persistent across system reboots.
Frequently Asked Questions
Can MACVLAN interfaces be created over Wi-Fi (WLAN) connections?
Generally no. The IEEE 802.11 Wi-Fi specification uses three-address frame formats in standard client station mode, meaning an access point rejects frames carrying MAC addresses that do not match the authenticated association. For wireless networking, prefer standard Linux bridges or IPVLAN in L2 mode.
What is the difference between MACVLAN and IPVLAN?
While MACVLAN generates a unique, distinct MAC address for every virtual interface, IPVLAN shares the single physical MAC address of the parent NIC across all child devices, differentiating traffic solely by IP addresses. IPVLAN is ideal when network switch port security restricts the number of active MAC addresses on a physical port.
Do MACVLAN interfaces survive a system reboot?
Interfaces created purely with ip link exist only in kernel memory and disappear upon shutdown. To preserve them across reboots, define them in your distribution’s network management configuration, such as Netplan, NetworkManager, or systemd-networkd.