Modern data centres, cloud environments, and containerised orchestrators frequently encounter the scalability constraints of legacy IEEE 802.1Q VLANs, which are restricted to a maximum of 4,094 network segments. To overcome this limitation and enable multi-tenant software-defined networking across routed Layer 3 physical networks, network engineers rely on Virtual Extensible LAN (VXLAN). VXLAN encapsulates Layer 2 Ethernet frames inside standard UDP datagrams using a 24-bit Network Identifier (VNI), supporting up to 16 million distinct virtual overlay networks.
In modern Linux distributions, the Linux kernel natively supports VXLAN termination and routing via the iproute2 suite. This guide explains how to create, configure, bridge, and verify VXLAN interfaces using ip link on Linux servers.
Understanding VXLAN Architecture and Parameters
Before creating a VXLAN interface, you must understand the key attributes required to establish an overlay tunnel:
- VNI (VXLAN Network Identifier): A 24-bit integer (ranging from 1 to 16,777,215) identifying the unique virtual broadcast domain.
- Underlay Interface (Physical Dev): The physical or bonded network interface (such as
eth0orenp3s0) that transmits encapsulated UDP packets across the underlying Layer 3 network. - Destination UDP Port: By default, Linux historically used UDP port 8472, but the IANA standard for VXLAN is UDP port 4789. Standardising on port 4789 ensures interoperability with enterprise switches and hardware appliances.
- Remote Endpoint (Unicast vs Multicast): VXLAN can forward broadcast, unknown unicast, and multicast (BUM) traffic using IP multicast groups (such as
239.1.1.1) or point-to-point unicast remote IP addresses.
Step 1: Verify Kernel Support and Load the VXLAN Module
While most modern production kernels compile the VXLAN driver as an autoloaded module, verify that the module is available on your host:
lsmod | grep vxlanIf the command outputs nothing, manually load the kernel module using modprobe:
sudo modprobe vxlanTo ensure the module automatically loads across system reboots, add it to your kernel modules configuration:
echo "vxlan" | sudo tee -a /etc/modules-load.d/vxlan.confStep 2: Create a Point-to-Point Unicast VXLAN Interface
In direct point-to-point topologies between two Linux hosts, you can establish an overlay tunnel by specifying the remote host’s underlay IP address.
Run the following command to create a virtual device named vxlan100 with VNI 100 on standard UDP port 4789:
sudo ip link add vxlan100 type vxlan \
id 100 \
remote 192.168.10.20 \
local 192.168.10.10 \
dstport 4789 \
dev eth0Parameter breakdown:
vxlan100: The name of the virtual network device created in the host network namespace.type vxlan id 100: Specifies the network device driver type and assigns VNI 100.remote 192.168.10.20: The remote peer underlay IP address.local 192.168.10.10: The local host underlay IP address on the physical interface.dstport 4789: Specifies the IANA standard destination port for VXLAN encapsulation.dev eth0: Declares the physical underlay egress interface.
Step 3: Create a Multicast VXLAN Interface (Multi-Host Topology)
When connecting more than two Linux hosts within the same overlay without running a complex BGP-EVPN control plane, use an IP multicast group for automatic peer discovery:
sudo ip link add vxlan200 type vxlan \
id 200 \
group 239.1.1.1 \
dstport 4789 \
dev eth0 \
ttl 10In this configuration, all hosts listening on multicast group 239.1.1.1 on the local network segment dynamically learn each other’s inner MAC addresses and underlay IP bindings.
Step 4: Assign an IP Address and Bring the Interface Up
Once the VXLAN virtual interface is created, assign an overlay IP address subnet that is distinct from your physical underlay network:
sudo ip addr add 10.100.0.1/24 dev vxlan100
sudo ip link set vxlan100 upOn the remote host (192.168.10.20), configure the matching peer:
sudo ip link add vxlan100 type vxlan id 100 remote 192.168.10.10 local 192.168.10.20 dstport 4789 dev eth0
sudo ip addr add 10.100.0.2/24 dev vxlan100
sudo ip link set vxlan100 upTest the overlay tunnel connectivity using standard ping:
ping -c 4 10.100.0.2Step 5: Bridge VXLAN to Virtual Machines and Containers
To connect local container network namespaces or KVM/QEMU virtual machines to the VXLAN overlay, attach the VXLAN interface to a Linux software bridge:
- Create a Linux network bridge:
sudo ip link add br-vxlan type bridge sudo ip link set br-vxlan up - Remove any IP address from the VXLAN interface and slave it to the bridge:
sudo ip addr flush dev vxlan100 sudo ip link set vxlan100 master br-vxlan - Assign the gateway IP address to the bridge interface:
sudo ip addr add 10.100.0.1/24 dev br-vxlan - Now, any virtual Ethernet pair (
veth) or TAP device connected tobr-vxlanautomatically inherits Layer 2 communication across the entire physical network.
Step 6: Inspect VXLAN Link Properties and Forwarding Tables
To inspect detailed configuration parameters and encapsulation counters, query ip link with the detailed flag:
ip -d link show vxlan100To inspect the Layer 2 Forwarding Database (FDB) where Linux stores mapped inner MAC addresses and their remote underlay IP endpoints, use the bridge utility:
bridge fdb show dev vxlan100Step 7: How to Delete a VXLAN Interface
To tear down and remove an existing VXLAN interface, bring the device down and invoke the delete command:
sudo ip link set vxlan100 down
sudo ip link delete vxlan100Troubleshooting Common VXLAN Issues
MTU Fragmentation and Dropped Packets
VXLAN adds 50 bytes of encapsulation overhead (14 bytes Ethernet + 20 bytes IPv4 + 8 bytes UDP + 8 bytes VXLAN header). If your physical underlay uses a standard 1500-byte MTU, overlay packets exceeding 1450 bytes will fragment or drop. Always set the overlay interface MTU to 1450, or configure Jumbo Frames (such as MTU 9000) on your physical underlay network:
sudo ip link set vxlan100 mtu 1450Firewall Blocking UDP Port 4789
If ping fails between VXLAN endpoints, check whether iptables, nftables, or ufw is blocking UDP traffic on the underlay port. Allow incoming traffic on port 4789:
sudo ufw allow 4789/udpFrequently Asked Questions
What is the difference between VLAN and VXLAN?
Standard VLAN (IEEE 802.1Q) tags packets at Layer 2 with a 12-bit identifier, restricting networks to 4,094 segments within the same physical broadcast domain. VXLAN uses a 24-bit VNI (supporting over 16 million networks) and encapsulates frames inside routable Layer 3 UDP packets, allowing overlay networks to span multiple subnets, routers, and data centres.
Can I configure VXLAN persistently across system reboots?
Yes. You can define VXLAN interfaces declaratively using systemd-networkd (using .netdev and .network files) or through Netplan on Ubuntu by specifying the vxlan tunnel configuration in your YAML files under /etc/netplan/.
Does VXLAN support IPv6 underlays?
Yes. The Linux kernel supports both IPv4 and IPv6 underlays for encapsulating VXLAN traffic. You can specify IPv6 remote and local addresses when creating the interface.