How to Configure IPv6 Segment Routing (SRv6) in Linux Using ip route and ip sr

In modern enterprise, cloud carrier, and Software-Defined Networking (SDN) backbones, directing network traffic through predetermined service paths (such as firewalls, deep packet inspection engines, or optimized low-latency transit links) is increasingly accomplished using Segment Routing over IPv6 (SRv6). Unlike legacy Multi-Protocol Label Switching (MPLS), which requires maintaining complex state distribution protocols (LDP or RSVP-TE) across every intermediate router, SRv6 encodes source routing path instructions directly inside standard IPv6 extension headers (Segment Routing Header, or SRH). The Linux kernel provides native, production-grade SRv6 data-plane forwarding and encapsulation, configured directly via iproute2.

Understanding SRv6 Mechanics and the Segment Routing Header

In SRv6 architecture, a packet\u2019s forwarding trajectory is divided into an ordered list of 128-bit IPv6 addresses known as Segment Identifiers (SIDs):

• Source Routing: The ingress node inspects matching packet flows and prepends an IPv6 Segment Routing Header (IPv6-SRH, routing type 4) containing the explicit list of transit SIDs.
• End-to-End Stateless Forwarding: Intermediate transit routers forward the packet using standard standard longest-prefix match on the current IPv6 destination address without maintaining flow state.
• Segments Left (SL): As each transit segment node receives the packet, it decrements the Segments Left pointer in the SRH and replaces the IPv6 destination address with the next SID in the list.
• Endpoint Behaviors: End nodes perform designated actions, such as stripping the SRH (PSP / USP) or decapsulating the payload into a tenant virtual routing namespace (End.DT4 / End.DT6).

Enabling SRv6 Subsystems in the Linux Kernel

Before configuring SRv6 routes, verify that the Linux kernel segment routing modules and sysctl flags are active:

sudo modprobe ipv6

Enable IPv6 forwarding and Seg6 routing processing on your target network interfaces:

sudo sysctl -w net.ipv6.conf.all.forwarding=1
sudo sysctl -w net.ipv6.conf.eth0.seg6_enabled=1
sudo sysctl -w net.ipv6.conf.all.seg6_enabled=1

To ensure persistent configuration across system reboots, append these values to /etc/sysctl.d/99-srv6.conf:

echo "net.ipv6.conf.all.seg6_enabled = 1" | sudo tee -a /etc/sysctl.d/99-srv6.conf
echo "net.ipv6.conf.eth0.seg6_enabled = 1" | sudo tee -a /etc/sysctl.d/99-srv6.conf

Encapsulating Ingress Traffic into an SRv6 Path

To configure an ingress router or gateway host to steer outbound IPv6 or IPv4 traffic through an explicit SRv6 path, use the encap seg6 route command:

sudo ip route add 2001:db8:beef::/48 encap seg6 mode encap segs 2001:db8:1::1,2001:db8:2::2,2001:db8:3::3 dev eth0

The parameters operate as follows:

• encap seg6: Invokes the kernel\u2019s Segment Routing encapsulation driver.
• mode encap: Wraps the original IP packet inside a new outer IPv6 header containing the SRH. (Alternatively, mode inline inserts the SRH directly into the existing IPv6 header).
• segs <SID1,SID2,SID3>: An ordered list of SIDs defining the exact path traversing the network.

When the host transmits packets destined for 2001:db8:beef::/48, the kernel automatically encapsulates them into an IPv6 packet whose initial destination address is 2001:db8:1::1 and attaches the remaining segment list in the SRH.

Configuring Intermediate Endpoint Behaviors with ip sr

On intermediate routers acting as SRv6 segment execution nodes, configure the local endpoint behavior using encap seg6local:

sudo ip route add 2001:db8:2::2/128 encap seg6local action End dev eth0

Common endpoint actions include:

• action End: Standard endpoint behavior. Decrements Segments Left, updates the destination address with the next SID, and forwards the packet.
• action End.X nh6 <NextHop>: Endpoint with cross-connect forwarding to a specific adjacent neighbor interface.
• action End.DT4 vrftable 100: Decapsulates outer IPv6/SRH headers and forwards the inner IPv4 packet according to VRF routing table 100.
• action End.DT6 vrftable 100: Decapsulates the packet and looks up the inner IPv6 address in VRF table 100.

Inspecting and Verifying SRv6 Routes

To inspect active SRv6 encapsulation routes in your routing table:

ip -6 route show encap seg6

The command lists active segment routing rules and their assigned segment arrays:

2001:db8:beef::/48  encap seg6 mode encap segs 3 [ 2001:db8:1::1 2001:db8:2::2 2001:db8:3::3 ] dev eth0 metric 1024 pref medium

You can verify packet transit and inspect the live Segment Routing Header using tcpdump on the egress interface:

sudo tcpdump -i eth0 -n "ip6[6] == 43" -vv

Routing type 43 identifies the IPv6 Routing Header, allowing visual confirmation of SID traversals across your network.