Virtual Routing and Forwarding Instances

Isolate traffic streams entirely within a single system using VRFs.

In this lesson, you will learn how to use Virtual Routing and Forwarding (VRF) instances to create multiple, isolated routing tables within a single Linux kernel, effectively segmenting network traffic at Layer 3.

The Concept of Virtual Routing

Normally, a Linux system maintains a single global routing table (or a few based on policy rules). When a packet arrives, the kernel consults this global table to decide where to send it. VRF changes this by creating "routing domains." When an interface is associated with a VRF, it ceases to use the global routing table and instead uses a table private to that VRF.

This allows you to have overlapping IP addresses on the same host—such as two interfaces both configured with 192.168.1.1—because the traffic from one interface is physically unable to see the routing decisions made by the other.

Implementing VRF in Linux

To set this up, we use the ip link tool. Think of a VRF as a special "master" device that acts as a container for your interfaces.

Create the VRF device:
```
ip link add vrf-blue type vrf table 100
ip link set vrf-blue up
```
Table 100 is the dedicated routing table that this specific VRF will manage.
Associate an interface with the VRF:
```
ip link set eth1 master vrf-blue
```
Now, any traffic entering eth1 is trapped within the vrf-blue context. If you run ip route show table 100, you will see routes that only apply to traffic passing through eth1.
Running applications inside the VRF: To force an application to use a specific VRF, you use ip vrf exec:
```
ip vrf exec vrf-blue ping 10.0.0.1
```
This ensures the application binds its sockets to the interfaces inside that VRF, preventing "leakage" into the global routing table.

This isolation is powerful because it allows you to maintain completely separate network topologies on one piece of hardware, which is essential for multi-tenant environments or complex security requirements where traffic paths must never intersect.

Key Takeaway: VRF instances provide complete Layer 3 isolation by binding interfaces and applications to dedicated, independent routing tables within the same kernel.