In this lesson, you will learn how to leverage Virtual Routing and Forwarding (VRF) to create multiple, completely isolated routing domains within a single Linux kernel.
The Concept of VRF
Up to this point, we have managed network traffic using global routing tables and namespaces. However, a standard network namespace often isolates the entire networking stack. VRF allows for a more granular approach: it enables you to partition the layer-3 routing table itself, effectively turning your Linux host into multiple virtual routers.
Unlike a network namespace, which virtualizes the entire stack, a VRF device acts as a "virtual router" interface. When you associate a physical or virtual interface (like a veth pair) with a VRF master device, all traffic traversing that interface is forced to look up routes only within that specific VRF’s table, rather than the global routing table.
Practical Implementation
To see this in action, we use the ip command to create a master device and assign an interface to it:
# Create a VRF master device named 'vrf-blue' associated with table 1001
ip link add vrf-blue type vrf table 1001
ip link set vrf-blue up
# Assign an existing interface (e.g., eth1) to the VRF
ip link set dev eth1 master vrf-blue
Once eth1 is enslaved to vrf-blue, any packet entering eth1 will be processed using routing table 1001. If you have two different VRFs, they can each have their own default gateway or overlapping IP subnets without causing any collisions. This is particularly powerful for container orchestration, where you might need to support multitenancy where different customers use identical private IP ranges (e.g., 10.0.0.0/24) without the packets leaking between them.
By binding your container applications to specific VRF interfaces, you ensure that their traffic remains logically separated at the routing layer, even if they share the same underlying hardware and kernel. This provides a lightweight alternative to full network namespace isolation when only layer-3 separation is required.
Key Takeaway: VRF provides a powerful mechanism to isolate routing decisions by binding network interfaces to specific, independent routing tables, enabling virtual router capabilities on a single host.