VXLAN Tunneling for Overlay Networks

Encapsulate Layer 2 frames over Layer 3 infrastructure to support multi-host container clusters.

In this lesson, you will learn how VXLAN (Virtual Extensible LAN) enables multi-host container clusters by encapsulating Layer 2 Ethernet frames inside Layer 3 UDP packets.

The Challenge of Multi-Host Connectivity

In a containerized environment, containers often reside on different physical hosts. While each host has its own network stack, containers frequently need to communicate as if they were on the same local Layer 2 broadcast domain. Standard veth pairs and Linux bridges work perfectly within a single node, but they fail when containers need to bridge across disparate physical subnets.

Enter VXLAN

VXLAN solves this by creating an overlay network. It takes an original Layer 2 frame (containing the container's MAC address) and wraps it inside a standard UDP packet. This "tunnel" allows the traffic to traverse any L3 infrastructure—even across routed data centers—while the containers remain oblivious to the underlying complexity.

The process follows these steps:

Encapsulation: The VXLAN interface (VTEP—VXLAN Tunnel End Point) receives the L2 frame.
Wrapping: It adds a VXLAN header (containing a Virtual Network Identifier, or VNI) and wraps the entire payload in an outer IP/UDP packet.
Transport: The packet is sent to the destination host’s IP address.
Decapsulation: The receiving VTEP strips the outer headers and delivers the original L2 frame to the target container.

Practical Implementation

To set up a basic VXLAN interface in Linux, you typically use iproute2. You define a VNI (the "tag" for your overlay) and point the remote destination to the physical IP of your secondary host:

# Create the VXLAN interface on host A
ip link add vxlan0 type vxlan id 100 dev eth0 dstport 4789
ip addr add 10.0.0.1/24 dev vxlan0
ip link set vxlan0 up

# Map the remote container's MAC to the remote host's physical IP
bridge fdb append 00:00:00:00:00:00 dev vxlan0 dst 192.168.1.50

By using the VNI as a segment ID, you can run multiple isolated overlay networks on top of the same physical infrastructure, allowing thousands of containers to maintain unique Layer 2 identities despite being spread across a massive L3 fabric.

Key Takeaway: VXLAN creates a virtual Layer 2 bridge over existing L3 networks by encapsulating Ethernet frames in UDP, enabling seamless container communication across physical host boundaries.