[systemd-devel] How to set up virtual network interface cards (NIC) with systemd-networkd "The Right Way (tm)"?

M. Buecher maddes+systemd at maddes.net
Wed May 1 19:48:11 UTC 2019

Dear all,

I read multiple articles on the internet about virtual interfaces via 
systemd-networkd, but most article just list the config files and do not 
explain why they did something this or that way.
Most are using MACVLAN netdevs but I couldn't get them working 
correctly, although the ip addresses were available on the interfaces.
In the docs, FAQ and mailing list I couldn't find anything related to 
I'm ok with most network topics, but unfortunately I'm not a network 
admin/expert, so please bear with me.

* Goal
A new mini pc shall become the gateway between all internal IP networks, 
DHCP server for the main internal IP network and the internal DNS server 
plus provide some additional DNS server instances for special cases.
For the DNS server scenario multiple additional virtual network 
interfaces are needed on the real network interface card (NIC) with 
IP addresses on the real and virtual interfaces shall be reachable from 
other machines and from all real/virtual interfaces on the mini pc 
Linux System is Debian GNU/Linux 9.9 (stretch) with kernel 
4.9.0-3/4.9.30-2+deb9u5 and systemd 232 +PAM +AUDIT +SELINUX +IMA 
The old "networking.service" (/etc/network/interface*) is disabled and 
"systemd-networkd.service" enabled.

In the first step the solution shall be implemented in a pure IPv4 
scenario with no firewall on the mini pc itself, later in a dual stack 
scenario plus ip[6]tables firewall.

The real NIC is named "ens192" and the virtual interfaces are named 
"dnsextra01" and "dnsextra02".
IPv4 LAN #1 is with default gateway (via 
router device) to internet plus gateway (mini pc) to IPv4 
LAN #2.
IPv4 LAN #2 is with gateway plus dns (mini 

* Detailed feature list
a) "ens192" has the main IPv4 LAN #1 with and secondary 
IPv4 LAN #2 with
For IPv4 LAN #2 it is also the gateway to IPv4 LAN #1 and the internet.
It provides the main DNS server instance for both IPv4 LANs.

b) "dnsextra01" (.98) has the main IPv4 LAN #1 with and 
secondary IPv4 LAN #2 with
It provides a special case DNS server instance for some machines in both 
IPv4 LANs.

c) "dnsextra02" (.99) has only the main IPv4 LAN #1 with
It provides a special case DNS server instance for one machine in IPv4 
LAN #1.

d) All machines in both IPv4 LANs should be able to ping all IP 
addresses of all real/virtual interfaces.
ping -O -c 10 

e) All real/virtual interfaces should be able to ping all IP addresses 
of all other real/virtual interfaces.
ping -I ens192 -O -c 10 <||>
ping -I dnsextra01 -O -c 10 <||>
ping -I dnsextra01 -O -c 10 

* My try
The following setup allows to ping some IPv4 addresses from other 
machines, but only sometimes and then it also takes several seconds 
until a ping finally succeeds.
Pinging the other interfaces on the mini pc itself does NOT work at all.
If the netdevs via MACVLAN are disabled, then the mini pc reacts nearly 
instantly on network requests (e.g. ssh, ping) and forwarding from IPv4 
LAN #1 to LAN #2 works fine.

a) /etc/sysctl.d/90_ipv4_filter.conf

b) /etc/systemd/network/ens192.network


## Virtual NICs on ens192



c) /etc/systemd/network/dnsextra01.netdev


d) /etc/systemd/network/dnsextra01.network


e) dnsextra02 same as dnsextra01 just only

What is wrong in this setup? How should this be done correctly via 
Is a newer version of systemd needed for this to work?

Any help is greatly appreciated.
Matthias "Maddes" B├╝cher

More information about the systemd-devel mailing list