NAME    [Toc]    [Back]

     gif - generic tunnel interface

SYNOPSIS    [Toc]    [Back]

     pseudo-device gif [count]

DESCRIPTION    [Toc]    [Back]

     The gif interface is a generic tunnelling pseudo-device  for
IPv4 and
     IPv6.  It can tunnel IPv[46] traffic over IPv[46], for a total of four
     possible combinations.  The behavior of gif is mainly  based
on RFC 1933
     IPv6-over-IPv4 configured tunnel.

     A gif interface can be created at runtime using the ifconfig
gifN create
     command or by setting up a hostname.if(5) configuration file
for
     netstart(8).

     To  use  gif,  the  administrator needs to configure the addresses used for
     the outer header.  This can be done by using ifconfig(8), or
through the
     SIOCSIFPHYADDR  ioctl.  The administrator needs to also configure the addresses
 used for the inner  header,  by  using  ifconfig(8).
Note that IPv6
     link-local  address  (those start with fe80::) will be automatically configured
 whenever possible.  One may need to remove any  IPv6
link-local
     address  manually  using  ifconfig(8), to disable the use of
IPv6 as inner
     header (e.g., when  a  pure  IPv4-over-IPv6  tunnel  is  required).  Also, the
     routing  table  may  be used to route the packets toward the
gif interface.

     If plain Ethernet-over-IP is being used, the sysctl(3) variable
     net.inet.etherip.allow must be set to 1.  This is not necessary in cases
     where Ethernet-over-IP is being protected using ipsec(4).

     Finally, the gif interface may be used as a  bridge(4)  member.  Ethernet
     frames  forwarded by the bridge to the gif interface are encapsulated inside
 an IPv4 or IPv6 header (depending on how the  interface
is configured),
 with transport protocol number 97 (etherip).  IPv4 or
IPv6 packets
     carrying transport protocol 97 are delivered to the gif  interface whose
     "physical"  addresses match the source/destination addresses
of the packet
     (the source address of the packet must match the destination
"physical"
     address, and vice versa).

SEE ALSO    [Toc]    [Back]

     sysctl(3),  bridge(4),  inet(4),  inet6(4),  ipsec(4), hostname.if(5),
     ifconfig(8), netstart(8)

     R. Gilligan and E. Nordmark, "Transition Mechanisms for IPv6
Hosts and
     Routers",   RFC   1933,  April  1996,  ftp://ftp.isi.edu/in-
notes/rfc1933.txt.

     Sally Floyd, David L. Black, and K. K.  Ramakrishnan,  IPsec
Interactions
     with ECN, December 1999, draft-ietf-ipsec-ecn-02.txt.

HISTORY    [Toc]    [Back]

     The gif device first appeared in WIDE hydrangea IPv6 kit.

BUGS    [Toc]    [Back]

     There  are  many tunnelling protocol specifications, defined
differently
     from each other.  gif may not interoperate with peers  which
are based on
     different  specifications,  and are picky about outer header
fields.  For
     example, you cannot usually use gif to talk with  IPsec  devices that use
     IPsec tunnel mode.

     The current code does not check if the ingress address (outer source
     address) configured to gif makes sense.  Make sure  to  configure an address
 which belongs to your node.  Otherwise, your node will
not be able
     to receive packets from the peer, and your node will  generate packets
     with a spoofed source address.

     If the outer protocol is IPv6, path MTU discovery for encapsulated packet
     may affect communication over the interface.

     When used in conjunction with the bridge(4), only one bridge
tunnel may
     be operational for every pair of source/destination addresses.  If more
     than one gif interface is configured with the same  pair  of
outer addresses,
  the  one  with the lowest index number will receive all
traffic.

OpenBSD     3.6                          April      10,      1999