gif - generic tunnel interface
pseudo-device gif [count]
The gif interface is a generic tunnelling pseudo-device for
IPv6. It can tunnel IPv traffic over IPv, for a total of four
possible combinations. The behavior of gif is mainly based
on RFC 1933
IPv6-over-IPv4 configured tunnel.
A gif interface can be created at runtime using the ifconfig
command or by setting up a hostname.if(5) configuration file
To use gif, the administrator needs to configure the addresses used for
the outer header. This can be done by using ifconfig(8), or
SIOCSIFPHYADDR ioctl. The administrator needs to also configure the addresses
used for the inner header, by using ifconfig(8).
Note that IPv6
link-local address (those start with fe80::) will be automatically configured
whenever possible. One may need to remove any IPv6
address manually using ifconfig(8), to disable the use of
IPv6 as inner
header (e.g., when a pure IPv4-over-IPv6 tunnel is required). Also, the
routing table may be used to route the packets toward the
If plain Ethernet-over-IP is being used, the sysctl(3) variable
net.inet.etherip.allow must be set to 1. This is not necessary in cases
where Ethernet-over-IP is being protected using ipsec(4).
Finally, the gif interface may be used as a bridge(4) member. Ethernet
frames forwarded by the bridge to the gif interface are encapsulated inside
an IPv4 or IPv6 header (depending on how the interface
with transport protocol number 97 (etherip). IPv4 or
carrying transport protocol 97 are delivered to the gif interface whose
"physical" addresses match the source/destination addresses
of the packet
(the source address of the packet must match the destination
address, and vice versa).
sysctl(3), bridge(4), inet(4), inet6(4), ipsec(4), hostname.if(5),
R. Gilligan and E. Nordmark, "Transition Mechanisms for IPv6
Routers", RFC 1933, April 1996, ftp://ftp.isi.edu/in-
Sally Floyd, David L. Black, and K. K. Ramakrishnan, IPsec
with ECN, December 1999, draft-ietf-ipsec-ecn-02.txt.
The gif device first appeared in WIDE hydrangea IPv6 kit.
There are many tunnelling protocol specifications, defined
from each other. gif may not interoperate with peers which
are based on
different specifications, and are picky about outer header
example, you cannot usually use gif to talk with IPsec devices that use
IPsec tunnel mode.
The current code does not check if the ingress address (outer source
address) configured to gif makes sense. Make sure to configure an address
which belongs to your node. Otherwise, your node will
not be able
to receive packets from the peer, and your node will generate packets
with a spoofed source address.
If the outer protocol is IPv6, path MTU discovery for encapsulated packet
may affect communication over the interface.
When used in conjunction with the bridge(4), only one bridge
be operational for every pair of source/destination addresses. If more
than one gif interface is configured with the same pair of
the one with the lowest index number will receive all
OpenBSD 3.6 April 10, 1999
[ Back ]