Skip to main content
A virtual Ethernet (veth) pair consists of two connected virtual network interfaces. Traffic sent through either endpoint is received by the other endpoint. Talos Linux creates both endpoints in the host network namespace. You can keep both endpoints in the default routing domain or attach one endpoint to a Virtual Routing and Forwarding (VRF) device.

​
Configure a veth pair

Create a VethConfig document that defines both endpoints:
This configuration creates veth-host and veth-router and assigns an address to each endpoint. Each endpoint supports independent up, mtu, addresses, routes, and multicast settings. When up is omitted, Talos brings the endpoint up. The name and peer.name fields are literal kernel interface names, not link aliases. The two names must differ, and no other link configuration document can claim either name.

​
Attach an endpoint to a VRF

List an endpoint in a VRFConfig document to move it into that routing domain:
In this example, veth-workload remains in the default routing domain and veth-router belongs to vrf-workload. The pair provides a point-to-point connection between the two routing domains. The native BGP workload-speaker topology uses this design to connect a host-networked Cilium or MetalLB speaker to a VRF-bound Talos BGP instance.

​
Verify the endpoints

Set NODE to the address of the Talos machine:
Inspect each endpoint:
Each LinkStatus reports kind: veth and identifies the other endpoint in veth.peerName. The endpoint indices also cross-reference each other through index and linkIndex. Inspect the configured addresses:
Confirm that each address reports the expected endpoint in linkName.

​
Lifecycle

Talos creates the two endpoints as one kernel veth pair and reconciles their common link settings independently. Removing the VethConfig removes the pair, and changing an endpoint name replaces the old pair with the newly named pair.