#### NOTE
The `nic` device type is supported for both containers and VMs.
NICs support hotplugging for both containers and VMs (with the exception of the `ipvlan` NIC type).
Network devices, also referred to as *Network Interface Controllers* or *NICs*, supply a connection to a network.
LXD supports several different types of network devices (*NIC types*).
## `nictype` vs. `network`
When adding a network device to an instance, there are two methods to specify the type of device that you want to add: through the `nictype` device option or the `network` device option.
These two device options are mutually exclusive, and you can specify only one of them when you create a device.
However, note that when you specify the `network` option, the `nictype` option is derived automatically from the network type.
`nictype`
: When using the `nictype` device option, you can specify a network interface that is not controlled by LXD.
Therefore, you must specify all information that LXD needs to use the network interface.
When using this method, the `nictype` option must be specified when creating the device, and it cannot be changed later.
`network`
: When using the `network` device option, the NIC is linked to an existing [managed network](https://canonical.com/lxd/docs/default/explanation/networks/index.html.md#managed-networks).
In this case, LXD has all required information about the network, and you need to specify only the network name when adding the device.
When using this method, LXD derives the `nictype` option automatically.
The value is read-only and cannot be changed.
Other device options that are inherited from the network are marked with a “yes” in the “Managed” field of the NIC-specific device options.
You cannot customize these options directly for the NIC if you’re using the `network` method.
See [Networking setups](https://canonical.com/lxd/docs/default/explanation/networks/index.html.md#networks) for more information.
## Available NIC types
The following NICs can be added using the `nictype` or `network` options:
- [`bridged`](#nic-bridged): Uses an existing bridge on the host and creates a virtual device pair to connect the host bridge to the instance.
- [`macvlan`](#nic-macvlan): Sets up a new network device based on an existing one, but using a different MAC address.
- [`sriov`](#nic-sriov): Passes a virtual function of an SR-IOV-enabled physical network device into the instance.
- [`physical`](#nic-physical): Passes a physical device from the host through to the instance.
The targeted device will vanish from the host and appear in the instance.
The following NICs can be added using only the `network` option:
- [`ovn`](#nic-ovn): Uses an existing OVN network and creates a virtual device pair to connect the instance to it.
The following NICs can be added using only the `nictype` option:
- [`ipvlan`](#nic-ipvlan): Sets up a new network device based on an existing one, using the same MAC address but a different IP.
- [`p2p`](#nic-p2p): Creates a virtual device pair, putting one side in the instance and leaving the other side on the host.
- [`routed`](#nic-routed): Creates a virtual device pair to connect the host to the instance and sets up static routes and proxy ARP/NDP entries to allow the instance to join the network of a designated parent interface.
The available device options depend on the NIC type and are listed in the following sections.
### `nictype`: `bridged`
#### NOTE
You can select this NIC type through the `nictype` option or the `network` option (see [Bridge network](https://canonical.com/lxd/docs/default/reference/network_bridge/index.html.md#network-bridge) for information about the managed `bridge` network).
A `bridged` NIC uses an existing bridge on the host and creates a virtual device pair to connect the host bridge to the instance.
#### Device options
NIC devices of type `bridged` have the following device options:
`boot.priority`
Boot priority for VMs
[](#device-nic-bridged-device-conf:boot.priority)
| **Key:** | `boot.priority` |
|--------------|-------------------|
| **Type:** | integer |
| **Managed:** | no |
A higher value for this option means that the VM boots first.
`host_name`
Name of the interface inside the host
[](#device-nic-bridged-device-conf:host_name)
| **Key:** | `host_name` |
|--------------|-------------------|
| **Type:** | string |
| **Default:** | randomly assigned |
| **Managed:** | no |
`hwaddr`
MAC address of the new interface
[](#device-nic-bridged-device-conf:hwaddr)
| **Key:** | `hwaddr` |
|--------------|-------------------|
| **Type:** | string |
| **Default:** | randomly assigned |
| **Managed:** | no |
`ipv4.address`
IPv4 address to assign to the instance through DHCP
[](#device-nic-bridged-device-conf:ipv4.address)
| **Key:** | `ipv4.address` |
|--------------|------------------|
| **Type:** | string |
| **Managed:** | no |
Set this option to `none` to restrict all IPv4 traffic when [`security.ipv4_filtering`](#device-nic-bridged-device-conf:security.ipv4_filtering) is set.
`ipv4.routes`
IPv4 static routes for the NIC to add on the host
[](#device-nic-bridged-device-conf:ipv4.routes)
| **Key:** | `ipv4.routes` |
|--------------|-----------------|
| **Type:** | string |
| **Managed:** | no |
Specify a comma-delimited list of IPv4 static routes for this NIC to add on the host.
`ipv4.routes.external`
IPv4 static routes to route to NIC
[](#device-nic-bridged-device-conf:ipv4.routes.external)
| **Key:** | `ipv4.routes.external` |
|--------------|--------------------------|
| **Type:** | string |
| **Managed:** | no |
Specify a comma-delimited list of IPv4 static routes to route to the NIC and publish on the uplink network (BGP).
`ipv6.address`
IPv6 address to assign to the instance through DHCP
[](#device-nic-bridged-device-conf:ipv6.address)
| **Key:** | `ipv6.address` |
|--------------|------------------|
| **Type:** | string |
| **Managed:** | no |
Set this option to `none` to restrict all IPv6 traffic when [`security.ipv6_filtering`](#device-nic-bridged-device-conf:security.ipv6_filtering) is set.
`ipv6.routes`
IPv6 static routes for the NIC to add on the host
[](#device-nic-bridged-device-conf:ipv6.routes)
| **Key:** | `ipv6.routes` |
|--------------|-----------------|
| **Type:** | string |
| **Managed:** | no |
Specify a comma-delimited list of IPv6 static routes for this NIC to add on the host.
`ipv6.routes.external`
IPv6 static routes to route to NIC
[](#device-nic-bridged-device-conf:ipv6.routes.external)
| **Key:** | `ipv6.routes.external` |
|--------------|--------------------------|
| **Type:** | string |
| **Managed:** | no |
Specify a comma-delimited list of IPv6 static routes to route to the NIC and publish on the uplink network (BGP).
`limits.egress`
I/O limit for outgoing traffic
[](#device-nic-bridged-device-conf:limits.egress)
| **Key:** | `limits.egress` |
|--------------|-------------------|
| **Type:** | string |
| **Managed:** | no |
Specify the limit in bit/s. Various suffixes are supported (see [Units for storage and network limits](https://canonical.com/lxd/docs/default/reference/instance_units/index.html.md#instances-limit-units)).
`limits.ingress`
I/O limit for incoming traffic
[](#device-nic-bridged-device-conf:limits.ingress)
| **Key:** | `limits.ingress` |
|--------------|--------------------|
| **Type:** | string |
| **Managed:** | no |
Specify the limit in bit/s. Various suffixes are supported (see [Units for storage and network limits](https://canonical.com/lxd/docs/default/reference/instance_units/index.html.md#instances-limit-units)).
`limits.max`
I/O limit for both incoming and outgoing traffic
[](#device-nic-bridged-device-conf:limits.max)
| **Key:** | `limits.max` |
|--------------|----------------|
| **Type:** | string |
| **Managed:** | no |
This option is the same as setting both [`limits.ingress`](#device-nic-bridged-device-conf:limits.ingress) and [`limits.egress`](#device-nic-bridged-device-conf:limits.egress).
Specify the limit in bit/s. Various suffixes are supported (see [Units for storage and network limits](https://canonical.com/lxd/docs/default/reference/instance_units/index.html.md#instances-limit-units)).
`limits.priority`
`skb->priority` value for outgoing traffic
[](#device-nic-bridged-device-conf:limits.priority)
| **Key:** | `limits.priority` |
|--------------|---------------------|
| **Type:** | integer |
| **Managed:** | no |
The `skb->priority` value for outgoing traffic is used by the kernel queuing discipline (qdisc) to prioritize network packets.
Specify the value as a 32-bit unsigned integer.
The effect of this value depends on the particular qdisc implementation, for example, `SKBPRIO` or `QFQ`.
Consult the kernel qdisc documentation before setting this value.
`maas.subnet.ipv4`
MAAS IPv4 subnet to register the instance in
[](#device-nic-bridged-device-conf:maas.subnet.ipv4)
| **Key:** | `maas.subnet.ipv4` |
|--------------|----------------------|
| **Type:** | string |
| **Managed:** | yes |
`maas.subnet.ipv6`
MAAS IPv6 subnet to register the instance in
[](#device-nic-bridged-device-conf:maas.subnet.ipv6)
| **Key:** | `maas.subnet.ipv6` |
|--------------|----------------------|
| **Type:** | string |
| **Managed:** | yes |
`mtu`
MTU of the new interface
[](#device-nic-bridged-device-conf:mtu)
| **Key:** | `mtu` |
|--------------|------------|
| **Type:** | integer |
| **Default:** | parent MTU |
| **Managed:** | yes |
`name`
Name of the interface inside the instance
[](#device-nic-bridged-device-conf:name)
| **Key:** | `name` |
|--------------|-----------------|
| **Type:** | string |
| **Default:** | kernel assigned |
| **Managed:** | no |
`network`
Managed network to link the device to
[](#device-nic-bridged-device-conf:network)
| **Key:** | `network` |
|--------------|-------------|
| **Type:** | string |
| **Managed:** | no |
You can specify this option instead of specifying the `nictype` directly.
`parent`
Name of the host device
[](#device-nic-bridged-device-conf:parent)
| **Key:** | `parent` |
|---------------|--------------------------------------|
| **Type:** | string |
| **Managed:** | yes |
| **Required:** | if specifying the `nictype` directly |
`queue.tx.length`
Transmit queue length for the NIC
[](#device-nic-bridged-device-conf:queue.tx.length)
| **Key:** | `queue.tx.length` |
|--------------|---------------------|
| **Type:** | integer |
| **Managed:** | no |
`security.ipv4_filtering`
Whether to prevent the instance from spoofing an IPv4 address
[](#device-nic-bridged-device-conf:security.ipv4_filtering)
| **Key:** | `security.ipv4_filtering` |
|--------------|-----------------------------|
| **Type:** | bool |
| **Default:** | `false` |
| **Managed:** | no |
Set this option to `true` to prevent the instance from spoofing another instance’s IPv4 address.
This option enables [`security.mac_filtering`](#device-nic-bridged-device-conf:security.mac_filtering).
`security.ipv6_filtering`
Whether to prevent the instance from spoofing an IPv6 address
[](#device-nic-bridged-device-conf:security.ipv6_filtering)
| **Key:** | `security.ipv6_filtering` |
|--------------|-----------------------------|
| **Type:** | bool |
| **Default:** | `false` |
| **Managed:** | no |
Set this option to `true` to prevent the instance from spoofing another instance’s IPv6 address.
This option enables [`security.mac_filtering`](#device-nic-bridged-device-conf:security.mac_filtering).
`security.mac_filtering`
Whether to prevent the instance from spoofing a MAC address
[](#device-nic-bridged-device-conf:security.mac_filtering)
| **Key:** | `security.mac_filtering` |
|--------------|----------------------------|
| **Type:** | bool |
| **Default:** | `false` |
| **Managed:** | no |
Set this option to `true` to prevent the instance from spoofing another instance’s MAC address.
`security.port_isolation`
Whether to respect port isolation
[](#device-nic-bridged-device-conf:security.port_isolation)
| **Key:** | `security.port_isolation` |
|--------------|-----------------------------|
| **Type:** | bool |
| **Default:** | `false` |
| **Managed:** | no |
Set this option to `true` to prevent the NIC from communicating with other NICs in the network that have port isolation enabled.
`vlan`
VLAN ID to use for non-tagged traffic
[](#device-nic-bridged-device-conf:vlan)
| **Key:** | `vlan` |
|--------------|----------|
| **Type:** | integer |
| **Managed:** | no |
Set this option to `none` to remove the port from the default VLAN.
`vlan.tagged`
VLAN IDs or VLAN ranges to join for tagged traffic
[](#device-nic-bridged-device-conf:vlan.tagged)
| **Key:** | `vlan.tagged` |
|--------------|-----------------|
| **Type:** | integer |
| **Managed:** | no |
Specify the VLAN IDs or ranges as a comma-delimited list.
#### Configuration examples
Add a `bridged` network device to an instance, connecting to a LXD managed network:
```none
lxc network create --type=bridge
lxc config device add nic network=
```
Note that `bridge` is the type when creating a managed bridge network, while the device `nictype` that is required when connecting to an unmanaged bridge is `bridged`.
Add a `bridged` network device to an instance, connecting to an existing bridge interface with `nictype`:
```none
lxc config device add nic nictype=bridged parent=
```
See [How to create a network](https://canonical.com/lxd/docs/default/howto/network_create/index.html.md#network-create) and [Configure devices](https://canonical.com/lxd/docs/default/howto/instances_configure/index.html.md#instances-configure-devices) for more information.
### `nictype`: `macvlan`
#### NOTE
You can select this NIC type through the `nictype` option or the `network` option (see [Macvlan network](https://canonical.com/lxd/docs/default/reference/network_macvlan/index.html.md#network-macvlan) for information about the managed `macvlan` network).
A `macvlan` NIC sets up a new network device based on an existing one, but using a different MAC address.
If you are using a `macvlan` NIC, communication between the LXD host and the instances is not possible.
Both the host and the instances can talk to the gateway, but they cannot communicate directly.
#### Device options
NIC devices of type `macvlan` have the following device options:
`boot.priority`
Boot priority for VMs
[](#device-nic-macvlan-device-conf:boot.priority)
| **Key:** | `boot.priority` |
|--------------|-------------------|
| **Type:** | integer |
| **Managed:** | no |
A higher value for this option means that the VM boots first.
`gvrp`
Whether to use GARP VLAN Registration Protocol
[](#device-nic-macvlan-device-conf:gvrp)
| **Key:** | `gvrp` |
|--------------|----------|
| **Type:** | bool |
| **Default:** | `false` |
| **Managed:** | no |
This option specifies whether to register the VLAN using the GARP VLAN Registration Protocol.
`hwaddr`
MAC address of the new interface
[](#device-nic-macvlan-device-conf:hwaddr)
| **Key:** | `hwaddr` |
|--------------|-------------------|
| **Type:** | string |
| **Default:** | randomly assigned |
| **Managed:** | no |
`maas.subnet.ipv4`
MAAS IPv4 subnet to register the instance in
[](#device-nic-macvlan-device-conf:maas.subnet.ipv4)
| **Key:** | `maas.subnet.ipv4` |
|--------------|----------------------|
| **Type:** | string |
| **Managed:** | yes |
`maas.subnet.ipv6`
MAAS IPv6 subnet to register the instance in
[](#device-nic-macvlan-device-conf:maas.subnet.ipv6)
| **Key:** | `maas.subnet.ipv6` |
|--------------|----------------------|
| **Type:** | string |
| **Managed:** | yes |
`mtu`
MTU of the new interface
[](#device-nic-macvlan-device-conf:mtu)
| **Key:** | `mtu` |
|--------------|------------|
| **Type:** | integer |
| **Default:** | parent MTU |
| **Managed:** | yes |
`name`
Name of the interface inside the instance
[](#device-nic-macvlan-device-conf:name)
| **Key:** | `name` |
|--------------|-----------------|
| **Type:** | string |
| **Default:** | kernel assigned |
| **Managed:** | no |
`network`
Managed network to link the device to
[](#device-nic-macvlan-device-conf:network)
| **Key:** | `network` |
|--------------|-------------|
| **Type:** | string |
| **Managed:** | no |
You can specify this option instead of specifying the `nictype` directly.
`parent`
Name of the host device
[](#device-nic-macvlan-device-conf:parent)
| **Key:** | `parent` |
|---------------|--------------------------------------|
| **Type:** | string |
| **Managed:** | yes |
| **Required:** | if specifying the `nictype` directly |
`vlan`
VLAN ID to attach to
[](#device-nic-macvlan-device-conf:vlan)
| **Key:** | `vlan` |
|--------------|----------|
| **Type:** | integer |
| **Managed:** | no |
#### Configuration examples
Add a `macvlan` network device to an instance, connecting to a LXD managed network:
```none
lxc network create --type=macvlan parent=
lxc config device add nic network=
```
Add a `macvlan` network device to an instance, connecting to an existing network interface with `nictype`:
```none
lxc config device add nic nictype=macvlan parent=
```
See [How to create a network](https://canonical.com/lxd/docs/default/howto/network_create/index.html.md#network-create) and [Configure devices](https://canonical.com/lxd/docs/default/howto/instances_configure/index.html.md#instances-configure-devices) for more information.
### `nictype`: `sriov`
#### NOTE
You can select this NIC type through the `nictype` option or the `network` option (see [SR-IOV network](https://canonical.com/lxd/docs/default/reference/network_sriov/index.html.md#network-sriov) for information about the managed `sriov` network).
An `sriov` NIC passes a virtual function of an SR-IOV-enabled physical network device into the instance.
An SR-IOV-enabled network device associates a set of virtual functions (VFs) with the single physical function (PF) of the network device.
PFs are standard PCIe functions.
VFs, on the other hand, are very lightweight PCIe functions that are optimized for data movement.
They come with a limited set of configuration capabilities to prevent changing properties of the PF.
Given that VFs appear as regular PCIe devices to the system, they can be passed to instances just like a regular physical device.
VF allocation
: The `sriov` interface type expects to be passed the name of an SR-IOV enabled network device on the system via the `parent` property.
LXD then checks for any available VFs on the system.
By default, LXD allocates the first free VF it finds.
If it detects that either none are enabled or all currently enabled VFs are in use, it bumps the number of supported VFs to the maximum value and uses the first free VF.
If all possible VFs are in use or the kernel or card doesn’t support incrementing the number of VFs, LXD returns an error.
#### NOTE
If you need LXD to use a specific VF, use a `physical` NIC instead of a `sriov` NIC and set its `parent` option to the VF name.
#### Device options
NIC devices of type `sriov` have the following device options:
`boot.priority`
Boot priority for VMs
[](#device-nic-sriov-device-conf:boot.priority)
| **Key:** | `boot.priority` |
|--------------|-------------------|
| **Type:** | integer |
| **Managed:** | no |
A higher value for this option means that the VM boots first.
`hwaddr`
MAC address of the new interface
[](#device-nic-sriov-device-conf:hwaddr)
| **Key:** | `hwaddr` |
|--------------|-------------------|
| **Type:** | string |
| **Default:** | randomly assigned |
| **Managed:** | no |
`maas.subnet.ipv4`
MAAS IPv4 subnet to register the instance in
[](#device-nic-sriov-device-conf:maas.subnet.ipv4)
| **Key:** | `maas.subnet.ipv4` |
|--------------|----------------------|
| **Type:** | string |
| **Managed:** | yes |
`maas.subnet.ipv6`
MAAS IPv6 subnet to register the instance in
[](#device-nic-sriov-device-conf:maas.subnet.ipv6)
| **Key:** | `maas.subnet.ipv6` |
|--------------|----------------------|
| **Type:** | string |
| **Managed:** | yes |
`mtu`
MTU of the new interface
[](#device-nic-sriov-device-conf:mtu)
| **Key:** | `mtu` |
|--------------|-----------------|
| **Type:** | integer |
| **Default:** | kernel assigned |
| **Managed:** | yes |
`name`
Name of the interface inside the instance
[](#device-nic-sriov-device-conf:name)
| **Key:** | `name` |
|--------------|-----------------|
| **Type:** | string |
| **Default:** | kernel assigned |
| **Managed:** | no |
`network`
Managed network to link the device to
[](#device-nic-sriov-device-conf:network)
| **Key:** | `network` |
|--------------|-------------|
| **Type:** | string |
| **Managed:** | no |
You can specify this option instead of specifying the `nictype` directly.
`parent`
Name of the host device
[](#device-nic-sriov-device-conf:parent)
| **Key:** | `parent` |
|---------------|--------------------------------------|
| **Type:** | string |
| **Managed:** | yes |
| **Required:** | if specifying the `nictype` directly |
`security.mac_filtering`
Whether to prevent the instance from spoofing a MAC address
[](#device-nic-sriov-device-conf:security.mac_filtering)
| **Key:** | `security.mac_filtering` |
|--------------|----------------------------|
| **Type:** | bool |
| **Default:** | `false` |
| **Managed:** | no |
Set this option to `true` to prevent the instance from spoofing another instance’s MAC address.
`vlan`
VLAN ID to attach to
[](#device-nic-sriov-device-conf:vlan)
| **Key:** | `vlan` |
|--------------|----------|
| **Type:** | integer |
| **Managed:** | no |
#### Configuration examples
Add a `sriov` network device to an instance, connecting to a LXD managed network:
```none
lxc network create --type=sriov parent=
lxc config device add nic network=
```
Add a `sriov` network device to an instance, connecting to an existing SR-IOV-enabled interface with `nictype`:
```none
lxc config device add nic nictype=sriov parent=
```
See [How to create a network](https://canonical.com/lxd/docs/default/howto/network_create/index.html.md#network-create) and [Configure devices](https://canonical.com/lxd/docs/default/howto/instances_configure/index.html.md#instances-configure-devices) for more information.
### `nictype`: `physical`
#### NOTE
- You can select this NIC type through the `nictype` option or the `network` option (see [Physical network](https://canonical.com/lxd/docs/default/reference/network_physical/index.html.md#network-physical) for information about the managed `physical` network).
- You can have only one `physical` NIC for each parent device.
A `physical` NIC provides straight physical device pass-through from the host.
The targeted device will vanish from the host and appear in the instance (which means that you can have only one `physical` NIC for each targeted device).
#### Device options
NIC devices of type `physical` have the following device options:
`boot.priority`
Boot priority for VMs
[](#device-nic-physical-device-conf:boot.priority)
| **Key:** | `boot.priority` |
|--------------|-------------------|
| **Type:** | integer |
| **Managed:** | no |
A higher value for this option means that the VM boots first.
`gvrp`
Whether to use GARP VLAN Registration Protocol
[](#device-nic-physical-device-conf:gvrp)
| **Key:** | `gvrp` |
|--------------|----------|
| **Type:** | bool |
| **Default:** | `false` |
| **Managed:** | no |
This option specifies whether to register the VLAN using the GARP VLAN Registration Protocol.
`hwaddr`
MAC address of the new interface
[](#device-nic-physical-device-conf:hwaddr)
| **Key:** | `hwaddr` |
|----------------|--------------------|
| **Type:** | string |
| **Default:** | parent MAC address |
| **Condition:** | container |
| **Managed:** | no |
`maas.subnet.ipv4`
MAAS IPv4 subnet to register the instance in
[](#device-nic-physical-device-conf:maas.subnet.ipv4)
| **Key:** | `maas.subnet.ipv4` |
|--------------|----------------------|
| **Type:** | string |
| **Managed:** | no |
`maas.subnet.ipv6`
MAAS IPv6 subnet to register the instance in
[](#device-nic-physical-device-conf:maas.subnet.ipv6)
| **Key:** | `maas.subnet.ipv6` |
|--------------|----------------------|
| **Type:** | string |
| **Managed:** | no |
`mtu`
MTU of the new interface
[](#device-nic-physical-device-conf:mtu)
| **Key:** | `mtu` |
|----------------|------------|
| **Type:** | integer |
| **Default:** | parent MTU |
| **Condition:** | container |
| **Managed:** | no |
`name`
Name of the interface inside the instance
[](#device-nic-physical-device-conf:name)
| **Key:** | `name` |
|--------------|-----------------|
| **Type:** | string |
| **Default:** | kernel assigned |
| **Managed:** | no |
`network`
Managed network to link the device to
[](#device-nic-physical-device-conf:network)
| **Key:** | `network` |
|--------------|-------------|
| **Type:** | string |
| **Managed:** | no |
You can specify this option instead of specifying the `nictype` directly.
`parent`
Name of the host device
[](#device-nic-physical-device-conf:parent)
| **Key:** | `parent` |
|---------------|--------------------------------------|
| **Type:** | string |
| **Managed:** | yes |
| **Required:** | if specifying the `nictype` directly |
`vlan`
VLAN ID to attach to
[](#device-nic-physical-device-conf:vlan)
| **Key:** | `vlan` |
|----------------|-----------|
| **Type:** | integer |
| **Condition:** | container |
| **Managed:** | no |
#### Configuration examples
Add a `physical` network device to an instance, connecting to an existing physical network interface with `nictype`:
```none
lxc config device add nic nictype=physical parent=
```
Adding a `physical` network device to an instance using a managed network is not possible, because the `physical` managed network type is intended to be used only with OVN networks.
See [Configure devices](https://canonical.com/lxd/docs/default/howto/instances_configure/index.html.md#instances-configure-devices) for more information.
### `nictype`: `ovn`
#### NOTE
You can select this NIC type only through the `network` option (see [OVN network](https://canonical.com/lxd/docs/default/reference/network_ovn/index.html.md#network-ovn) for information about the managed `ovn` network).
An `ovn` NIC uses an existing OVN network and creates a virtual device pair to connect the instance to it.
SR-IOV hardware acceleration
: To use `acceleration=sriov`, you must have a compatible SR-IOV physical NIC that supports the Ethernet switch device driver model (`switchdev`) in your LXD host.
LXD assumes that the physical NIC (PF) is configured in `switchdev` mode and connected to the OVN integration OVS bridge, and that it has one or more virtual functions (VFs) active.
To achieve this, follow these basic prerequisite setup steps:
1. Set up PF and VF:
1. Activate some VFs on PF (called `enp9s0f0np0` in the following example, with a PCI address of `0000:09:00.0`) and unbind them.
2. Enable `switchdev` mode and `hw-tc-offload` on the PF.
3. Rebind the VFs.
```default
echo 4 > /sys/bus/pci/devices/0000:09:00.0/sriov_numvfs
for i in $(lspci -nnn | grep "Virtual Function" | cut -d' ' -f1); do echo 0000:$i > /sys/bus/pci/drivers/mlx5_core/unbind; done
devlink dev eswitch set pci/0000:09:00.0 mode switchdev
ethtool -K enp9s0f0np0 hw-tc-offload on
for i in $(lspci -nnn | grep "Virtual Function" | cut -d' ' -f1); do echo 0000:$i > /sys/bus/pci/drivers/mlx5_core/bind; done
```
2. Set up OVS by enabling hardware offload and adding the PF NIC to the integration bridge (normally called `br-int`):
```default
ovs-vsctl set open_vswitch . other_config:hw-offload=true
systemctl restart openvswitch-switch
ovs-vsctl add-port br-int enp9s0f0np0
ip link set enp9s0f0np0 up
```
VDPA hardware acceleration
: To use `acceleration=vdpa`, you must have a compatible VDPA physical NIC.
The setup is the same as for SR-IOV hardware acceleration, except that you must also enable the `vhost_vdpa` module and check that you have some available VDPA management devices :
```default
modprobe vhost_vdpa && vdpa mgmtdev show
```
#### Device options
NIC devices of type `ovn` have the following device options:
`acceleration`
Enable hardware acceleration
[](#device-nic-ovn-device-conf:acceleration)
| **Key:** | `acceleration` |
|--------------|------------------|
| **Type:** | string |
| **Default:** | `none` |
| **Managed:** | no |
Possible values are `none`, `sriov`, or `vdpa`.
See [SR-IOV hardware acceleration](#devices-nic-hw-acceleration) for more information.
`acceleration.parent`
Physical function interfaces to allocate virtual functions from for hardware acceleration
[](#device-nic-ovn-device-conf:acceleration.parent)
| **Key:** | `acceleration.parent` |
|--------------|-------------------------|
| **Type:** | string |
| **Managed:** | yes |
Comma separated list of physical function (PF) interfaces to allocate virtual functions (VFs) from for hardware acceleration when [`acceleration`](#device-nic-ovn-device-conf:acceleration) is enabled.
In [`restricted`](https://canonical.com/lxd/docs/default/reference/projects/index.html.md#project-restricted:restricted) projects, it can only be used when [`restricted.virtual-machines.lowlevel`](https://canonical.com/lxd/docs/default/reference/projects/index.html.md#project-restricted:restricted.virtual-machines.lowlevel) or [`restricted.containers.lowlevel`](https://canonical.com/lxd/docs/default/reference/projects/index.html.md#project-restricted:restricted.containers.lowlevel) is set to `allow`.
If this is not specified, and [`acceleration`](#device-nic-ovn-device-conf:acceleration) is enabled then all PFs connected to the OVS integration bridge are scanned for a free VF.
See [SR-IOV hardware acceleration](#devices-nic-hw-acceleration) for more information.
`boot.priority`
Boot priority for VMs
[](#device-nic-ovn-device-conf:boot.priority)
| **Key:** | `boot.priority` |
|--------------|-------------------|
| **Type:** | integer |
| **Managed:** | no |
A higher value for this option means that the VM boots first.
`host_name`
Name of the interface inside the host
[](#device-nic-ovn-device-conf:host_name)
| **Key:** | `host_name` |
|--------------|-------------------|
| **Type:** | string |
| **Default:** | randomly assigned |
| **Managed:** | no |
`hwaddr`
MAC address of the new interface
[](#device-nic-ovn-device-conf:hwaddr)
| **Key:** | `hwaddr` |
|--------------|-------------------|
| **Type:** | string |
| **Default:** | randomly assigned |
| **Managed:** | no |
`ipv4.address`
IPv4 address to assign to the instance through DHCP
[](#device-nic-ovn-device-conf:ipv4.address)
| **Key:** | `ipv4.address` |
|--------------|------------------|
| **Type:** | string |
| **Managed:** | no |
`ipv4.routes`
IPv4 static routes to route for the NIC
[](#device-nic-ovn-device-conf:ipv4.routes)
| **Key:** | `ipv4.routes` |
|--------------|-----------------|
| **Type:** | string |
| **Managed:** | no |
Specify a comma-delimited list of IPv4 static routes to route for this NIC.
`ipv4.routes.external`
IPv4 static routes to route to NIC
[](#device-nic-ovn-device-conf:ipv4.routes.external)
| **Key:** | `ipv4.routes.external` |
|--------------|--------------------------|
| **Type:** | string |
| **Managed:** | no |
Specify a comma-delimited list of IPv4 static routes to route to the NIC and publish on the uplink network.
`ipv6.address`
IPv6 address to assign to the instance through DHCP
[](#device-nic-ovn-device-conf:ipv6.address)
| **Key:** | `ipv6.address` |
|--------------|------------------|
| **Type:** | string |
| **Managed:** | no |
`ipv6.routes`
IPv6 static routes to route to the NIC
[](#device-nic-ovn-device-conf:ipv6.routes)
| **Key:** | `ipv6.routes` |
|--------------|-----------------|
| **Type:** | string |
| **Managed:** | no |
Specify a comma-delimited list of IPv6 static routes to route to the NIC.
`ipv6.routes.external`
IPv6 static routes to route to NIC
[](#device-nic-ovn-device-conf:ipv6.routes.external)
| **Key:** | `ipv6.routes.external` |
|--------------|--------------------------|
| **Type:** | string |
| **Managed:** | no |
Specify a comma-delimited list of IPv6 static routes to route to the NIC and publish on the uplink network.
`name`
Name of the interface inside the instance
[](#device-nic-ovn-device-conf:name)
| **Key:** | `name` |
|--------------|-----------------|
| **Type:** | string |
| **Default:** | kernel assigned |
| **Managed:** | no |
`nested`
Parent NIC name to nest this NIC under
[](#device-nic-ovn-device-conf:nested)
| **Key:** | `nested` |
|--------------|------------|
| **Type:** | string |
| **Managed:** | no |
See also [`vlan`](#device-nic-ovn-device-conf:vlan).
`network`
Managed network to link the device to
[](#device-nic-ovn-device-conf:network)
| **Key:** | `network` |
|---------------|-------------|
| **Type:** | string |
| **Managed:** | yes |
| **Required:** | yes |
`security.acls`
Network ACLs to apply
[](#device-nic-ovn-device-conf:security.acls)
| **Key:** | `security.acls` |
|--------------|-------------------|
| **Type:** | string |
| **Managed:** | no |
Specify a comma-separated list
`security.acls.default.egress.action`
Default action to use for egress traffic
[](#device-nic-ovn-device-conf:security.acls.default.egress.action)
| **Key:** | `security.acls.default.egress.action` |
|--------------|-----------------------------------------|
| **Type:** | string |
| **Default:** | `reject` |
| **Managed:** | no |
The specified action is used for all egress traffic that doesn’t match any ACL rule.
`security.acls.default.egress.logged`
Whether to log egress traffic that doesn’t match any ACL rule
[](#device-nic-ovn-device-conf:security.acls.default.egress.logged)
| **Key:** | `security.acls.default.egress.logged` |
|--------------|-----------------------------------------|
| **Type:** | bool |
| **Default:** | `false` |
| **Managed:** | no |
`security.acls.default.ingress.action`
Default action to use for ingress traffic
[](#device-nic-ovn-device-conf:security.acls.default.ingress.action)
| **Key:** | `security.acls.default.ingress.action` |
|--------------|------------------------------------------|
| **Type:** | string |
| **Default:** | `reject` |
| **Managed:** | no |
The specified action is used for all ingress traffic that doesn’t match any ACL rule.
`security.acls.default.ingress.logged`
Whether to log ingress traffic that doesn’t match any ACL rule
[](#device-nic-ovn-device-conf:security.acls.default.ingress.logged)
| **Key:** | `security.acls.default.ingress.logged` |
|--------------|------------------------------------------|
| **Type:** | bool |
| **Default:** | `false` |
| **Managed:** | no |
`vlan`
VLAN ID to use when nesting
[](#device-nic-ovn-device-conf:vlan)
| **Key:** | `vlan` |
|--------------|----------|
| **Type:** | integer |
| **Managed:** | no |
See also [`nested`](#device-nic-ovn-device-conf:nested).
#### Configuration examples
An `ovn` network device must be added using a managed network.
To do so:
```none
lxc network create --type=ovn network=
lxc config device add nic network=
```
See [How to set up OVN with LXD](https://canonical.com/lxd/docs/default/howto/network_ovn_setup/index.html.md#network-ovn-setup) for full instructions, and [How to create a network](https://canonical.com/lxd/docs/default/howto/network_create/index.html.md#network-create) and [Configure devices](https://canonical.com/lxd/docs/default/howto/instances_configure/index.html.md#instances-configure-devices) for more information.
### `nictype`: `ipvlan`
#### NOTE
- This NIC type is available only for containers, not for virtual machines.
- You can select this NIC type only through the `nictype` option.
- This NIC type does not support hotplugging.
An `ipvlan` NIC sets up a new network device based on an existing one, using the same MAC address but a different IP.
If you are using an `ipvlan` NIC, communication between the LXD host and the instances is not possible.
Both the host and the instances can talk to the gateway, but they cannot communicate directly.
LXD currently supports IPVLAN in L2 and L3S mode.
In this mode, the gateway is automatically set by LXD, but the IP addresses must be manually specified using the `ipv4.address` and/or `ipv6.address` options before the container is started.
DNS
: The name servers must be configured inside the container, because they are not set automatically.
To do this, set the following `sysctls`:
- When using IPv4 addresses:
```default
net.ipv4.conf..forwarding=1
```
- When using IPv6 addresses:
```default
net.ipv6.conf..forwarding=1
net.ipv6.conf..proxy_ndp=1
```
#### Device options
NIC devices of type `ipvlan` have the following device options:
`gvrp`
Whether to use GARP VLAN Registration Protocol
[](#device-nic-ipvlan-device-conf:gvrp)
| **Key:** | `gvrp` |
|--------------|----------|
| **Type:** | bool |
| **Default:** | `false` |
This option specifies whether to register the VLAN using the GARP VLAN Registration Protocol.
`hwaddr`
MAC address of the new interface
[](#device-nic-ipvlan-device-conf:hwaddr)
| **Key:** | `hwaddr` |
|--------------|-------------------|
| **Type:** | string |
| **Default:** | randomly assigned |
`ipv4.address`
IPv4 static addresses to add to the instance
[](#device-nic-ipvlan-device-conf:ipv4.address)
| **Key:** | `ipv4.address` |
|-------------|------------------|
| **Type:** | string |
Specify a comma-delimited list of IPv4 static addresses to add to the instance.
In `l2` mode, you can specify them as CIDR values or singular addresses using a subnet of `/24`.
`ipv4.gateway`
IPv4 gateway
[](#device-nic-ipvlan-device-conf:ipv4.gateway)
| **Key:** | `ipv4.gateway` |
|--------------|----------------------------|
| **Type:** | string |
| **Default:** | `auto` (`l3s`), `-` (`l2`) |
In `l3s` mode, the option specifies whether to add an automatic default IPv4 gateway.
Possible values are `auto` and `none`.
In `l2` mode, this option specifies the IPv4 address of the gateway.
`ipv4.host_table`
Custom policy routing table ID to add IPv4 static routes to
[](#device-nic-ipvlan-device-conf:ipv4.host_table)
| **Key:** | `ipv4.host_table` |
|-------------|---------------------|
| **Type:** | integer |
The custom policy routing table is in addition to the main routing table.
`ipv6.address`
IPv6 static addresses to add to the instance
[](#device-nic-ipvlan-device-conf:ipv6.address)
| **Key:** | `ipv6.address` |
|-------------|------------------|
| **Type:** | string |
Specify a comma-delimited list of IPv6 static addresses to add to the instance.
In `l2` mode, you can specify them as CIDR values or singular addresses using a subnet of `/64`.
`ipv6.gateway`
IPv6 gateway
[](#device-nic-ipvlan-device-conf:ipv6.gateway)
| **Key:** | `ipv6.gateway` |
|--------------|----------------------------|
| **Type:** | string |
| **Default:** | `auto` (`l3s`), `-` (`l2`) |
In `l3s` mode, the option specifies whether to add an automatic default IPv6 gateway.
Possible values are `auto` and `none`.
In `l2` mode, this option specifies the IPv6 address of the gateway.
`ipv6.host_table`
Custom policy routing table ID to add IPv6 static routes to
[](#device-nic-ipvlan-device-conf:ipv6.host_table)
| **Key:** | `ipv6.host_table` |
|-------------|---------------------|
| **Type:** | integer |
The custom policy routing table is in addition to the main routing table.
`mode`
IPVLAN mode
[](#device-nic-ipvlan-device-conf:mode)
| **Key:** | `mode` |
|--------------|----------|
| **Type:** | string |
| **Default:** | `l3s` |
Possible values are `l2` and `l3s`.
`mtu`
The MTU of the new interface
[](#device-nic-ipvlan-device-conf:mtu)
| **Key:** | `mtu` |
|--------------|------------|
| **Type:** | integer |
| **Default:** | parent MTU |
`name`
Name of the interface inside the instance
[](#device-nic-ipvlan-device-conf:name)
| **Key:** | `name` |
|--------------|-----------------|
| **Type:** | string |
| **Default:** | kernel assigned |
`parent`
Name of the host device
[](#device-nic-ipvlan-device-conf:parent)
| **Key:** | `parent` |
|---------------|------------|
| **Type:** | string |
| **Required:** | yes |
`vlan`
VLAN ID to attach to
[](#device-nic-ipvlan-device-conf:vlan)
| **Key:** | `vlan` |
|-------------|----------|
| **Type:** | integer |
#### Configuration examples
Add an `ipvlan` network device to an instance, connecting to an existing network interface with `nictype`:
```none
lxc stop
lxc config device add nic nictype=ipvlan parent=
```
Adding an `ipvlan` network device to an instance using a managed network is not possible.
See [Configure devices](https://canonical.com/lxd/docs/default/howto/instances_configure/index.html.md#instances-configure-devices) for more information.
### `nictype`: `p2p`
#### NOTE
You can select this NIC type only through the `nictype` option.
A `p2p` NIC creates a virtual device pair, putting one side in the instance and leaving the other side on the host.
#### Device options
NIC devices of type `p2p` have the following device options:
`boot.priority`
Boot priority for VMs
[](#device-nic-p2p-device-conf:boot.priority)
| **Key:** | `boot.priority` |
|-------------|-------------------|
| **Type:** | integer |
A higher value for this option means that the VM boots first.
`host_name`
Name of the interface inside the host
[](#device-nic-p2p-device-conf:host_name)
| **Key:** | `host_name` |
|--------------|-------------------|
| **Type:** | string |
| **Default:** | randomly assigned |
`hwaddr`
MAC address of the new interface
[](#device-nic-p2p-device-conf:hwaddr)
| **Key:** | `hwaddr` |
|--------------|-------------------|
| **Type:** | string |
| **Default:** | randomly assigned |
`ipv4.routes`
IPv4 static routes for the NIC to add on the host
[](#device-nic-p2p-device-conf:ipv4.routes)
| **Key:** | `ipv4.routes` |
|-------------|-----------------|
| **Type:** | string |
Specify a comma-delimited list of IPv4 static routes for this NIC to add on the host.
`ipv6.routes`
IPv6 static routes for the NIC to add on the host
[](#device-nic-p2p-device-conf:ipv6.routes)
| **Key:** | `ipv6.routes` |
|-------------|-----------------|
| **Type:** | string |
Specify a comma-delimited list of IPv6 static routes for this NIC to add on the host.
`limits.egress`
I/O limit for outgoing traffic
[](#device-nic-p2p-device-conf:limits.egress)
| **Key:** | `limits.egress` |
|-------------|-------------------|
| **Type:** | string |
Specify the limit in bit/s. Various suffixes are supported (see [Units for storage and network limits](https://canonical.com/lxd/docs/default/reference/instance_units/index.html.md#instances-limit-units)).
`limits.ingress`
I/O limit for incoming traffic
[](#device-nic-p2p-device-conf:limits.ingress)
| **Key:** | `limits.ingress` |
|-------------|--------------------|
| **Type:** | string |
Specify the limit in bit/s. Various suffixes are supported (see [Units for storage and network limits](https://canonical.com/lxd/docs/default/reference/instance_units/index.html.md#instances-limit-units)).
`limits.max`
I/O limit for both incoming and outgoing traffic
[](#device-nic-p2p-device-conf:limits.max)
| **Key:** | `limits.max` |
|-------------|----------------|
| **Type:** | string |
This option is the same as setting both [`limits.ingress`](#device-nic-bridged-device-conf:limits.ingress) and [`limits.egress`](#device-nic-bridged-device-conf:limits.egress).
Specify the limit in bit/s. Various suffixes are supported (see [Units for storage and network limits](https://canonical.com/lxd/docs/default/reference/instance_units/index.html.md#instances-limit-units)).
`limits.priority`
`skb->priority` value for outgoing traffic
[](#device-nic-p2p-device-conf:limits.priority)
| **Key:** | `limits.priority` |
|-------------|---------------------|
| **Type:** | integer |
The `skb->priority` value for outgoing traffic is used by the kernel queuing discipline (qdisc) to prioritize network packets.
Specify the value as a 32-bit unsigned integer.
The effect of this value depends on the particular qdisc implementation, for example, `SKBPRIO` or `QFQ`.
Consult the kernel qdisc documentation before setting this value.
`mtu`
MTU of the new interface
[](#device-nic-p2p-device-conf:mtu)
| **Key:** | `mtu` |
|--------------|-----------------|
| **Type:** | integer |
| **Default:** | kernel assigned |
`name`
Name of the interface inside the instance
[](#device-nic-p2p-device-conf:name)
| **Key:** | `name` |
|--------------|-----------------|
| **Type:** | string |
| **Default:** | kernel assigned |
`queue.tx.length`
Transmit queue length for the NIC
[](#device-nic-p2p-device-conf:queue.tx.length)
| **Key:** | `queue.tx.length` |
|-------------|---------------------|
| **Type:** | integer |
#### Configuration examples
Add a `p2p` network device to an instance using `nictype`:
```none
lxc config device add nic nictype=p2p
```
Adding a `p2p` network device to an instance using a managed network is not possible.
See [Configure devices](https://canonical.com/lxd/docs/default/howto/instances_configure/index.html.md#instances-configure-devices) for more information.
### `nictype`: `routed`
#### NOTE
You can select this NIC type only through the `nictype` option.
A `routed` NIC creates a virtual device pair to connect the host to the instance and sets up static routes and proxy ARP/NDP entries to allow the instance to join the network of a designated parent interface.
For containers it uses a virtual Ethernet device pair, and for VMs it uses a TAP device.
This NIC type is similar in operation to `ipvlan`, in that it allows an instance to join an external network without needing to configure a bridge and shares the host’s MAC address.
However, it differs from `ipvlan` because it does not need IPVLAN support in the kernel, and the host and the instance can communicate with each other.
This NIC type respects `netfilter` rules on the host and uses the host’s routing table to route packets, which can be useful if the host is connected to multiple networks.
IP addresses, gateways and routes
: You must manually specify the IP addresses (using `ipv4.address` and/or `ipv6.address`) before the instance is started.
For containers, the NIC configures the following link-local gateway IPs on the host end and sets them as the default gateways in the container’s NIC interface:
```none
169.254.0.1
fe80::1
```
For VMs, the gateways must be configured manually or via a mechanism like `cloud-init` (see the [how to guide](https://canonical.com/lxd/docs/default/howto/instances_routed_nic_vm/index.html.md#instances-routed-nic-vm)).
#### NOTE
If your container image is configured to perform DHCP on the interface, it will likely remove the automatically added configuration.
In this case, you must configure the IP addresses and gateways manually or via a mechanism like `cloud-init`.
The NIC type configures static routes on the host pointing to the instance’s `veth` interface for all of the instance’s IPs.
Multiple IP addresses
: Each NIC device can have multiple IP addresses added to it.
However, it might be preferable to use multiple `routed` NIC interfaces instead.
In this case, set the `ipv4.gateway` and `ipv6.gateway` values to `none` on any subsequent interfaces to avoid default gateway conflicts.
Also consider specifying a different host-side address for these subsequent interfaces using `ipv4.host_address` and/or `ipv6.host_address`.
Parent interface
: This NIC can operate with and without a `parent` network interface set.
: With the `parent` network interface set, proxy ARP/NDP entries of the instance’s IPs are added to the parent interface, which allows the instance to join the parent interface’s network at layer 2.
: To enable this, the following network configuration must be applied on the host via `sysctl`:
- When using IPv4 addresses:
```default
net.ipv4.conf..forwarding=1
```
- When using IPv6 addresses:
```default
net.ipv6.conf.all.forwarding=1
net.ipv6.conf..forwarding=1
net.ipv6.conf.all.proxy_ndp=1
net.ipv6.conf..proxy_ndp=1
```
#### Device options
NIC devices of type `routed` have the following device options:
`gvrp`
Whether to use GARP VLAN Registration Protocol
[](#device-nic-routed-device-conf:gvrp)
| **Key:** | `gvrp` |
|--------------|----------|
| **Type:** | bool |
| **Default:** | `false` |
This option specifies whether to register the VLAN using the GARP VLAN Registration Protocol.
`host_name`
Name of the interface inside the host
[](#device-nic-routed-device-conf:host_name)
| **Key:** | `host_name` |
|--------------|-------------------|
| **Type:** | string |
| **Default:** | randomly assigned |
`hwaddr`
MAC address of the new interface
[](#device-nic-routed-device-conf:hwaddr)
| **Key:** | `hwaddr` |
|--------------|-------------------|
| **Type:** | string |
| **Default:** | randomly assigned |
`ipv4.address`
IPv4 static addresses to add to the instance
[](#device-nic-routed-device-conf:ipv4.address)
| **Key:** | `ipv4.address` |
|-------------|------------------|
| **Type:** | string |
Specify a comma-delimited list of IPv4 static addresses to add to the instance.
`ipv4.gateway`
Whether to add an automatic default IPv4 gateway
[](#device-nic-routed-device-conf:ipv4.gateway)
| **Key:** | `ipv4.gateway` |
|--------------|------------------|
| **Type:** | string |
| **Default:** | `auto` |
Possible values are `auto` and `none`.
`ipv4.host_address`
IPv4 address to add to the host-side `veth` interface
[](#device-nic-routed-device-conf:ipv4.host_address)
| **Key:** | `ipv4.host_address` |
|--------------|-----------------------|
| **Type:** | string |
| **Default:** | `169.254.0.1` |
`ipv4.host_table`
Custom policy routing table ID to add IPv4 static routes to
[](#device-nic-routed-device-conf:ipv4.host_table)
| **Key:** | `ipv4.host_table` |
|-------------|---------------------|
| **Type:** | integer |
The custom policy routing table is in addition to the main routing table.
`ipv4.neighbor_probe`
Whether to probe the parent network for IPv4 address availability
[](#device-nic-routed-device-conf:ipv4.neighbor_probe)
| **Key:** | `ipv4.neighbor_probe` |
|--------------|-------------------------|
| **Type:** | bool |
| **Default:** | `true` |
`ipv4.routes`
IPv4 static routes for the NIC to add on the host
[](#device-nic-routed-device-conf:ipv4.routes)
| **Key:** | `ipv4.routes` |
|-------------|-----------------|
| **Type:** | string |
Specify a comma-delimited list of IPv4 static routes for this NIC to add on the host (without L2 ARP/NDP proxy).
`ipv6.address`
IPv6 static addresses to add to the instance
[](#device-nic-routed-device-conf:ipv6.address)
| **Key:** | `ipv6.address` |
|-------------|------------------|
| **Type:** | string |
Specify a comma-delimited list of IPv6 static addresses to add to the instance.
`ipv6.gateway`
Whether to add an automatic default IPv6 gateway
[](#device-nic-routed-device-conf:ipv6.gateway)
| **Key:** | `ipv6.gateway` |
|--------------|------------------|
| **Type:** | string |
| **Default:** | `auto` |
Possible values are `auto` and `none`.
`ipv6.host_address`
IPv6 address to add to the host-side `veth` interface
[](#device-nic-routed-device-conf:ipv6.host_address)
| **Key:** | `ipv6.host_address` |
|--------------|-----------------------|
| **Type:** | string |
| **Default:** | `fe80::1` |
`ipv6.host_table`
Custom policy routing table ID to add IPv6 static routes to
[](#device-nic-routed-device-conf:ipv6.host_table)
| **Key:** | `ipv6.host_table` |
|-------------|---------------------|
| **Type:** | integer |
The custom policy routing table is in addition to the main routing table.
`ipv6.neighbor_probe`
Whether to probe the parent network for IPv6 address availability
[](#device-nic-routed-device-conf:ipv6.neighbor_probe)
| **Key:** | `ipv6.neighbor_probe` |
|--------------|-------------------------|
| **Type:** | bool |
| **Default:** | `true` |
`ipv6.routes`
IPv6 static routes for the NIC to add on the host
[](#device-nic-routed-device-conf:ipv6.routes)
| **Key:** | `ipv6.routes` |
|-------------|-----------------|
| **Type:** | string |
Specify a comma-delimited list of IPv6 static routes for this NIC to add on the host (without L2 ARP/NDP proxy).
`limits.egress`
I/O limit for outgoing traffic
[](#device-nic-routed-device-conf:limits.egress)
| **Key:** | `limits.egress` |
|-------------|-------------------|
| **Type:** | string |
Specify the limit in bit/s. Various suffixes are supported (see [Units for storage and network limits](https://canonical.com/lxd/docs/default/reference/instance_units/index.html.md#instances-limit-units)).
`limits.ingress`
I/O limit for incoming traffic
[](#device-nic-routed-device-conf:limits.ingress)
| **Key:** | `limits.ingress` |
|-------------|--------------------|
| **Type:** | string |
Specify the limit in bit/s. Various suffixes are supported (see [Units for storage and network limits](https://canonical.com/lxd/docs/default/reference/instance_units/index.html.md#instances-limit-units)).
`limits.max`
I/O limit for both incoming and outgoing traffic
[](#device-nic-routed-device-conf:limits.max)
| **Key:** | `limits.max` |
|-------------|----------------|
| **Type:** | string |
This option is the same as setting both [`limits.ingress`](#device-nic-bridged-device-conf:limits.ingress) and [`limits.egress`](#device-nic-bridged-device-conf:limits.egress).
Specify the limit in bit/s. Various suffixes are supported (see [Units for storage and network limits](https://canonical.com/lxd/docs/default/reference/instance_units/index.html.md#instances-limit-units)).
`limits.priority`
`skb->priority` value for outgoing traffic
[](#device-nic-routed-device-conf:limits.priority)
| **Key:** | `limits.priority` |
|-------------|---------------------|
| **Type:** | integer |
The `skb->priority` value for outgoing traffic is used by the kernel queuing discipline (qdisc) to prioritize network packets.
Specify the value as a 32-bit unsigned integer.
The effect of this value depends on the particular qdisc implementation, for example, `SKBPRIO` or `QFQ`.
Consult the kernel qdisc documentation before setting this value.
`mtu`
The MTU of the new interface
[](#device-nic-routed-device-conf:mtu)
| **Key:** | `mtu` |
|--------------|------------|
| **Type:** | integer |
| **Default:** | parent MTU |
`name`
Name of the interface inside the instance
[](#device-nic-routed-device-conf:name)
| **Key:** | `name` |
|--------------|-----------------|
| **Type:** | string |
| **Default:** | kernel assigned |
`parent`
Name of the host device to join the instance to
[](#device-nic-routed-device-conf:parent)
| **Key:** | `parent` |
|-------------|------------|
| **Type:** | string |
`queue.tx.length`
Transmit queue length for the NIC
[](#device-nic-routed-device-conf:queue.tx.length)
| **Key:** | `queue.tx.length` |
|-------------|---------------------|
| **Type:** | integer |
`vlan`
VLAN ID to attach to
[](#device-nic-routed-device-conf:vlan)
| **Key:** | `vlan` |
|-------------|----------|
| **Type:** | integer |
#### Configuration examples
Add a `routed` network device to an instance using `nictype`:
```none
lxc config device add nic nictype=routed ipv4.address=192.0.2.2 ipv6.address=2001:db8::2
```
Adding a `routed` network device to an instance using a managed network is not possible.
See [Configure devices](https://canonical.com/lxd/docs/default/howto/instances_configure/index.html.md#instances-configure-devices) for more information.
## `bridged`, `macvlan` or `ipvlan` for connection to physical network
The `bridged`, `macvlan` and `ipvlan` interface types can be used to connect to an existing physical network.
`macvlan` effectively lets you fork your physical NIC, getting a second interface that is then used by the instance.
This method saves you from creating a bridge device and virtual Ethernet device pairs and usually offers better performance than a bridge.
The downside to this method is that `macvlan` devices, while able to communicate between themselves and to the outside, cannot talk to their parent device.
This means that you can’t use `macvlan` if you ever need your instances to talk to the host itself.
In such case, a `bridge` device is preferable.
A bridge also lets you use MAC filtering and I/O limits, which cannot be applied to a `macvlan` device.
`ipvlan` is similar to `macvlan`, with the difference being that the forked device has IPs statically assigned to it and inherits the parent’s MAC address on the network.
## MAAS integration
If you’re using MAAS to manage the physical network under your LXD host and want to attach your instances directly to a MAAS-managed network, LXD can be configured to interact with MAAS so that it can track your instances.
At the daemon level, you must configure [`maas.api.url`](https://canonical.com/lxd/docs/default/server/index.html.md#server-miscellaneous:maas.api.url) and [`maas.api.key`](https://canonical.com/lxd/docs/default/server/index.html.md#server-miscellaneous:maas.api.key), and then set the NIC-specific `maas.subnet.ipv4` and/or `maas.subnet.ipv6` keys on the instance or profile’s `nic` entry.
With this configuration, LXD registers all your instances with MAAS, giving them proper DHCP leases and DNS records.
If you set the `ipv4.address` or `ipv6.address` keys on the NIC, those are registered as static assignments in MAAS.