实战|Linux网络虚拟化namespace

1. namespace常用命令练习

#查看namespace命令帮助
[root@localhost ~]# ip netns help
Usage: ip netns list
       ip netns add NAME
       ip netns set NAME NETNSID
       ip [-all] netns delete [NAME]
       ip netns identify [PID]
       ip netns pids NAME
       ip [-all] netns exec [NAME] cmd ...
       ip netns monitor
       ip netns list-id
#添加net1 namespace
[root@localhost ~]# ip netns add net1
#列出所有的namespace，下面两个命令效果相同
[root@localhost ~]# ip netns list
net1
[root@localhost ~]# ip netns ls
net1
#删除namespace
[root@localhost ~]# ip netns delete net1

#查看net1 namespace中的ip信息
[root@localhost ~]# ip netns add net1
[root@localhost ~]# ip netns exec net1 ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
#进入net1 namespace，进入之后可以直接查看IP信息，退出请输入exit
[root@localhost ~]# ip netns exec net1 bash
[root@localhost ~]# ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
[root@localhost ~]# exit
exit
#为了避免进入namespace后混淆当前bash所在哪个namespace，可以给进入的namespace取名,通过echo 将“PS1=namespace net1> ”赋值给--rcfile，效果如下
[root@localhost ~]#ip netns exec net1  bash  --rcfile  <(echo "PS1=\"namespace net1> \"")
namespace net1> ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
namespace net1> exit
exit

2. 直接连通两个namespace

#创建两个namespace vnet1 vnet2,并查看各自的ip 信息
[root@localhost ~]# ip netns add vnet1
[root@localhost ~]# ip netns add vnet2
[root@localhost ~]# ip netns ls
vnet2
vnet1
[root@localhost ~]# ip netns exec vnet1 ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
[root@localhost ~]# ip netns exec vnet2 ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

#创建用于连接两个namespace网络的连接线,ip link add type 后面可以跟bridge，veth，vlan，vxlan等等很多类型，详见帮助文档 ：man ip link add type
[root@localhost ~]# ip link add type veth
#创建完成后，使用ip link ，可以看到veth0@veth1和veth1@veth0两个网口，从名字上就能看出，这是一对，类似一个网线的两头
[root@localhost ~]# ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
    link/ether 00:50:56:94:36:38 brd ff:ff:ff:ff:ff:ff
3: veth0@veth1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether d6:eb:7b:fb:19:b4 brd ff:ff:ff:ff:ff:ff
4: veth1@veth0: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 9e:98:c0:85:27:b0 brd ff:ff:ff:ff:ff:ff
#使用ifconfig -a查看的话，可以看到 veth0和veth1
[root@localhost ~]# ifconfig
veth0: flags=4098<BROADCAST,MULTICAST>  mtu 1500
        ether 22:47:9e:6e:e9:4f  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

veth1: flags=4098<BROADCAST,MULTICAST>  mtu 1500
        ether f2:db:9c:f2:89:0c  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
#将两个网卡分别连接到vnet1 和 vnet2 两个namespace中,此时宿主机上ifconfig已经看不到这两个网卡了
[root@localhost ~]# ip link set veth0 netns vnet1
[root@localhost ~]# ip link set veth1 netns vnet2
#vnet1的namespace中可以看到一个网卡veth0
[root@localhost ~]# ip netns exec vnet1 ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
3: veth0@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether d6:eb:7b:fb:19:b4 brd ff:ff:ff:ff:ff:ff link-netnsid 1
#vnet1的namespace中可以看到一个网卡veth1
[root@localhost ~]# ip netns exec  vnet2 ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
4: veth1@if3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 9e:98:c0:85:27:b0 brd ff:ff:ff:ff:ff:ff link-netnsid 0

#给vnet1的namespace中 veth0配置ip地址并up网卡
[root@localhost ~]# ip netns exec vnet1 ip link set veth0 up
[root@localhost ~]# ip netns exec vnet1 ip addr add 1.1.1.1/24 dev veth0
[root@localhost ~]# ip netns exec vnet1 ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
3: veth0@if4: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state LOWERLAYERDOWN group default qlen 1000
    link/ether d6:eb:7b:fb:19:b4 brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet 1.1.1.1/24 scope global veth0
       valid_lft forever preferred_lft forever
#给vnet2的namespace中 veth1配置ip地址并up网卡
[root@localhost ~]# ip netns exec vnet2 ip addr add 1.1.1.2/24 dev veth1
[root@localhost ~]# ip netns exec vnet