杂项

 

Historically, Open vSwitch (OVS) could not interact directly with iptables to implement security groups. Thus, the OVS agent and Compute service use a Linux bridge between each instance (VM) and the OVS integration bridge br-int to implement security groups. The Linux bridge device contains the iptables rules pertaining to the instance. In general, additional components between instances and physical network infrastructure cause scalability and performance problems. To alleviate such problems, the OVS agent includes an optional firewall driver that natively implements security groups as flows in OVS rather than the Linux bridge device and iptables. This increases scalability and performance.

 

modprobe ifb
tc qdisc add dev bond0 handle ffff: ingress
ip link set dev ifb0 up
tc filter add dev bond0 parent ffff: protocol ip u32 match ip src X.X.X.X action mirred egress redirect dev ifb0
tc qdisc add dev ifb0 root handle 1: htb default 20
tc class add dev ifb0 parent 1:1 classid 1:30 htb rate 400mbit
tc filter add dev ifb0 protocol ip parent 1:0 prio 1 u32 match ip src X.X.X.X flowid 1:30




tc qdisc add dev bond0 root handle 1: htb default 20
tc class add dev bond0 parent 1:1 classid 1:35 htb rate 2gbit
tc filter add dev bond0 protocol ip parent 1:0 prio 1 u32 match ip dst X.X.X.X flowid 1:35