Linux虚拟网络设备

tun/tap

Linux使用tun模块实现tun/tap，tun工作在L3，tap工作在L2

module_init(tun_init)
	misc_register(&tun_miscdev)
		.fops = &tun_fops

tun_chr_ioctl
	__tun_chr_ioctl
		tun_set_iff
			tun_net_init
				dev->netdev_ops = &tun_netdev_ops
				dev->netdev_ops = &tap_netdev_ops
			tun_attach
			register_netdevice

# 查看和加载tun模块
modinfo tun
lsmod | grep tun
modprobe tun

# 安装tunctl
vi /etc/yum.repos.d/nux-misc.repo
[nux-misc]
name=Nux Misc
baseurl=http://li.nux.ro/download/nux/misc/el7/x86_64/
enabled=0
gpgcheck=1
gpgkey=http://li.nux.ro/download/nux/RPM-GPG-KEY-nux.ro

yum --enablerepo=nux-misc install tunctl -y

# 创建tap
tunctl -t tap1
ip addr add 10.0.0.1/24 dev tap1
ip link set tap1 up

namespace

一个namespace提供了一套独立的网络协议栈

# 创建namespace
ip netns add ns1
# 将tap移入namespace
ip link set tap1 netns ns1
ip netns exec ns1 ip addr add 10.0.0.1/24 dev tap1
ip netns exec ns1 ip link set tap1 up
# 打开namespace的转发
ip netns exec ns1 sysctl -w net.ipv4.ip_forward=1

veth pair

veth pair用于连接两个虚拟网络设备

# 创建veth pair
ip link add tap1 type veth peer name tap2

ip netns add ns1
ip netns add ns2

ip link set tap1 netns ns1
ip link set tap2 netns ns2

ip netns exec ns1 ip addr add 10.0.0.1/24 dev tap1
ip netns exec ns2 ip addr add 10.0.0.2/24 dev tap2

ip netns exec ns1 ip link set tap1 up
ip netns exec ns2 ip link set tap2 up

ip netns exec ns1 ping 10.0.0.2
ip netns exec ns2 ping 10.0.0.1

bridge

bridge相当于一个二层交换机

yum install bridge-utils -y

ip link add tap1 type veth peer name peer1
ip link add tap2 type veth peer name peer2
ip link add tap3 type veth peer name peer3
ip link add tap4 type veth peer name peer4

ip netns add ns1
ip netns add ns2
ip netns add ns3
ip netns add ns4

# 将veth pair的一端加入namespace
ip link set tap1 netns ns1
ip link set tap2 netns ns2
ip link set tap3 netns ns3
ip link set tap4 netns ns4

# 创建bridge
brctl addbr br1

# 将veth pair的另一端加入bridge
brctl addif br1 peer1
brctl addif br1 peer2
brctl addif br1 peer3
brctl addif br1 peer4

ip netns exec ns1 ip addr add 10.0.0.1/24 dev tap1
ip netns exec ns2 ip addr add 10.0.0.2/24 dev tap2
ip netns exec ns3 ip addr add 10.0.0.3/24 dev tap3
ip netns exec ns4 ip addr add 10.0.0.4/24 dev tap4

ip link set br1 up
ip link set peer1 up
ip link set peer2 up
ip link set peer3 up
ip link set peer4 up
ip netns exec ns1 ip link set tap1 up
ip netns exec ns2 ip link set tap2 up
ip netns exec ns3 ip link set tap3 up
ip netns exec ns4 ip link set tap4 up

ip netns exec ns1 ping 10.0.0.2
ip netns exec ns1 ping 10.0.0.3
ip netns exec ns1 ping 10.0.0.4

router

linux本身就是一个路由器

cat /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/ip_forward

ip link add tap1 type veth peer name peer1
ip link add tap2 type veth peer name peer2

ip netns add ns1
ip netns add ns2

ip link set tap1 netns ns1
ip link set tap2 netns ns2

ip addr add 10.0.1.1/24 dev peer1
ip addr add 10.0.2.1/24 dev peer2
ip netns exec ns1 ip addr add 10.0.1.2/24 dev tap1
ip netns exec ns2 ip addr add 10.0.2.2/24 dev tap2

ip link set peer1 up
ip link set peer2 up
ip netns exec ns1 ip link set tap1 up
ip netns exec ns2 ip link set tap2 up

ip netns exec ns1 ip route add 10.0.2.0/24 via 10.0.1.1
ip netns exec ns2 ip route add 10.0.1.0/24 via 10.0.2.1

ip netns exec ns1 ping 10.0.2.2
ip netns exec ns2 ping 10.0.1.2

tun

在router的基础上建立ipip隧道

ip netns exec ns1 ip tunnel add tun1 mode ipip remote 10.0.2.2 local 10.0.1.2
ip netns exec ns2 ip tunnel add tun2 mode ipip remote 10.0.1.2 local 10.0.2.2

ip netns exec ns1 ip addr add 10.0.3.2/24 dev tun1
ip netns exec ns2 ip addr add 10.0.4.2/24 dev tun2

ip netns exec ns1 ip link set tun1 up
ip netns exec ns2 ip link set tun2 up

ip netns exec ns1 ip route add 10.0.4.0/24 dev tun1
ip netns exec ns2 ip route add 10.0.3.0/24 dev tun2

# iptables放行ipip
iptables -I FORWARD -p 4 -j ACCEPT

ip netns exec ns1 ping 10.0.4.2
ip netns exec ns2 ping 10.0.3.2

vxlan

配置vm1

ip link add vxlan1 type vxlan id 1 dstport 4789 group 239.1.1.1 dev ens33
ip addr add 10.0.0.1/24 dev vxlan1
ip link set vxlan1 up

# iptables放行udp 4789
iptables -I INPUT -p udp --dport 4789 -j ACCEPT

配置vm2

ip link add vxlan1 type vxlan id 1 dstport 4789 group 239.1.1.1 dev ens33
ip addr add 10.0.0.2/24 dev vxlan1
ip link set vxlan1 up

# iptables放行udp 4789
iptables -I INPUT -p udp --dport 4789 -j ACCEPT

vm1和vm2互ping

ping 10.0.0.2
ping 10.0.0.1