-
Namespace实现网络隔离与互通
-
新建ns:
ip netns add foo
-
查看ns:
ip netns
-
查看ns详细配置:
ip netns exec foo ip addr
-
设置ns内部lo网络up:
ip netns exec foo ip link set lo up
ip netns exec foo ip addr
ip netns exec foo route –n
ip netns exec foo iptables -t nat –S
-
ip netns exec foo ping 10.20.0.88
-
创建tap设备对:
ip link add tap-foo type veth peer name tap-root
ip link
使用ethtool确认属于成对设备:
-
设置tap设备的ns:
ip link set tap-foo netns foo
ip netns exec foo ip link
ip netns exec foo ip link set tap-foo up
root的ns看不到foo-tap了:
-
为tap设备添加ip地址
ip netns exec foo ip addr add 88.88.88.100/24 dev tap-foo
ip netns exec foo ifconfig
-
设置tap-root设备的ip地址
ip addr add 88.88.88.101/24 dev tap-root
-
up起root的tap设备
ip link set tap-root up
ifconfig
-
可以相互ping通88.88.88.100、88.88.88.101,但是仍然不可访问10.20.0.88
ip netns exec foo ping 10.20.0.88
-
设置默认路由
ip netns exec foo route add -net 0.0.0.0 netmask 0.0.0.0 gw 88.88.88.101
ip netns exec foo route –n
-
继续ping 10.20.0.88,可以ping通
ip netns exec foo ping 10.20.0.88
-
机器重启所有配置自动清除。
-
-
Openvswitch VM+GRE隧道实现同网段虚拟机跨主机通信
-
环境拓扑
-
环境准备
network1
eth0:10.20.0.201 (management network)
eht1:172.16.0.201 (public/external network)
eht2:192.168.4.201 (private network,gre tunning)
compute1
eth0:10.20.0.202 (management network)
eht1:(disabled)
eht2:192.168.4.202 (private network,gre tunning)
-
先看网络节点。
安装必备软件包:yum install libvirt openvswitch python-virtinst xauth tigervnc –y
yum install kvm qemu-kvm qemu-kvm-tools
yum install bridge-utils qemu-img
yum install python-virtinst virt-manager virt-viewer
yum install libvirt libvirt-client
reboot -h 0,vm重启生效。
-
移除默认的libvirt网络
virsh net-destroy default
virsh net-autostart --disable default
virsh net-undefine default
virsh net-list
-
设置允许ipforward
vi /etc/sysctl.conf
net.ipv4.ip_forward=1
net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0
sysctl –p,立即生效。
-
启动openvswitch
service openvswitch start
chkconfig openvswitch on
-
创建linux bridge,qbr设备,虚拟机网卡与br-int网桥之间的桥梁网桥。
brctl addbr qbr01
ip link set qbr01 up
brctl show
ifconfig
-
创建虚拟机,虚拟机网卡连接到网桥qbr01的tap设备:
mkdir -p /var/tmp/gre
mv instance1.img instance1.xml /var/tmp/gre
instance文件参考:
https://github.com/yongluo2013/osf-openstack-training/blob/master/installation/gre/instance1.xml
cd /var/tmp/gre
virsh define instance1.xml
virsh start instance1
virsh vncdisplay instance1
vncviewer :0
vncviewer进入虚拟机。
-
为虚拟机配置IP与默认网关
sudo ip addr add 192.168.1.11/24 dev eth0
sudo route add default gw 192.168.1.1
-
创建br-int网桥,用于连接qbr网桥
ovs-vsctl add-br br-int
ovs-vsctl add-port br-int gre0 -- set interface gre0 type=gre options:remote_ip=192.168.4.202
-
创建tap对,用于br-int与qbr之间的连接
ip link add qvo01 type veth peer name qvb01
brctl addif qbr01 qvb01,设置qvb01为qbr01的接口
ovs-vsctl add-port br-int qvo01
ovs-vsctl set port qvo01 tag=100
ip link set qvb01 up
ip link set qvo01 up
br-int以下的网络设备均up起来了
-
再看计算节点。准备软件与网络节点一致。
brctl addbr qbr02
ip link set qbr02 up
virsh define instance2.xml
virsh start instance2
virsh vncdisplay instance2
vncviewer :0
sudo ip addr add 192.168.1.12/24 dev eth0
sudo route add default gw 192.168.1.1
ovs-vsctl add-br br-int
ovs-vsctl add-port br-int gre0 -- set interface gre0 type=gre options:remote_ip=192.168.4.201
ip link add qvo02 type veth peer name qvb02
brctl addif qbr02 qvb02
ovs-vsctl add-port br-int qvo02
ovs-vsctl set port qvo02 tag=100
ip link set qvb02 up
ip link set qvo02 up
-
至此,vm01的192.168.1.11可以ping通vm02的192.168.1.12。在没有namespace场景下,同一vlan可以直接连通。
vm01:
vm02:
-
-
Openvswitch VM+GRE隧道+NameSpace实现dhcp的namespace
-
添加dhcp的ns
ip netns add dhcp01
-
为br-int添加dhcp的tap设备接口
ovs-vsctl add-port br-int tapdhcp01 -- set interface tapdhcp01 type=internal
-
ovs-vsctl set port tapdhcp01 tag=100
-
设置tap设备所属的ns
ip link set tapdhcp01 netns dhcp01
-
为dhcp的tap设备设置ip
ip netns exec dhcp01 ip addr add 192.168.1.2/24 dev tapdhcp01
ip netns exec dhcp01 ip link set tapdhcp01 up
-
在namespace中可以访问vm01与vm02。
-
-
Openvswitch VM+GRE隧道+NameSpace实现router的namespace
-
ovs-vsctl add-br br-ex
-
重新配置eth1和br-ex
vi /etc/sysconfig/network-scripts/ifcfg-eth1
DEVICE=eth1
ONBOOT=yes
BOOTPROTO=none
PROMISC=yes
MTU=1546
vi /etc/sysconfig/network-scripts/ifcfg-br-ex
DEVICE=br-ex
TYPE=Bridge
ONBOOT=yes
BOOTPROTO=none
IPADDR0=172.16.0.201
PREFIX0=24
ovs-vsctl add-port br-ex eth1
-
重启网络服务:service network restart
ip link set br-ex up
sudo ip addr add 172.16.0.20/24 dev br-ex
-
添加router的ns
ip netns add router01
-
添加私网的网关
ovs-vsctl add-port br-int qr01 -- set interface qr01 type=internal
ovs-vsctl set port qr01 tag=100
-
设置网关在router01的ns中
ip link set qr01 netns router01
ip netns exec router01 ip addr add 192.168.1.1/24 dev qr01
ip netns exec router01 ip link set qr01 up
ip netns exec router01 ip link set lo up
-
至此,路由器的qr端可以ping通vm的私有ip。
-
在br-ex中添加qg设备,设置为私有网段连接外网的下一跳地址
ovs-vsctl add-port br-ex qg01 -- set interface qg01 type=internal
ip link set qg01 netns router01
ip netns exec router01 ip addr add 172.16.0.100/24 dev qg01
ip netns exec router01 ip link set qg01 up
ip netns exec router01 ip link set lo up
-
为虚拟机添加浮动ip,并且配置iptables,规则使虚拟机可以访问外网
ip netns exec router01 ip addr add 172.16.0.101/32 dev qg01
ip netns exec router01 iptables -t nat -A OUTPUT -d 172.16.0.101/32 -j DNAT --to-destination 192.168.1.11
ip netns exec router01 iptables -t nat -A PREROUTING -d 172.16.0.101/32 -j DNAT --to-destination 192.168.1.11
ip netns exec router01 iptables -t nat -A POSTROUTING -s 192.168.1.11/32 -j SNAT --to-source 172.16.0.101
ip netns exec router01 iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source 172.16.0.100
-
到此,可以使用洗浮动IP访问虚拟机,如下图所示:
-
-
参考文档: