linux支持的网络设备,Linux 虚拟网络设备---router、tun

标签：

Linux 虚拟网络设备—router、tun

router

router在虚拟网络中就是路由器，实现三层通信作用。

Linux 本身开启转发功能后就是一个路由器。

# 开启转发策略

[root@public ~]# cat /proc/sys/net/ipv4/ip_forward

0

[root@public ~]# echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

[root@public ~]# sysctl -p

net.ipv4.ip_forward = 1

[root@public ~]# cat /proc/sys/net/ipv4/ip_forward

1

[root@public ~]#

使用测试用例，模拟验证router功能，拓扑图如下：

根据拓扑图创建对应设备：

# 开启转发后，根据拓扑进行配置

[root@public ~]#

[root@public ~]# ip link add tap1 type veth peer name tap1_peer

[root@public ~]# ip link add tap2 type veth peer name tap2_peer

[root@public ~]#

[root@public ~]# ip netns add ns1

[root@public ~]# ip netns add ns2

[root@public ~]#

[root@public ~]# ip link set tap1 netns ns1

[root@public ~]# ip link set tap2 netns ns2

[root@public ~]#

[root@public ~]# ip addr add 192.168.1.1/24 dev tap1_peer

[root@public ~]# ip addr add 192.168.2.1/24 dev tap2_peer

[root@public ~]# ip netns exec ns1 ip addr add 192.168.1.100/24 dev tap1

[root@public ~]# ip netns exec ns2 ip addr add 192.168.2.100/24 dev tap2

[root@public ~]#

[root@public ~]# ip link set tap1_peer up

[root@public ~]# ip link set tap2_peer up

[root@public ~]# ip netns exec ns1 ip link set tap1 up

[root@public ~]# ip netns exec ns2 ip link set tap2 up

[root@public ~]#

[root@public ~]# ip netns exec ns1 ping 192.168.2.100

connect: Network is unreachable

[root@public ~]#

配置好ip后，发现直接通信，无法成功，检查路由信息后，发现没有去另一网段的路由，配置路由再进行测试。

[root@public ~]# ip netns exec ns1 route -nee

Kernel IP routing table

Destination Gateway Genmask Flags Metric Ref Use Iface MSS Window irtt

192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 tap1 0 0 0

[root@public ~]#

[root@public ~]# ip netns exec ns1 route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.1.1

[root@public ~]# ip netns exec ns2 route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.2.1

[root@public ~]#

[root@public ~]# ip netns exec ns1 route -nee

Kernel IP routing table

Destination Gateway Genmask Flags Metric Ref Use Iface MSS Window irtt

192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 tap1 0 0 0

192.168.2.0 192.168.1.1 255.255.255.0 UG 0 0 0 tap1 0 0 0

[root@public ~]#

[root@public ~]# ip a s

1: lo: mtu 65536 qdisc noqueue state UNKNOWN qlen 1

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

valid_lft forever preferred_lft forever

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether fa:16:3e:08:0b:39 brd ff:ff:ff:ff:ff:ff

inet 192.168.10.93/24 brd 192.168.10.255 scope global noprefixroute dynamic eth0

valid_lft 70616sec preferred_lft 70616sec

inet6 fe80::f816:3eff:fe08:b39/64 scope link

valid_lft forever preferred_lft forever

3: tap1_peer@if4: mtu 1500 qdisc noqueue state UP qlen 1000

link/ether ca:6c:92:02:af:32 brd ff:ff:ff:ff:ff:ff link-netnsid 0

inet 192.168.1.1/24 scope global tap1_peer

valid_lft forever preferred_lft forever

inet6 fe80::c86c:92ff:fe02:af32/64 scope link

valid_lft forever preferred_lft forever

5: tap2_peer@if6: mtu 1500 qdisc noqueue state UP qlen 1000

link/ether 42:c6:2a:f3:7e:37 brd ff:ff:ff:ff:ff:ff link-netnsid 1

inet 192.168.2.1/24 scope global tap2_peer

valid_lft forever preferred_lft forever

inet6 fe80::40c6:2aff:fef3:7e37/64 scope link

valid_lft forever preferred_lft forever

[root@public ~]#

[root@public ~]#

[root@public ~]#

[root@public ~]# ip netns exec ns1 ping 192.168.2.100

PING 192.168.2.100 (192.168.2.100) 56(84) bytes of data.

64 bytes from 192.168.2.100: icmp_seq=1 ttl=63 time=0.020 ms

64 bytes from 192.168.2.100: icmp_seq=2 ttl=63 time=0.025 ms

64 bytes from 192.168.2.100: icmp_seq=3 ttl=63 time=0.030 ms

^C

--- 192.168.2.100 ping statistics ---

3 packets transmitted, 3 received, 0% packet loss, time 1999ms

rtt min/avg/max/mdev = 0.020/0.025/0.030/0.004 ms

[root@public ~]#

[root@public ~]# ip netns exec ns2 ping 192.168.1.100

PING 192.168.1.100 (192.168.1.100) 56(84) bytes of data.

64 bytes from 192.168.1.100: icmp_seq=1 ttl=63 time=0.020 ms

64 bytes from 192.168.1.100: icmp_seq=2 ttl=63 time=0.036 ms

64 bytes from 192.168.1.100: icmp_seq=3 ttl=63 time=0.034 ms

^C

--- 192.168.1.100 ping statistics ---

3 packets transmitted, 3 received, 0% packet loss, time 1999ms

rtt min/avg/max/mdev = 0.020/0.030/0.036/0.007 ms

[root@public ~]#

tun

tun是一个网络层的点对点的设备，它启用了ip层隧道功能。Linux原生支持的三层隧道，可以通过命令行ip tunnel help查看：

[root@public ~]# lsmod | grep ip

ip_tables 27115 0

[root@public ~]# modprobe ipip

[root@public ~]# lsmod | grep ipip

ipip 13465 0

tunnel4 13252 1 ipip

ip_tunnel 25163 1 ipip

[root@public ~]#

[root@public ~]# ip tunnel

tunl0: ip/ip remote any local any ttl inherit nopmtudisc

[root@public ~]# ip tunnel help

Usage: ip tunnel { add | change | del | show | prl | 6rd } [ NAME ]

[ mode { ipip | gre | sit | isatap | vti } ] [ remote ADDR ] [ local ADDR ]

[ [i|o]seq ] [ [i|o]key KEY ] [ [i|o]csum ]

[ prl-default ADDR ] [ prl-nodefault ADDR ] [ prl-delete ADDR ]

[ 6rd-prefix ADDR ] [ 6rd-relay_prefix ADDR ] [ 6rd-reset ]

[ ttl TTL ] [ tos TOS ] [ [no]pmtudisc ] [ dev PHYS_DEV ]

Where: NAME := STRING

ADDR := { IP_ADDRESS | any }

TOS := { STRING | 00..ff | inherit | inherit/STRING | inherit/00..ff }

TTL := { 1..255 | inherit }

KEY := { DOTTED_QUAD | NUMBER }

[root@public ~]#

Linux一共原生支持5种三层隧道(tunnel)，ipip、gre、sit、isatap、vti。

使用一个测试用例来讲述tun，拓扑图如下：

加载ipip模块模块，创建对应的设备进行验证：

# 在ns1上创建 tun1 和 ipip tunnel

[root@public ~]# ip netns exec ns1 ip tunnel add tun1 mode ipip remote 192.168.2.100 local 192.168.1.100 ttl 255

[root@public ~]# ip netns exec ns1 ip link set tun1 up

[root@public ~]# ip netns exec ns1 ip addr add 192.168.90.70 peer 192.168.70.70 dev tun1

[root@public ~]#

# 在ns2 上创建 tun2 和 ipip tunnel

[root@public ~]# ip netns exec ns2 ip tunnel add tun2 mode ipip remote 192.168.1.100 local 192.168.2.100 ttl 255

[root@public ~]# ip netns exec ns2 ip link set tun2 up

[root@public ~]# ip netns exec ns2 ip addr add 192.168.70.70 peer 192.168.90.70 dev tun2

[root@public ~]#

[root@public ~]# ip netns exec ns1 ping 192.168.70.70

PING 192.168.70.70 (192.168.70.70) 56(84) bytes of data.

64 bytes from 192.168.70.70: icmp_seq=1 ttl=64 time=0.051 ms

64 bytes from 192.168.70.70: icmp_seq=2 ttl=64 time=0.069 ms

64 bytes from 192.168.70.70: icmp_seq=3 ttl=64 time=0.048 ms

64 bytes from 192.168.70.70: icmp_seq=4 ttl=64 time=0.046 ms

^C

--- 192.168.70.70 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 2999ms

rtt min/avg/max/mdev = 0.046/0.053/0.069/0.011 ms

[root@public ~]# ip netns exec ns2 ping 192.168.90.70

PING 192.168.90.70 (192.168.90.70) 56(84) bytes of data.

64 bytes from 192.168.90.70: icmp_seq=1 ttl=64 time=0.033 ms

64 bytes from 192.168.90.70: icmp_seq=2 ttl=64 time=0.051 ms

64 bytes from 192.168.90.70: icmp_seq=3 ttl=64 time=0.045 ms

64 bytes from 192.168.90.70: icmp_seq=4 ttl=64 time=0.100 ms

^C

--- 192.168.90.70 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 2999ms

rtt min/avg/max/mdev = 0.033/0.057/0.100/0.026 ms

[root@public ~]#

ip tunnel add命令详解：

ip tunnel add tun1 mode ipip：创建一个tun类型的设备tun1，并隧道模式是ipip

remote 192.168.1.100 local 192.168.2.100：这个隧道的外层ip地址是：远端192.168.1.100，本地192.168.2.100。

如果将命令中的ipip换成gre，其余不变，就创建了一个gre隧道的tun设备。

标签：

来源： https://blog.csdn.net/LL845876425/article/details/82729161