VXLAN和LINUX BRIDGE實驗
一、配置主機A
1.1創建網橋br-vx100和br-vx200並啟用
[root@localhost ~]# brctl addbr br-vx100 [root@localhost ~]# ip link set br-vx100 up [root@localhost ~]# brctl addbr br-vx200 [root@localhost ~]# ip link set br-vx200 up
1.2添加並啟用虛擬網卡，類型為vxlan，名字為vxlan100，ID為100，端口為4789，關聯的實體網卡為enp0s3
[root@localhost ~]# ip link add vxlan100 type vxlan id 100 remote 192.168.1.227 local 192.168.1.226 dstport 4789 dev enp0s3 [root@localhost ~]# ip link set vxlan100 up [root@localhost ~]# ip link add vxlan200 type vxlan id 200 remote 192.168.1.227 local 192.168.1.226 dstport 4789 dev enp0s3 [root@localhost ~]# ip link set vxlan200 up
1.3將創建的虛擬網卡加入橋中
[root@localhost ~]# brctl addif br-vx100 vxlan100 [root@localhost ~]# brctl addif br-vx200 vxlan200
1.4創建虛擬網卡對veth100和veth101
[root@localhost ~]# ip link add veth100 type veth peer name veth101 [root@localhost ~]# ip link add veth200 type veth peer name veth201
1.5創建網絡命名空間
[root@localhost ~]# ip netns add ns100 [root@localhost ~]# ip netns add ns200
1.6將veth0加入命名空間ns1
[root@localhost ~]# ip link set veth100 netns ns100 [root@localhost ~]# ip link set veth200 netns ns200
1.7為ns1中虛擬網卡對veth100配置IP地址、設置MTU並啟用
[root@localhost ~]# ip netns exec ns100 ip addr add 10.10.10.1/24 dev veth100 [root@localhost ~]# ip netns exec ns100 ip link set veth100 mtu 1450 [root@localhost ~]# ip netns exec ns100 ip link set veth100 up [root@localhost ~]# ip netns exec ns200 ip addr add 20.20.20.1/24 dev veth200 [root@localhost ~]# ip netns exec ns200 ip link set veth200 mtu 1450 [root@localhost ~]# ip netns exec ns200 ip link set veth200 up
1.8為ns1中虛擬網卡對veth1設置MTU並啟用
[root@localhost ~]# ip link set veth101 mtu 1450 [root@localhost ~]# ip link set veth101 up [root@localhost ~]# ip link set veth201 mtu 1450 [root@localhost ~]# ip link set veth201 up
1.9將虛擬網卡對veth1加入網橋br-vx中
[root@localhost ~]# brctl addif br-vx100 veth101 [root@localhost ~]# brctl addif br-vx200 veth201
1.10查看驗證配置
[root@localhost ~]# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 08:00:27:b7:2f:9e brd ff:ff:ff:ff:ff:ff inet 192.168.1.226/24 brd 192.168.1.255 scope global enp0s3 valid_lft forever preferred_lft forever inet6 fe80::a00:27ff:feb7:2f9e/64 scope link valid_lft forever preferred_lft forever 3: br-vx100: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP link/ether 56:46:bc:d5:76:71 brd ff:ff:ff:ff:ff:ff inet6 fe80::5446:bcff:fed5:7671/64 scope link valid_lft forever preferred_lft forever 4: br-vx200: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP link/ether 12:95:b7:15:29:49 brd ff:ff:ff:ff:ff:ff inet6 fe80::48f4:c6ff:fe1c:f448/64 scope link valid_lft forever preferred_lft forever 5: vxlan100: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master br-vx100 state UNKNOWN link/ether 56:46:bc:d5:76:71 brd ff:ff:ff:ff:ff:ff inet6 fe80::5446:bcff:fed5:7671/64 scope link valid_lft forever preferred_lft forever 6: vxlan200: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master br-vx200 state UNKNOWN link/ether 4a:f4:c6:1c:f4:48 brd ff:ff:ff:ff:ff:ff inet6 fe80::48f4:c6ff:fe1c:f448/64 scope link valid_lft forever preferred_lft forever 7: veth101@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast master br-vx100 state UP qlen 1000 link/ether 62:5f:68:e2:0d:22 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet6 fe80::605f:68ff:fee2:d22/64 scope link valid_lft forever preferred_lft forever 9: veth201@if10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast master br-vx200 state UP qlen 1000 link/ether 12:95:b7:15:29:49 brd ff:ff:ff:ff:ff:ff link-netnsid 1 inet6 fe80::1095:b7ff:fe15:2949/64 scope link valid_lft forever preferred_lft forever [root@localhost ~]# ip netns exec ns100 ip a 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 8: veth100@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast state UP qlen 1000 link/ether 52:73:5f:bf:37:59 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 10.10.10.1/24 scope global veth100 valid_lft forever preferred_lft forever inet6 fe80::5073:5fff:febf:3759/64 scope link valid_lft forever preferred_lft forever [root@localhost ~]# ip netns exec ns200 ip a 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 10: veth200@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast state UP qlen 1000 link/ether 3e:63:45:02:cc:97 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 20.20.20.1/24 scope global veth200 valid_lft forever preferred_lft forever inet6 fe80::3c63:45ff:fe02:cc97/64 scope link valid_lft forever preferred_lft forever
二、配置主機B
[root@localhost ~]# brctl addbr br-vx100 [root@localhost ~]# ip link set br-vx100 up [root@localhost ~]# brctl addbr br-vx200 [root@localhost ~]# ip link set br-vx200 up [root@localhost ~]# ip link add vxlan100 type vxlan id 100 remote 192.168.1.226 local 192.168.1.227 dstport 4789 dev enp0s3 [root@localhost ~]# ip link set vxlan100 up [root@localhost ~]# ip link add vxlan200 type vxlan id 200 remote 192.168.1.226 local 192.168.1.227 dstport 4789 dev enp0s3 [root@localhost ~]# ip link set vxlan200 up [root@localhost ~]# brctl addif br-vx100 vxlan100 [root@localhost ~]# brctl addif br-vx200 vxlan200 [root@localhost ~]# ip link add veth100 type veth peer name veth101 [root@localhost ~]# ip link add veth200 type veth peer name veth201 [root@localhost ~]# ip netns add ns100 [root@localhost ~]# ip netns add ns200 [root@localhost ~]# ip link set veth100 netns ns100 [root@localhost ~]# ip link set veth200 netns ns200 [root@localhost ~]# ip netns exec ns100 ip addr add 10.10.10.2/24 dev veth100 [root@localhost ~]# ip netns exec ns100 ip link set veth100 mtu 1450 [root@localhost ~]# ip netns exec ns100 ip link set veth100 up [root@localhost ~]# ip netns exec ns200 ip addr add 20.20.20.2/24 dev veth200 [root@localhost ~]# ip netns exec ns200 ip link set veth200 mtu 1450 [root@localhost ~]# ip netns exec ns200 ip link set veth200 up [root@localhost ~]# ip link set veth101 mtu 1450 [root@localhost ~]# ip link set veth101 up [root@localhost ~]# ip link set veth201 mtu 1450 [root@localhost ~]# ip link set veth201 up [root@localhost ~]# brctl addif br-vx100 veth101 [root@localhost ~]# brctl addif br-vx200 veth201 [root@localhost ~]# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 08:00:27:e5:7a:ef brd ff:ff:ff:ff:ff:ff inet 192.168.1.227/24 brd 192.168.1.255 scope global enp0s3 valid_lft forever preferred_lft forever inet6 fe80::a00:27ff:fee5:7aef/64 scope link valid_lft forever preferred_lft forever 3: br-vx100: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP link/ether 66:3d:be:39:d4:f4 brd ff:ff:ff:ff:ff:ff inet6 fe80::643d:beff:fe39:d4f4/64 scope link valid_lft forever preferred_lft forever 4: br-vx200: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP link/ether aa:ca:26:af:62:c1 brd ff:ff:ff:ff:ff:ff inet6 fe80::c037:56ff:fe70:fe63/64 scope link valid_lft forever preferred_lft forever 5: vxlan100: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master br-vx100 state UNKNOWN link/ether 66:3d:be:39:d4:f4 brd ff:ff:ff:ff:ff:ff inet6 fe80::643d:beff:fe39:d4f4/64 scope link valid_lft forever preferred_lft forever 6: vxlan200: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master br-vx200 state UNKNOWN link/ether c2:37:56:70:fe:63 brd ff:ff:ff:ff:ff:ff inet6 fe80::c037:56ff:fe70:fe63/64 scope link valid_lft forever preferred_lft forever 7: veth101@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast master br-vx100 state UP qlen 1000 link/ether 92:40:d4:9d:bb:68 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet6 fe80::9040:d4ff:fe9d:bb68/64 scope link valid_lft forever preferred_lft forever 9: veth201@if10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast master br-vx200 state UP qlen 1000 link/ether aa:ca:26:af:62:c1 brd ff:ff:ff:ff:ff:ff link-netnsid 1 inet6 fe80::a8ca:26ff:feaf:62c1/64 scope link valid_lft forever preferred_lft forever [root@localhost ~]# ip netns exec ns100 ip a 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 8: veth100@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast state UP qlen 1000 link/ether 96:4a:fe:5a:7d:a2 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 10.10.10.2/24 scope global veth100 valid_lft forever preferred_lft forever inet6 fe80::944a:feff:fe5a:7da2/64 scope link valid_lft forever preferred_lft forever [root@localhost ~]# ip netns exec ns200 ip a 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 10: veth200@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast state UP qlen 1000 link/ether 06:6a:2a:d3:8c:c4 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 20.20.20.2/24 scope global veth200 valid_lft forever preferred_lft forever inet6 fe80::46a:2aff:fed3:8cc4/64 scope link valid_lft forever preferred_lft forever
三、驗證測試 ###############注意注意注意防火墻###############
[root@localhost ~]# ip netns exec ns100 ping 10.10.10.2 PING 10.10.10.2 (10.10.10.2) 56(84) bytes of data. 64 bytes from 10.10.10.2: icmp_seq=1 ttl=64 time=0.547 ms 64 bytes from 10.10.10.2: icmp_seq=2 ttl=64 time=0.551 ms ^C --- 10.10.10.2 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1004ms rtt min/avg/max/mdev = 0.547/0.549/0.551/0.002 ms [root@localhost ~]# ip netns exec ns100 ping 20.20.20.2 connect: Network is unreachable [root@localhost ~]# ip netns exec ns200 ping 10.10.10.2 connect: Network is unreachable [root@localhost ~]# ip netns exec ns200 ping 20.20.20.2 PING 20.20.20.2 (20.20.20.2) 56(84) bytes of data. 64 bytes from 20.20.20.2: icmp_seq=1 ttl=64 time=0.606 ms ^C --- 20.20.20.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.606/0.606/0.606/0.000 ms
四、防火墻
[root@localhost ~]# firewall-cmd --permanent --add-port=4789/udp success [root@localhost firewalld]# firewall-cmd --reload success [root@localhost zones]# ls public.xml public.xml.old [root@localhost zones]# vi public.xml <?xml version="1.0" encoding="utf-8"?> <zone> <short>Public</short> <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description> <service name="dhcpv6-client"/> <service name="ssh"/> <port protocol="udp" port="4789"/> </zone>
五、命令參考
查看網橋
[root@localhost ~]# brctl show
從橋中移除網卡
[root@localhost ~]# brctl delif br-vx veth1
刪除VETH設備
[root@localhost ~]# ip link del dev veth1
增加網絡命名空間
[root@localhost ~]# ip netns add ns1
查看所有網絡命名空間
[root@localhost ~]# ip netns list
將網卡加入命名空間
[root@localhost ~]# ip link set veth0 netns ns1
查看命名空間內網絡配置
[root@localhost ~]# ip netns exec ns1 ip a
為命名空間內網卡配置IP
[root@localhost ~]# ip netns exec ns1 ip addr add 10.10.10.2/24 dev veth0
啟動命名空間內網卡
[root@localhost ~]# ip netns exec ns1 ip link set veth0 up
刪除VXLAN
[root@localhost ~]# ip link del vxlan10
安裝netstat和telnet
[root@localhost ~]# yum install telnet [root@localhost ~]# yum install net-tools
停用防火墻
[root@localhost ~]# systemctl stop firewalld.service [root@localhost ~]# iptables -nvL