网络虚拟化技术(一): Linux网络虚拟化
2014-11-22 00:31
453 查看
转载:https://blog.kghost.info/2013/03/01/linux-network-emulator/
笔者现在在做云计算的网络设计,涉及到上百台服务器与交换机,在实测前必须进行原型测试,但是我只有一个工作用开发机,本文介绍一种方法,使用这一台机器模拟数十台服务器以及路由器的网络环境。
Linux的网络虚拟化是LXC项目中的一个子项目,LXC包括文件系统虚拟化,进程空间虚拟化,用户虚拟化,网络虚拟化,等等 LXC内核命门空间 " class="footnote">[1],这里使用LXC的网络虚拟化来模拟多个网络环境。
可以创建一个完全隔离的新网络环境,这个环境包括一个独立的网卡空间,路由表,ARP表,ip地址表,iptables,ebtables,等等。总之,与网络有关的组件都是独立的。
ip命令需要root权限的,但是由于本文大量使用ip命令,于是笔者给ip命令添加了capability,使普通用户也能使用ip命令
使用命令
可以看到我们刚才创建的网络环境
我们可以在 net0 虚拟环境中运行任何命令
这样我们可以在新的网络环境中打开一个shell,可以看到,新的网络环境里面只有一个lo设备,并且这个lo设备与外面的lo设备是不同的,之间不能互相通讯。
先创建另一个网络环境net1,我们的目标是把net0与net1连起来
这里创建连一对veth虚拟网卡,类似pipe,发给veth0的数据包veth1那边会收到,发给veth1的数据包veth0会收到。就相当于给机器安装了两个网卡,并且之间用网线连接起来了
这两条命令的意思就是把veth0移动到net0环境里面,把veth1移动到net1环境里面,我们看看结果
veth0 veth1已经在我们的环境里面消失了,并且分别出现在net0与net1里面。下面我们简单测试一下net0与net1的联通性
分别配置好两个设备,然后用ping测试一下联通性:
![](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA***4AAAC2CAIAAAAeKXIWAAAOGElEQVR42u2dX0xT5xuA+VOrM6VZZISm8QLmcISYuFiaRV1UEky8AOOWXZnptRczcxcmXkAgIXGJmRdeGJJ5UUUXZnSSLTgcWzQCQwKmphXMqJVQOogUbLColAH6e+X87DpqSwuOfrbPc9XvnPN9PXnf93t6vtPCyXgBABBBBiEAANQAAAmq4TkApD2oAQBQAwCgBgBADQCAGgAANQAAagAA1AAAqAEAUAMAoAYAQA0AgBoAADWgBgBADQCAGgAANQAAagAA1AAAqAEAUAMAoAYAQA0AgBoAADUAQPKZm5tDDQD/0NvbW1NTU1JSkjFP5AEul2vv3r0GgyEnJ0deuN3u2AMmdPyi776E8Q8ePFhUVCQv7Hb74cOH5bVer8/Pzy8rK2tubo4ccGZmZvfu3UePHo3/HFADpD4yLWVy3r1797UTY2xszGw2W61W7zwWi2X9+vWPHj2KNlqix8d+9yWMPzs7m5eXd+TIEXkth50+fbq/vz8YDIpQZP7LW9TX1y8YU6RQXl4ugkANAK/htROjurpaNv70009a88qVK9KUyRxtkESPj/3uSxj/1q1bsqW1tTWyr8fjkV0FBQXhG3/44YfCwkIxTvzngBoANTzfsmWLbJTP5/DZVVpaGm2QRI9PVA2Lji/ukLWGXCZE9vX5fHKwLC5CWxwOh1xiyLojoXNADYAanst6XjaGZtqzZ8+kaTQaow2S6PGJqmHR8cUdn3766Wv7ancTNm3apDVlGbJhw4YLFy4keg6o***DD86ysLNkYunsvK3lpZmdnRxsk0eMTnZaxxx8eHs7MzDxz5kxkx5MnT2pv0djYqG3Zs2fP119/vYRzQA0rTXFxcQa8QqKhzlXD1NRUQlcN8R+/tKuGaOOLFEQNIogFvU6cOCGHya5Tp06FNpaVlc3MzKCGt+NT6wWEKikjIxAIPHnyRKbB9PS0fDwm8V7D0NCQ1hwcHIznXkP8xy/tXkO08WUpIQcs6HL8+HE5Ri43FlxNxFYzakAN6qrB6/WOjo76/X4RhNghKWqoqqoK/0bgxx9/DP9GILJLosfHfveExg8GgwaDobq6Ovz4uro6zQs2m+1N6Qk1oIYkq6Gvr+/BgwdyeSx2kCvnpKjB5/OZTCar1frXPBaLxWw2j4+PR+uS6PGJqiHG+K2trXLwrVu3QgfX1tZqdyIaGhqWHAHUgBqUU0NnZ6fD4RA7PHz4cHJy8r+WQrTL6f7+/oqKCsM8lZWVLpcr9lxK9PgY757Q+EeOHMnLywtfeSW6WEANqOHtUENLS4vYobe3V5bWExMTVEhsioqKDh48qNpZoQbU8ObVcPHiRblI7unpcbvdMX5rDCqDGlDDm1dDY2PjtWvXuru779+/jxpQA2pY+lxKdITYXZYwIGoA1IAaUAOghhRVwwoPiBpQA2pImhrOnTtXUlKi1+s3bNhw/vz5BXuDweBXX32Vl5eXlZUVOfkbGhqk16pVq2QEGWfB3gsXLsTY297eXl5enpOTYzQat23bdvXqVdQAqEEhNWzdunVwcHBoaGj79u3SvH79evjeb7/99s6dO7Ozs5HXBb/99pu8ll6eebTuob0yTmhw4eOPPw7fe+PGDZ1Ot2PHDrfb7ff7Dxw4oEkKNQBqUEUNf/zxh9aUF9IsKysL33v79u1oS4Zdu3ZpvzIK7x7aK+PI646ODq3Z1tYWvlekIK+dTqfWHB0dlebGjRtRA6AGVdQwOTmpNQOBgDRzc3PD9/7999/R1LBu3brI7nHuXbt2beRP7rKzs1EDoAZF1SBTOsY9xTerBp/Px21IQA1v5YIihhp27ty56IKiq6vrtQsKbTFy6dIl1ACoQVE1aPcRQ7chf//99zjV8Ouvvy56G1L0ISNH3obs6OjQ6/WFhYXijunpael+9uxZGQE1AGpQRQ0yJzdv3vzOO+/IRA3/jmBRNQg2m+3999+XvjKCjPPaLy+1vd99992Cuwk9PT379u3Lzc3V6XRms3n//v03b95EDYAakq+GlUR7bsKHH37IT54ANaS7Gj777LPbt28Hg8E///xTu7mwzF8uoAbUAKmghsuXL1ssllWrVhmNRlFDU1MTP5QG1IAa+BsKQA2oATUAakANqAFQA2pADYAaUANqANSAGlADoIbUxGQy8ajLEEajETWgBvg/ExMTHo/H6XS2t7c3Nzd/Hzcyl75Xj2WelURA4iDRkJjwHArUkNYEAoGRkRGXy2W329va2n6JG5mEv6jHMs9KIiBxkGhITCQylAdqSF+ePn06Pj7u9XplPjgcjq640f5iWjWWeVYSAYmDRENiIpGhPFBD+hIMBuXjUWaCfE4ODg72x41Mwn71WOZZSQQkDhINiYlEhvJADenLzMyMzAH5hHz8+LHf7x+LG5mEY+qxzLOSCEgcJBoSE4kM5YEa0p25V8zGjUzCWfVY5lmF4kBJoAZYIm/82ecpfFaAGlADZwWoATVwVoAaADUAagDUAKgBUAOgBkANgBoANQBqQA1MQtQAqIFJiBoANaAG1ACoATWgBkANqAE1AGpADagBUENKEwgEDAYDagDUAP9iYGCgoKAANQBqgH9ht9s3bdqk4InJtYzf7ydBqAE1JAebzfb5558reGKlpaXXr18nQagBNSSHioqKM2fOKHhiVVVVX375JQlCDaghCcjH8nvvvafmdbvL5Xr33XedTidpQg2oYeUIBAL19fUy95qampQ9STlDk8nU2Nj47NkzUoYa0l0N8jn5xRdffPDBBzJv/7unQq5Zs2bPnj2dnZ2KR6OlpeWTTz7R6XT/XSgkzsXFxYcOHRoYGGA2ogZFkc9wqdRvvvnm3r173J9fGSTOouNjx45J5Nva2ggIalCOkZERWflzWz5ZyMqloKCAxQtqUI66ujpZSlAQSUQWL+fPnycOqEG5upSlNQWRROrr67EzalAOWev6fD4KIol0d3d/9NFHxAE1q***/NZB0lP2LEtSAGiCZ+P1+uXYjDqjhbVVDb29vTU1NSUmJ9s08NZSULNjt9sOHDxcVFen1+vz8/LKysubmZgKIGpJZlCIFUcPdu3dRQxKzYLVaT58+3d/fHwwGXS7X7t27pW99fT0xRA3JX1CgBnWWdR6PR/pyqwI1oAay8C98Pp/0lcUFMUQNqIEs/MPRo0elr5r/Fwc1oAZIjhpOnjyp5aKxsZEYogbUQBZecuLECemVmZl56tQpAogaUANZeMnx48elS1ZWlpr/LAs1pHJRxpj/qCG5Wairq9O8YLPZCB1qQA1k4SW1tbWyJTs7u6GhgbihBlXUEPnfiqikFc5CtH8bRQxRQ/LvNQBZQA0UJZAF1EBRAllADaiBoiQLgBooSrIAqIGiJAuAGihKsgCogaIkC4AaKEqyAOmghuLi4gx4hURDwbIgR+rnKAXVILF+AaG4Z2QEAoEnT55MTU1NT0/Pzs4q8ulNahTPEWpI/bLzer2jo6N+v1+KTyoPNZAj1AAvy66vr+/BgwfDw8NSeYo8D5YcqZ8j1JD6ZdfZ2elwOKTyHj58ODk5iRrIEWqAl2XX0tIildfb2zs0NDQxMYEayBFqgJdld/HixdbW1p6eHrfb/ejRI9RAjlADvND+D/K1a9e6u7vv37+PGsgRalAr95FnJUWwd+9eg8GQk5MjL2SdiRqUylFfX19tbW3o4aOoATWsRNmNj4+bzWar1frXPBaLZf369X6/HzWokyPt4aOy/kcNqGHlyq66ulq2/Pzzz1qzqalJmvIZhRqUurJbdBdqSHc1aMVx+fLlrVu3rlmzZt26dZWVlQMDA6ED2tvby8vLZWlgNBq3bdt29erVBX1DaBu3bNkir+V6QWsODQ1Js7S0FDWokyPUgBriLbvNmzffuXMnEAhoTyjYuXOntvfGjRs6nW7Hjh1ut1sWBQcOHJC9586di1FbUqCyZXp6WmtOTU1JU0oWNaiTI9SAGuItu66uLq05OTkpzdWrV2tNKThpOp1OrTk6OirNjRs3xqitrKws7a8Atebc3Jz21APUoE6OUANqiLfsQh/yz189p0Brrl27NvLP6cLnebSrhmAwyFWDsjlCDahhKfeoIsvO5/PF31271+D1erWmx+PhXoNqOUINqGG5Zbdr1y55fenSpWjdMzMzF3SvqqoK/4biypUr0qypqUEN6uQINaCG5ZZdR0eHXq8vLCyUha5c0MolwNmzZ7dv3x462Gw2y8H37t0LbRkbGzOZTFardXgei8Uix0hNoAZ1coQaUMNyy07o6enZt29fbm6uTqeTItu/f//NmzdDe202W35+/oIuLperoqLCME9lZaXURPqU3duSo8jbE6gBNaQI/OSJHKEGyg41kCPUQNmhBnKEGig71ECOUANlhxrIEWqg7FADOUINqIGyI0eoATVQduQINaAGyo4coQbF1WAymXiMYgij0ahg2ZEj9XOUgmoQJiYmPB6P0+lsb29vbm7+Pr2RCEgcJBoSE3WecUCO1M9RCqohEAiMjIy4XC673d7W1vZLeiMRkDhINCQmEhlFKoMcqZ+jFFTD06dPx8fHvV6vxNrhcHSlNxIBiYNEQ2IikVGkMsiR+jlKQTUEg0FRr0RZHDw4ONif3kgEJA4SDYmJREaRyiBH6ucoBdUwMzMj8RX7Pn782O/3j6U3EgGJg0RDYiKRUaQyyJH6OUpBNWjMvWI2vQnFQcH6IEfq5ygF1QAAqAEAUAMAoAYAQA0AgBoAADWgBgBADQCAGgAANQAAagAA1AAAqAEAUAMAoAYAQA0AgBoAADUAAGoAANQAAKgBNQAAagAA1AAAqAEAUAMArLQaAABQAwCgBgBIkP8B9sj66+D5RSsAAAAASUVORK5CYII=)
创建虚拟网络环境并且连接网线
在bridge中创建并且设置br设备
然后配置两个虚拟环境的网卡
测试
github 上有一个 lldp 在 linux 下的开源实现 implementation of IEEE 802.1ab (LLDP) " class="footnote">[3],通过在每个环境中起一个 lldp daemon,我们就可以实时查看每个网卡的连接情况
Bridge 上 lldp 的数据
笔者现在在做云计算的网络设计,涉及到上百台服务器与交换机,在实测前必须进行原型测试,但是我只有一个工作用开发机,本文介绍一种方法,使用这一台机器模拟数十台服务器以及路由器的网络环境。
Linux的网络虚拟化是LXC项目中的一个子项目,LXC包括文件系统虚拟化,进程空间虚拟化,用户虚拟化,网络虚拟化,等等 LXC内核命门空间 " class="footnote">[1],这里使用LXC的网络虚拟化来模拟多个网络环境。
创建虚拟网络环境
使用命令$ ip netns add net0 |
ip命令需要root权限的,但是由于本文大量使用ip命令,于是笔者给ip命令添加了capability,使普通用户也能使用ip命令
使用命令
$ ip netns list net0 |
进入虚拟网络环境
使用命令$ ip netns exec net0 `command` |
$ ip netns exec net0 bash $ ip ad 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 |
连接两个网络环境
新的网络环境里面没有任何网络设备,并且也无法和外部通讯,就是一个孤岛,通过下面介绍的这个方法可以把两个网络环境连起来,简单的说,就是在两个网络环境之间拉一根网线$ ip netns add net1 |
$ ip link add type veth $ ip ad 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 81: veth0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000 link/ether 12:39:09:81:3a:dd brd ff:ff:ff:ff:ff:ff 82: veth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000 link/ether 32:4f:fd:cc:79:1b brd ff:ff:ff:ff:ff:ff |
$ ip link set veth0 netns net0 $ ip link set veth1 netns net1 |
$ ip ad 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 $ ip netns exec net0 ip ad 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 81: veth0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000 link/ether 12:39:09:81:3a:dd brd ff:ff:ff:ff:ff:ff $ ip netns exec net1 ip ad 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 82: veth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000 link/ether 32:4f:fd:cc:79:1b brd ff:ff:ff:ff:ff:ff |
$ ip netns exec net0 ip link set veth0 up $ ip netns exec net0 ip address add 10.0.1.1/24 dev veth0 $ ip netns exec net1 ip link set veth1 up $ ip netns exec net1 ip address add 10.0.1.2/24 dev veth1 |
$ ip netns exec net0 ping -c 3 10.0.1.2 PING 10.0.1.2 (10.0.1.2) 56(84) bytes of data. 64 bytes from 10.0.1.2: icmp_req=1 ttl=64 time=0.101 ms 64 bytes from 10.0.1.2: icmp_req=2 ttl=64 time=0.057 ms 64 bytes from 10.0.1.2: icmp_req=3 ttl=64 time=0.048 ms --- 10.0.1.2 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 1999ms rtt min/avg/max/mdev = 0.048/0.068/0.101/0.025 ms |
一个稍微复杂的网络环境
创建虚拟网络环境并且连接网线
ip netns add net0 ip netns add net1 ip netns add bridge ip link add type veth ip link set dev veth0 name net0-bridge netns net0 ip link set dev veth1 name bridge-net0 netns bridge ip link add type veth ip link set dev veth0 name net1-bridge netns net1 ip link set dev veth1 name bridge-net1 netns bridge |
ip netns exec bridge brctl addbr br ip netns exec bridge ip link set dev br up ip netns exec bridge ip link set dev bridge-net0 up ip netns exec bridge ip link set dev bridge-net1 up ip netns exec bridge brctl addif br bridge-net0 ip netns exec bridge brctl addif br bridge-net1 |
ip netns exec net0 ip link set dev net0-bridge up ip netns exec net0 ip address add 10.0.1.1/24 dev net0-bridge |
ip netns exec net1 ip link set dev net1-bridge up ip netns exec net1 ip address add 10.0.1.2/24 dev net1-bridge |
$ ip netns exec net0 ping -c 3 10.0.1.2 PING 10.0.1.2 (10.0.1.2) 56(84) bytes of data. 64 bytes from 10.0.1.2: icmp_req=1 ttl=64 time=0.121 ms 64 bytes from 10.0.1.2: icmp_req=2 ttl=64 time=0.072 ms 64 bytes from 10.0.1.2: icmp_req=3 ttl=64 time=0.069 ms --- 10.0.1.2 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 1999ms rtt min/avg/max/mdev = 0.069/0.087/0.121/0.025 ms |
配置lldpd检查线路链接情况
随着虚拟网络环境增加,环境中网卡数量也在不断增加,经常会忘记环境中哪些网卡连接到哪里,通过 lldp Link Layer Discovery Protocol " class="footnote">[2] 协议,我们可以清楚看到每个网卡连接到了哪些环境中的哪个网卡。github 上有一个 lldp 在 linux 下的开源实现 implementation of IEEE 802.1ab (LLDP) " class="footnote">[3],通过在每个环境中起一个 lldp daemon,我们就可以实时查看每个网卡的连接情况
Bridge 上 lldp 的数据
[code]$ lldpcli show neighbors LLDP neighbors: Interface: bridge-net0, via: LLDP, RID: 2, Time: 0 day, 00:06:53 Chassis: ChassisID: mac 82:be:2a:ec:70:69 SysName: localhost SysDescr: net0 Capability: Bridge, off Capability: Router, off Capability: Wlan, off Port: PortID: mac 82:be:2a:ec:70:69 PortDescr: net0-bridge Interface: bridge-net1, via: LLDP, RID: 1, Time: 0 day, 00:06:53 Chassis: ChassisID: mac b2:34:28:b1:be:49 SysName: localhost SysDescr: net1 Capability: Bridge, off Capability: Router, off Capability: Wlan, off Port: PortID: mac b2:34:28:b1:be:49 PortDescr: net1-bridge
相关文章推荐
- 网络虚拟化技术(一): Linux网络虚拟化
- 网络虚拟化技术(一): Linux网络虚拟化
- 网络虚拟化技术(一): Linux网络虚拟化
- [转发]网络虚拟化技术(一): Linux网络虚拟化
- 网络虚拟化技术(一): Linux网络虚拟化
- 网络虚拟化技术(一): Linux网络虚拟化
- 网络虚拟化技术(一): Linux网络虚拟化
- Docker核心实现技术(命名空间&控制组&联合文件系统&Linux网络虚拟化支持)
- Docker核心实现技术 (命名空间 & 控制组 & 联合文件系统 & Linux网络虚拟化支持)
- 基于Linux集群技术的校园网络中心方案
- Linux网络的多播IP技术
- Linux 无线网络技术: WLAN
- Linux 虚拟化和 PCI 透传技术 - 设备模拟和硬件 I/O 虚拟化
- Linux上的虚拟化技术
- Linux 虚拟化和 PCI 透传技术
- Linux网络的多播IP技术
- Linux下的管道编程技术-dup函数和dup2函数(网络资源)
- Linux上的虚拟化技术 Xen 初学者指南