网络虚拟化（二）namespace的内部通信

namspace点到点通信

本文两个实验介绍了namespace的基础用法，如何创建虚拟网卡对和网桥设备实现namespace间通信

实验示意

实验步骤

1、宿主机上创建两个namespace

# ip netns add ns0
# ip netns add ns1
# ip netns list
        ns1
        ns0

2、默认情况下，两个namespace内只有环回口

# ip netns exec ns0 ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
# ip netns exec ns1 ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

3、创建一对网口设备

# ip link add type veth
创建后在宿主机上通过ip addr 可以查看到一对虚拟设备
veth0@veth1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 4e:96:10:30:f2:9c brd ff:ff:ff:ff:ff:ff
veth1@veth0: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 16:b4:da:7e:b8:6b brd ff:ff:ff:ff:ff:ff

4、将虚拟设备加入各自namespace中

# ip link set veth0 netns ns0
# ip link set veth1 netns ns1
加入之后，宿主机上ip addr查看可发现虚拟设备已经没有了，对应已经进入各自namespace中
# ip netns exec ns0 ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
9: veth0@if10: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 4e:96:10:30:f2:9c brd ff:ff:ff:ff:ff:ff link-netnsid 1
# ip netns exec ns1 ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
10: veth1@if9: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 16:b4:da:7e:b8:6b brd ff:ff:ff:ff:ff:ff link-netnsid 0

5、添加ip地址

# ip netns exec ns0 ip address add 10.0.0.1/24 dev veth0
# ip netns exec ns0 ip link set veth0 up
# ip netns exec ns1 ip address add 10.0.0.2/24 dev veth1
# ip netns exec ns1 ip link set veth1 up

6、测试联通性

ip netns exec ns0 ping 10.0.0.2
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.065 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.039 ms
64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=0.040 ms
^C
--- 10.0.0.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.039/0.048/0.065/0.012 ms

网桥通信

网桥通信是将两个namespace的接口分别连接至虚拟桥上，类似于物理网络中两台机器连接至交换机上。

实验示意

实验步骤

1、创建ns0、ns1、bridge

# ip netns add ns0
# ip netns add ns1
# ip netns add bridge
# ip netns list
bridge
ns1
ns0

2、创建虚拟设备,用于连接ns0和bridge

# ip link add type veth

3、关联链路

将veth0命名为ns0-bridge并加入到ns0

# ip link set dev veth0 name ns0-bridge netns ns0

将veth1命名为bridge-ns0 并加入到bridge

# ip link set dev veth1 namebridge-ns0 netns ns0

查看ns0和bridge链路

# ip netns exec bridge ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
12: bridge-ns0@if11: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 4e:ad:08:bc:57:dc brd ff:ff:ff:ff:ff:ff link-netnsid 0
# ip netns exec ns0 ip add
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
11: ns0-bridge@if12: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 42:52:96:38:a0:32 brd ff:ff:ff:ff:ff:ff link-netnsid 1

4、再创建一对虚拟设备，用于连接ns1和bridge

# ip link add type veth
# ip link set dev veth0 name ns1-bridge netns ns1
# ip link set dev veth1 name bridge-ns1 netns bridge

5、给网桥创建虚拟桥

# ip netns exec bridge brctl addbr br
# ip netns exec bridge ip link set dev br up
# ip netns exec bridge ip link set dev bridge-ns0  up
# ip netns exec bridge ip link set dev bridge-ns1  up

网桥内部接口互联

# ip netns exec bridge brctl addif br bridge-ns0
# ip netns exec bridge brctl addif br bridge-ns1

6、ns1、ns2设置ip

# ip netns exec ns0 ip address add 10.0.0.1/24 dev ns0-bridge
# ip netns exec ns1 ip address add 10.0.0.2/24 dev ns1-bridge
# ip netns exec ns0 ip link set dev ns0-bridge up
# ip netns exec ns1 ip link set dev ns1-bridge up

7、测试

# ip netns exec ns0 ping 10.0.0.2
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.057 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.067 ms
64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=0.053 ms