一、linux网卡桥接问题
在linux上创建桥接网卡，与真实的物理网卡进行绑定，相当于在linux中创建了一个虚拟的交换机，以linux网卡地址为源地址的数据，从桥接网卡br0进入，从实际的物理网卡eth0发出；
创建桥接网卡br0，需要在网卡的配置文件目录下创建br0的配置文件，并与实际的物理网卡eth0进行绑定，配置如下:
[root@linux-node1 network-scripts]# cat ifcfg-br0
DEVICE=br0
TYPE=Bridge
ONBOOT=yes
BOOTPROTO=static
IPADDR=192.168.74.20
NETMASK=255.255.255.0
[root@linux-node1 network-scripts]# cat ifcfg-eth0
TYPE=Ethernet
BOOTPROTO=none #必须为none
NAME=eth0
DEVICE=eth0
ONBOOT=yes
BRIDGE=br0
重启机器之后，就可以看到两者绑定了，并且地址存在于网卡br0上，如下:
[root@linux-node1 ~]# brctl show
bridge name bridge id STP enabled interfaces
br0 8000.000c29896a8f no eth0
veth0pl8880
docker0 8000.02426fb6b621 no
virbr0 8000.000000000000 yes
[root@linux-node1 ~]# ifconfig
br0: flags=4163 mtu 1500
inet 192.168.74.20 netmask 255.255.255.0 broadcast 192.168.74.255
inet6 fe80::f816:37ff:fe69:8763 prefixlen 64 scopeid 0x20
ether 00:0c:29:89:6a:8f txqueuelen 0 (Ethernet)
RX packets 26941 bytes 14148328 (13.4 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 23408 bytes 2718697 (2.5 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eth0: flags=4163 mtu 1500
ether 00:0c:29:89:6a:8f txqueuelen 1000 (Ethernet)
RX packets 77954 bytes 97712837 (93.1 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 23714 bytes 3017447 (2.8 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
但是，这样配置之后，还存在一个问题，对于同一个网段内的地址(192.168.74.0/24)，通信是没有问题的，不跨网段，不涉及路由，不需要都网关就可以到达，但是如果是其他网段的地址，就无法通信了,给所有的网卡加上网关。给所有的网卡配置上网关，而不需要在每一个网卡上面进行配置，需要如下配置:
[root@linux-node1 ~]# cat /etc/sysconfig/network
# Created by anaconda
NETWORKING=yes
HOSTNAME=linux-node1
GATEWAY=192.168.74.2
这样，重启机器，就可以全部生效了
[root@linux-node1 ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.74.2 0.0.0.0 UG 425 0 0 br0
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
192.168.74.0 0.0.0.0 255.255.255.0 U 425 0 0 br0
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0
二、docker网卡使用桥接，网关地址设置为宿主机地址后，数据转发问题
首先创建一个docker，并分配指定的地址和网关
docker create -it -h myhost --cap-add SYS_PTRACE --net=none --name myhost_192.168.74.30 --cpu-quota 1200000 --cpu-period=10000 841c208badec "/sbin/init"
docker start myhost_192.168.74.30
pipework br0 -i eth0 myhost_192.168.74.30 192.168.74.30/[email protected]
查看docker状态如下:
[root@linux-node1 ~]# docker exec -it myhost_192.168.74.30 bash
[root@myhost /]# ifconfig
eth0: flags=4163 mtu 1500
inet 192.168.74.30 netmask 255.255.255.0 broadcast 192.168.74.255
inet6 fe80::88cf:29ff:fe44:5ec8 prefixlen 64 scopeid 0x20
ether 8a:cf:29:44:5e:c8 txqueuelen 1000 (Ethernet)
RX packets 744 bytes 141673 (138.3 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 9 bytes 690 (690.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73 mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10
loop txqueuelen 0 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
[root@myhost /]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.74.20 0.0.0.0 UG 0 0 0 eth0
192.168.74.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
但是此时，在容器ping外网地址，不通:
[root@linux-node1 ~]# sysctl -a|grep forwarding|grep br0.for
net.ipv4.conf.br0.forwarding = 0
net.ipv4.conf.virbr0.forwarding = 1
net.ipv6.conf.br0.forwarding = 0
net.ipv6.conf.virbr0.forwarding = 0
可以看到br0转发默认是关闭的，打开br0的转发就可以了:
[root@linux-node1 ~]# sysctl -w net.ipv4.conf.br0.forwarding=1
net.ipv4.conf.br0.forwarding = 1
[root@linux-node1 ~]#
三、多块网卡使用同一个网关时，数据转发问题
我们添加另外一块网卡eth0：
[root@linux-node1 ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth1
TYPE=Ethernet
BOOTPROTO=static
NAME=eth1
UUID=8f53b0c4-abe1-49ac-964a-7add4b5809d4
DEVICE=eth1
ONBOOT=yes
IPADDR=10.0.0.4
路由表如下:
[root@linux-node1 ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.74.2 0.0.0.0 UG 100 0 0 eth1
0.0.0.0 192.168.74.2 0.0.0.0 UG 425 0 0 br0
10.0.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth1
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
192.168.74.0 0.0.0.0 255.255.255.0 U 425 0 0 br0
192.168.74.2 0.0.0.0 255.255.255.255 UH 100 0 0 eth1
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0
但是，如果以eth1为源地址，ping外网地址，可以通，以br0位源地址，ping外网地址，不通，也就是说，只有一块网卡可以与外网通信，如何解决：
[root@linux-node1 ~]# sysctl -a|grep rp_filter
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.br0.arp_filter = 0
net.ipv4.conf.br0.rp_filter = 1
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.docker0.arp_filter = 0
net.ipv4.conf.docker0.rp_filter = 1
net.ipv4.conf.eth0.arp_filter = 0
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.eth1.arp_filter = 0
net.ipv4.conf.eth1.rp_filter = 1
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.veth0pl4654.arp_filter = 0
net.ipv4.conf.veth0pl4654.rp_filter = 1
net.ipv4.conf.virbr0.arp_filter = 0
net.ipv4.conf.virbr0.rp_filter = 1
net.ipv4.conf.virbr0-nic.arp_filter = 0
net.ipv4.conf.virbr0-nic.rp_filter = 1
可以看到rp_filter参数为1，如果设置为0，就可以了
sysctl -w net.ipv4.conf.br0.rp_filter=0如果想要使得配置永久生效，可以将其写入/etc/sysctl.conf中就可以了;
三、测试网卡是否有误网线连接
[root@BASE-SERVER-1-10-10 network-scripts]# mii-tool em2
em2: negotiated 1000baseT-FD flow-control, link ok
[root@BASE-SERVER-1-10-10 network-scripts]# mii-tool em1
em1: negotiated 1000baseT-FD flow-control, link ok
[root@BASE-SERVER-1-10-10 network-scripts]# mii-tool br2