KVM网络配置（二）—— 桥接(bridge)模式

 

简介

在 QEMU/KVM 的网络使用中，桥接模式可以让虚拟机需物理机共享一个物理网络设备连接外部网络，虚拟机有自己独立的 IP 地址，可以访问外部网络，外部网络也可以访问虚拟机。

优缺点：使用桥接模式配置简单，但如果你的网络环境是ip资源很缺少或对ip管理比较严格的话，那桥接模式就不太适用了

 

桥接模式网络配置步骤

1. 安装 bridge-utils 软件包，它提供 brctl 工具来配置网桥

yum install bridge-utils

2. 加载 tun 和 bridge 模块

[root@localhost ~]# lsmod | grep tun
tun                    36164  2 vhost_net
[root@localhost ~]# 
[root@localhost ~]# lsmod | grep bridge
bridge                151336  1 ebtable_broute
stp                    12976  1 bridge
llc                    14552  2 stp,bridge
[root@localhost ~]# 

3. 创建 brdige

将物理机工作的网口绑定到 brdige 上，将网口 IP 清除，让 bridge 获取 IP

root@localhost:~# brctl addbr br0
root@localhost:~# brctl addif br0 enp3s0
root@localhost:~# brctl show br0 
bridge name	bridge id		STP enabled	interfaces
br0		8000.eef79549afe7	no		enp3s0
root@localhost:~# 
root@localhost:~# brctl stp br0 on
root@localhost:~# 
root@localhost:~# brctl show br0 
bridge name	bridge id		STP enabled	interfaces
br0		8000.eef79549afe7	yes		enp3s0
root@localhost:~# 
root@localhost:~# 
root@localhost:~# ifconfig enp3s0
enp3s0: flags=4163  mtu 1500
        inet 10.200.200.111  netmask 255.255.255.0  broadcast 10.200.200.255
        inet6 fe80::401c:b143:3935:a3e  prefixlen 64  scopeid 0x20
        ether ee:f7:95:49:af:e7  txqueuelen 1000  (Ethernet)
        RX packets 5597473  bytes 7095008949 (6.6 GiB)
        RX errors 0  dropped 15  overruns 0  frame 0
        TX packets 2065687  bytes 153950765 (146.8 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 41  

root@localhost:~# 
root@localhost:~# ifconfig br0
br0: flags=4163  mtu 1500
        ether ee:f7:95:49:af:e7  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

root@localhost:~# ifconfig enp3s0 0 up
root@localhost:~# ifconfig br0 up
root@localhost:~# dhclient br0
root@localhost:~# 
root@localhost:~# ifconfig br0
br0: flags=4163  mtu 1500
        inet 10.200.200.111  netmask 255.255.255.0  broadcast 10.200.200.255
        inet6 fe80::ecf7:95ff:fe49:afe7  prefixlen 64  scopeid 0x20
        ether ee:f7:95:49:af:e7  txqueuelen 1000  (Ethernet)
        RX packets 703  bytes 65605 (64.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 92  bytes 15483 (15.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

root@localhost:~# ifconfig enp3s0
enp3s0: flags=4163  mtu 1500
        inet6 fe80::401c:b143:3935:a3e  prefixlen 64  scopeid 0x20
        ether ee:f7:95:49:af:e7  txqueuelen 1000  (Ethernet)
        RX packets 5597473  bytes 7095008949 (6.6 GiB)
        RX errors 0  dropped 15  overruns 0  frame 0
        TX packets 2065687  bytes 153950765 (146.8 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 41  

root@localhost:~# 

此时， 作为网桥借口的附庸（slave），物理网口 enp3s0 借口没有自己的 IP 地址， 网桥寄生在它身上，网桥与物理网口 MAC 地址相同。

当有虚拟机启动时，QEMU 创建的 tap 设备绑定到 bridge 上，虚拟机就能和外部网络连通了。

创建网桥后的接口逻辑图如下：

 

4. 准备 qemu-ifup/qemu-ifdown 脚本

在虚拟机启动网络前执行的脚本由 script 参数配置（默认 /etc/qemu-ifup）。该脚本时将 QEMU 自动创建的 TAP 设备绑定到网桥上。

虚拟机关闭时，QEMU 会自动解除 TAP 设备的绑定，删除 TAP 设备。所以 qemu-ifdown 是不用配置的。

[root@localhost ~]# cat /etc/qemu-ifup
#!/bin/bash
switch=br0
ifconfig $1 up
brctl addif $switch $1

 

5. 启动虚拟机

[root@localhost ~]# 
[root@localhost ~]# /usr/libexec/qemu-kvm centos70-64.qcow2 -enable-kvm -smp 2 -m 2G -device virtio-net-pci,netdev=vnet0 -netdev tap,id=vnet0 -monitor telnet::3333,server,nowait -serial stdio
VNC server running on ::1:5900

CentOS Linux 7 (Core)
Kernel 3.10.0-1127.el7.x86_64 on an x86_64

localhost login: root
Password: 
Last login: Thu May 13 23:05:33 on ttyS0
[root@localhost ~]# 
[root@localhost ~]# ifconfig 
eth0: flags=4163  mtu 1500
        inet 10.200.200.122  netmask 255.255.255.0  broadcast 10.200.200.255
        inet6 fe80::e940:5ead:bd61:cde5  prefixlen 64  scopeid 0x20
        ether 52:54:00:12:34:56  txqueuelen 1000  (Ethernet)
        RX packets 62  bytes 5733 (5.5 KiB)
        RX errors 0  dropped 22  overruns 0  frame 0
        TX packets 48  bytes 4481 (4.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@localhost ~]# 
[root@localhost ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.200.200.254  0.0.0.0         UG    100    0        0 eth0
10.200.200.0    0.0.0.0         255.255.255.0   U     100    0        0 eth0
[root@localhost ~]# 
[root@localhost ~]# 

 

物理机上检查 bridge 状态

[root@localhost ~]# brctl show 
bridge name	bridge id		STP enabled	interfaces
br0		8000.eef79549afe7	yes		tap0
							enp3s0
[root@localhost ~]# 

 此时的接口逻辑图如下：