Network related posts

| 分类 Network  | 标签 network 

Bridge related

Overview

bridge and iptables

bridge and containers

Host bridge将Host的物理NIC eth0作为bridge的端口，容器（虚拟机）看上去就像一台物理机（相同的IP网络），可以直接 与外部通信。NAT bridge不会将Host的物理NIC eth0作为bridge的端口，只用连接内部私有的容器（虚拟机）网络， 容器（虚拟机）不能直接与外部通信，需要通过Host的eth0进行DNAT/SNAT。

VLAN/MacVLAN/IPVLAN

VLAN

Overview

VLAN的主要优点: (1)广播域被限制在一个VLAN内,节省了带宽,提高了网络处理能力。 (2)增强局域网的安全性:VLAN间不能直接通信,即一个VLAN内的用户不能和其它VLAN内的用户直接通信,而需要通过路由器或三层交换机等三层设备。 (3)灵活构建虚拟工作组:用VLAN可以划分不同的用户到不同的工作组,同一工作组的用户也不必局限于某一固定的物理范围,网络构建和维护更方便灵活。

# ip link add link eth0 name eth0.11 type vlan id 11  ### vconfig add eth0 11
# ip a
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:50:56:2b:94:78 brd ff:ff:ff:ff:ff:ff
    inet 172.16.213.128/24 brd 172.16.213.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::250:56ff:fe2b:9478/64 scope link 
       valid_lft forever preferred_lft forever
4: eth0.11@eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN 
    link/ether 00:50:56:2b:94:78 brd ff:ff:ff:ff:ff:ff
# ip -d link show eth0.11
4: eth0.11@eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN 
    link/ether 00:50:56:2b:94:78 brd ff:ff:ff:ff:ff:ff
    vlan id 11 <REORDER_HDR>

注意：VLAN设备的MAC地址与eth0相同。

MacVLAN

Overview

MacVLAN的实现来自EVB标准。

  • Create MacVLAN
# ip link add eth0.1 link eth0 type macvlan mode bridge
# ip a
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:50:56:2b:94:78 brd ff:ff:ff:ff:ff:ff
    inet 172.16.213.128/24 brd 172.16.213.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::250:56ff:fe2b:9478/64 scope link 
       valid_lft forever preferred_lft forever
3: eth0.1@eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN 
    link/ether 92:57:e0:02:3e:3d brd ff:ff:ff:ff:ff:ff

# ip -d link show eth0.1
3: eth0.1@eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN 
    link/ether 92:57:e0:02:3e:3d brd ff:ff:ff:ff:ff:ff
    macvlan  mode bridge

MacVLAN and Containers

IPVLAN

Overview

MacVLAN vs IPVLAN

What to choose (macvlan vs. ipvlan)?

These two devices are very similar in many regards and the specific use case could very well define which device to choose. if one of the following situations defines your use case then you can choose to use ipvlan

  • (a) The Linux host that is connected to the external switch / router has policy configured that allows only one mac per port.
  • (b) No of virtual devices created on a master exceed the mac capacity and puts the NIC in promiscous mode and degraded performance is a concern.
  • (c) If the slave device is to be put into the hostile / untrusted network namespace where L2 on the slave could be changed / misused.

SDN

VXLAN

Overview

VXLAN and containers

OVN

OVN & Container

OVS

OVSDB

NFV

Neutron

DPDK

User space driver

DPDK & SR-IOV

Netfilter

overview

iptables

overview

NAT

Stateless NAT

BPF

XDP

Kubernetes network

CNM & CNI

Loadbalance

haproxy

Routing

policy routing

BGP

GoBGP

Bird

Network stack

GRO

Tools

iproute2

tcpdump

Blogs


上一篇     下一篇