Linux 网桥介绍

发布时间: 更新时间: 总字数:1536 阅读时间:4m 作者: 分享
专栏文章
  1. Linux tap/tun 介绍
  2. Linux Veth Pair 介绍
  3. Linux 网桥介绍(当前)
  4. Linux Net Namespace 介绍
  5. 通过 Linux ip_forward 实现两个 netns 通信

Linux Bridge(网桥) 是一种虚拟网络设备,具备交换机所有的功能。Bridge 有多个端口,数据可以从多个端口

功能

担当交换机的角色,接入其他物理/虚拟 网络设备。功能类似与物理交换机,有很多 端口,通过网线(veth pair)连接终端设备

使用场景

Bridge 设备通常会和 tap/tunveth pair 等设备用于虚拟机容器等网络里。

与 veth pair 配合使用

用例说明:

下面通过 iproutebrctl 实现上述示例。

iproute 命令

  • 创建 bridge
$ ip link add br1 type bridge
$ ip link show br1
4: br1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether f6:bd:3a:67:9e:83 brd ff:ff:ff:ff:ff:ff
$ ip link set dev br1 up
$ ip link show br1
4: br1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether f6:bd:3a:67:9e:83 brd ff:ff:ff:ff:ff:ff

新创建的 br1 时,它是一个独立的网络设备,可以看成是一端连接网络协议栈,并且br1没有任何端口

  • 将已有的网卡接口绑定到 br1
$ ip addr show  # ens33 为物理网卡接口
$ ip link set dev ens33 master br1  # br1 的mac地址变成了 ens33 的mac地址

出现上述示例,说明ens33已经绑定到br1上了,注意:若当前采用 ens33 连接到主机,会断网。

  • 配置上网
$ ip addr del 192.168.179.152/24 dev ens33
  • 创建 veth-pair,并配置IP地址
$ ip link add veth1 type veth peer name veth2
$ ip link set dev veth1 up
$ ip link set dev veth2 up
$ ip link set dev veth2 master br1
$ ip addr add 192.168.179.152/24 dev veth1
$ ip route add default via 192.168.179.1
  • 通过 veth1 ping xiexianbin.cn 可以通到外网,br1 上抓包情况如下:
$ tcpdump -i br1 -nnt -vv icmp
tcpdump: listening on br1, link-type EN10MB (Ethernet), capture size 262144 bytes
IP (tos 0x0, ttl 64, id 18168, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.179.152 > 47.105.172.234: ICMP echo request, id 1834, seq 1, length 64
IP (tos 0x0, ttl 46, id 9335, offset 0, flags [none], proto ICMP (1), length 84)
    47.105.172.234 > 192.168.179.152: ICMP echo reply, id 1834, seq 1, length 64
IP (tos 0x0, ttl 64, id 18331, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.179.152 > 47.105.172.234: ICMP echo request, id 1834, seq 2, length 64
  • 查看bridge连接
$ bridge link
2: ens33 state UP : <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master br1 state forwarding priority 32 cost 4
5: veth2 state UP @veth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master br1 state forwarding priority 32 cost 2
$ bridge vlan
port	vlan ids
ens33	 1 PVID Egress Untagged

br1	 1 PVID Egress Untagged

veth2	 1 PVID Egress Untagged
$ bridge fdb
3a:f9:d3:81:3c:64 dev ens33 master br1
00:50:56:3b:49:58 dev ens33 master br1 permanent
00:50:56:3b:49:58 dev ens33 vlan 1 master br1 permanent
33:33:00:00:00:01 dev ens33 self permanent
01:00:5e:00:00:01 dev ens33 self permanent
33:33:ff:3b:49:58 dev ens33 self permanent
33:33:00:00:00:01 dev br1 self permanent
01:00:5e:00:00:01 dev br1 self permanent
33:33:ff:67:9e:83 dev br1 self permanent
9e:93:33:72:f9:f9 dev veth2 vlan 1 master br1 permanent
7e:c0:0e:2f:dc:36 dev veth2 master br1
9e:93:33:72:f9:f9 dev veth2 master br1 permanent
33:33:00:00:00:01 dev veth2 self permanent
01:00:5e:00:00:01 dev veth2 self permanent
33:33:ff:72:f9:f9 dev veth2 self permanent
33:33:00:00:00:01 dev veth1 self permanent
01:00:5e:00:00:01 dev veth1 self permanent
33:33:ff:2f:dc:36 dev veth1 self permanent

brctl 命令

yum install bridge-utils -y
  • help
brctl --help
Usage: brctl [commands]
commands:
	addbr     	<bridge>		add bridge
	delbr     	<bridge>		delete bridge
	addif     	<bridge> <device>	add interface to bridge
	delif     	<bridge> <device>	delete interface from bridge
	hairpin   	<bridge> <port> {on|off}	turn hairpin on/off
	setageing 	<bridge> <time>		set ageing time
	setbridgeprio	<bridge> <prio>		set bridge priority
	setfd     	<bridge> <time>		set bridge forward delay
	sethello  	<bridge> <time>		set hello time
	setmaxage 	<bridge> <time>		set max message age
	setpathcost	<bridge> <port> <cost>	set path cost
	setportprio	<bridge> <port> <prio>	set port priority
	show      	[ <bridge> ]		show a list of bridges
	showmacs  	<bridge>		show a list of mac addrs
	showstp   	<bridge>		show bridge stp info
	stp       	<bridge> {on|off}	turn stp on/off
  • 创建
$ brctl addbr br2
$ brctl show br2
bridge name	bridge id		STP enabled	interfaces
br2		8000.000000000000	no
$ ip link set dev br2 up  # ifup br2
  • 将已有的网卡接口绑定到 br2
$ ip addr show  # ens33 为物理网卡接口
$ brctl addif br2 ens33  # 将网卡接口添加到网桥,同时添加多个,命令:brctl addif br2 ens33 ens34 ... ,br2的mac地址变成了ens33的mac地址
$ brctl show br2
bridge name	bridge id		STP enabled	interfaces
br2		8000.000000000000	no          ens33

出现上述示例,说明ens33已经绑定到br2上了,注意:若当前采用ens33连接到主机,会断网。

  • 配置上网
$ ip addr del 192.168.179.152/24 dev ens33
  • 创建 veth-pair,并配置IP地址
$ ip link add veth1 type veth peer name veth2
$ ip link set dev veth1 up
$ ip link set dev veth2 up
$ brctl addif br2 veth2
$ ip addr add 192.168.179.152/24 dev veth1
$ ip route add default via 192.168.179.1

也可以配置veth1的配置文件,/etc/sysconfig/network-scripts/ifcfg-veth1

TYPE="Ethernet"
PROXY_METHOD="none"
BROWSER_ONLY="no"
BOOTPROTO="static"
DEFROUTE="yes"
IPV4_FAILURE_FATAL="no"
NAME="veth1"
DEVICE="veth1"
ONBOOT="yes"
IPADDR=192.168.179.152
GATEWAY=192.168.179.1
NETMASK=255.255.255.0

启动网卡接口:

ifdown veth1; ifup veth1
  • 上网验证
$ ping -c 1 192.168.179.1
PING 192.168.179.1 (192.168.179.1) 56(84) bytes of data.
64 bytes from 192.168.179.1: icmp_seq=1 ttl=64 time=0.279 ms

--- 192.168.179.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.279/0.279/0.279/0.000 ms

实现 docker 通信

上图通过 Bridge 连接两个 Docker 容器tap 虚拟网卡和物理网卡 ens33

环境:

以 c7-1 容器为例,获取pid

$ docker inspect -f '{{.State.Pid}}' c7-1
3489

ping 的时候在 br0 抓包:

$ tcpdump -vv -nnt -i br0
tcpdump: listening on br0, link-type EN10MB (Ethernet), capture size 262144 bytes
IP (tos 0x0, ttl 64, id 44118, offset 0, flags [DF], proto ICMP (1), length 84)
    172.20.0.2 > 172.20.0.1: ICMP echo request, id 120, seq 1, length 64
IP (tos 0x0, ttl 64, id 30180, offset 0, flags [none], proto ICMP (1), length 84)
    172.20.0.1 > 172.20.0.2: ICMP echo reply, id 120, seq 1, length 64
ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.20.0.2 tell 172.20.0.1, length 28
ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.20.0.1 tell 172.20.0.2, length 28
ARP, Ethernet (len 6), IPv4 (len 4), Reply 172.20.0.1 is-at 06:d9:35:e0:9e:e1, length 28
ARP, Ethernet (len 6), IPv4 (len 4), Reply 172.20.0.2 is-at ba:2f:78:24:ad:d1, length 28
专栏文章
  1. Linux tap/tun 介绍
  2. Linux Veth Pair 介绍
  3. Linux 网桥介绍(当前)
  4. Linux Net Namespace 介绍
  5. 通过 Linux ip_forward 实现两个 netns 通信
最新评论
加载中...
Home Archives Categories Tags