日韩性视频-久久久蜜桃-www中文字幕-在线中文字幕av-亚洲欧美一区二区三区四区-撸久久-香蕉视频一区-久久无码精品丰满人妻-国产高潮av-激情福利社-日韩av网址大全-国产精品久久999-日本五十路在线-性欧美在线-久久99精品波多结衣一区-男女午夜免费视频-黑人极品ⅴideos精品欧美棵-人人妻人人澡人人爽精品欧美一区-日韩一区在线看-欧美a级在线免费观看

歡迎訪問(wèn) 生活随笔!

生活随笔

當(dāng)前位置: 首頁(yè) > 编程资源 > 编程问答 >内容正文

编程问答

DVR分布式路由

發(fā)布時(shí)間:2023/12/9 编程问答 56 豆豆
生活随笔 收集整理的這篇文章主要介紹了 DVR分布式路由 小編覺(jué)得挺不錯(cuò)的,現(xiàn)在分享給大家,幫大家做個(gè)參考.

1. 背景

  沒(méi)有使用DVR的場(chǎng)景:

  

  從圖中可以明顯看到東西向和南北向的流量會(huì)集中到網(wǎng)絡(luò)節(jié)點(diǎn),這會(huì)使網(wǎng)絡(luò)節(jié)點(diǎn)成為瓶頸。

  如果啟用DVR,如下圖:

  

?

  對(duì)于東西向的流量, 流量會(huì)直接在計(jì)算節(jié)點(diǎn)之間傳遞。

對(duì)于南北向的流量,如果有floating ip,流量就直接走計(jì)算節(jié)點(diǎn)。如果沒(méi)有floating ip,則會(huì)走網(wǎng)絡(luò)節(jié)點(diǎn)。

?2.部署以及流量走向

  

   

  2.1東西向流量

  VM1 (10.0.1.5 Net1) ping VM2 (10.0.2.5 Net2)

?  1) VM1 (10.0.1.5) -> qr (10.0.1.1)

    VM1 根據(jù)默認(rèn)路由發(fā)送arp(廣播)請(qǐng)求qr網(wǎng)關(guān)的地址,請(qǐng)求到網(wǎng)關(guān)地址后,icmp報(bào)文走向qr口。

    (關(guān)于報(bào)文格式的一點(diǎn)解釋,當(dāng)VM1 ping VM2時(shí),報(bào)文的源/目的IP始終不變,報(bào)文的源/目的MAC則會(huì)根據(jù)不同的路段而變化。)

    同時(shí),br-tun網(wǎng)橋會(huì)丟棄目的地址是interface_distributed接口的arp廣播,不至于讓不必要的流量流向外面:

# ovs-ofctl dump-flows br-tun NXST_FLOW reply (xid=0x4): ... cookie=0x0, duration=64720.432s, table=1, n_packets=4, n_bytes=168, idle_age=64607, priority=3,arp,dl_vlan=1,arp_tpa=10.0.1.1 actions=drop ...

   2)qr ?(10.0.1.1) -> qr (10.0.2.1)

    進(jìn)入qrouter namespace后,利用linux內(nèi)核的高級(jí)路由功能,查看路由規(guī)則。

# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip rule 0: from all lookup local 32766: from all lookup main 32767: from all lookup default 32768: from 10.0.1.5 lookup 16 32769: from 10.0.2.3 lookup 16 167772417: from 10.0.1.1/24 lookup 167772417 167772417: from 10.0.1.1/24 lookup 167772417 167772673: from 10.0.2.1/24 lookup 167772673

    先查看main表:

# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip route list table main 10.0.1.0/24 dev qr-ddbdc784-d7 proto kernel scope link src 10.0.1.1 10.0.2.0/24 dev qr-001d0ed9-01 proto kernel scope link src 10.0.2.1 169.254.31.28/31 dev rfp-0fbb351e-a proto kernel scope link src 169.254.31.28

    在main表中滿足以上路由,因此會(huì)從另一個(gè)qr口出去。(Q1:不同計(jì)算節(jié)點(diǎn)的同一子網(wǎng)下qr口ip是相同的嗎?)

?  3)qr -> br-int  ?

  之后需要去查詢10.0.2.5的MAC地址, MAC是由neutron使用靜態(tài)ARP的方式設(shè)定的,由于Neutron知道所有VM的信息,因此他可以事先設(shè)定好靜態(tài)ARP:

# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip nei 10.0.1.5 dev qr-ddbdc784-d7 lladdr fa:16:3e:da:75:6d PERMANENT 10.0.2.3 dev qr-001d0ed9-01 lladdr fa:16:3e:a4:fc:98 PERMANENT 10.0.1.6 dev qr-ddbdc784-d7 lladdr fa:16:3e:9f:55:67 PERMANENT 10.0.2.2 dev qr-001d0ed9-01 lladdr fa:16:3e:13:55:66 PERMANENT 10.0.2.5 dev qr-001d0ed9-01 lladdr fa:16:3e:51:99:b8 PERMANENT 10.0.1.4 dev qr-ddbdc784-d7 lladdr fa:16:3e:da:e3:6e PERMANENT 10.0.1.7 dev qr-ddbdc784-d7 lladdr fa:16:3e:14:b8:ec PERMANENT 169.254.31.29 dev rfp-0fbb351e-a lladdr 42:0d:9f:49:63:c6 STALE

  此時(shí),報(bào)文進(jìn)入br-int,根據(jù)table 0 進(jìn)行normal轉(zhuǎn)發(fā):

cookie=0x0, duration=16440.644s, table=0, n_packets=1074, n_bytes=104318, idle_age=8917, priority=1 actions=NORMAL

  normal動(dòng)作則表示根據(jù)OVS fdb表項(xiàng)匹配目的MAC地址,從而決定該報(bào)文要往哪個(gè)端口發(fā)送。如果沒(méi)有該MAC的fdb表項(xiàng)記錄,則進(jìn)行泛洪,對(duì)除了報(bào)文進(jìn)來(lái)的端口以外的所有同屬于一個(gè)vlan的端口發(fā)送該報(bào)文。例如:

# ovs-appctl fdb/show br-intport VLAN MAC Age LOCAL 0 da:91:42:cd:fb:44 1818 0 52:54:00:a9:b8:b0 019 0 52:54:00:a9:b8:b1 0

  因此如果此時(shí)VM2也在該compute node上,則VM2也會(huì)直接收到該報(bào)文,不需要走br-tun(有了VM2的MAC fdb表項(xiàng)記錄后)。否則,繼續(xù)往br-tun走。

  4)br-int ->?br-tun -> 出compute node 1

  然后報(bào)文從br-int進(jìn)入br-tun匹配流表:

cookie=0x0, duration=66172.51s, table=0, n_packets=58, n_bytes=5731, idle_age=20810, hard_age=65534, priority=1,in_port=3 actions=resubmit(,4)cookie=0x0, duration=67599.526s, table=0, n_packets=273, n_bytes=24999, idle_age=1741, hard_age=65534, priority=1,in_port=1 actions=resubmit(,1)cookie=0x0, duration=64437.052s, table=0, n_packets=28, n_bytes=2980, idle_age=20799, priority=1,in_port=4 actions=resubmit(,4)cookie=0x0, duration=67601.704s, table=0, n_packets=5, n_bytes=390, idle_age=65534, hard_age=65534, priority=0 actions=dropcookie=0x0, duration=66135.811s, table=1, n_packets=140, n_bytes=13720, idle_age=65534, hard_age=65534, priority=1,dl_vlan=1,dl_src=fa:16:3e:66:13:af actions=mod_dl_src:fa:16:3f:fe:49:e9,resubmit(,2)cookie=0x0, duration=64082.141s, table=1, n_packets=2, n_bytes=200, idle_age=64081, priority=1,dl_vlan=2,dl_src=fa:16:3e:69:b4:05 actions=mod_dl_src:fa:16:3f:fe:49:e9,resubmit(,2)cookie=0x0, duration=66135.962s, table=1, n_packets=1, n_bytes=98, idle_age=65301, hard_age=65534, priority=2,dl_vlan=1,dl_dst=fa:16:3e:66:13:af actions=drop cookie=0x0, duration=64082.297s, table=1, n_packets=0, n_bytes=0, idle_age=64082, priority=2,dl_vlan=2,dl_dst=fa:16:3e:69:b4:05 actions=dropcookie=0x0, duration=66136.115s, table=1, n_packets=4, n_bytes=168, idle_age=65534, hard_age=65534, priority=3,arp,dl_vlan=1,arp_tpa=10.0.1.1 actions=dropcookie=0x0, duration=64082.449s, table=1, n_packets=2, n_bytes=84, idle_age=63991, priority=3,arp,dl_vlan=2,arp_tpa=10.0.2.1 actions=dropcookie=0x0, duration=67599.22s, table=1, n_packets=123, n_bytes=10687, idle_age=1741, hard_age=65534, priority=0 actions=resubmit(,2)

  先匹配table 0,然后匹配table 1,它會(huì)把源MAC地址(另一個(gè)qr口)改為全局唯一與計(jì)算節(jié)點(diǎn)綁定的MAC。

  這個(gè)全局唯一和計(jì)算節(jié)點(diǎn)綁定的MAC地址,是由neutron全局分配的,數(shù)據(jù)庫(kù)中可以看到這個(gè)MAC是每個(gè)host一個(gè):

  

  它的base MAC是可以在neutron.conf中配置的:

  

  同時(shí),后面的兩條table1會(huì)丟棄目標(biāo)ip是interface_distributed接口的ARP和目的MAC是interface_distributed的包,以防止虛機(jī)發(fā)送給本地IP的包不會(huì)被轉(zhuǎn)發(fā)到網(wǎng)絡(luò)中。

  然后繼續(xù)查詢table 2,table 2是vxlan表,如果是廣播包就會(huì)查詢表22,如果是單播包就查詢table 20

cookie=0x0, duration=67601.554s, table=2, n_packets=176, n_bytes=16981, idle_age=20810, hard_age=65534, priority=0,dl_dst=00:00:00:00:00:00/01:00:00:00:00:00 actions=resubmit(,20)cookie=0x0, duration=67601.406s, table=2, n_packets=92, n_bytes=7876, idle_age=1741, hard_age=65534, priority=0,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 actions=resubmit(,22)

  廣播MAC地址是FF:FF:FF:FF:FF:FF,組播MAC地址以01-00-5E開(kāi)頭(具體可查看http://book.51cto.com/art/200904/120471.htm),匹配規(guī)則滿足CIDR。

  ICMP包是單播包,因此會(huì)查詢表20,由于開(kāi)啟了L2 pop功能,在表20中會(huì)事先學(xué)習(xí)到應(yīng)該轉(zhuǎn)發(fā)到哪個(gè)VTEP:

cookie=0x0, duration=64015.308s, table=20, n_packets=0, n_bytes=0, idle_age=64015, priority=2,dl_vlan=2,dl_dst=fa:16:3e:51:99:b8 actions=strip_vlan,set_tunnel:0x3eb,output:4

  (Q2:社區(qū)br-tun下面的隧道口是如何與物理口建立聯(lián)系的?)

  5)進(jìn)compute node 2 -> br-tun

  在br-tun中,從外面進(jìn)入的報(bào)文將首先匹配以下table0表:

cookie=0x0, duration=66293.658s, table=0, n_packets=31, n_bytes=3936, idle_age=22651, hard_age=65534, priority=1,in_port=3 actions=resubmit(,4)cookie=0x0, duration=69453.368s, table=0, n_packets=103, n_bytes=9360, idle_age=22651, hard_age=65534, priority=1,in_port=1 actions=resubmit(,1)cookie=0x0, duration=66292.808s, table=0, n_packets=20, n_bytes=1742, idle_age=3598, hard_age=65534, priority=1,in_port=4 actions=resubmit(,4)cookie=0x0, duration=69455.675s, table=0, n_packets=5, n_bytes=390, idle_age=65534, hard_age=65534, priority=0 actions=drop

  在table 4中,會(huì)將對(duì)應(yīng)的vni改為本地vlan id,之后查詢表9:

cookie=0x0, duration=65937.871s, table=4, n_packets=32, n_bytes=3653, idle_age=22651, hard_age=65534, priority=1,tun_id=0x3eb actions=mod_vlan_vid:3,resubmit(,9)cookie=0x0, duration=66294.732s, table=4, n_packets=19, n_bytes=2025, idle_age=3598, hard_age=65534, priority=1,tun_id=0x3e9 actions=mod_vlan_vid:2,resubmit(,9)cookie=0x0, duration=69455.115s, table=4, n_packets=0, n_bytes=0, idle_age=65534, hard_age=65534, priority=0 actions=drop

  在表9中,如果發(fā)現(xiàn)包的源地址是全局唯一并與計(jì)算節(jié)點(diǎn)綁定的MAC地址,就將其轉(zhuǎn)發(fā)到br-int:

cookie=0x0, duration=69453.507s, table=9, n_packets=0, n_bytes=0, idle_age=65534, hard_age=65534, priority=1,dl_src=fa:16:3f:fe:49:e9 actions=output:1cookie=0x0, duration=69453.782s, table=9, n_packets=0, n_bytes=0, idle_age=65534, hard_age=65534, priority=1,dl_src=fa:16:3f:72:3f:a7 actions=output:1cookie=0x0, duration=69453.23s, table=9, n_packets=56, n_bytes=6028, idle_age=3598, hard_age=65534, priority=0 actions=resubmit(,10)

  6)br-tun -> br-int

  進(jìn)入br-int后,在table 0中,如果是全局唯一并與計(jì)算節(jié)點(diǎn)綁定的MAC地址就查詢table 1,否則就正常轉(zhuǎn)發(fā);

  在table 1中,事先設(shè)定好了flow,如果目的MAC是發(fā)送給VM2,就將源MAC改為Net2的網(wǎng)關(guān)MAC地址(qr口)(Q3:修改源MAC的原因?為了報(bào)文能返回)。

cookie=0x0, duration=70039.903s, table=0, n_packets=0, n_bytes=0, idle_age=65534, hard_age=65534, priority=2,in_port=6,dl_src=fa:16:3f:72:3f:a7 actions=resubmit(,1)cookie=0x0, duration=70039.627s, table=0, n_packets=0, n_bytes=0, idle_age=65534, hard_age=65534, priority=2,in_port=6,dl_src=fa:16:3f:fe:49:e9 actions=resubmit(,1)cookie=0x0, duration=70040.053s, table=0, n_packets=166, n_bytes=15954, idle_age=4184, hard_age=65534, priority=1 actions=NORMALcookie=0x0, duration=66458.695s, table=1, n_packets=0, n_bytes=0, idle_age=65534, hard_age=65534, priority=4,dl_vlan=3,dl_dst=fa:16:3e:51:99:b8 actions=strip_vlan,mod_dl_src:fa:16:3e:69:b4:05,output:12cookie=0x0, duration=66877.515s, table=1, n_packets=0, n_bytes=0, idle_age=65534, hard_age=65534, priority=4,dl_vlan=2,dl_dst=fa:16:3e:14:b8:ec actions=strip_vlan,mod_dl_src:fa:16:3e:66:13:af,output:9cookie=0x0, duration=66877.369s, table=1, n_packets=0, n_bytes=0, idle_age=65534, hard_age=65534, priority=2,ip,dl_vlan=2,nw_dst=10.0.1.0/24 actions=strip_vlan,mod_dl_src:fa:16:3e:66:13:af,output:9cookie=0x0, duration=66458.559s, table=1, n_packets=0, n_bytes=0, idle_age=65534, hard_age=65534, priority=2,ip,dl_vlan=3,nw_dst=10.0.2.0/24 actions=strip_vlan,mod_dl_src:fa:16:3e:69:b4:05,output:12

  7)br-int -> VM2

  至此,VM2就會(huì)收到VM1的包了。從通信的過(guò)程可以看到,跨網(wǎng)段的東西向流量沒(méi)有經(jīng)過(guò)網(wǎng)絡(luò)節(jié)點(diǎn)。

  2.2 南北向流量(VM有floating ip)?  

  VM1 (local ip:10.0.1.5 , floating ip: 172.24.4.5)ping 8.8.8.8

  1)VM1 (10.0.1.5) -> qr (10.0.1.1)

    與上面一致

  2) qr (10.0.1.1) -> rfp (169.254.31.28) ->?fpr (169.254.31.29)

  進(jìn)入qrouter namespace后:

# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip rule 0: from all lookup local 32766: from all lookup main 32767: from all lookup default 32768: from 10.0.1.5 lookup 16 32769: from 10.0.2.3 lookup 16 167772417: from 10.0.1.1/24 lookup 167772417 167772417: from 10.0.1.1/24 lookup 167772417 167772673: from 10.0.2.1/24 lookup 167772673

  在main表中沒(méi)有合適的路由:

# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip route list table main 10.0.1.0/24 dev qr-ddbdc784-d7 proto kernel scope link src 10.0.1.1 10.0.2.0/24 dev qr-001d0ed9-01 proto kernel scope link src 10.0.2.1 169.254.31.28/31 dev rfp-0fbb351e-a proto kernel scope link src 169.254.31.28

  由于包是從10.0.1.5發(fā)來(lái)的之后會(huì)查看table 16,包會(huì)命中這條路由。

# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip route list table 16 default via 169.254.31.29 dev rfp-0fbb351e-a

  路由之后會(huì)通過(guò)netfilter的POSTROUTING鏈中進(jìn)行SNAT:

# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa iptables -nvL -t nat ... Chain neutron-l3-agent-float-snat (1 references)pkts bytes target prot opt in out source destination0 0 SNAT all -- * * 10.0.2.3 0.0.0.0/0 to:172.24.4.70 0 SNAT all -- * * 10.0.1.5 0.0.0.0/0 to:172.24.4.5 ...

  之后就可以看到包會(huì)通過(guò)rfp-0fbb351e-a發(fā)送給169.254.31.29。

  端口rfp-0fbb351e-a和fpr-0fbb351e-a是一對(duì)veth pair。在fip namespace中你可以看到這個(gè)接口:

  3)?fpr (169.254.31.29) -> fg (172.24.4.6)

  到了fip的namespace之后,會(huì)查詢路由, 在main表里有通往公網(wǎng)的默認(rèn)路由:

# ip netns exec fip-fbd46644-c70f-4227-a414-862a00cbd1d2 ip route default via 172.24.4.1 dev fg-081d537b-06 169.254.31.28/31 dev fpr-0fbb351e-a proto kernel scope link src 169.254.31.29 172.24.4.0/24 dev fg-081d537b-06 proto kernel scope link src 172.24.4.6 172.24.4.5 via 169.254.31.28 dev fpr-0fbb351e-a 172.24.4.7 via 169.254.31.28 dev fpr-0fbb351e-a

  通過(guò)fg-081d537b-06發(fā)送到br-ex。這是從虛機(jī)發(fā)送到公網(wǎng)的過(guò)程。(Q4:br-ex上的流表是什么樣的?如果沒(méi)有br-ex,直接走br-int,流表會(huì)有什么變化?)

  

  外網(wǎng) ping VM1 (?floating ip: 172.24.4.5)

  1)fip namespace

  此時(shí)fip的namespace會(huì)做arp代理:

  (Q5:arp代理的作用?外部arp廣播報(bào)文進(jìn)入fip ns,查詢172.24.4.5的mac地址,由于arp報(bào)文無(wú)法跨路由器傳播,而且該ip在qrouter ns里。)

# ip netns exec fip-fbd46644-c70f-4227-a414-862a00cbd1d2 sysctl net.ipv4.conf.fg-081d537b-06.proxy_arp net.ipv4.conf.fg-081d537b-06.proxy_arp = 1

  可以看到接口的arp代理是打開(kāi)的,對(duì)于floating ip 有以下路由:

# ip netns exec fip-fbd46644-c70f-4227-a414-862a00cbd1d2 ip route ... 172.24.4.5 via 169.254.31.28 dev fpr-0fbb351e-a 172.24.4.7 via 169.254.31.28 dev fpr-0fbb351e-a ...

  ARP會(huì)去通過(guò)VETH Pair到IR(Inter Router)的namespace中去查詢,在IR中可以看到,接口rfp-0fbb351e-a配置了floating ip:

# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: rfp-0fbb351e-a: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000link/ether ea:5c:56:9a:36:9c brd ff:ff:ff:ff:ff:ffinet 169.254.31.28/31 scope global rfp-0fbb351e-avalid_lft forever preferred_lft foreverinet 172.24.4.5/32 brd 172.24.4.5 scope global rfp-0fbb351e-avalid_lft forever preferred_lft foreverinet 172.24.4.7/32 brd 172.24.4.7 scope global rfp-0fbb351e-avalid_lft forever preferred_lft foreverinet6 fe80::e85c:56ff:fe9a:369c/64 scope link valid_lft forever preferred_lft forever 17: qr-ddbdc784-d7: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default link/ether fa:16:3e:66:13:af brd ff:ff:ff:ff:ff:ff inet 10.0.1.1/24 brd 10.0.1.255 scope global qr-ddbdc784-d7 valid_lft forever preferred_lft forever inet6 fe80::f816:3eff:fe66:13af/64 scope link valid_lft forever preferred_lft forever 19: qr-001d0ed9-01: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default link/ether fa:16:3e:69:b4:05 brd ff:ff:ff:ff:ff:ff inet 10.0.2.1/24 brd 10.0.2.255 scope global qr-001d0ed9-01 valid_lft forever preferred_lft forever inet6 fe80::f816:3eff:fe69:b405/64 scope link valid_lft forever preferred_lft forever

  因此fip的namespace會(huì)對(duì)這個(gè)floating ip進(jìn)行ARP回應(yīng)。

  外部發(fā)起目標(biāo)地址為floating ip的請(qǐng)求后,fip會(huì)將其轉(zhuǎn)發(fā)到IR中,IR的RPOROUTING鏈中規(guī)則如下:

# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa iptables -nvL -t nat ... Chain neutron-l3-agent-PREROUTING (1 references)pkts bytes target prot opt in out source destination0 0 REDIRECT tcp -- * * 0.0.0.0/0 169.254.169.254 tcp dpt:80 redir ports 96970 0 DNAT all -- * * 0.0.0.0/0 172.24.4.7 to:10.0.2.30 0 DNAT all -- * * 0.0.0.0/0 172.24.4.5 to:10.0.1.5 ...

  這條DNAT規(guī)則會(huì)將floating ip地址轉(zhuǎn)換為內(nèi)部地址,之后進(jìn)行路由查詢:

# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip route 10.0.1.0/24 dev qr-ddbdc784-d7 proto kernel scope link src 10.0.1.1 10.0.2.0/24 dev qr-001d0ed9-01 proto kernel scope link src 10.0.2.1 169.254.31.28/31 dev rfp-0fbb351e-a proto kernel scope link src 169.254.31.28

  目的地址是10.0.1.0/24網(wǎng)段的,因此會(huì)從qr-ddbdc784-d7轉(zhuǎn)發(fā)出去。之后就會(huì)轉(zhuǎn)發(fā)到br-int再到虛機(jī)。

?

  2.3 南北向流量(VM沒(méi)有floating ip)

  在虛機(jī)沒(méi)有floating ip的情況下,從虛機(jī)發(fā)出的包會(huì)首先到IR,IR中查詢路由:

# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip rule 0: from all lookup local 32766: from all lookup main 32767: from all lookup default 32768: from 10.0.1.5 lookup 16 32769: from 10.0.2.3 lookup 16 167772417: from 10.0.1.1/24 lookup 167772417 167772673: from 10.0.2.1/24 lookup 167772673

  會(huì)先查詢main表,之后查詢167772417表。(Q7:不會(huì)匹配table 16?) 

# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip route list table 167772417 default via 10.0.1.6 dev qr-ddbdc784-d7

  這個(gè)表會(huì)將其轉(zhuǎn)發(fā)給10.0.1.6,而這個(gè)IP就是在network node上的router_centralized_snat接口。

  在network node的snat namespace中,我們可以看到這個(gè)接口。

$ sudo ip netns exec snat-0fbb351e-a65b-4790-a409-8fb219ce16aa iptables -nvL -t nat ... Chain neutron-l3-agent-snat (1 references)pkts bytes target prot opt in out source destination0 0 SNAT all -- * * 10.0.1.0/24 0.0.0.0/0 to:172.24.4.40 0 SNAT all -- * * 10.0.2.0/24 0.0.0.0/0 to:172.24.4.4 ...

  這里就和以前的L3類似,會(huì)將沒(méi)有floating ip的包SNAT成一個(gè)172.24.4.4(DVR的網(wǎng)關(guān)臂)。這個(gè)過(guò)程是和以前L3類似的,不再累述。

  參考:http://www.sxt.cn/u/756/blog/3168

3. QA

  (未完)

?

轉(zhuǎn)載于:https://www.cnblogs.com/xingyun/p/4876083.html

總結(jié)

以上是生活随笔為你收集整理的DVR分布式路由的全部?jī)?nèi)容,希望文章能夠幫你解決所遇到的問(wèn)題。

如果覺(jué)得生活随笔網(wǎng)站內(nèi)容還不錯(cuò),歡迎將生活随笔推薦給好友。