美文网首页
Linux Network Namespace

Linux Network Namespace

作者: yuanzicheng | 来源:发表于2020-08-24 23:15 被阅读0次

    首先，通过一个小的实验来了解Linux网络命名空间的作用。

    为了不受干扰，更清楚地了解整个过程，这里我使用虚拟机最小化安装CentOS 8.0。

    1.查询及创建网络命名空间

    查询网络命名空间，此时系统中并没有任何网络命名空间

    $ ip netns list

    接着，创建新的网络命名空间

    $ ip netns add test1
$ ip netns add test2

    再来查询，发现多出2个刚才创建的网络命名空间

    $ ip netns list
test2
test1

    如果想要删除已有的网络命名空间，使用以下命令

    ip netns delete <namespace>

    2.查看网络连接

    查看本机的网络连接

    $ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp0s5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 00:1c:42:0c:7c:82 brd ff:ff:ff:ff:ff:ff

    查看刚才创建的Namespcae的命名空间

    $ ip netns exec test1 ip link
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
$ ip netns exec test2 ip link
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

    注意，test1、test2这两个网络命名空间的网络连接的本地回环接口lo的状态均为DOWN。

    接下来将test1、test2的lo接口设为UP状态。

    $ ip netns exec test1 ip link set dev lo up
$ ip netns exec test2 ip link set dev lo up
$ ip netns exec test1 ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
$ ip netns exec test2 ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

    此时，test1与test2的lo网络接口均为UNKNOWN状态,并不是UP状态，这是因为网络接口未被连接。

    3.创建网络连接

    Linux中有一种虚拟网络设备的技术叫做veth, veth总是成对出现的，连接两个网络接口（设备）。

    接着就使用veth连接test1、test2的lo接口

    $ ip link add veth-test1 type veth peer name veth-test2

    再查看本机的的网络接口

    $ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp0s5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 00:1c:42:0c:7c:82 brd ff:ff:ff:ff:ff:ff
3: veth-test2@veth-test1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 7e:43:1a:8a:a1:53 brd ff:ff:ff:ff:ff:ff
4: veth-test1@veth-test2: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether b6:6e:98:86:5c:80 brd ff:ff:ff:ff:ff:ff

    可以看到多了2个设备veth-test2@veth-test1、veth-test1@veth-test2，正是刚才创建的一对veth

    接着将这一对veth分配给test1和test2

    ip link set veth-test1 netns test1
ip link set veth-test2 netns test2

    此时在查看本机的网络设备，已经看不到刚才的veth-test2@veth-test1、veth-test1@veth-test2了

    $ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp0s5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 00:1c:42:0c:7c:82 brd ff:ff:ff:ff:ff:ff

    它们分别出现在了test1、test2中

    $ ip netns exec test1 ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
4: veth-test1@if3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether b6:6e:98:86:5c:80 brd ff:ff:ff:ff:ff:ff link-netns test2
$ ip netns exec test2 ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
3: veth-test2@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 7e:43:1a:8a:a1:53 brd ff:ff:ff:ff:ff:ff link-netns test1

    但此时，这一对veth仅有mac地址，没有ip，那么接下来就给它们分配ip地址

    $ ip netns exec test1 ip addr add 192.168.1.1/24 dev veth-test1
$ ip netns exec test2 ip addr add 192.168.1.2/24 dev veth-test2

    此时，这一对veth已经有了IP地址，但还处于DOWN状态。

    $ ip netns exec test1 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
4: veth-test1@if3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether b6:6e:98:86:5c:80 brd ff:ff:ff:ff:ff:ff link-netns test2
    inet 192.168.1.1/24 scope global veth-test1
       valid_lft forever preferred_lft forever
$ ip netns exec test2 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
3: veth-test2@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 7e:43:1a:8a:a1:53 brd ff:ff:ff:ff:ff:ff link-netns test1
    inet 192.168.1.2/24 scope global veth-test2
       valid_lft forever preferred_lft forever

    接着，先将veth-test1设为UP状态

    $ netns exec test1 ip link set dev veth-test1 up

    但结果仍处于LOWERLAYERDOWN状态

    $ ip netns exec test1 ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
4: veth-test1@if3: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state LOWERLAYERDOWN group default qlen 1000
    link/ether b6:6e:98:86:5c:80 brd ff:ff:ff:ff:ff:ff link-netns test2
    inet 192.168.1.1/24 scope global veth-test1
       valid_lft forever preferred_lft forever

    这是因为与它连接的veth-test2还没有UP，接着将veth-test2也设为UP状态

    ip netns exec test2 ip link set dev veth-test2 up

    查看veth-test2，状态为UP

    $ ip netns exec test2 ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
3: veth-test2@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 7e:43:1a:8a:a1:53 brd ff:ff:ff:ff:ff:ff link-netns test1
    inet 192.168.1.2/24 scope global veth-test2
       valid_lft forever preferred_lft forever
    inet6 fe80::7c43:1aff:fe8a:a153/64 scope link
       valid_lft forever preferred_lft forever

    再查看veth-test1，状态也变成了UP，所以刚才的LOWERLAYERDOWN可以理解为等待其它设备与它连接。

    $ ip netns exec test1 ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
4: veth-test1@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether b6:6e:98:86:5c:80 brd ff:ff:ff:ff:ff:ff link-netns test2
    inet 192.168.1.1/24 scope global veth-test1
       valid_lft forever preferred_lft forever
    inet6 fe80::b46e:98ff:fe86:5c80/64 scope link
       valid_lft forever preferred_lft forever

    4.测试网络连接

    最后，使用ping命令来测试以两个命名空间中2个网络接口是否能正常连接。

    $ ip netns exec test1 ping 192.168.1.2
PING 192.168.1.2 (192.168.1.2) 56(84) bytes of data.
64 bytes from 192.168.1.2: icmp_seq=1 ttl=64 time=0.037 ms
64 bytes from 192.168.1.2: icmp_seq=2 ttl=64 time=0.065 ms
64 bytes from 192.168.1.2: icmp_seq=3 ttl=64 time=0.065 ms
^C
--- 192.168.1.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 37ms
rtt min/avg/max/mdev = 0.037/0.055/0.065/0.015 ms
$ ip netns exec test2 ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.033 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.063 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.063 ms
^C
--- 192.168.1.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 45ms
rtt min/avg/max/mdev = 0.033/0.053/0.063/0.014 ms

    从结果可以看到，创建两个网络命名空间，再将一对veth设备分配给它们，配置ip地址后，互相就能正常连接了。

    实际上，同一个宿主机上，不同的docker容器之间能够进行网络连接，也正是这个原理。

    最后，上一张简单的示意图来总结下上面实验，可能命令和输出结果太多了让人眼花，对照图片看看吧。

    image.png

    相关文章

      网友评论

          本文标题：Linux Network Namespace

          本文链接：https://www.haomeiwen.com/subject/mblepftx.html

          延伸阅读

          深度阅读

          • 您也可以注册成为美文阅读网的作者，发表您的原创作品、分享您的心情！

          栏目导航

          热点阅读

          关于我们|服务条款|联系我们|Linux Network Namespace|投稿指南|网站地图|RSS订阅|排版工具|手机版

          提供经典美文摘抄,优美散文欣赏,现代诗歌精选,短篇小说,心情随笔,表白情书范文,故事会在线阅读欣赏

          Copyright © 2014-2023 Haomeiwen.com All Rights Reserved. 好美文阅读网 版权所有

          备案信息：桂公网安备 45052102000051号 · 桂ICP备13007215号-3

          本站所收录作品、热点评论等信息部分来源互联网，目的只是为了系统归纳学习和传递资讯

          所有作品版权归原创作者所有，与本站立场无关，如不慎侵犯了你的权益，请联系我们告知，我们将做删除处理！