美文网首页Docker容器虚拟化技术
[docker 网络] 跨主机docker容器隔离 VLAN

[docker 网络] 跨主机docker容器隔离 VLAN

作者: nicktming | 来源:发表于2019-06-08 18:17 被阅读1次

1. 前言

[docker 网络] 单主机docker容器网络隔离 VLAN 使用了单主机内的容器网络隔离, 本文将测试跨主机容器的网络隔离. (容器都在同一个网络中)

2. 配置

2.1 当前环境

[root@vm1 ovs-learning]# iptables -t nat -F
[root@vm1 ovs-learning]# echo 0 > /proc/sys/net/ipv4/ip_forward

2.2 vm1配置

脚本

docker run -d --name con1 --net=none --privileged=true busybox top
docker run -d --name con2 --net=none --privileged=true busybox top
# 添加ovs网桥br0
ovs-vsctl add-br br0
# 为两个容器配置网络
ovs-docker add-port br0 eth0 con1 --ipaddress=192.168.0.1/16
ovs-docker add-port br0 eth0 con2 --ipaddress=192.168.0.2/16
# 建立gre tunnel
ovs-vsctl add-port br0 gre0 -- set interface gre0 type=gre options:remote_ip=172.19.0.8

执行完

[root@vm1 ovs-learning]# ovs-vsctl show
c152c245-2f6c-478c-9c07-2e4a3c7a2403
    Bridge "br0"
        Port "ffaf166ee3bd4_l"
            Interface "ffaf166ee3bd4_l"
        Port "e051d19358344_l"
            Interface "e051d19358344_l"
        Port "gre0"
            Interface "gre0"
                type: gre
                options: {remote_ip="172.19.0.8"}
        Port "br0"
            Interface "br0"
                type: internal
    ovs_version: "2.5.1"
[root@vm1 ovs-learning]# 
[root@vm1 ovs-learning]# docker exec -it con1 ping -c 1 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: seq=0 ttl=64 time=7.182 ms

--- 192.168.1.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 7.182/7.182/7.182 ms
[root@vm1 ovs-learning]# docker exec -it con1 ping -c 1 192.168.1.2
PING 192.168.1.2 (192.168.1.2): 56 data bytes
64 bytes from 192.168.1.2: seq=0 ttl=64 time=8.603 ms

--- 192.168.1.2 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 8.603/8.603/8.603 ms

con1 与 con2 互相通信.

2.3 vm2配置

vm2 配置

[root@vm2 ovs-learning]# echo 0 > /proc/sys/net/ipv4/ip_forward
[root@vm2 ovs-learning]# iptables -t nat -F

脚本

docker run -d --name con1 --net=none --privileged=true busybox top
docker run -d --name con2 --net=none --privileged=true busybox top
# 添加ovs网桥br0
ovs-vsctl add-br br0
# 为两个容器配置网络
ovs-docker add-port br0 eth0 con1 --ipaddress=192.168.1.1/16
ovs-docker add-port br0 eth0 con2 --ipaddress=192.168.1.2/16
# 建立gre tunnel
ovs-vsctl add-port br0 gre0 -- set interface gre0 type=gre options:remote_ip=172.19.0.12

执行完

[root@vm2 ovs-learning]# ovs-vsctl show
533800d4-246f-4099-a776-8254610db91f
    Bridge "br0"
        Port "82d505eb9e2e4_l"
            Interface "82d505eb9e2e4_l"
        Port "br0"
            Interface "br0"
                type: internal
        Port "77a338b1a9494_l"
            Interface "77a338b1a9494_l"
        Port "gre0"
            Interface "gre0"
                type: gre
                options: {remote_ip="172.19.0.12"}
    ovs_version: "2.5.1"
[root@vm2 ovs-learning]# docker exec -it con1 ping -c 1 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: seq=0 ttl=64 time=0.064 ms

--- 192.168.1.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.064/0.064/0.064 ms
[root@vm2 ovs-learning]# docker exec -it con1 ping -c 1 192.168.1.2
PING 192.168.1.2 (192.168.1.2): 56 data bytes
64 bytes from 192.168.1.2: seq=0 ttl=64 time=3.374 ms

--- 192.168.1.2 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 3.374/3.374/3.374 ms

con1 与 con2是互通的.

2.4 测试互相访问

origin.png

测试vm1中的con1,con2与vm2中的con1,con2是否可以互相访问, 因为有gre tunnel,并且处于同一网络内,所以理论上是可以访问.

从vm1的con1,con2访问vm2中的con1,con2成功

[root@vm1 ovs-learning]# docker exec -it con1 ping -c 1 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: seq=0 ttl=64 time=7.182 ms

--- 192.168.1.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 7.182/7.182/7.182 ms
[root@vm1 ovs-learning]# docker exec -it con1 ping -c 1 192.168.1.2
PING 192.168.1.2 (192.168.1.2): 56 data bytes
64 bytes from 192.168.1.2: seq=0 ttl=64 time=8.603 ms

--- 192.168.1.2 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 8.603/8.603/8.603 ms
[root@vm1 ovs-learning]# docker exec -it con2 ping -c 1 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: seq=0 ttl=64 time=6.881 ms

--- 192.168.1.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 6.881/6.881/6.881 ms
[root@vm1 ovs-learning]# docker exec -it con2 ping -c 1 192.168.1.2
PING 192.168.1.2 (192.168.1.2): 56 data bytes
64 bytes from 192.168.1.2: seq=0 ttl=64 time=9.141 ms

--- 192.168.1.2 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 9.141/9.141/9.141 ms

从vm2的con1,con2访问vm1中的con1,con2成功

[root@vm2 ovs-learning]# docker exec -it con1 ping -c 1 192.168.0.1
PING 192.168.0.1 (192.168.0.1): 56 data bytes
64 bytes from 192.168.0.1: seq=0 ttl=64 time=4.804 ms

--- 192.168.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 4.804/4.804/4.804 ms
[root@vm2 ovs-learning]# docker exec -it con1 ping -c 1 192.168.0.2
PING 192.168.0.2 (192.168.0.2): 56 data bytes
64 bytes from 192.168.0.2: seq=0 ttl=64 time=4.920 ms

--- 192.168.0.2 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 4.920/4.920/4.920 ms
[root@vm2 ovs-learning]# docker exec -it con2 ping -c 1 192.168.0.1
PING 192.168.0.1 (192.168.0.1): 56 data bytes
64 bytes from 192.168.0.1: seq=0 ttl=64 time=4.652 ms

--- 192.168.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 4.652/4.652/4.652 ms
[root@vm2 ovs-learning]# docker exec -it con2 ping -c 1 192.168.0.2
PING 192.168.0.2 (192.168.0.2): 56 data bytes
64 bytes from 192.168.0.2: seq=0 ttl=64 time=3.129 ms

--- 192.168.0.2 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 3.129/3.129/3.129 ms

3. 设置tag

3.1 为vm1中的容器设置tag

vm1

[root@vm1 ovs-learning]# ovs-vsctl show
c152c245-2f6c-478c-9c07-2e4a3c7a2403
    Bridge "br0"
        Port "ffaf166ee3bd4_l"
            Interface "ffaf166ee3bd4_l"
        Port "e051d19358344_l"
            Interface "e051d19358344_l"
        Port "gre0"
            Interface "gre0"
                type: gre
                options: {remote_ip="172.19.0.8"}
        Port "br0"
            Interface "br0"
                type: internal
    ovs_version: "2.5.1"
[root@vm1 ovs-learning]# ovs-vsctl list interface ffaf166ee3bd4_l | grep container_id
external_ids        : {container_id="con2", container_iface="eth0"}
[root@vm1 ovs-learning]# ovs-vsctl set port ffaf166ee3bd4_l tag=200
[root@vm1 ovs-learning]# 
[root@vm1 ovs-learning]# ovs-vsctl list interface e051d19358344_l | grep container_id
external_ids        : {container_id="con1", container_iface="eth0"}
[root@vm1 ovs-learning]# ovs-vsctl set port e051d19358344_l tag=100

3.2 为vm2中的容器设置tag

vm2

[root@vm2 ovs-learning]# ovs-vsctl show
533800d4-246f-4099-a776-8254610db91f
    Bridge "br0"
        Port "82d505eb9e2e4_l"
            Interface "82d505eb9e2e4_l"
        Port "br0"
            Interface "br0"
                type: internal
        Port "77a338b1a9494_l"
            Interface "77a338b1a9494_l"
        Port "gre0"
            Interface "gre0"
                type: gre
                options: {remote_ip="172.19.0.12"}
    ovs_version: "2.5.1"
[root@vm2 ovs-learning]# ovs-vsctl list interface 82d505eb9e2e4_l | grep container_id
external_ids        : {container_id="con2", container_iface="eth0"}
[root@vm2 ovs-learning]# ovs-vsctl set port 82d505eb9e2e4_l tag=200
[root@vm2 ovs-learning]# 
[root@vm2 ovs-learning]# ovs-vsctl list interface 77a338b1a9494_l | grep container_id
external_ids        : {container_id="con1", container_iface="eth0"}
[root@vm2 ovs-learning]# ovs-vsctl set port 77a338b1a9494_l tag=100

3.3 测试

tag.png

测试后vm1的con1可以互相访问到vm2的con1, 不能访问vm1或者vm2的con2.
测试后vm1的con2可以互相访问到vm2的con2, 不能访问vm1或者vm2的con1.

[root@vm1 ovs-learning]# docker exec -it con1 ping -c 1 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: seq=0 ttl=64 time=9.737 ms

--- 192.168.1.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 9.737/9.737/9.737 ms
[root@vm1 ovs-learning]# docker exec -it con1 ping -c 1 192.168.1.2
PING 192.168.1.2 (192.168.1.2): 56 data bytes

--- 192.168.1.2 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
[root@vm1 ovs-learning]# docker exec -it con1 ping -c 1 192.168.0.2
PING 192.168.0.2 (192.168.0.2): 56 data bytes

--- 192.168.0.2 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
[root@vm1 ovs-learning]# 
[root@vm1 ovs-learning]# docker exec -it con2 ping -c 1 192.168.1.2
PING 192.168.1.2 (192.168.1.2): 56 data bytes
64 bytes from 192.168.1.2: seq=0 ttl=64 time=7.109 ms

--- 192.168.1.2 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 7.109/7.109/7.109 ms
[root@vm1 ovs-learning]# docker exec -it con2 ping -c 1 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes

--- 192.168.1.1 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
[root@vm1 ovs-learning]# docker exec -it con2 ping -c 1 192.168.0.1
PING 192.168.0.1 (192.168.0.1): 56 data bytes

--- 192.168.0.1 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
[root@vm1 ovs-learning]#

4. 设置trunk

4.1 为vm1的gre0设置trunk

vm1

[root@vm1 ovs-learning]# ovs-vsctl set port gre0 VLAN_mode=trunk
[root@vm1 ovs-learning]# ovs-vsctl set port gre0 trunk=100
[root@vm1 ovs-learning]# ovs-vsctl show
c152c245-2f6c-478c-9c07-2e4a3c7a2403
    Bridge "br0"
        Port "ffaf166ee3bd4_l"
            tag: 200
            Interface "ffaf166ee3bd4_l"
        Port "e051d19358344_l"
            tag: 100
            Interface "e051d19358344_l"
        Port "gre0"
            trunks: [100]
            Interface "gre0"
                type: gre
                options: {remote_ip="172.19.0.8"}
        Port "br0"
            Interface "br0"
                type: internal
    ovs_version: "2.5.1"

4.2 为vm2的gre0设置trunk

vm2

[root@vm2 ovs-learning]# ovs-vsctl set port gre0 VLAN_mode=trunk
[root@vm2 ovs-learning]# ovs-vsctl set port gre0 trunk=100
[root@vm2 ovs-learning]# ovs-vsctl show
533800d4-246f-4099-a776-8254610db91f
    Bridge "br0"
        Port "82d505eb9e2e4_l"
            tag: 200
            Interface "82d505eb9e2e4_l"
        Port "br0"
            Interface "br0"
                type: internal
        Port "77a338b1a9494_l"
            tag: 100
            Interface "77a338b1a9494_l"
        Port "gre0"
            trunks: [100]
            Interface "gre0"
                type: gre
                options: {remote_ip="172.19.0.12"}
    ovs_version: "2.5.1"

4.3 测试

trunk.png

此时只有tag=100的容器可以互相访问, 所以vm1的con1可以与vm2的con1互相访问, vm1的con2就不能互相访问vm2的con2了.

[root@vm1 ovs-learning]# docker exec -it con2 ping -c 1 192.168.1.2
PING 192.168.1.2 (192.168.1.2): 56 data bytes

--- 192.168.1.2 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
[root@vm1 ovs-learning]# docker exec -it con1 ping -c 1 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: seq=0 ttl=64 time=4.467 ms

--- 192.168.1.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 4.467/4.467/4.467 ms
[root@vm1 ovs-learning]#

vm2中的con2访问不了vm1的con2, vm2的con1可以访问vm1的con1.

[root@vm2 ovs-learning]# docker exec -it con2 ping -c 1 192.168.0.2
PING 192.168.0.2 (192.168.0.2): 56 data bytes

--- 192.168.0.2 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
[root@vm2 ovs-learning]# docker exec -it con1 ping -c 1 192.168.0.1
PING 192.168.0.1 (192.168.0.1): 56 data bytes
64 bytes from 192.168.0.1: seq=0 ttl=64 time=4.642 ms

--- 192.168.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 4.642/4.642/4.642 ms
[root@vm2 ovs-learning]#

5. 参考

1. Docker 容器与容器云
2. https://zpzhou.com/archives/openvswitch_vlan.html

相关文章

网友评论

    本文标题：[docker 网络] 跨主机docker容器隔离 VLAN

    本文链接：https://www.haomeiwen.com/subject/tdcdxctx.html

    延伸阅读

    深度阅读

    • 您也可以注册成为美文阅读网的作者，发表您的原创作品、分享您的心情！

    栏目导航

    热点阅读

    Docker容器

    虚拟化技术

    关于我们|服务条款|联系我们|[docker 网络] 跨主机docker容器隔离 VLAN|投稿指南|网站地图|RSS订阅|排版工具|手机版

    提供经典美文摘抄,优美散文欣赏,现代诗歌精选,短篇小说,心情随笔,表白情书范文,故事会在线阅读欣赏

    Copyright © 2014-2023 Haomeiwen.com All Rights Reserved. 好美文阅读网 版权所有

    备案信息：桂公网安备 45052102000051号 · 桂ICP备13007215号-3

    本站所收录作品、热点评论等信息部分来源互联网，目的只是为了系统归纳学习和传递资讯

    所有作品版权归原创作者所有，与本站立场无关，如不慎侵犯了你的权益，请联系我们告知，我们将做删除处理！