Linux网络命名空间模拟Openstack网络架构

1. 创建网络命名空间

# 创建VM命名空间
sudo ip netns add TenantA-VM1
sudo ip netns add TenantA-VM2
sudo ip netns add TenantC-VM1
sudo ip netns add TenantC-VM2
sudo ip netns add TenantC-VM3
sudo ip netns add TenantC-VM4

# 创建路由器命名空间
sudo ip netns add TenantA-Router
sudo ip netns add TenantC-Router

2. 创建虚拟交换机和连接

# 创建bridge
sudo ip link add TenantA-br type bridge
sudo ip link add TenantC-br1 type bridge
sudo ip link add TenantC-br2 type bridge
sudo ip link add Ext-br type bridge

# 激活bridge
sudo ip link set TenantA-br up
sudo ip link set TenantC-br1 up
sudo ip link set TenantC-br2 up
sudo ip link set Ext-br up

3. 连接VM到私有网络

# TenantA VMs
sudo ip link add veth-A1 type veth peer name A1-br
sudo ip link set A1-br master TenantA-br
sudo ip link set veth-A1 netns TenantA-VM1

sudo ip link add veth-A2 type veth peer name A2-br
sudo ip link set A2-br master TenantA-br
sudo ip link set veth-A2 netns TenantA-VM2

# TenantC VMs
sudo ip link add veth-C1 type veth peer name C1-br
sudo ip link set C1-br master TenantC-br1
sudo ip link set veth-C1 netns TenantC-VM1

sudo ip link add veth-C2 type veth peer name C2-br
sudo ip link set C2-br master TenantC-br1
sudo ip link set veth-C2 netns TenantC-VM2

sudo ip link add veth-C3 type veth peer name C3-br
sudo ip link set C3-br master TenantC-br2
sudo ip link set veth-C3 netns TenantC-VM3

sudo ip link add veth-C4 type veth peer name C4-br
sudo ip link set C4-br master TenantC-br2
sudo ip link set veth-C4 netns TenantC-VM4

4. 配置路由器和外部网络

# TenantA Router
sudo ip link add RA-ext type veth peer name Ext-RA
sudo ip link set RA-ext netns TenantA-Router
sudo ip link set Ext-RA master Ext-br

# TenantC Router
sudo ip link add RC-ext type veth peer name Ext-RC
sudo ip link set RC-ext netns TenantC-Router
sudo ip link set Ext-RC master Ext-br

# 连接私有网络到路由器
sudo ip link add RA-priv type veth peer name priv-RA
sudo ip link set RA-priv netns TenantA-Router
sudo ip link set priv-RA master TenantA-br

sudo ip link add RC-priv1 type veth peer name priv1-RC
sudo ip link set RC-priv1 netns TenantC-Router
sudo ip link set priv1-RC master TenantC-br1

sudo ip link add RC-priv2 type veth peer name priv2-RC
sudo ip link set RC-priv2 netns TenantC-Router
sudo ip link set priv2-RC master TenantC-br2

5. 配置IP地址

# TenantA VMs
sudo ip netns exec TenantA-VM1 ip addr add 10.0.0.2/24 dev veth-A1
sudo ip netns exec TenantA-VM2 ip addr add 10.0.0.3/24 dev veth-A2

# TenantC VMs
sudo ip netns exec TenantC-VM1 ip addr add 10.0.0.2/24 dev veth-C1
sudo ip netns exec TenantC-VM2 ip addr add 10.0.0.3/24 dev veth-C2
sudo ip netns exec TenantC-VM3 ip addr add 10.0.1.2/24 dev veth-C3
sudo ip netns exec TenantC-VM4 ip addr add 10.0.1.3/24 dev veth-C4

# Routers
sudo ip netns exec TenantA-Router ip addr add 10.0.0.1/24 dev RA-priv
sudo ip netns exec TenantA-Router ip addr add 30.0.0.2/22 dev RA-ext

sudo ip netns exec TenantC-Router ip addr add 10.0.0.1/24 dev RC-priv1
sudo ip netns exec TenantC-Router ip addr add 10.0.1.1/24 dev RC-priv2
sudo ip netns exec TenantC-Router ip addr add 30.0.0.3/22 dev RC-ext

# 外部网络网关（假设30.0.0.1在宿主机）
sudo ip addr add 30.0.0.1/22 dev Ext-br

6. 配置路由和NAT

# 启用IP转发
sudo sysctl -w net.ipv4.ip_forward=1

# TenantA Router
sudo ip netns exec TenantA-Router sysctl -w net.ipv4.ip_forward=1
sudo ip netns exec TenantA-Router iptables -t nat -A POSTROUTING -o RA-ext -j MASQUERADE
sudo ip netns exec TenantA-Router ip route add default via 30.0.0.1

# TenantC Router
sudo ip netns exec TenantC-Router sysctl -w net.ipv4.ip_forward=1
sudo ip netns exec TenantC-Router iptables -t nat -A POSTROUTING -o RC-ext -j MASQUERADE
sudo ip netns exec TenantC-Router ip route add default via 30.0.0.1

# VM默认路由
sudo ip netns exec TenantA-VM1 ip route add default via 10.0.0.1
sudo ip netns exec TenantA-VM2 ip route add default via 10.0.0.1
sudo ip netns exec TenantC-VM1 ip route add default via 10.0.0.1
sudo ip netns exec TenantC-VM2 ip route add default via 10.0.0.1
sudo ip netns exec TenantC-VM3 ip route add default via 10.0.1.1
sudo ip netns exec TenantC-VM4 ip route add default via 10.0.1.1

7. 验证测试

# 同网段通信（TenantA-VM1 -> TenantA-VM2）
sudo ip netns exec TenantA-VM1 ping 10.0.0.3

# 跨网段通信（TenantC-VM1 -> TenantC-VM3）
sudo ip netns exec TenantC-VM1 ping 10.0.1.2

# 访问外网（TenantA-VM1 -> 外部网关）
sudo ip netns exec TenantA-VM1 ping 30.0.0.1

# 跨租户通信（需要额外策略）

关键点说明：

1. 使用bridge实现同网段通信
2. 路由器命名空间处理跨子网路由
3. NAT实现外网访问
4. 所有接口需要ip link set up激活
5. 外部网络30.0.0.0/22的网关需在宿主机配置或连接真实网络设备

注意：实际环境中可能需要额外处理ARP代理和防火墙规则。建议使用tcpdump在关键接口抓包排查问题。