neutron DVR 通信流程

最新推荐文章于 2019-05-21 20:48:16 发布

原创

最新推荐文章于 2019-05-21 20:48:16 发布 · 1k 阅读

2 ·

CC 4.0 BY-SA版权

本文详细阐述了Neutron DVR模式下，东西向流量（如A ping B）和南北向流量（VM访问外部网络）的通信流程。涉及数据包在计算节点和网络节点上的路由、SNAT转换、ARP寻址以及FIP的处理策略，揭示了DVR模式在OpenStack网络中的工作原理。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

场景1：
网络采用dvr模式
A:192.168.1.5
B:192.168.2.7

东西向流量：A ping B

数据包首先到达A的网关qr1:192.168.1.1

在· 在这里插入图片描述
A的网关qr1：192.168.1.1与A的虚拟网卡tap1都连接在br-int交换机上，第一步数据包直接发送到网关 .

计算节点路由namespace

[root@compute1 ~]# ip netns
qrouter-37842dc4-50bf-44b0-9559-00fe2cd7bac8
[root@compute1 ~]# ip netns exec qrouter-37842dc4-50bf-44b0-9559-00fe2cd7bac8 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
16: qr-1af1d89d-f6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN group default qlen 1000
    link/ether fa:16:3e:dd:46:3d brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.1/24 brd 192.168.2.255 scope global qr-1af1d89d-f6
       valid_lft forever preferred_lft forever
    inet6 fe80::f816:3eff:fedd:463d/64 scope link 
       valid_lft forever preferred_lft forever
17: qr-e6a45441-da: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN group default qlen 1000
    link/ether fa:16:3e:13:83:f2 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global qr-e6a45441-da
       valid_lft forever preferred_lft forever
    inet6 fe80::f816:3eff:fe13:83f2/64 scope link 
       valid_lft forever preferred_lft forever

[root@compute2 ~]# ip netns exec qrouter-37842dc4-50bf-44b0-9559-00fe2cd7bac8 ip nei
192.168.1.2 dev qr-e6a45441-da lladdr fa:16:3e:14:ff:c9 PERMANENT
192.168.2.2 dev qr-1af1d89d-f6 lladdr fa:16:3e:06:5c:94 PERMANENT
192.168.2.6 dev qr-1af1d89d-f6 lladdr fa:16:3e:1c:76:34 PERMANENT
192.168.1.5 dev qr-e6a45441-da lladdr fa:16:3e:1f:ef:2c PERMANENT
192.168.1.9 dev qr-e6a45441-da lladdr fa:16:3e:3d:4b:98 PERMANENT
192.168.1.3 dev qr-e6a45441-da lladdr fa:16:3e:1d:10:15 PERMANENT
192.168.2.15 dev qr-1af1d89d-f6 lladdr fa:16:3e:38:67:5c PERMANENT
192.168.2.7 dev qr-1af1d89d-f6 lladdr fa:16:3e:ee:89:21 PERMANENT

到达qrouter中的网关（192.168.1.1）后，通过静态路由表查找到目标（192.168.2.7）mac，此时源mac地址为192.168.2.1的mac地址为（fa:16:3e:dd:46:3d），目标mac为fa:16:3e:ee:89:21.
在将数据包发出计算节点前，经过以下规则将源mac修改为dvr_host_macs. fa:16:3f:b9:f5:9e.，这是分布式路由中比较巧妙的一点

 cookie=0xf665ca95b2522963, duration=3461.538s, table=1, n_packets=0, n_bytes=0, priority=1,dl_vlan=2,dl_src=fa:16:3e:dd:46:3d actions=mod_dl_src:fa:16:3f:b9:f5:9e,resubmit(,2)

根据目标mac地址（fa:16:3e:ee:89:21 ）选择vxlan出口

 cookie=0xf665ca95b2522963, duration=3462.926s, table=20, n_packets=0, n_bytes=0, priority=2,dl_vlan=2,dl_dst=fa:16:3e:ee:89:21 actions=strip_vlan,load:0x1c->NXM_NX_TUN_ID[],output:"vxlan-0ac88961"

compute3
根据源mac（compte2的dvr host）匹配流表

[root@compute3 ~]# ovs-ofctl dump-flows br-tun|more
 cookie=0x33fef470ab162913, duration=6811.923s, table=9, n_packets=583, n_bytes=57134, idle_age=1, priority=1,dl_src=fa:16:3f:b9:f5:9e actions=output:1

以下规则将流量提交至一号表并修改源mac地址为192.168.2.1的网关地址:fa:16:3e:dd:46:3d

[root@compute3 ~]# ovs-ofctl dump-flows br-int|more
NXST_FLOW reply (xid=0x4):
 cookie=0x10c1e3c2df3b5b43, duration=7013.089s

最低0.47元/天解锁文章

200万优质内容无限畅学