在不同子網中橋接Xen domU與網關

Question

我有一個運行Debian Wheezy（7.8）和Xen 4.1的Xen dom0，使用橋接網絡進行設置。

• 199.XXX.161.64是dom0網關。
• 199.XXX.161.65是dom0地址。
• 192.XXX.13.128/28是domU的子網。

配置的dom0：

root@dom0:~# cat /etc/network/interfaces 
auto lo 
iface lo inet loopback 

auto eth0 
iface eth0 inet manual 

auto xenbr0 
iface xenbr0 inet static 
    address 199.XXX.161.65 
    netmask 255.255.255.254 
    network 199.XXX.161.64 
    broadcast 199.XXX.161.65 
    gateway 199.XXX.161.64 
    dns-nameservers 199.XXX.162.41 199.XXX.162.141 
    bridge_ports eth0 
    bridge_stp off  # disable Spanning Tree Protocol 
    bridge_fd 0   # no forwarding delay 
    bridge_maxwait 0 # no delay before a port becomes available 

allow-hotplug xenbr0 # start interface on hotplug event 


root@dom0:~# ip a 
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 
    inet 127.0.0.1/8 scope host lo 
    inet6 ::1/128 scope host 
     valid_lft forever preferred_lft forever 
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master xenbr0 state UP qlen 1000 
    link/ether 00:25:90:d5:06:1a brd ff:ff:ff:ff:ff:ff 
3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000 
    link/ether 00:25:90:d5:06:1b brd ff:ff:ff:ff:ff:ff 
4: xenbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 00:25:90:d5:06:1a brd ff:ff:ff:ff:ff:ff 
    inet 199.XXX.161.65/31 brd 199.XXX.161.65 scope global xenbr0 
    inet6 fe80::XXXX:90ff:fed5:61a/64 scope link 
     valid_lft forever preferred_lft forever 
8: vif1.0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master xenbr0 state UP qlen 32 
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff 
    inet6 fe80::fcff:ffff:feff:ffff/64 scope link 
     valid_lft forever preferred_lft forever 


root@dom0:~# brctl show 
bridge name bridge id   STP enabled interfaces 
xenbr0  8000.002590d5061a no   eth0 
              vif1.0 


root@dom0:~# route -n 
Kernel IP routing table 
Destination  Gateway   Genmask   Flags Metric Ref Use Iface 
0.0.0.0   199.XXX.161.64 0.0.0.0   UG 0  0  0 xenbr0 
192.XXX.13.128 0.0.0.0   255.255.255.240 U  0  0  0 xenbr0 
199.XXX.161.64 0.0.0.0   255.255.255.254 U  0  0  0 xenbr0 

root@dom0:~# iptables -L -n 
Chain INPUT (policy ACCEPT) 
target  prot opt source    destination 

Chain FORWARD (policy ACCEPT) 
target  prot opt source    destination 
ACCEPT  all -- 0.0.0.0/0   0.0.0.0/0   PHYSDEV match --physdev-out vif1.0 --physdev-is-bridged 
ACCEPT  udp -- 0.0.0.0/0   0.0.0.0/0   PHYSDEV match --physdev-in vif1.0 --physdev-is-bridged udp spt:68 dpt:67 
ACCEPT  all -- 0.0.0.0/0   0.0.0.0/0   PHYSDEV match --physdev-out vif1.0 --physdev-is-bridged 
ACCEPT  all -- 192.XXX.13.129  0.0.0.0/0   PHYSDEV match --physdev-in vif1.0 --physdev-is-bridged 

Chain OUTPUT (policy ACCEPT) 
target  prot opt source    destination 

這臺主機可以達到它的網關，因此互聯網。

root@dom0:~# ping -c 1 199.XXX.161.64 
PING 199.XXX.161.64 (199.XXX.161.64) 56(84) bytes of data. 
64 bytes from 199.XXX.161.64: icmp_req=1 ttl=64 time=0.459 ms 

--- 199.XXX.161.64 ping statistics --- 
1 packets transmitted, 1 received, 0% packet loss, time 0ms 
rtt min/avg/max/mdev = 0.459/0.459/0.459/0.000 ms 

我也有一個domU（具有相同的操作系統），它需要在不同的子網中的主IP地址。此子網中的網絡上沒有網關。我想保持我的網絡設置橋接（沒有dom0路由或NAT），所以我添加了dom0網關作爲domU的網關，如this blogpost中所述。

配置的domU：

root@domU:~# ip a 
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 
    inet 127.0.0.1/8 scope host lo 
    inet6 ::1/128 scope host 
     valid_lft forever preferred_lft forever 
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 
    link/ether 00:16:3e:b7:7e:cc brd ff:ff:ff:ff:ff:ff 
    inet 192.XXX.13.129/28 brd 192.XXX.13.143 scope global eth0 
    inet6 fe80::XXXX:3eff:feb7:7ecc/64 scope link 
     valid_lft forever preferred_lft forever 


root@domU:~# route -n 
Kernel IP routing table 
Destination  Gateway   Genmask   Flags Metric Ref Use Iface 
0.0.0.0   199.XXX.161.64 0.0.0.0   UG 0  0  0 eth0 
192.XXX.13.128 0.0.0.0   255.255.255.240 U  0  0  0 eth0 
199.XXX.161.64 0.0.0.0   255.255.255.255 UH 0  0  0 eth0 

在這種配置下的domU仍然沒有網絡接入。爲了測試橋是否工作，我手動添加了一個路由到dom0。

root@domU:~# route -n 
Kernel IP routing table 
Destination  Gateway   Genmask   Flags Metric Ref Use Iface 
0.0.0.0   199.XXX.161.64 0.0.0.0   UG 0  0  0 eth0 
192.XXX.13.128 0.0.0.0   255.255.255.240 U  0  0  0 eth0 
199.XXX.161.64 0.0.0.0   255.255.255.255 UH 0  0  0 eth0 
199.XXX.161.65 0.0.0.0   255.255.255.255 UH 0  0  0 eth0 

現在，dom0和domU可以通過網橋進行通信。

root@domU:~# ping -c 1 199.XXX.161.65 
PING 199.XXX.161.65 (199.XXX.161.65) 56(84) bytes of data. 
64 bytes from 199.XXX.161.65: icmp_req=1 ttl=64 time=0.037 ms 

--- 199.XXX.161.65 ping statistics --- 
1 packets transmitted, 1 received, 0% packet loss, time 0ms 
rtt min/avg/max/mdev = 0.037/0.037/0.037/0.000 ms 

root@dom0:~# ping -c 1 192.XXX.13.129 
PING 192.184.13.129 (192.XXX.13.129) 56(84) bytes of data. 
64 bytes from 192.XXX.13.129: icmp_req=1 ttl=64 time=0.100 ms 

--- 192.XXX.13.129 ping statistics --- 
1 packets transmitted, 1 received, 0% packet loss, time 0ms 
rtt min/avg/max/mdev = 0.100/0.100/0.100/0.000 ms 

但是，domU仍然無法到達網關。

root@domU:~# ping -c 1 199.XXX.161.64 
PING 199.XXX.161.64 (199.XXX.161.64) 56(84) bytes of data. 
From 192.XXX.13.129 icmp_seq=1 Destination Host Unreachable 

--- 199.XXX.161.64 ping statistics --- 
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms 

我試圖登錄確定是否實際上是被通過的橋樑通過在INPUT，OUTPUT和FORWARD iptables的鏈的頂端插入-j LOG規則發送的流量。當domU嘗試ping網關時，dom0不記錄單個數據包。我還嘗試在domU的ARP表中手動添加網關條目，但結果相同。除了能夠通過靜態路由與dom0進行通信之外，domU無法到達網關，因此沒有網絡訪問權限。

Answer 1

所以，如果我理解正確這一點，下面是你的DomU的網絡配置：

• 192.XXX.13.129/28 - DomU的IP地址
• 199.XXX.161.64 - DomU的GW地址

問題是你的DomU沒有一個路由（第3層）允許它與GW地址對話，因爲GW地址在不同的子網中。因此，即使路由器位於同一個第2層網絡中，路由器（如果它正在處理您的數據包）也不知道您的第3層網絡，並將其響應發送給其默認網關。

你能夠從DomU ping Dom0很奇怪，可能是Dom0和DomU使用同一個Linux Bridge（它不是真正的以太網交換機，更像是一個啞集線器）的結果。

簡單的修復方法是將DomU網絡的地址添加到路由器上的LAN接口。

更好的解決方法是使用VLAN通過第2層分割不同的網絡，並用Open vSwitch替換Linux橋接器。這將完全隔離Dom0和DomU流量，以便它們被要求通過路由器和可能的防火牆進行通信。