浏览此站
联系我们相册切换到窄版 Language

 找回密码
 注册
易陆发现论坛»论坛 › 云计算开源区 › OpenStack介绍版 › openstack添加vrrp安全组规则入口配置
返回列表 发新帖
查看: 1494|回复: 3

openstack添加vrrp安全组规则入口配置

[复制链接]
admin

1

主题

0

回帖

12

积分

管理员

积分
12
QQ
发表于 2021-12-7 15:01:06 | 显示全部楼层 |阅读模式
       valid_lft forever preferred_lft forever
& M5 m3 f: \# J[root@keepalievd-1 ~]# tcpdump -i eth1 vrrp ) _8 M; H) x& C0 d" T
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode4 v7 L1 w6 Z7 F# f) F3 `, y& k2 a
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes
' U3 L" x1 S% Y1 e15:01:31.166318 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20
" f( c) ]; F! ?. [8 x  |15:01:32.166682 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 202 X$ b' l6 B7 {" `( J
15:01:33.167075 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20
8 k7 S2 y1 S) `+ f4 U1 K^C+ x$ J; v* W' O# q7 S7 v* m

! O0 I+ B7 X& @. m# n7 z. t9 a[root@keepalived-2 ~]# tcpdump -i eth1  vrrp1 Q! o2 b" a: {5 w% W% p( Y1 A/ S
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
. {( {* D$ {4 Ulistening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes
% W* ]/ d. s- i) Y8 j15:01:22.170651 IP keepalived-2.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 99, authtype simple, intvl 1s, length 20
$ I% U5 A4 I9 C$ o4 p; ^. S3 k15:01:23.171685 IP keepalived-2.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 99, authtype simple, intvl 1s, length 20
- L6 V5 O9 h( x, p& i% [15:01:24.172739 IP keepalived-2.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 99, authtype simple, intvl 1s, length 20$ }+ F- D9 c5 S; j
15:01:25.173771 IP keepalived-2.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 99, authtype simple, intvl 1s, length 202 [: v( y# L1 ]0 w; m
15:01:26.174855 IP keepalived-2.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 99, authtype simple, intvl 1s, length 20
1 M; b* F/ d+ M/ N1 Y^C
3 H8 A9 ?& _  K! B
2 p1 N6 J2 N! F: x
7 R, t2 H* K: c: F5 ~7 n3 H在openstack平台上创建的keepalived虚机因安全组不通而导致vrrp不通，openstack上需要调整vrrp安全组规则入口配置：
2 r/ V! K- G3 O, f- {
7 }; }3 V+ o, X

2 k6 p$ i+ I0 V, I4 Q+ \7 }  Y( N入口		IPv4112任何192.168.0.0/24

) h9 h7 u) z5 A7 e0 y
/ W9 I4 T' \# M  @
入口1 `: L. ]- ?* s3 i: B
IPv4112任何0.0.0.0/0
回复

举报

admin

1

主题

0

回帖

12

积分

管理员

积分
12
QQ
 楼主| 发表于 2021-12-7 15:04:32 | 显示全部楼层
[root@keepalievd-1 ~]# tcpdump -i eth1 vrrp 9 B/ |- y) K  U
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode8 `# y, [+ s1 k! J0 l7 ^7 H
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes; H, r7 E; ?/ o0 _8 W
15:03:08.894788 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20
6 ?( O9 T8 F" \" ?  a& ^15:03:09.132334 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 20
2 j$ l1 D  @7 ^8 L9 C% Z15:03:09.895798 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20
% f& I" c4 W1 |) r$ L, N15:03:10.133082 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 20
! |; X- c! k. s! [: n* C, \2 f" u, p! L7 M15:03:10.896827 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20
' \3 h9 [7 U* J9 l/ v0 _3 a, t15:03:11.133514 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 200 ~( I* P. t7 o* r; f  v
15:03:11.897792 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 202 r' t2 Q! G* o1 A* t
15:03:12.134724 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 207 S& K) |0 Y9 L! d

/ Z4 y$ h2 g# V5 \6 ?0 I' K$ _第二台设备：% S5 F+ t. E! t/ F) E/ }0 r
8 [. s1 y1 k2 e) l( ~) U
[root@keepalived-2 ~]# tcpdump -i eth1  vrrp
; x: p  ^2 X7 {  x3 Btcpdump: verbose output suppressed, use -v or -vv for full protocol decode
) ?7 E1 T2 \7 ^listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes. _  D! }8 e4 [7 k( ?) b2 p" k$ `7 u
15:03:03.277349 IP 192.168.0.186 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20
, j+ D* l( I$ ~- i  g! r* d6 J15:03:03.516783 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 20+ w. [8 Q7 m' K. P
15:03:04.278375 IP 192.168.0.186 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20
" U8 f! b/ c* ~, G7 I8 X7 K1 A8 D15:03:04.517146 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 20) m6 s- B- I# l8 ~3 l
15:03:05.279264 IP 192.168.0.186 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20+ ]* D8 r5 b+ R# f6 M
15:03:05.517812 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 20
' N0 n) F" l' |* M15:03:06.280214 IP 192.168.0.186 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20
$ C+ v! s- s0 `+ u^C
. Z% X2 X: V  P) i5 f& L( p" D6 ^8 i# @# g
地址通了。
( c( S& K% N  e' i- S, n
回复

举报

admin

1

主题

0

回帖

12

积分

管理员

积分
12
QQ
 楼主| 发表于 2021-12-7 15:10:16 | 显示全部楼层
安全组允许VRRP协议
' c7 |; O5 A+ T' `$ B直接在控制台导航：项目-访问&安全，搜索虚机所在的安全组, 然后点击后面的管理规则按钮进入规则列表；点击添加规则按钮，弹出框里，在规则的下拉选里选择 其他协议, 然后再 端口 文本框输入 112, 最后点击添加按钮即可 # VRRP协议的端口号是112
回复

举报

admin

1

主题

0

回帖

12

积分

管理员

积分
12
QQ
 楼主| 发表于 2021-12-7 15:29:28 | 显示全部楼层
对于负载均衡，G版本已经集成了haproxy插件，对haproxy的配置做了一层封装，可以很方便的通过quantum去创建一个负载均衡池，为相同或者不同宿主机上的虚拟机提供负载均衡的能力。- g! u$ B( J. N0 n" p/ C' c# ^

) o% C5 {0 u1 X在这个模式下，haproxy是运行在宿主机上的。2 I& e" P. t5 e& _4 r! m1 q
遗憾的是，目前还不能通过openstack做到haproxy的高可用。  M6 ~. {) x1 Y; Z4 |0 K" W

/ r# j- G# g( b1 E3 w& F7 p想要做高可用，只能在虚拟机中去飘VIP了# U8 g/ |% w8 V: ~

# ~7 U- h, t# L2 T但是创建了虚拟机之后，在这个虚拟机实例中只能使用指定的IP。
2 v% w+ z! M5 @# |; j3 ?! G* K! U% K这就导致想在虚拟机中部署高可用去飘VIP是不可行的。
- X4 t) [# U4 f4 H+ ~+ _" ?2 @
% P- K8 p+ N3 _0 E1 _( K6 a( ]可以理解，在公有云环境下，是不可能让用户在虚拟机中随意去配置额外地址的。8 E) S: h1 k/ O% O
但我们是私有云环境，这个规则对私有云环境下很是麻烦。9 k0 R' j' {3 B* \: P0 W
在openstack中创建虚拟机，通过nova boot的--nic选项指定网卡和IP地址：+ s, }# k1 b0 s; G- x
--nic net-id=${NETWORK_ID},v4-fixed-ip=${Host_IP}
/ u+ s4 T( w8 v+ @: F
8 @' j# x$ t  o5 [& C* x之前一直以为是iptables规则导致的。于是去看了一遍宿主机中的iptables规则
- Z3 x/ C" \3 m/ V- X6 n1 Froot@node1:~# iptables -vnL
2 g, c8 L1 |8 H; N; d) _1 \Chain INPUT (policy ACCEPT 3556K packets, 744M bytes)4 v4 W  W9 q4 W' x
pkts bytes target prot opt in out source destination  v( i( i% `$ j& s
1778K 372M nova-compute-INPUT all -- * * 0.0.0.0/0 0.0.0.0/0% x( o7 }9 Q* l3 B9 a
/ z8 m. k7 L4 O8 R5 e' k' e
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
% y* X0 {6 R5 c2 K/ U: l0 Ppkts bytes target prot opt in out source destination
9 r0 `; E; b( t! Z" U4 F150 13488 nova-filter-top all -- * * 0.0.0.0/0 0.0.0.0/0
: e0 u6 Y3 z1 y& e' I, e6 1392 nova-compute-FORWARD all -- * * 0.0.0.0/0 0.0.0.0/0
9 |& j1 `9 y6 I9 b0 d6 t- r
, U/ p7 Z3 N) M# M5 i( fChain OUTPUT (policy ACCEPT 4208K packets, 567M bytes). \. K& b4 G2 Q
pkts bytes target prot opt in out source destination
& `/ h1 z+ ~. {$ E' m4 X4202K 567M nova-filter-top all -- * * 0.0.0.0/0 0.0.0.0/0
; U/ A! H2 @0 G: m3 j2106K 284M nova-compute-OUTPUT all -- * * 0.0.0.0/0 0.0.0.0/0
# S$ y( e' C) k' t; L8 y6 I( a% h5 _1 L% I5 j' M
Chain nova-compute-FORWARD (1 references)# f7 M& N5 r( I3 V+ h( n; r
pkts bytes target prot opt in out source destination
. F$ _/ E# i+ h3 C8 x3 }4 1312 ACCEPT udp -- * * 0.0.0.0 255.255.255.255 udp spt:68 dpt:67
2 a! g' j4 Z* p2 80 ACCEPT all -- brq3eefcd79-07 * 0.0.0.0/0 0.0.0.0/09 V0 Y+ P5 e; g- J4 A$ x2 D
0 0 ACCEPT all -- * brq3eefcd79-07 0.0.0.0/0 0.0.0.0/0- c, g' w8 Y7 }: _* u2 f
0 F- t& X5 ]0 o; ^8 Q0 M
Chain nova-compute-INPUT (1 references)% L6 @. w1 }4 x! U
pkts bytes target prot opt in out source destination8 B/ W/ O3 o# l8 A
2 656 ACCEPT udp -- * * 0.0.0.0 255.255.255.255 udp spt:68 dpt:67
  S- H$ w9 M4 n3 \4 g
! x5 B3 q, G1 y& LChain nova-compute-OUTPUT (1 references)
8 `  F0 s8 C: M6 E4 c9 g, F/ zpkts bytes target prot opt in out source destination
) H; o* j. G  @: U: {) |) L" f$ P7 \: H; h2 \( R* Y: l% W, r
Chain nova-compute-inst-15 (1 references)
; B- Z% l& G1 l+ R% opkts bytes target prot opt in out source destination# z2 t8 ^3 R( N7 ~! w* ]0 e( D1 ]
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID( a! v5 f6 V$ Y/ }" w8 x5 L
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED' W$ t) H* ]: q
0 0 nova-compute-provider all -- * * 0.0.0.0/0 0.0.0.0/0
6 l8 G; v. N: k" w# S! b7 g$ v" F0 0 ACCEPT udp -- * * 10.16.0.102 0.0.0.0/0 udp spt:67 dpt:68
" l7 g+ R3 A9 U' q0 X- S0 {0 0 ACCEPT all -- * * 10.16.0.0/24 0.0.0.0/0
: U: v. x9 \% s( X0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 1:65535* @1 r$ S* N. h; e3 X
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 1:65535
% T2 ?. o  z1 o  L% e( V0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/07 {* F) y( R& F6 Q7 c
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8 code 8' u, ~- v  q5 B9 p! Y) X
0 0 nova-compute-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0
9 u) x( V1 s  o4 d+ |6 l0 Q2 H, D" P4 d2 j" `1 i, F+ G; Q$ F5 s
Chain nova-compute-inst-17 (1 references)
( T' L& j& K$ z: K- B' F% E$ jpkts bytes target prot opt in out source destination
, R1 B6 y& r1 l* G5 a/ Q  j4 z7 M0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID7 {8 ~' K, I( L7 i
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED* w" \( X; W3 P9 Q3 ]1 ^
0 0 nova-compute-provider all -- * * 0.0.0.0/0 0.0.0.0/04 g. F" X# c0 V, ^2 L2 x. [
0 0 ACCEPT udp -- * * 10.16.0.102 0.0.0.0/0 udp spt:67 dpt:68& H! y2 K( s4 f7 q. y
0 0 ACCEPT all -- * * 10.16.0.0/24 0.0.0.0/09 c. j, X7 I5 T- U; O) |- }+ _
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 1:65535
; U  V+ ]( p0 U$ M0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 1:65535
  D% o" D5 r9 i# G! T2 k4 B0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 t6 ~: f6 ]7 {0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8 code 8( [7 A6 r, [3 g# M% w' ~
0 0 nova-compute-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0- q8 \# s% a5 v0 f5 Q
6 @4 ~- c& V5 f% w2 M
Chain nova-compute-local (1 references): j$ k1 o7 }8 ]) ?' v
pkts bytes target prot opt in out source destination$ C& d! Q/ T& E+ @2 f7 I
0 0 nova-compute-inst-15 all -- * * 0.0.0.0/0 10.16.0.1116 ~& O2 A; p" w9 m. Q, l1 \& K
0 0 nova-compute-inst-17 all -- * * 0.0.0.0/0 10.16.0.131; t% w& E/ }# Y+ _6 \% `9 _! t
) y2 C4 w5 P0 V. `" b, y& l2 ^/ N
Chain nova-compute-provider (2 references)
4 e7 V' T- Z# f1 u6 Jpkts bytes target prot opt in out source destination6 c7 }$ I" C4 \+ G

) {7 Y7 x: ~5 H7 |* o" ?Chain nova-compute-sg-fallback (2 references)+ O; Q+ {4 t% I0 x$ x" B: w# G
pkts bytes target prot opt in out source destination
+ N; e: c3 S7 {) v0 h; O- f0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
" l/ F4 D# D4 l, z  e' t0 O& F) A6 }! G
Chain nova-filter-top (2 references)
! X6 G5 e7 V& m3 |1 v3 Vpkts bytes target prot opt in out source destination! Y2 S+ r4 G% P+ @
2106K 284M nova-compute-local all -- * * 0.0.0.0/0 0.0.0.0/08 D3 r$ I* R/ _* S8 R( }# ]
0 z% m6 M5 M; H8 H5 H& {/ n
分析一下这些openstack自动生成的规则，可以看到input，forword和output链默认都是accept状态。分析每条链对数据包的跳转和过滤，如果在虚拟机中配置新的地址，是不会被过滤的。
. a- f. U7 o3 z( }; z# ~  P( v) C" R# y; E6 T* W* P; [
经过一番折腾，最终发现限制IP的原因是ebtables在起作用) y7 s, j; {' n$ }8 e' @: I( R* z
root@node1:~# ebtables -t nat -L2 N: R5 j9 x( Q$ r
Bridge table: nat8 V6 Q9 W. e% m0 b1 V$ T
& M" g- N3 l1 J4 {- W% }
Bridge chain: PREROUTING, entries: 2, policy: ACCEPT
2 D( C1 `+ f$ e1 f) {& o; E0 b& B" o-i tap0678bf1d-41 -j libvirt-I-tap0678bf1d-41# w9 A% [4 f9 N5 @- y8 @8 u& ~& R- x
-i tap496fa038-9e -j libvirt-I-tap496fa038-9e
1 S& ~$ K: C/ y' R  j
8 {( q) E- i8 p: V6 H" y6 ~9 PBridge chain: OUTPUT, entries: 0, policy: ACCEPT8 t: i1 A- S; i4 [2 S) t
+ Q: i6 B7 Y& ?' ~( P* K3 N" C" D
Bridge chain: POSTROUTING, entries: 0, policy: ACCEPT
+ W4 W5 X0 Q. l/ z
# `6 a- L. N' E9 oBridge chain: libvirt-I-tap0678bf1d-41, entries: 4, policy: ACCEPT1 G$ x5 h+ _; V( R
-j I-tap0678bf1d-41-mac7 F0 \9 M- L' ^6 b( \, S
-p IPv4 -j I-tap0678bf1d-41-ipv4-ip
' ^& ]# Z7 ~: i- u-p ARP -j I-tap0678bf1d-41-arp-mac# l5 t' i) R6 z* F, f/ Z
-p ARP -j I-tap0678bf1d-41-arp-ip4 V0 _; T# g2 O3 D" y8 L. r) [% b
. {2 [& U- M7 @( `% x
Bridge chain: I-tap0678bf1d-41-mac, entries: 2, policy: ACCEPT, |! E! r7 q0 h
-s fa:16:3e:a6:5f:70 -j RETURN- i( a4 r1 I" j$ k% k
-j DROP- S0 @1 m/ G& C( ^
/ [& `) n; h7 [
Bridge chain: I-tap0678bf1d-41-ipv4-ip, entries: 3, policy: ACCEPT
, F3 N7 ?& f& ~- o3 a5 t, R2 e-p IPv4 --ip-src 0.0.0.0 --ip-proto udp -j RETURN
9 T- h& w/ U5 s0 V4 J-p IPv4 --ip-src 10.16.0.131 -j RETURN
6 F. w" t) T! P( ]+ {+ z3 c-j DROP& x/ `4 k; K* N- J
- D, f1 X; c! V! l
Bridge chain: I-tap0678bf1d-41-arp-mac, entries: 2, policy: ACCEPT5 H: v- _- I0 _  [( p
-p ARP --arp-mac-src fa:16:3e:a6:5f:70 -j RETURN
' d/ L% f% O9 E& W  ?-j DROP1 j4 t1 U1 c4 m$ ^
- J( a3 y( z: I. U# }
Bridge chain: I-tap0678bf1d-41-arp-ip, entries: 2, policy: ACCEPT
6 I# r' B6 j/ E3 H, \8 F' i. Z  Z-p ARP --arp-ip-src 10.16.0.131 -j RETURN, i5 g, x/ N4 @- h+ W% n: }
-j DROP- L$ b0 t2 i! `% f: U& ?. U3 t1 `0 x
0 e7 N$ x, ^1 N# C
Bridge chain: libvirt-I-tap496fa038-9e, entries: 4, policy: ACCEPT
& ~0 G" n( D. H; ?2 A2 D-j I-tap496fa038-9e-mac( z/ R, m/ K: Y/ h0 H) G) c
-p IPv4 -j I-tap496fa038-9e-ipv4-ip
4 J8 W3 u% m# W- y-p ARP -j I-tap496fa038-9e-arp-mac) |/ n2 h# f+ B3 L7 ]$ \
-p ARP -j I-tap496fa038-9e-arp-ip
% p5 E) R( ?: c
; B  B. V! N% T' V  F4 ~& I/ C. FBridge chain: I-tap496fa038-9e-mac, entries: 2, policy: ACCEPT
& M4 d6 ]- v. t+ [' K-s fa:16:3e:58:1:ac -j RETURN
+ }  {* d" S  _0 F0 ^-j DROP* j& Y4 b* s2 c) }$ M" i1 n

! ~% `) e; v, [* \Bridge chain: I-tap496fa038-9e-ipv4-ip, entries: 3, policy: ACCEPT* T7 k# ^! Q, X* o' R
-p IPv4 --ip-src 0.0.0.0 --ip-proto udp -j RETURN& s7 t( A2 l- x8 [
-p IPv4 --ip-src 10.16.0.111 -j RETURN
6 K- q6 y! M) H3 d$ K- t-j DROP4 N% k; H/ @; F$ ~8 U* f
' I- Z" `/ L* Y* N
Bridge chain: I-tap496fa038-9e-arp-mac, entries: 2, policy: ACCEPT
+ I3 y! F, r+ V2 c5 t-p ARP --arp-mac-src fa:16:3e:58:1:ac -j RETURN
8 C& r8 n1 K" o- Y-j DROP
. n* Q  Y" ~6 d3 `# B2 n, r: V* V2 g/ v; ]5 J2 T
Bridge chain: I-tap496fa038-9e-arp-ip, entries: 2, policy: ACCEPT. H! T$ t1 K8 ~& u1 I  I  P
-p ARP --arp-ip-src 10.16.0.111 -j RETURN
  d" z% ?9 u9 p1 A. r. M-j DROP
+ e7 \7 E; W0 x+ v& s% ~5 M8 @$ y
1 L: _$ l3 p' \9 `ebtables是linux专门做二层数据链路层过滤的。! q) ~0 X8 y, Y3 r

" V9 ?/ j3 p  z* D8 f( r' }在通过nova创建虚拟机后，会生成libvirt的一个xml配置文件8 `. |9 t/ {8 R3 F
路径在：/etc/libvirt/nwfilter/nova-base.xml& g2 m" O4 P* O: i8 j6 R/ ~' m
里面定义了以下规则，这些规则限制了在虚拟机上的地址，在二层上就做了过滤
7 {( ~4 S# P) m$ h( J<filter name='nova-base' chain='root'>
: V. c4 T& o' L- L<uuid>12ec8693-253a-7db0-7cd3-f8cc0a1e1b02</uuid>
2 ], r% X# h' I' W% u% o<filterref filter='no-mac-spoofing'/>: ]  J6 U& Q, A7 f0 V# q9 Q
<filterref filter='no-ip-spoofing'/>
. A% i/ Y! y, e6 c# D# C<filterref filter='no-arp-spoofing'/>
; @; W$ ^+ h8 c% \' R<filterref filter='allow-dhcp-server'/>
, G- S- I( s* h8 M: G0 `</filter>
; L, p! @1 r+ L# c7 b* F) t  Q8 i* V' d7 c% j5 x
然后为每个虚拟机创建一个xml文件，每个虚拟机的xml配置中包含了nova-base.xml中的配置8 _2 G6 e3 O. j9 ~9 m8 X2 r
打开其中一个虚拟机的xml配置，可以看到，这个配置文件中只放行了指定IP在二层上可以通过，所以其它手动配置的地址是不可用的。! w0 P2 `/ E, p7 c9 C
cat /etc/libvirt/nwfilter/nova-instance-instance-0000000f-fa163e5801ac.xml0 t9 o; Z6 ^9 n6 C
<filter name='nova-instance-instance-0000000f-fa163e5801ac' chain='root'># y% ~; e' F- g; x& \/ c. L
<uuid>972d18be-2db0-4bf2-2853-a0a61beac036</uuid>0 k9 a8 `6 H& d/ H; Y
<filterref filter='nova-base'>
' V9 X* i7 q5 S# Y) M& n5 |3 F<parameter name='DHCPSERVER' value='10.16.0.102'/>
" Q9 i  o; d+ Y" H" O, d" |<parameter name='IP' value='10.16.0.111'/>
+ F, g5 S( F& ~3 e<parameter name='PROJMASK' value='255.255.255.0'/>
2 u- M5 _' q( Y1 J<parameter name='PROJNET' value='10.16.0.0'/>8 S, J; [3 R# _
</filterref>; W2 B& I8 V+ I. e# B$ G. W, C
</filter># j7 W2 t9 R; Y! @4 ?% ]
) g$ l1 O# ]1 x/ q# ~2 j) j( O/ ]
libvirt可以通过在这些xml配置的规则，去生成ebtables规则，最终是ebtables做出限制。; ~( F& T" |2 z. A( P5 ]! ^& Y

# `! [2 d* {  t0 A0 M$ M: w如何破解？  q, x* v! C. W
修改nova-base.xml文件
7 `" b' l  p2 Q: x# p) b, }; W注释掉以下三行: E+ c' ~. k, J$ e" H
<filterref filter='no-mac-spoofing'/>5 ?5 ^# W% T7 p- s% b0 O
<filterref filter='no-ip-spoofing'/>( E9 f0 s1 z# j: _" O6 A
<filterref filter='no-arp-spoofing'/>
3 c& [8 t' B$ w+ X9 n( A然后重启libvirt进程，libvirt会重新读取xml中的配置，生成新的ebtables规则。
& J! L  o; T7 E3 ?- P修改后，我通过新建虚拟机，重启nova-computer进程，或者直接重启宿主机，这个base文件都不会发生变化了。$ j$ c4 W6 B: `8 ]  n! H  a

2 g. h. Y2 P( |. |2 d% Y还有就是修改nova源码（未测试）9 d" a# Z- L$ r. n6 t8 `; V5 S
源码位置在- Q; N0 [: y. \0 B$ h3 x
/usr/lib/python2.7/dist-packages/nova/virt/libvirt/firewall.py4 |) k: D; W, V
-----------------------------------2 B1 H% r& u0 }/ \! _6 L# v
©著作权归作者所有：来自51CTO博客作者lustlost的原创作品，如需转载，请注明出处，否则将追究法律责任$ H2 Q' [5 M  p
解除openstack中instance对IP的限制（在虚拟机中飘VIP）
$ n" c+ M6 L) F7 X7 T/ i. dhttps://blog.51cto.com/lustlost/1324832
# a1 L4 P2 ~; n( o4 `1 g! `/ ]
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 注册

本版积分规则

返回首页|Archiver|手机版|小黑屋|易陆发现技术论坛 ( 蜀ICP备2026014127号-1 )

GMT+8, 2026-6-12 01:02 , Processed in 0.015149 second(s), 23 queries .

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表