浏览此站
联系我们相册切换到窄版 Language

 找回密码
 注册
易陆发现论坛»论坛 › 云计算开源区 › OpenStack介绍版 › openstack添加vrrp安全组规则入口配置
返回列表 发新帖
查看: 1496|回复: 3

openstack添加vrrp安全组规则入口配置

[复制链接]
admin

1

主题

0

回帖

12

积分

管理员

积分
12
QQ
发表于 2021-12-7 15:01:06 | 显示全部楼层 |阅读模式
       valid_lft forever preferred_lft forever
% M- h) T, }/ S0 W[root@keepalievd-1 ~]# tcpdump -i eth1 vrrp ; r1 @1 v  u5 A( s; ?7 R5 g7 e
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode3 w; f! k8 p7 D
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes
. m1 }. Y0 A1 b7 k, S" K5 A$ [: X15:01:31.166318 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 201 L! |4 b0 N% q. w1 x+ J% ?
15:01:32.166682 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20" S* k* o. g- i' Q! v  F% L6 H# A4 m; ]
15:01:33.167075 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20- f5 Y" N- `: T7 |/ B
^C
* B7 z/ Q  x% S; _7 h( D6 u! p0 D8 p; k. O1 |+ c8 _, F, \" Y5 f
[root@keepalived-2 ~]# tcpdump -i eth1  vrrp+ A6 ^3 [/ @& X/ H5 [+ ]6 W5 y9 i
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode( _. P. o" O! m+ N7 l, |* r" @
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes! f' S' F% H! s" P
15:01:22.170651 IP keepalived-2.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 99, authtype simple, intvl 1s, length 20
* C  A3 a' B/ n0 u) E  G  q8 @! I% e15:01:23.171685 IP keepalived-2.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 99, authtype simple, intvl 1s, length 20% @* Q5 z& S$ L! @, ]7 V" z
15:01:24.172739 IP keepalived-2.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 99, authtype simple, intvl 1s, length 20
( @1 R8 x; U" b$ P15:01:25.173771 IP keepalived-2.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 99, authtype simple, intvl 1s, length 20; t1 z( u7 n# d0 L) w4 m. a
15:01:26.174855 IP keepalived-2.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 99, authtype simple, intvl 1s, length 20/ }2 j& R8 @: u. D$ v& c
^C- H# j+ l: x, D$ e6 L( j1 y% u/ e5 R
4 c$ |( a. @2 P6 |

9 a3 N2 a: C; P在openstack平台上创建的keepalived虚机因安全组不通而导致vrrp不通，openstack上需要调整vrrp安全组规则入口配置：
/ w- X; q" H* P0 \3 ?; _5 d$ `  \1 }: j( C: ~" |% i* i" V
  S# g3 h/ Y/ a7 x. `/ P  {! x
入口		IPv4112任何192.168.0.0/24
# X3 k5 r  e. Z" J0 C8 K, H1 a
9 b$ O2 G. }  B. C7 e
入口
. O3 f) k& ?  _" }+ s( ~* D3 R		IPv4112任何0.0.0.0/0
回复

举报

admin

1

主题

0

回帖

12

积分

管理员

积分
12
QQ
 楼主| 发表于 2021-12-7 15:04:32 | 显示全部楼层
[root@keepalievd-1 ~]# tcpdump -i eth1 vrrp # A/ I* z8 F& c$ Q. H- k- w
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode( D) t2 n9 p& b2 R) u" K
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes; `  }  g. b; V* T& l" l
15:03:08.894788 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20
7 E% _. L- Z8 k15:03:09.132334 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 20
! V: Y5 x2 w5 l5 k7 z15:03:09.895798 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20! c" n* [/ o9 R& f$ C4 |9 v
15:03:10.133082 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 20
8 i1 O) G9 l) O( \" k" n15:03:10.896827 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20( |/ g; Y; W& Y" n# N
15:03:11.133514 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 20( c& e  J! C8 x  q4 L; j
15:03:11.897792 IP keepalievd-1.novalocal > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20
# |  J2 k4 V, _. c& z( |( k5 |15:03:12.134724 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 202 g, D7 Z# q) f- U: n. O7 n

& q1 Q/ |3 n2 S5 k8 H% C, x) e$ i, {5 y第二台设备：$ z5 {, A7 l7 T% `" w% n) D

( `7 @; B1 d4 Q+ A" p" N[root@keepalived-2 ~]# tcpdump -i eth1  vrrp6 D. T0 o+ @2 l# F* |1 o( }
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode$ u* a5 u$ j, Q
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes
* }9 h8 i! B: R6 w. g6 `15:03:03.277349 IP 192.168.0.186 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20
' L6 T) Y, v1 L' Z4 X$ e, R& g2 _) k15:03:03.516783 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 20
6 |( o! f6 A, C: ^) D15:03:04.278375 IP 192.168.0.186 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 207 D! s9 X" P9 l. d: v5 x( x
15:03:04.517146 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 20# j/ N! @' |" s( _1 v% X1 k1 W
15:03:05.279264 IP 192.168.0.186 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20( R0 |& _) w" V$ y1 q0 P
15:03:05.517812 IP 192.168.0.62 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 52, prio 2, authtype simple, intvl 1s, length 20
$ T+ s9 l) k1 \" U+ G) m8 D15:03:06.280214 IP 192.168.0.186 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20
6 |% q/ z+ k3 f0 [8 o3 d9 z^C
( M5 k/ \/ G1 F7 ?* U0 }& C2 a0 O; C) O% z
地址通了。
2 T2 e6 x5 r$ a3 v
回复

举报

admin

1

主题

0

回帖

12

积分

管理员

积分
12
QQ
 楼主| 发表于 2021-12-7 15:10:16 | 显示全部楼层
安全组允许VRRP协议
8 B1 a( @% K  t( C5 }( M直接在控制台导航：项目-访问&安全，搜索虚机所在的安全组, 然后点击后面的管理规则按钮进入规则列表；点击添加规则按钮，弹出框里，在规则的下拉选里选择 其他协议, 然后再 端口 文本框输入 112, 最后点击添加按钮即可 # VRRP协议的端口号是112
回复

举报

admin

1

主题

0

回帖

12

积分

管理员

积分
12
QQ
 楼主| 发表于 2021-12-7 15:29:28 | 显示全部楼层
对于负载均衡，G版本已经集成了haproxy插件，对haproxy的配置做了一层封装，可以很方便的通过quantum去创建一个负载均衡池，为相同或者不同宿主机上的虚拟机提供负载均衡的能力。2 O9 V7 V, Y4 O) m3 E/ h& F3 v
8 ?& e: j  j' F$ w  ^
在这个模式下，haproxy是运行在宿主机上的。% S2 o# f- V" c' A/ }
遗憾的是，目前还不能通过openstack做到haproxy的高可用。; J* l1 e  q9 V+ \; g9 |/ V6 O1 s8 A

. Z0 l; f1 X4 T* m4 {9 K想要做高可用，只能在虚拟机中去飘VIP了
( e5 A8 E) R! F0 o8 E7 F3 J" O2 c4 d
但是创建了虚拟机之后，在这个虚拟机实例中只能使用指定的IP。
9 L$ e* x8 G1 H/ D! ]! G这就导致想在虚拟机中部署高可用去飘VIP是不可行的。
* P& D9 X" g: `! z6 W# P! C; v9 O
) d+ j  o& T' L6 S可以理解，在公有云环境下，是不可能让用户在虚拟机中随意去配置额外地址的。
9 i" X! h+ C3 a0 O+ i但我们是私有云环境，这个规则对私有云环境下很是麻烦。& {( Q1 S  o8 B! I2 i
在openstack中创建虚拟机，通过nova boot的--nic选项指定网卡和IP地址：# c  S9 r# y& j  D6 U
--nic net-id=${NETWORK_ID},v4-fixed-ip=${Host_IP}8 E3 z7 Q! Y7 H+ w& Y: r, C
( w+ @* k/ m( m' e( [! ^! e
之前一直以为是iptables规则导致的。于是去看了一遍宿主机中的iptables规则
; k+ D& V& V, N+ _0 A8 w: mroot@node1:~# iptables -vnL1 `/ N/ u9 ]2 U" L5 m
Chain INPUT (policy ACCEPT 3556K packets, 744M bytes)& |) u7 C2 v) |* P
pkts bytes target prot opt in out source destination
1 x, y4 d8 l* a7 i/ {, \1778K 372M nova-compute-INPUT all -- * * 0.0.0.0/0 0.0.0.0/0+ [7 }% Y4 \5 I! d4 }
: P$ Y$ o0 h& y0 j2 O
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)9 \6 N& O4 q/ V/ D: j  }4 _$ c2 G
pkts bytes target prot opt in out source destination# b$ B. s+ K5 n! j* x) D+ D5 |9 w
150 13488 nova-filter-top all -- * * 0.0.0.0/0 0.0.0.0/0- f4 q6 k0 W2 |# |' Q
6 1392 nova-compute-FORWARD all -- * * 0.0.0.0/0 0.0.0.0/0' O* C' d/ ~  W# F  ^; ^
! X' U% [& H1 S, e5 ]6 p( S' t
Chain OUTPUT (policy ACCEPT 4208K packets, 567M bytes)
: G6 e) Q$ y/ q' Jpkts bytes target prot opt in out source destination
3 x2 C' ~" m% K( U( b' R2 z4202K 567M nova-filter-top all -- * * 0.0.0.0/0 0.0.0.0/0
0 T2 s# L1 S6 }4 H2106K 284M nova-compute-OUTPUT all -- * * 0.0.0.0/0 0.0.0.0/0
: Q$ X  }! a& b0 l- Y! W3 X/ _6 N
1 I4 k2 ?) ~: o0 J  |" Q8 K) AChain nova-compute-FORWARD (1 references)( |( T0 _5 ~1 Y1 K; u
pkts bytes target prot opt in out source destination; ~" F$ w. X  H
4 1312 ACCEPT udp -- * * 0.0.0.0 255.255.255.255 udp spt:68 dpt:67$ p2 l- h: d" e4 k/ V
2 80 ACCEPT all -- brq3eefcd79-07 * 0.0.0.0/0 0.0.0.0/0
. }, r0 d' q) _+ m- r+ ^$ @8 Z0 0 ACCEPT all -- * brq3eefcd79-07 0.0.0.0/0 0.0.0.0/0! ?: O* f- z3 R& A
6 y0 w& P2 E& |+ @2 K' P  E
Chain nova-compute-INPUT (1 references)# j+ h5 X: G! v$ A
pkts bytes target prot opt in out source destination
2 _- s: k. O3 L' N* _1 p5 `7 U2 656 ACCEPT udp -- * * 0.0.0.0 255.255.255.255 udp spt:68 dpt:673 Y8 y* p* Q# K$ n2 @& w4 I
5 J' U5 \) k! s3 T+ W: @; }: d
Chain nova-compute-OUTPUT (1 references)
3 f, H- r0 t0 H: V. lpkts bytes target prot opt in out source destination; N5 u" S. G$ F9 }& U# f8 v! W

6 [  K( e7 @7 Q, Z& z9 N( SChain nova-compute-inst-15 (1 references)" y5 M4 J! d! Q, \0 [
pkts bytes target prot opt in out source destination, I* F1 b% O8 \! M5 v
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
( N% A: C8 m+ `0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED; P$ C) t% C6 j; k
0 0 nova-compute-provider all -- * * 0.0.0.0/0 0.0.0.0/0
6 g9 ^5 W5 M/ Z% ^- |0 0 ACCEPT udp -- * * 10.16.0.102 0.0.0.0/0 udp spt:67 dpt:68, A0 z' ]' _; Y0 \# A
0 0 ACCEPT all -- * * 10.16.0.0/24 0.0.0.0/06 d. U- i, J8 C6 v- S1 \6 p! c
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 1:65535$ s0 c* V2 j% q$ ~, |$ a0 I# z( H
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 1:65535
; m& K- Q% b- y" v# a6 N, `2 @0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0. C4 E1 U: [$ `4 d1 I
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8 code 8
6 s! Z  P' v5 K/ S9 V% B0 0 nova-compute-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0# K! h0 J& V$ [, S

: E3 V& X3 x4 L/ iChain nova-compute-inst-17 (1 references)( {( ?$ ]1 {) b& C' n, K
pkts bytes target prot opt in out source destination
( V, M* l1 \  M3 T7 U& N8 G0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID+ p3 j- Q  l$ Y, P0 Y' w
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED3 K- m+ h4 c* @
0 0 nova-compute-provider all -- * * 0.0.0.0/0 0.0.0.0/0
  @7 z2 V! s2 a6 t1 k4 z1 d0 0 ACCEPT udp -- * * 10.16.0.102 0.0.0.0/0 udp spt:67 dpt:68+ L; q8 K& ^8 K; ^+ n' f
0 0 ACCEPT all -- * * 10.16.0.0/24 0.0.0.0/0: F! d7 B2 `7 N! {$ P1 z
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 1:65535% I9 v' M& q% Z  L& Q
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 1:65535
1 _9 H7 ]* X2 K. k& _0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0: k4 `/ R+ C' k: R
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8 code 8
/ g% y  g; Q  v  j( q# T0 0 nova-compute-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0; H4 ?4 ~- m+ ?7 b% V

  Z' Z; R* Z5 A+ E- n" l  v; @# v, qChain nova-compute-local (1 references)4 S3 R; u- _9 _$ G
pkts bytes target prot opt in out source destination# M/ \  j, N# f1 j; g
0 0 nova-compute-inst-15 all -- * * 0.0.0.0/0 10.16.0.1117 W7 l1 T. [) @  T) S
0 0 nova-compute-inst-17 all -- * * 0.0.0.0/0 10.16.0.131
  r6 o! Y; [. Z2 b# Z- P9 @
% v9 g; v7 }; a2 E' t/ Z( i+ ^Chain nova-compute-provider (2 references)
* Z; ^1 k9 B# l; d7 wpkts bytes target prot opt in out source destination) K3 K+ h6 {; \* @1 j: k

" d, O3 p, A7 a6 a/ B5 n! yChain nova-compute-sg-fallback (2 references); J' M  p) t8 _# z+ c7 I
pkts bytes target prot opt in out source destination1 V  A3 t- v& E8 X+ K" A
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0$ m1 B2 S+ v# H6 x* p; R8 F% f! T" R
% }9 s" [. M: d: L
Chain nova-filter-top (2 references)
! @8 ?# h- \* H& m" s" rpkts bytes target prot opt in out source destination
* u9 M; i) n3 Y8 c' G8 {2106K 284M nova-compute-local all -- * * 0.0.0.0/0 0.0.0.0/0/ p+ s/ L; y1 D) p) L4 K1 B4 B
% @; S* ?7 Q0 \. ^- i  Y8 h
分析一下这些openstack自动生成的规则，可以看到input，forword和output链默认都是accept状态。分析每条链对数据包的跳转和过滤，如果在虚拟机中配置新的地址，是不会被过滤的。
9 ~8 f8 P7 |& {' G- C; n1 {6 D# p  U* h- |$ S" k
经过一番折腾，最终发现限制IP的原因是ebtables在起作用3 g0 v: v' @' \- v7 ?
root@node1:~# ebtables -t nat -L
# A" m9 [* G5 h! K* cBridge table: nat
& U! ]0 ?" p, Q: m: y; c' |  T1 y" `" S$ S
Bridge chain: PREROUTING, entries: 2, policy: ACCEPT
- A+ a) S5 r4 t. D9 x* m* w' L-i tap0678bf1d-41 -j libvirt-I-tap0678bf1d-41
3 W$ w7 J5 ^& C& i+ O-i tap496fa038-9e -j libvirt-I-tap496fa038-9e  v8 M$ @9 i5 a9 l2 s
2 q+ N5 e0 V( d! ~- y* K
Bridge chain: OUTPUT, entries: 0, policy: ACCEPT9 _; Z: r! j0 C/ C& k1 D
4 L, ]- ?8 ?2 z0 M& m
Bridge chain: POSTROUTING, entries: 0, policy: ACCEPT
! D! ]( Y- x6 v, T$ J8 c, G
! j" o  L# g: a; @Bridge chain: libvirt-I-tap0678bf1d-41, entries: 4, policy: ACCEPT  u5 f% i7 e( W2 k  ]
-j I-tap0678bf1d-41-mac
* c8 m( k" x4 V8 Z7 i- g( N-p IPv4 -j I-tap0678bf1d-41-ipv4-ip
" |$ r3 }+ a* v& D2 y- v6 j-p ARP -j I-tap0678bf1d-41-arp-mac
( ?8 q- S! l5 k-p ARP -j I-tap0678bf1d-41-arp-ip  B2 N: C  ]! T# a
1 z; q) W: j/ M# x
Bridge chain: I-tap0678bf1d-41-mac, entries: 2, policy: ACCEPT
2 c2 @$ I( P. j! k1 p, t-s fa:16:3e:a6:5f:70 -j RETURN
& N' B4 _. x+ I1 [* t-j DROP
) i3 L" I8 C! m
/ Z4 p! d* S4 O" L$ n0 L9 a: ABridge chain: I-tap0678bf1d-41-ipv4-ip, entries: 3, policy: ACCEPT
& d' y& d3 F4 |0 }5 n-p IPv4 --ip-src 0.0.0.0 --ip-proto udp -j RETURN* K  V8 i- |( P2 q
-p IPv4 --ip-src 10.16.0.131 -j RETURN
: Y! q9 |4 S. y: d$ y# X$ Y; }-j DROP
$ V9 h$ o" K4 U( ?. X/ e' z3 k) x: |3 u7 ]1 \  y5 {7 @1 q6 K# \
Bridge chain: I-tap0678bf1d-41-arp-mac, entries: 2, policy: ACCEPT# {& i+ Y+ j+ B, Q! }" q
-p ARP --arp-mac-src fa:16:3e:a6:5f:70 -j RETURN
$ u( p  N7 Y) P9 O' F-j DROP
6 N9 X( [$ F% L4 S2 W7 k
* }6 A* f5 `, e+ h0 OBridge chain: I-tap0678bf1d-41-arp-ip, entries: 2, policy: ACCEPT
8 t$ |6 p+ K5 n  W5 F% ]; b-p ARP --arp-ip-src 10.16.0.131 -j RETURN
6 W4 }  W( B1 E-j DROP( N& \6 ^9 R. O+ C$ b' H' r
" A' J: [. ]$ K6 m' T1 v
Bridge chain: libvirt-I-tap496fa038-9e, entries: 4, policy: ACCEPT2 T2 O) Q" g- O$ E# C. l: p
-j I-tap496fa038-9e-mac% M; K! z+ G6 Q1 A% h/ t5 z6 i- t$ W
-p IPv4 -j I-tap496fa038-9e-ipv4-ip. l7 v* t: j. Y2 ]
-p ARP -j I-tap496fa038-9e-arp-mac( ~& l7 S4 L! p$ A
-p ARP -j I-tap496fa038-9e-arp-ip* J' ~* E8 W/ e$ w( ?

% w' r0 W; Q7 W) t0 d2 t& G% EBridge chain: I-tap496fa038-9e-mac, entries: 2, policy: ACCEPT# K. }  W" z4 i0 C4 O# H
-s fa:16:3e:58:1:ac -j RETURN" L* z- W) z. R* _& x1 I4 G
-j DROP
' {; n9 Z' H3 \+ d
8 z% A& K( q* l5 l) \Bridge chain: I-tap496fa038-9e-ipv4-ip, entries: 3, policy: ACCEPT
+ ]1 K. ^/ I9 Y* I% l: P-p IPv4 --ip-src 0.0.0.0 --ip-proto udp -j RETURN
! a% n) q' k/ B-p IPv4 --ip-src 10.16.0.111 -j RETURN8 u8 {8 s: B. H' I5 H/ q! r
-j DROP
" _& ?& z( _: \% A* L3 _! p  w; x3 S+ [- x3 {
Bridge chain: I-tap496fa038-9e-arp-mac, entries: 2, policy: ACCEPT
" ]. G. p& m4 x- F. W! Z* n-p ARP --arp-mac-src fa:16:3e:58:1:ac -j RETURN5 ?: Q3 ?( }) \4 A
-j DROP$ d9 ]1 K( o4 u- ~
# E# X. u; z9 \$ [
Bridge chain: I-tap496fa038-9e-arp-ip, entries: 2, policy: ACCEPT
( V7 L9 Y7 \; j, a-p ARP --arp-ip-src 10.16.0.111 -j RETURN" p: R/ A$ c% P* Z  T5 q  I3 ]+ y% G
-j DROP4 a  c% G; p$ o: Y/ k7 H. b

4 c: C! ]  \5 E/ r4 y! `- [; uebtables是linux专门做二层数据链路层过滤的。1 H0 C  ]0 }4 p: t3 ?
1 E% R9 l7 L  m+ L4 J: {
在通过nova创建虚拟机后，会生成libvirt的一个xml配置文件% W; x: p. b6 o- E
路径在：/etc/libvirt/nwfilter/nova-base.xml/ v/ }. |: R, a, X3 R% N* p
里面定义了以下规则，这些规则限制了在虚拟机上的地址，在二层上就做了过滤
1 g8 Q. |* q+ G! y, H: f7 e2 ]<filter name='nova-base' chain='root'>; E2 p% t& o2 ], J- Z% v) G) k# U
<uuid>12ec8693-253a-7db0-7cd3-f8cc0a1e1b02</uuid>( d8 J" e% D3 ~) d) z
<filterref filter='no-mac-spoofing'/>- X; B+ I" j2 H. Z' c
<filterref filter='no-ip-spoofing'/>
  a& E/ o* z# u) `<filterref filter='no-arp-spoofing'/>; L0 d' }% f$ E0 h% ?0 I
<filterref filter='allow-dhcp-server'/>6 _5 w8 Q1 U2 y8 ?
</filter>: @# x' D! m; r. w/ q

% A5 n/ ]# H: z6 i然后为每个虚拟机创建一个xml文件，每个虚拟机的xml配置中包含了nova-base.xml中的配置
5 f* H+ n4 o$ i& {0 B打开其中一个虚拟机的xml配置，可以看到，这个配置文件中只放行了指定IP在二层上可以通过，所以其它手动配置的地址是不可用的。
/ U+ d& E$ t' z! qcat /etc/libvirt/nwfilter/nova-instance-instance-0000000f-fa163e5801ac.xml% Z; z! n# v* Y! P9 S/ z3 r8 w
<filter name='nova-instance-instance-0000000f-fa163e5801ac' chain='root'>
0 m% J, V" _9 @  \6 @+ b- o8 C6 n+ n<uuid>972d18be-2db0-4bf2-2853-a0a61beac036</uuid>
2 I4 l! B" T  e) \<filterref filter='nova-base'>
3 z9 d7 {. F: A; h" m<parameter name='DHCPSERVER' value='10.16.0.102'/>: B- O6 |  e5 |- q
<parameter name='IP' value='10.16.0.111'/>
: M% _& F8 A; r. w) y: _3 t. j<parameter name='PROJMASK' value='255.255.255.0'/>
4 p- u* H( G0 b( j" A" V<parameter name='PROJNET' value='10.16.0.0'/>
! @; \6 ^+ E6 m! ^9 G. h</filterref>
" W* L2 r4 \% b, ?' G, W+ |& Q8 {. K</filter>
0 f  ?1 {9 b# M( y& ?% K( P
" Y7 l; l1 v* v5 }libvirt可以通过在这些xml配置的规则，去生成ebtables规则，最终是ebtables做出限制。/ Z7 l6 [( q4 x2 X3 Q0 Z% c

  b# K  z. z* n& S0 R  _' T% r2 C如何破解？
2 h$ m* Z, z* o3 E( d. g: ?/ S* s修改nova-base.xml文件5 v9 q# l% j' }$ ~- u) N5 Y2 m
注释掉以下三行! o4 O6 k2 E8 Q4 ^3 u; s
<filterref filter='no-mac-spoofing'/>* _' _7 X/ ^9 r! i4 p
<filterref filter='no-ip-spoofing'/>
3 d" Z& T) x1 o! v8 X% f& T* V) y<filterref filter='no-arp-spoofing'/>
+ Q9 e% [  D+ Q$ m$ k0 v7 e然后重启libvirt进程，libvirt会重新读取xml中的配置，生成新的ebtables规则。2 u6 V0 r1 x& B
修改后，我通过新建虚拟机，重启nova-computer进程，或者直接重启宿主机，这个base文件都不会发生变化了。
& B2 x" |# j: h" R( R) N9 v& L' w" A% ]7 `  A' _
还有就是修改nova源码（未测试）* a- E# b# Y5 l- T1 W
源码位置在
8 ?' q. w0 ]1 G* l! d+ S) F/usr/lib/python2.7/dist-packages/nova/virt/libvirt/firewall.py
1 C0 [; |3 o3 C------------------------------------ t: }5 H# H9 c) n) A& F6 E
©著作权归作者所有：来自51CTO博客作者lustlost的原创作品，如需转载，请注明出处，否则将追究法律责任% c7 L8 {8 D3 M2 \) |7 G6 _! \
解除openstack中instance对IP的限制（在虚拟机中飘VIP）
: `, Y" c' I* s( r& `5 L3 H1 Fhttps://blog.51cto.com/lustlost/1324832
  L6 n( _3 c1 J9 O) l% ?: P  W
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 注册

本版积分规则

返回首页|Archiver|手机版|小黑屋|易陆发现技术论坛 ( 蜀ICP备2026014127号-1 )

GMT+8, 2026-6-12 03:21 , Processed in 0.045510 second(s), 23 queries .

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表