GRE 实验2 异网段GRE实验

简介

本文描述我所进行的异网段GRE tunnel实验.

在进行了前述的同网段GRE实验后，我发现把该配置用于实际的环境，无论如何都不通，通过tcpdump抓包分析后怀疑是由于实际环境是异网段造成的，为了找到原因，设计了以下异网段实验

ipv4 over GRE over IPv4

准备

lxc 虚拟机配置 这次arch1 和 arch2 异网段 arch3 作为路由器沟通两个网段

lxc list
+-------+---------+-----------------------+-----------------------------------------------+-----------+-----------+
| NAME  |  STATE  |         IPV4          |                     IPV6                      |   TYPE    | SNAPSHOTS |
+-------+---------+-----------------------+-----------------------------------------------+-----------+-----------+
| arch1 | RUNNING | 192.168.101.1 (lo1)   | fd42:a497:a975:8f4d:216:3eff:fe48:c4db (eth0) | CONTAINER | 0         |
|       |         | 10.165.103.239 (eth0) | fd00:0:0:1::1 (lo1)                           |           |           |
+-------+---------+-----------------------+-----------------------------------------------+-----------+-----------+
| arch2 | RUNNING | 192.168.102.1 (lo1)   | fd42:cb1f:d526:a477:216:3eff:fe23:7b9f (eth0) | CONTAINER | 0         |
|       |         | 10.113.224.163 (eth0) | fd00:0:0:2::1 (lo1)                           |           |           |
+-------+---------+-----------------------+-----------------------------------------------+-----------+-----------+
| arch3 | RUNNING | 10.165.103.144 (eth0) | fd42:cb1f:d526:a477:216:3eff:fe16:6f0 (eth1)  | CONTAINER | 0         |
|       |         | 10.113.224.116 (eth1) | fd42:a497:a975:8f4d:216:3eff:fe57:445d (eth0) |           |           |
+-------+---------+-----------------------+-----------------------------------------------+-----------+-----------+

lxc 网络配置

lxc network list
+--------+----------+---------+-----------------+---------------------------+-------------+---------+---------+
|  NAME  |   TYPE   | MANAGED |      IPV4       |           IPV6            | DESCRIPTION | USED BY |  STATE  |
+--------+----------+---------+-----------------+---------------------------+-------------+---------+---------+
| eth0   | physical | NO      |                 |                           |             | 0       |         |
+--------+----------+---------+-----------------+---------------------------+-------------+---------+---------+
| lxdbr0 | bridge   | YES     | 10.165.103.1/24 | fd42:a497:a975:8f4d::1/64 |             | 3       | CREATED |
+--------+----------+---------+-----------------+---------------------------+-------------+---------+---------+
| lxdbr1 | bridge   | YES     | 10.9.87.1/24    | fd42:9ec5:6315:437a::1/64 |             | 0       | CREATED |
+--------+----------+---------+-----------------+---------------------------+-------------+---------+---------+
| lxdbr2 | bridge   | YES     | 10.113.224.1/24 | fd42:cb1f:d526:a477::1/64 |             | 2       | CREATED |
+--------+----------+---------+-----------------+---------------------------+-------------+---------+---------+

ipv4 over GRE over IPv4

arch1

route delete default
ip route add default via 10.165.103.144
ip tunnel delete gre-arch2
ip tunnel add gre-arch2 local 10.165.103.239 remote 10.113.224.163 mode gre key 42 ttl 64
#ip link set gre-arch2 multicast on
ip link set gre-arch2 up
ip address add 10.0.3.1/30 dev gre-arch2 peer 10.0.3.2/30
ip route add 192.168.102.0/24 dev gre-arch2

arch2

ip route delete default
ip route add default via 10.113.224.116
ip tunnel delete gre-arch1
ip tunnel add gre-arch1 local 10.113.224.163 remote 10.165.103.239 mode gre key 42 ttl 64
#ip link set gre-arch1 multicast on
ip link set gre-arch1 up
ip address add 10.0.3.2/30 dev gre-arch1 peer 10.0.3.1/30
ip route add 192.168.101.0/24 dev gre-arch1

实验从arch1上ping 192.168.102.1能通,从arch2上ping 192.168.101.1能通，实验成功

总结

  • 这里最重要的是 ttl 64，如果没有这个异网段就不通,上一个同网段实验中能通我想是因为ttl默认为1
  • ip link set gre-arch1 multicast on这个可以不要
  • 经测试，由于在异网段环境下, ip tunnel add 的gre通道也能自动获得link-local-address，所以ipv6 也是可以通的,参考GRE实验1，此处不再赘述
  • 经测速，在GRE over IPsec的环境下，也是能通的，参考GRE实验1，此处不再赘述

下一步

使用systemd-networkd 固化GRE

参考