docs: networking: convert ipvlan.txt to ReST
- add SPDX header; - adjust titles and chapters, adding proper markups; - mark code blocks and literals as such; - adjust identation, whitespaces and blank lines; - add to networking/index.rst. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
19093313cb
commit
1dc2a78595
|
@ -71,6 +71,7 @@ Contents:
|
||||||
ipsec
|
ipsec
|
||||||
ip-sysctl
|
ip-sysctl
|
||||||
ipv6
|
ipv6
|
||||||
|
ipvlan
|
||||||
|
|
||||||
.. only:: subproject and html
|
.. only:: subproject and html
|
||||||
|
|
||||||
|
|
|
@ -1,11 +1,15 @@
|
||||||
|
.. SPDX-License-Identifier: GPL-2.0
|
||||||
|
|
||||||
IPVLAN Driver HOWTO
|
===================
|
||||||
|
IPVLAN Driver HOWTO
|
||||||
|
===================
|
||||||
|
|
||||||
Initial Release:
|
Initial Release:
|
||||||
Mahesh Bandewar <maheshb AT google.com>
|
Mahesh Bandewar <maheshb AT google.com>
|
||||||
|
|
||||||
1. Introduction:
|
1. Introduction:
|
||||||
This is conceptually very similar to the macvlan driver with one major
|
================
|
||||||
|
This is conceptually very similar to the macvlan driver with one major
|
||||||
exception of using L3 for mux-ing /demux-ing among slaves. This property makes
|
exception of using L3 for mux-ing /demux-ing among slaves. This property makes
|
||||||
the master device share the L2 with it's slave devices. I have developed this
|
the master device share the L2 with it's slave devices. I have developed this
|
||||||
driver in conjunction with network namespaces and not sure if there is use case
|
driver in conjunction with network namespaces and not sure if there is use case
|
||||||
|
@ -13,34 +17,48 @@ outside of it.
|
||||||
|
|
||||||
|
|
||||||
2. Building and Installation:
|
2. Building and Installation:
|
||||||
In order to build the driver, please select the config item CONFIG_IPVLAN.
|
=============================
|
||||||
|
|
||||||
|
In order to build the driver, please select the config item CONFIG_IPVLAN.
|
||||||
The driver can be built into the kernel (CONFIG_IPVLAN=y) or as a module
|
The driver can be built into the kernel (CONFIG_IPVLAN=y) or as a module
|
||||||
(CONFIG_IPVLAN=m).
|
(CONFIG_IPVLAN=m).
|
||||||
|
|
||||||
|
|
||||||
3. Configuration:
|
3. Configuration:
|
||||||
There are no module parameters for this driver and it can be configured
|
=================
|
||||||
|
|
||||||
|
There are no module parameters for this driver and it can be configured
|
||||||
using IProute2/ip utility.
|
using IProute2/ip utility.
|
||||||
|
::
|
||||||
|
|
||||||
ip link add link <master> name <slave> type ipvlan [ mode MODE ] [ FLAGS ]
|
ip link add link <master> name <slave> type ipvlan [ mode MODE ] [ FLAGS ]
|
||||||
where
|
where
|
||||||
MODE: l3 (default) | l3s | l2
|
MODE: l3 (default) | l3s | l2
|
||||||
FLAGS: bridge (default) | private | vepa
|
FLAGS: bridge (default) | private | vepa
|
||||||
|
|
||||||
|
e.g.
|
||||||
|
|
||||||
e.g.
|
|
||||||
(a) Following will create IPvlan link with eth0 as master in
|
(a) Following will create IPvlan link with eth0 as master in
|
||||||
L3 bridge mode
|
L3 bridge mode::
|
||||||
bash# ip link add link eth0 name ipvl0 type ipvlan
|
|
||||||
(b) This command will create IPvlan link in L2 bridge mode.
|
bash# ip link add link eth0 name ipvl0 type ipvlan
|
||||||
bash# ip link add link eth0 name ipvl0 type ipvlan mode l2 bridge
|
(b) This command will create IPvlan link in L2 bridge mode::
|
||||||
(c) This command will create an IPvlan device in L2 private mode.
|
|
||||||
bash# ip link add link eth0 name ipvlan type ipvlan mode l2 private
|
bash# ip link add link eth0 name ipvl0 type ipvlan mode l2 bridge
|
||||||
(d) This command will create an IPvlan device in L2 vepa mode.
|
|
||||||
bash# ip link add link eth0 name ipvlan type ipvlan mode l2 vepa
|
(c) This command will create an IPvlan device in L2 private mode::
|
||||||
|
|
||||||
|
bash# ip link add link eth0 name ipvlan type ipvlan mode l2 private
|
||||||
|
|
||||||
|
(d) This command will create an IPvlan device in L2 vepa mode::
|
||||||
|
|
||||||
|
bash# ip link add link eth0 name ipvlan type ipvlan mode l2 vepa
|
||||||
|
|
||||||
|
|
||||||
4. Operating modes:
|
4. Operating modes:
|
||||||
IPvlan has two modes of operation - L2 and L3. For a given master device,
|
===================
|
||||||
|
|
||||||
|
IPvlan has two modes of operation - L2 and L3. For a given master device,
|
||||||
you can select one of these two modes and all slaves on that master will
|
you can select one of these two modes and all slaves on that master will
|
||||||
operate in the same (selected) mode. The RX mode is almost identical except
|
operate in the same (selected) mode. The RX mode is almost identical except
|
||||||
that in L3 mode the slaves wont receive any multicast / broadcast traffic.
|
that in L3 mode the slaves wont receive any multicast / broadcast traffic.
|
||||||
|
@ -48,39 +66,50 @@ L3 mode is more restrictive since routing is controlled from the other (mostly)
|
||||||
default namespace.
|
default namespace.
|
||||||
|
|
||||||
4.1 L2 mode:
|
4.1 L2 mode:
|
||||||
In this mode TX processing happens on the stack instance attached to the
|
------------
|
||||||
|
|
||||||
|
In this mode TX processing happens on the stack instance attached to the
|
||||||
slave device and packets are switched and queued to the master device to send
|
slave device and packets are switched and queued to the master device to send
|
||||||
out. In this mode the slaves will RX/TX multicast and broadcast (if applicable)
|
out. In this mode the slaves will RX/TX multicast and broadcast (if applicable)
|
||||||
as well.
|
as well.
|
||||||
|
|
||||||
4.2 L3 mode:
|
4.2 L3 mode:
|
||||||
In this mode TX processing up to L3 happens on the stack instance attached
|
------------
|
||||||
|
|
||||||
|
In this mode TX processing up to L3 happens on the stack instance attached
|
||||||
to the slave device and packets are switched to the stack instance of the
|
to the slave device and packets are switched to the stack instance of the
|
||||||
master device for the L2 processing and routing from that instance will be
|
master device for the L2 processing and routing from that instance will be
|
||||||
used before packets are queued on the outbound device. In this mode the slaves
|
used before packets are queued on the outbound device. In this mode the slaves
|
||||||
will not receive nor can send multicast / broadcast traffic.
|
will not receive nor can send multicast / broadcast traffic.
|
||||||
|
|
||||||
4.3 L3S mode:
|
4.3 L3S mode:
|
||||||
This is very similar to the L3 mode except that iptables (conn-tracking)
|
-------------
|
||||||
|
|
||||||
|
This is very similar to the L3 mode except that iptables (conn-tracking)
|
||||||
works in this mode and hence it is L3-symmetric (L3s). This will have slightly less
|
works in this mode and hence it is L3-symmetric (L3s). This will have slightly less
|
||||||
performance but that shouldn't matter since you are choosing this mode over plain-L3
|
performance but that shouldn't matter since you are choosing this mode over plain-L3
|
||||||
mode to make conn-tracking work.
|
mode to make conn-tracking work.
|
||||||
|
|
||||||
5. Mode flags:
|
5. Mode flags:
|
||||||
At this time following mode flags are available
|
==============
|
||||||
|
|
||||||
|
At this time following mode flags are available
|
||||||
|
|
||||||
5.1 bridge:
|
5.1 bridge:
|
||||||
This is the default option. To configure the IPvlan port in this mode,
|
-----------
|
||||||
|
This is the default option. To configure the IPvlan port in this mode,
|
||||||
user can choose to either add this option on the command-line or don't specify
|
user can choose to either add this option on the command-line or don't specify
|
||||||
anything. This is the traditional mode where slaves can cross-talk among
|
anything. This is the traditional mode where slaves can cross-talk among
|
||||||
themselves apart from talking through the master device.
|
themselves apart from talking through the master device.
|
||||||
|
|
||||||
5.2 private:
|
5.2 private:
|
||||||
If this option is added to the command-line, the port is set in private
|
------------
|
||||||
|
If this option is added to the command-line, the port is set in private
|
||||||
mode. i.e. port won't allow cross communication between slaves.
|
mode. i.e. port won't allow cross communication between slaves.
|
||||||
|
|
||||||
5.3 vepa:
|
5.3 vepa:
|
||||||
If this is added to the command-line, the port is set in VEPA mode.
|
---------
|
||||||
|
If this is added to the command-line, the port is set in VEPA mode.
|
||||||
i.e. port will offload switching functionality to the external entity as
|
i.e. port will offload switching functionality to the external entity as
|
||||||
described in 802.1Qbg
|
described in 802.1Qbg
|
||||||
Note: VEPA mode in IPvlan has limitations. IPvlan uses the mac-address of the
|
Note: VEPA mode in IPvlan has limitations. IPvlan uses the mac-address of the
|
||||||
|
@ -89,18 +118,25 @@ neighbor will have source and destination mac same. This will make the switch /
|
||||||
router send the redirect message.
|
router send the redirect message.
|
||||||
|
|
||||||
6. What to choose (macvlan vs. ipvlan)?
|
6. What to choose (macvlan vs. ipvlan)?
|
||||||
These two devices are very similar in many regards and the specific use
|
=======================================
|
||||||
|
|
||||||
|
These two devices are very similar in many regards and the specific use
|
||||||
case could very well define which device to choose. if one of the following
|
case could very well define which device to choose. if one of the following
|
||||||
situations defines your use case then you can choose to use ipvlan -
|
situations defines your use case then you can choose to use ipvlan:
|
||||||
(a) The Linux host that is connected to the external switch / router has
|
|
||||||
policy configured that allows only one mac per port.
|
|
||||||
(b) No of virtual devices created on a master exceed the mac capacity and
|
(a) The Linux host that is connected to the external switch / router has
|
||||||
puts the NIC in promiscuous mode and degraded performance is a concern.
|
policy configured that allows only one mac per port.
|
||||||
(c) If the slave device is to be put into the hostile / untrusted network
|
(b) No of virtual devices created on a master exceed the mac capacity and
|
||||||
namespace where L2 on the slave could be changed / misused.
|
puts the NIC in promiscuous mode and degraded performance is a concern.
|
||||||
|
(c) If the slave device is to be put into the hostile / untrusted network
|
||||||
|
namespace where L2 on the slave could be changed / misused.
|
||||||
|
|
||||||
|
|
||||||
6. Example configuration:
|
6. Example configuration:
|
||||||
|
=========================
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
+=============================================================+
|
+=============================================================+
|
||||||
| Host: host1 |
|
| Host: host1 |
|
||||||
|
@ -117,30 +153,37 @@ namespace where L2 on the slave could be changed / misused.
|
||||||
+==============================#==============================+
|
+==============================#==============================+
|
||||||
|
|
||||||
|
|
||||||
(a) Create two network namespaces - ns0, ns1
|
(a) Create two network namespaces - ns0, ns1::
|
||||||
ip netns add ns0
|
|
||||||
ip netns add ns1
|
|
||||||
|
|
||||||
(b) Create two ipvlan slaves on eth0 (master device)
|
ip netns add ns0
|
||||||
ip link add link eth0 ipvl0 type ipvlan mode l2
|
ip netns add ns1
|
||||||
ip link add link eth0 ipvl1 type ipvlan mode l2
|
|
||||||
|
|
||||||
(c) Assign slaves to the respective network namespaces
|
(b) Create two ipvlan slaves on eth0 (master device)::
|
||||||
ip link set dev ipvl0 netns ns0
|
|
||||||
ip link set dev ipvl1 netns ns1
|
|
||||||
|
|
||||||
(d) Now switch to the namespace (ns0 or ns1) to configure the slave devices
|
ip link add link eth0 ipvl0 type ipvlan mode l2
|
||||||
- For ns0
|
ip link add link eth0 ipvl1 type ipvlan mode l2
|
||||||
(1) ip netns exec ns0 bash
|
|
||||||
(2) ip link set dev ipvl0 up
|
(c) Assign slaves to the respective network namespaces::
|
||||||
(3) ip link set dev lo up
|
|
||||||
(4) ip -4 addr add 127.0.0.1 dev lo
|
ip link set dev ipvl0 netns ns0
|
||||||
(5) ip -4 addr add $IPADDR dev ipvl0
|
ip link set dev ipvl1 netns ns1
|
||||||
(6) ip -4 route add default via $ROUTER dev ipvl0
|
|
||||||
- For ns1
|
(d) Now switch to the namespace (ns0 or ns1) to configure the slave devices
|
||||||
(1) ip netns exec ns1 bash
|
|
||||||
(2) ip link set dev ipvl1 up
|
- For ns0::
|
||||||
(3) ip link set dev lo up
|
|
||||||
(4) ip -4 addr add 127.0.0.1 dev lo
|
(1) ip netns exec ns0 bash
|
||||||
(5) ip -4 addr add $IPADDR dev ipvl1
|
(2) ip link set dev ipvl0 up
|
||||||
(6) ip -4 route add default via $ROUTER dev ipvl1
|
(3) ip link set dev lo up
|
||||||
|
(4) ip -4 addr add 127.0.0.1 dev lo
|
||||||
|
(5) ip -4 addr add $IPADDR dev ipvl0
|
||||||
|
(6) ip -4 route add default via $ROUTER dev ipvl0
|
||||||
|
|
||||||
|
- For ns1::
|
||||||
|
|
||||||
|
(1) ip netns exec ns1 bash
|
||||||
|
(2) ip link set dev ipvl1 up
|
||||||
|
(3) ip link set dev lo up
|
||||||
|
(4) ip -4 addr add 127.0.0.1 dev lo
|
||||||
|
(5) ip -4 addr add $IPADDR dev ipvl1
|
||||||
|
(6) ip -4 route add default via $ROUTER dev ipvl1
|
Loading…
Reference in New Issue