使用两个不同物理网络接口的两个 LXC 容器

使用两个不同物理网络接口的两个 LXC 容器

我有一台运行 Ubuntu 16.04 的机器,上面有两个 LXC 容器ubuntu_lxcubuntu_lxc1.该机器有两个物理网络接口。我想显式地将每个接口桥接到每个容器,并完全分离两个容器之间的网络流量,以便运行两个不同的服务,每个服务都在一个容器上。

这两个物理接口应该有 DHCP、PPPoE 或静态 IP 地址,我将在 /etc/network/interfaces 中进行相应配置。

我正在使用本指南http://www.itzgeek.com/how-tos/linux/ubuntu-how-tos/setup-linux-container-with-lxc-on-ubuntu-16-04-14-04.html 创建容器和桥接。

这些是桥接的详细信息(在主机中):cat /etc/network/interfaces

# The loopback network interface
auto lo
iface lo inet loopback

### bridge name ###

auto br0
auto br1

### bridge information ###

#br0
iface br0 inet dhcp

bridge_ports enp2s0
bridge_stp off
bridge_fd 9

# br1
iface br1 inet dhcp

bridge_ports enp1s0
bridge_stp off
bridge_fd 9

# The primary network interface
auto enp2s0
iface enp2s0 inet dhcp

# second network interface
auto enp1s0
iface enp1s0 inet dhcp

在本例中,我对两个接口都使用 DHCP。

这些是我拥有的接口(在主机中):ifconfig

br0       Link encap:Ethernet  HWaddr 00:e0:81:bb:cc:71  
          inet addr:192.168.0.102  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::2e0:81ff:febb:cc71/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1994 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:386641 (386.6 KB)  TX bytes:2004 (2.0 KB)

br1       Link encap:Ethernet  HWaddr 00:e0:81:bb:cc:70  
          inet addr:10.0.1.2  Bcast:10.0.1.255  Mask:255.255.255.0
          inet6 addr: fe80::2e0:81ff:febb:cc70/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:55 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:23506 (23.5 KB)  TX bytes:1332 (1.3 KB)

enp1s0    Link encap:Ethernet  HWaddr 00:e0:81:bb:cc:70  
          inet addr:10.0.1.2  Bcast:10.0.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2092 errors:0 dropped:0 overruns:0 frame:0
          TX packets:218 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:601774 (601.7 KB)  TX bytes:39572 (39.5 KB)
          Interrupt:16 Memory:fdee0000-fdf00000 

enp2s0    Link encap:Ethernet  HWaddr 00:e0:81:bb:cc:71  
          inet addr:192.168.0.102  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:164151 errors:0 dropped:0 overruns:0 frame:0
          TX packets:23218 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:226362607 (226.3 MB)  TX bytes:1829585 (1.8 MB)
          Interrupt:17 Memory:fdfe0000-fe000000 

看看动态分配的IP地址,我怀疑br0已成功桥接到恩普2s0br1恩普1s0

这是主机中容器的配置:cat /etc/lxc/default.conf

lxc.network.type = veth
lxc.network.link = br0
lxc.network.flags = up
lxc.network.hwaddr = 00:16:3e:xx:xx:xx



lxc.network.type = veth
lxc.network.link = br1
lxc.network.flags = up
lxc.network.hwaddr = 00:16:3e:xx:xx:xx

我还怀疑此配置将第一个容器关联到br0和第二个容器br1

我可以从两个容器 ping 到互联网。但我似乎无法验证流量是否被隔离。

ifconfigubuntu_lxc(第一个容器):

eth0      Link encap:Ethernet  HWaddr 00:16:3e:77:2b:9c  
          inet addr:192.168.0.103  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::216:3eff:fe77:2b9c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:20 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:3978 (3.9 KB)  TX bytes:1332 (1.3 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ifconfigubuntu_lxc1(第二个容器):

eth0      Link encap:Ethernet  HWaddr 00:16:3e:f4:b8:f9  
          inet addr:192.168.0.106  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::216:3eff:fef4:b8f9/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:69 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:14203 (14.2 KB)  TX bytes:1332 (1.3 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

问题是:为什么ubuntu_lxc1容器分配的 IP 地址不同于br1在主机中(应该与该容器关联)?

如何将物理接口仅关联到特定容器?

如何验证流量已隔离?

相关内容