KVM Bridge 仅单向转发数据包

KVM Bridge 仅单向转发数据包

我已经使用 virsh/libvirt/kvm 配置了 Linux VM,但桥接网络存在问题。libvirt 的默认 NAT 网络运行良好,但我需要桥接至公共接口。我已使用 virsh 删除了默认网络,并将 virsh 中的 VM 网络设置更改为:

    <interface type='bridge'>
      <mac address='02:00:00:c1:8f:95'/>
      <source bridge='br0'/>
      <model type='virtio'/>
      <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
    </interface>

在主机系统上我已经配置了桥接器:

# brctl show br0
bridge name     bridge id               STP enabled     interfaces
br0             8000.a0423f494574       yes             enp97s0f0
                                                        vnet0

# brctl showstp br0
br0
 bridge id              8000.a0423f494574
 designated root        8000.a0423f494574
 root port                 0                    path cost                  0
 max age                  20.00                 bridge max age            20.00
 hello time                2.00                 bridge hello time          2.00
 forward delay            15.00                 bridge forward delay      15.00
 ageing time             300.00
 hello timer               0.86                 tcn timer                  0.00
 topology change timer     0.00                 gc timer                 240.41
 flags


enp97s0f0 (1)
 port id                8001                    state                forwarding
 designated root        8000.a0423f494574       path cost                100
 designated bridge      8000.a0423f494574       message age timer          0.00
 designated port        8001                    forward delay timer        0.00
 designated cost           0                    hold timer                 0.00
 flags

vnet0 (2)
 port id                8002                    state                forwarding
 designated root        8000.a0423f494574       path cost                100
 designated bridge      8000.a0423f494574       message age timer          0.00
 designated port        8002                    forward delay timer        0.00
 designated cost           0                    hold timer                 0.00

其中 enp97s0f0 是公共 NIC,vnet0 是 libvirt 使用的虚拟 NIC。

我已经在虚拟机上配置了 IP 和网关,但 ping 未收到任何回复。在从虚拟机到 1.1.1.1 cloudflare dns 的 ping 过程中,我在主机上执行了 tcpdump,在 vnet0 和 br0 上均如此。结果如下:

# tcpdump -i vnet0 -n host VM.VM.VM.VM
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vnet0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:13:50.863273 IP VM.VM.VM.VM > 1.1.1.1: ICMP echo request, id 2016, seq 80, length 64
15:13:51.887267 IP VM.VM.VM.VM > 1.1.1.1: ICMP echo request, id 2016, seq 81, length 64
15:13:52.911271 IP VM.VM.VM.VM > 1.1.1.1: ICMP echo request, id 2016, seq 82, length 64
15:13:53.935270 IP VM.VM.VM.VM > 1.1.1.1: ICMP echo request, id 2016, seq 83, length 64
# tcpdump -i br0 -n host VM.VM.VM.VM
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:12:33.039228 IP VM.VM.VM.VM > 1.1.1.1: ICMP echo request, id 2016, seq 4, length 64
15:12:33.045522 IP 1.1.1.1 > VM.VM.VM.VM: ICMP echo reply, id 2016, seq 4, length 64
15:12:33.045532 IP 1.1.1.1 > VM.VM.VM.VM: ICMP echo reply, id 2016, seq 4, length 64
15:12:34.063111 IP VM.VM.VM.VM > 1.1.1.1: ICMP echo request, id 2016, seq 5, length 64
15:12:34.069501 IP 1.1.1.1 > VM.VM.VM.VM: ICMP echo reply, id 2016, seq 5, length 64
15:12:34.069510 IP 1.1.1.1 > VM.VM.VM.VM: ICMP echo reply, id 2016, seq 5, length 64
15:12:35.087281 IP VM.VM.VM.VM > 1.1.1.1: ICMP echo request, id 2016, seq 6, length 64
15:12:35.093640 IP 1.1.1.1 > VM.VM.VM.VM: ICMP echo reply, id 2016, seq 6, length 64
15:12:35.093649 IP 1.1.1.1 > VM.VM.VM.VM: ICMP echo reply, id 2016, seq 6, length 64

所以我可以看到,VM 通过 vnet0 发送 ping 请求,网桥 br0 将此请求转发到 1.1.1.1,而 1.1.1.1 则将回复发送回网桥。然后数据包消失,再也没有到达 VM 接口。

这就是为什么我认为该问题可能与主机上的某种数据包过滤有关,但我已经检查了一堆变量并且一切看起来正常:

/proc/sys/net/ipv4/ip_forward : 1
/proc/sys/net/ipv4/conf/br0/forwarding : 1
/proc/sys/net/ipv4/conf/vnet0/forwarding : 1
/proc/sys/net/ipv4/conf/enp97s0f0/forwarding : 1
/proc/sys/net/bridge/bridge-nf-call-iptables: No such file or directory
# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
# ebtables -L
Bridge table: filter

Bridge chain: INPUT, entries: 0, policy: ACCEPT

Bridge chain: FORWARD, entries: 0, policy: ACCEPT

Bridge chain: OUTPUT, entries: 0, policy: ACCEPT

# nft list ruleset
table bridge filter {
        chain INPUT {
                type filter hook input priority filter; policy accept;
        }

        chain FORWARD {
                type filter hook forward priority filter; policy accept;
        }

        chain OUTPUT {
                type filter hook output priority filter; policy accept;
        }
}
table ip filter {
        chain INPUT {
                type filter hook input priority filter; policy accept;
        }

        chain FORWARD {
                type filter hook forward priority filter; policy accept;
        }

        chain OUTPUT {
                type filter hook output priority filter; policy accept;
        }
}
[root@HOST ~] # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp97s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br0 state UP group default qlen 1000
    link/ether a0:42:3f:49:45:74 brd ff:ff:ff:ff:ff:ff
3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether a0:42:3f:49:45:74 brd ff:ff:ff:ff:ff:ff
    inet xxx.xxx.xxx.xxx/24 scope global dynamic noprefixroute br0
       valid_lft 71705sec preferred_lft 71705sec
    inet6 fe80::6559:22b2:dccd:3b24/64 scope link noprefixroute
       valid_lft forever preferred_lft forever
4: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UNKNOWN group default qlen 1000
    link/ether fe:00:00:c1:8f:95 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::fc00:ff:fec1:8f95/64 scope link
       valid_lft forever preferred_lft forever
[root@VM ~]# ip addr show
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp1s0:  mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 02:00:00:c1:8f:95 brd ff:ff:ff:ff:ff:ff
    inet VM.VM.VM.VM/24 scope global enp1s0
       valid_lft forever preferred_lft forever
[root@HOST ~]# bridge link
2: enp97s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master br0 state forwarding priority 32 cost 100
8: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master br0 state forwarding priority 32 cost 100
[root@HOST ~]# bridge fdb show
fc:bd:67:ff:ec:6a dev enp97s0f0 master br0
fc:bd:67:ff:ec:31 dev enp97s0f0 master br0
2c:dd:e9:0d:9d:31 dev enp97s0f0 master br0
fe:ed:de:ad:be:ef dev enp97s0f0 master br0
a0:42:3f:49:45:74 dev enp97s0f0 vlan 1 master br0 permanent
a0:42:3f:49:45:74 dev enp97s0f0 master br0 permanent
01:00:5e:00:00:01 dev enp97s0f0 self permanent
33:33:00:00:00:01 dev enp97s0f0 self permanent
01:00:5e:00:00:01 dev br0 self permanent
33:33:00:00:00:01 dev br0 self permanent
33:33:ff:cd:3b:24 dev br0 self permanent
01:00:5e:00:00:6a dev br0 self permanent
33:33:00:00:00:6a dev br0 self permanent
02:00:00:c1:8f:95 dev vnet0 master br0
fe:00:00:c1:8f:95 dev vnet0 vlan 1 master br0 permanent
fe:00:00:c1:8f:95 dev vnet0 master br0 permanent
33:33:00:00:00:01 dev vnet0 self permanent
01:00:5e:00:00:01 dev vnet0 self permanent
33:33:ff:c1:8f:95 dev vnet0 self permanent
[root@HOST ~]# bridge vlan show
port              vlan-id
enp97s0f0         1 PVID Egress Untagged
vnet0             1 PVID Egress Untagged

主机系统为 Centos8,内核为 5.13.12-1.el8.elrepo.x86_64。VM 系统默认安装 Centos8。

编辑:

如果我在主机 br0 和虚拟机 enp1s0 接口上配置了私有网络 IP,那么虚拟机可以 ping 通主机,主机也可以 ping 通虚拟机。但仍然无法 ping 通本地网络之外的任何内容。

答案1

通过在主机上创建到虚拟机 IP 地址的路由来解决:

route add -host VM.VM.VM.VM dev br0

相关内容