Note

外观

Linux隧道 ​

更新于 2021-02-19
英文原文点此处

Linux支持多种隧道,这里简介下几种常用的隧道.

常用的隧道包括 ​

  • IPIP Tunnel
  • SIT Tunnel
  • ip6tnl Tunnel
  • VTI and VTI6
  • GRE and GRETAP
  • IP6GRE and IP6GRETAP
  • FOU
  • GUE
  • GENEVE
  • ERSPAN and IP6ERSPAN

IPIP Tunnel ​

隧道头如图:
ipip

应用 ​

通过IPv4公网链接连两个IPv4子网.

优势 ​

开销低,但是只支持单播报文,不支持多播报文.

创建 ​

当IPIP模块加载后,或者创建IPIP设备后,
Linux内核会创建一个默认名为tun10 设备,属性:local=any,remote=any

shell
On Server A:
# ip link add name ipip0 type ipip local LOCAL_IPv4_ADDR remote REMOTE_IPv4_ADDR
# ip link set ipip0 up
# ip addr add INTERNAL_IPV4_ADDR/24 dev ipip0
Add a remote internal subnet route if the endpoints don't belong to the same subnet
# ip route add REMOTE_INTERNAL_SUBNET/24 dev ipip0

On Server B:
# ip link add name ipip0 type ipip local LOCAL_IPv4_ADDR remote REMOTE_IPv4_ADDR
# ip link set ipip0 up
# ip addr add INTERNAL_IPV4_ADDR/24 dev ipip0
# ip route add REMOTE_INTERNAL_SUBNET/24 dev ipip0

用真实环境IP替换配置中的4个参数:LOCAL_IPv4_ADDR,REMOTE_IPv4_ADDR,INTERNAL_IPV4_ADDR, REMOTE_INTERNAL_SUBNET

SIT Tunnel ​

SIT即简单网络传输.
SIT

应用 ​

连接IPv4环境下鼓励的IPv6网络.
最开始仅支持IPv4封装IPv6,现在支持ipip (the same with IPIP tunnel), ip6ip, mplsip, any

创建 ​

当sit模块加载后,内核会创建名为sit0的设备.

shell
On Server A:
# ip link add name sit1 type sit local LOCAL_IPv4_ADDR remote REMOTE_IPv4_ADDR mode any
# ip link set sit1 up
# ip addr add INTERNAL_IPV4_ADDR/24 dev sit1

配置完本端后,在远端设备上做同样的配置.

ip6tnl Tunnel ​

ip6tnl是用IPv6封装IPv4/IPv6
支持模式:ip6ip6,ipip6,anyip6tnl 当ip6tnl模块加载后,内核会创建名为ip6tnl0的设备

shell
# ip link add name ipip6 type ip6tnl local LOCAL_IPv6_ADDR remote REMOTE_IPv6_ADDR mode any

VTI and VTI6 ​

linux上的虚拟隧道接口(Virtual Tunnel Interface,VTI),即IPsec隧道
通过内核xfrm模块,对内部IP报文进行加密并封装.

shell
# ip link add name vti1 type vti key VTI_KEY local LOCAL_IPv4_ADDR remote REMOTE_IPv4_ADDR
# ip link set vti1 up
# ip addr add LOCAL_VIRTUAL_ADDR/24 dev vti1

# ip xfrm state add src LOCAL_IPv4_ADDR dst REMOTE_IPv4_ADDR spi SPI PROTO ALGR mode tunnel
# ip xfrm state add src REMOTE_IPv4_ADDR dst LOCAL_IPv4_ADDR spi SPI PROTO ALGR mode tunnel
# ip xfrm policy add dir in tmpl src REMOTE_IPv4_ADDR dst LOCAL_IPv4_ADDR PROTO mode tunnel mark VTI_KEY
# ip xfrm policy add dir out tmpl src LOCAL_IPv4_ADDR dst REMOTE_IPv4_ADDR PROTO mode tunnel mark VTI_KEY

GRE and GRETAP ​

通用路由封装(Generic Routing Encapsulation)
GRE隧道在内部和外部IP头之间增加GRE头部
GRE可以在有效的Ethernet头内封装任意的三层协议头
grp 可以在GRE隧道内传播多播报文和IPv6报文.

shell
# ip link add name gre1 type gre local LOCAL_IPv4_ADDR remote REMOTE_IPv4_ADDR [seq] key KEY

GRE隧道在OSI模型3层操作,GRETAP隧道在OSI模型的二层操作. geneve

shell
# ip link add name gretap1 type gretap local LOCAL_IPv4_ADDR remote REMOTE_IPv4_ADDR

IP6GRE and IP6GRETAP ​

gre6gre6tap

shell
# ip link add name gre1 type ip6gre local LOCAL_IPv6_ADDR remote REMOTE_IPv6_ADDR
# ip link add name gretap1 type ip6gretap local LOCAL_IPv6_ADDR remote REMOTE_IPv6_ADDR

FOU ​

FOU(foo over UDP)是UDP层的隧道. UDP隧道通常配合硬件指令(网卡RSS,交换机ECMP,checksum卸载)同时使用, fou 目前,FOU隧道支持基于IPIP,SIT,GRE的封装协议

shell
# ip fou add port 5555 ipproto 4
# ip link add name tun1 type ipip remote 192.168.1.1 local 192.168.1.2 ttl 225 encap fou encap-sport auto encap-dport 5555

GUE ​

Generic UDP Encapsulation (GUE)是另一种UDP隧道.
与FOU不同之处是,它有自己的协议头. gue GUE内部指出IPIP, SIT, GRE封装.

shell
# ip fou add port 5555 gue
# ip link add name tun1 type ipip remote 192.168.1.1 local 192.168.1.2 ttl 225 encap gue encap-sport auto encap-dport 5555

GENEVE ​

Generic Network Virtualization Encapsulation (GENEVE)包含VXLAN, NVGRE, and STT所有功能
geneve 此图与VXLAN看起来很相似
主要区别是:GENEVE头部是可扩展(通过添加TLV)

shell
# ip link add name geneve0 type geneve id VNI remote REMOTE_IPv4_ADDR

ERSPAN and IP6ERSPAN ​

Encapsulated Remote Switched Port Analyzer (ERSPAN)使用GRE封装实现二层或三层的端口镜像功能.
针对三层流量镜像,报文格式如下:
erspan
linux主机通过ERSPAN隧道将镜像流量发送到远端主机.

shell
# ip link add dev erspan1 type erspan local LOCAL_IPv4_ADDR remote REMOTE_IPv4_ADDR seq key KEY erspan_ver 1 erspan IDX
or
# ip link add dev erspan1 type erspan local LOCAL_IPv4_ADDR remote REMOTE_IPv4_ADDR seq key KEY erspan_ver 2 erspan_dir DIRECTION erspan_hwid HWID

Add tc filter to monitor traffic
# tc qdisc add dev MONITOR_DEV handle ffff: ingress
# tc filter add dev MONITOR_DEV parent ffff: matchall skip_hw action mirred egress mirror dev erspan1

总结 ​

Tunnel/Link TypeOuter HeaderEncapsulate HeaderInner Header
ipipIPv4NoneIPv4
sitIPv4NoneIPv4/IPv6
ip6tnl IPv6NoneIPv4/IPv6
vtiIPv4IPsecIPv4
vti6IPv6IPsecIPv6
greIPv4GREIPv4/IPv6
gretapIPv4GREEther + IPv4/IPv6
ip6greIPv6GREIPv4/IPv6
ip6gretapIPv6GREEther + IPv4/IPv6
fouIPv4/IPv6UDPIPv4/IPv6/GRE
gueIPv4/IPv6UDP + GUEIPv4/IPv6/GRE
geneveIPv4/IPv6UDP + GeneveEther + IPv4/IPv6
erspanIPv4GRE + ERSPANIPv4/IPv6
ip6erspanIPv6GRE + ERSPANIPv4/IPv6