使用openvswitch网桥连接不同的network namespace

Namespace是Linux提供的一种内核级别环境隔离的方法，在Linux中Namespace实际上有6中，这里只是单纯的说明一下网络命名空间（Network Namespace）。在实际应用中，Network NameSpace为kvm、容器等虚拟化所打造的一个虚拟化网络环境，他使得你可以创建不同的命名空间，并且每个命名空间都是相对独立的，有自己的ip、arp、route，并且每个命名空间都相互不影响。

在内核中的支持如下：

相关内容可参考：ip netns的使用及network namespace 简介

下面将介绍使用openvswitch创建网桥，连接两个不同的Network Namespace。网络拓扑如下：

1. 创建两个Network Namespace

# ip netns add ns0
# ip netns add ns1
# ip netns
ns1
ns0

2. 创建两组veth

两组veth成对出现，两个相互连接的命名空间（两个设备间相当于用网线直接连接在一起）。

默认会创建下面两对点到点的veth：
veth0—veth1
veth2—veth3

或者这样创建自定义命名设备：
ip link add veth0 type veth peer name veth1
ip link add veth2 type veth peer name veth2

# ip link add type veth
# ip link add type veth
# ip addr
1: veth0@veth1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN group default qlen 1000link/ether ea:25:dd:b8:1d:77 brd ff:ff:ff:ff:ff:ff
2: veth1@veth0: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop master ovs-system state DOWN group default qlen 1000link/ether ee:e9:83:72:bf:08 brd ff:ff:ff:ff:ff:ff
3: veth2@veth3: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN group default qlen 1000link/ether 46:dc:09:03:fe:b1 brd ff:ff:ff:ff:ff:ff
4: veth3@veth2: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop master ovs-system state DOWN group default qlen 1000

3. 把veth0/veth2划到ns0/ns1中，并配置ip

# ip link set veth0 netns ns0
# ip netns exec ns0 ip addr add 10.0.0.1/24 dev veth0
# ip netns exec ns0 ip link set veth0 up
# ip netns exec ns0 ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
5: veth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000link/ether ea:25:dd:b8:1d:77 brd ff:ff:ff:ff:ff:ff link-netnsid 0inet 10.0.0.1/24 scope global veth0valid_lft forever preferred_lft foreverinet6 fe80::e825:ddff:feb8:1d77/64 scope link valid_lft forever preferred_lft forever# ip link set veth2 netns ns1
# ip netns exec ns1 ip addr add 10.0.0.2/24 dev veth2
# ip netns exec ns1 ip link set veth2 up
# ip netns exec ns1 ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
7: veth2@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000link/ether 46:dc:09:03:fe:b1 brd ff:ff:ff:ff:ff:ff link-netnsid 0inet 10.0.0.2/24 scope global veth2valid_lft forever preferred_lft foreverinet6 fe80::44dc:9ff:fe03:feb1/64 scope link valid_lft forever preferred_lft forever

4. 创建网桥vswitch0，并将把veth1/veth3加入到网桥

# ovs-vsctl add-br vswitch0
# ovs-vsctl add-port vswitch0 veth1
# ovs-vsctl add-port vswitch0 veth3
# ip link set dev veth1 up
# ip link set dev veth3 up
# ovs-vsctl show
9f5877b0-14c0-41bd-a5c7-627e8d1aac24Bridge "vswitch0"Port "veth1"Interface "veth1"Port "vswitch0"Interface "vswitch0"type: internalPort "veth3"Interface "veth3"ovs_version: "2.12.0"

5. 分别进入ns0/ns1，ping一下对方，查看效果

# ip netns exec ns0 /bin/bash --rcfile <(echo "PS1=\"ns0> \"")
ns0> ip addr show veth0
5: veth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000link/ether ea:25:dd:b8:1d:77 brd ff:ff:ff:ff:ff:ff link-netnsid 0inet 10.0.0.1/24 scope global veth0valid_lft forever preferred_lft foreverinet6 fe80::e825:ddff:feb8:1d77/64 scope link valid_lft forever preferred_lft forever
ns0> ping 10.0.0.2 -c 3
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.409 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.083 ms
64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=0.079 ms--- 10.0.0.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 87ms
rtt min/avg/max/mdev = 0.079/0.190/0.409/0.155 ms

# ip netns exec ns1 /bin/bash --rcfile <(echo "PS1=\"ns1> \"")
ns1> ip addr show veth2
7: veth2@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000link/ether 46:dc:09:03:fe:b1 brd ff:ff:ff:ff:ff:ff link-netnsid 0inet 10.0.0.2/24 scope global veth2valid_lft forever preferred_lft foreverinet6 fe80::44dc:9ff:fe03:feb1/64 scope link valid_lft forever preferred_lft forever
ns1> ping 10.0.0.1 -c 3
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.254 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.079 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=64 time=0.079 ms--- 10.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 39ms
rtt min/avg/max/mdev = 0.079/0.137/0.254/0.083 ms

参考：
https://www.jianshu.com/p/df3931c2ec8a
https://www.cnblogs.com/zqyanywn/p/10491916.html