使用openvswitch網橋連接不同的network namespace

Namespace是Linux提供的一種內核級別環境隔離的方法，在Linux中Namespace實際上有6中，這裏只是單純的說明一下網絡命名空間（Network Namespace）。在實際應用中，Network NameSpace爲kvm、容器等虛擬化所打造的一個虛擬化網絡環境，他使得你可以創建不同的命名空間，並且每個命名空間都是相對獨立的，有自己的ip、arp、route，並且每個命名空間都相互不影響。

在內核中的支持如下：

相關內容可參考：ip netns的使用及network namespace 簡介

下面將介紹使用openvswitch創建網橋，連接兩個不同的Network Namespace。網絡拓撲如下：

1. 創建兩個Network Namespace

# ip netns add ns0
# ip netns add ns1
# ip netns
ns1
ns0

2. 創建兩組veth

兩組veth成對出現，兩個相互連接的命名空間（兩個設備間相當於用網線直接連接在一起）。

默認會創建下面兩對點到點的veth：
veth0—veth1
veth2—veth3

或者這樣創建自定義命名設備：
ip link add veth0 type veth peer name veth1
ip link add veth2 type veth peer name veth2

# ip link add type veth
# ip link add type veth
# ip addr
1: veth0@veth1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether ea:25:dd:b8:1d:77 brd ff:ff:ff:ff:ff:ff
2: veth1@veth0: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop master ovs-system state DOWN group default qlen 1000
    link/ether ee:e9:83:72:bf:08 brd ff:ff:ff:ff:ff:ff
3: veth2@veth3: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 46:dc:09:03:fe:b1 brd ff:ff:ff:ff:ff:ff
4: veth3@veth2: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop master ovs-system state DOWN group default qlen 1000

3. 把veth0/veth2劃到ns0/ns1中，並配置ip

# ip link set veth0 netns ns0
# ip netns exec ns0 ip addr add 10.0.0.1/24 dev veth0
# ip netns exec ns0 ip link set veth0 up
# ip netns exec ns0 ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
5: veth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether ea:25:dd:b8:1d:77 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.0.0.1/24 scope global veth0
       valid_lft forever preferred_lft forever
    inet6 fe80::e825:ddff:feb8:1d77/64 scope link 
       valid_lft forever preferred_lft forever

# ip link set veth2 netns ns1
# ip netns exec ns1 ip addr add 10.0.0.2/24 dev veth2
# ip netns exec ns1 ip link set veth2 up
# ip netns exec ns1 ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
7: veth2@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 46:dc:09:03:fe:b1 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.0.0.2/24 scope global veth2
       valid_lft forever preferred_lft forever
    inet6 fe80::44dc:9ff:fe03:feb1/64 scope link 
       valid_lft forever preferred_lft forever

4. 創建網橋vswitch0，並將把veth1/veth3加入到網橋

# ovs-vsctl add-br vswitch0
# ovs-vsctl add-port vswitch0 veth1
# ovs-vsctl add-port vswitch0 veth3
# ip link set dev veth1 up
# ip link set dev veth3 up
# ovs-vsctl show
9f5877b0-14c0-41bd-a5c7-627e8d1aac24
    Bridge "vswitch0"
        Port "veth1"
            Interface "veth1"
        Port "vswitch0"
            Interface "vswitch0"
                type: internal
        Port "veth3"
            Interface "veth3"
    ovs_version: "2.12.0"

5. 分別進入ns0/ns1，ping一下對方，查看效果

# ip netns exec ns0 /bin/bash --rcfile <(echo "PS1=\"ns0> \"")
ns0> ip addr show veth0
5: veth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether ea:25:dd:b8:1d:77 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.0.0.1/24 scope global veth0
       valid_lft forever preferred_lft forever
    inet6 fe80::e825:ddff:feb8:1d77/64 scope link 
       valid_lft forever preferred_lft forever
ns0> ping 10.0.0.2 -c 3
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.409 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.083 ms
64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=0.079 ms

--- 10.0.0.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 87ms
rtt min/avg/max/mdev = 0.079/0.190/0.409/0.155 ms

# ip netns exec ns1 /bin/bash --rcfile <(echo "PS1=\"ns1> \"")
ns1> ip addr show veth2
7: veth2@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 46:dc:09:03:fe:b1 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.0.0.2/24 scope global veth2
       valid_lft forever preferred_lft forever
    inet6 fe80::44dc:9ff:fe03:feb1/64 scope link 
       valid_lft forever preferred_lft forever
ns1> ping 10.0.0.1 -c 3
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.254 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.079 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=64 time=0.079 ms

--- 10.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 39ms
rtt min/avg/max/mdev = 0.079/0.137/0.254/0.083 ms

參考：
https://www.jianshu.com/p/df3931c2ec8a
https://www.cnblogs.com/zqyanywn/p/10491916.html