☰

libvirt 브리지 KVM 가상 머신을 라우팅할 수 없습니다.

tag-icon • tag-icon linux networking kvm libvirt
libvirt 브리지 KVM 가상 머신을 라우팅할 수 없습니다.

네트워크 브리지(br0)를 통해 실행되는 libvirt KVM VM(netstuff)이 있는데, 여기에는 두 개의 슬레이브 장치((em2) 호스트 물리적 인터페이스와 (vnet0) 가상 네트워크 카드)가 있습니다. dnsmasq-dhcp는 호스트에 상주하며 가상 머신 및 기타 물리적 호스트에 IP 주소를 제공합니다.

가상 머신과 하드웨어 간을 포함하여 192.168.1.0/24 어디든 라우팅할 수 있지만 가상 머신은 다른 네트워크나 인터넷으로 라우팅할 수 없습니다. 게스트에서 호스트로 나가는 트래픽은 브리지에서 기본 경로가 있는 em1 인터페이스로 라우팅되지 않는 것으로 보입니다.

돕다?

호스트 libvirt XML:

# virsh dumpxml netstuff

... snip ...
<interface type='bridge'>
  <mac address='52:54:00:27:c4:22'/>
  <source bridge='br0'/>
  <target dev='vnet0'/>
  <model type='virtio'/>
  <alias name='net0'/>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>
... snip ...

호스트 IP 라우팅:

# ip r
default via XXX.99.126.1 dev em1
169.254.0.0/16 dev em1  scope link  metric 1002
169.254.0.0/16 dev br0  scope link  metric 1004
192.168.1.0/24 dev br0  proto kernel  scope link  src 192.168.1.1
XXX.99.126.0/27 dev em1  proto kernel  scope link  src XXX.99.126.4

호스트 네트워크 카드:

# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether d4:ae:52:9d:73:c2 brd ff:ff:ff:ff:ff:ff
    inet XXX.99.126.4/27 brd XXX.99.126.31 scope global em1
       valid_lft forever preferred_lft forever
    inet6 fe80::d6ae:52ff:fe9d:73c2/64 scope link
       valid_lft forever preferred_lft forever
3: em2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br0 state UP qlen 1000
    link/ether d4:ae:52:9d:73:c3 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::d6ae:52ff:fe9d:73c3/64 scope link
       valid_lft forever preferred_lft forever
4: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether d4:ae:52:9d:73:c3 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br0
       valid_lft forever preferred_lft forever
    inet6 fe80::d6ae:52ff:fe9d:73c3/64 scope link
       valid_lft forever preferred_lft forever
5: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UNKNOWN qlen 1000
    link/ether fe:54:00:27:c4:22 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::fc54:ff:fe27:c422/64 scope link
       valid_lft forever preferred_lft forever

호스트 IP 테이블:

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
INPUT_direct  all  --  anywhere             anywhere
INPUT_ZONES_SOURCE  all  --  anywhere             anywhere
INPUT_ZONES  all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere             ctstate INVALID
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             PHYSDEV match --physdev-is-bridged
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
FORWARD_direct  all  --  anywhere             anywhere
FORWARD_IN_ZONES_SOURCE  all  --  anywhere             anywhere
FORWARD_IN_ZONES  all  --  anywhere             anywhere
FORWARD_OUT_ZONES_SOURCE  all  --  anywhere             anywhere
FORWARD_OUT_ZONES  all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere             ctstate INVALID
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
OUTPUT_direct  all  --  anywhere             anywhere

Chain FORWARD_IN_ZONES (1 references)
target     prot opt source               destination
FWDI_public  all  --  anywhere             anywhere            [goto]
FWDI_public  all  --  anywhere             anywhere            [goto]
FWDI_public  all  --  anywhere             anywhere            [goto]

Chain FORWARD_IN_ZONES_SOURCE (1 references)
target     prot opt source               destination

Chain FORWARD_OUT_ZONES (1 references)
target     prot opt source               destination
FWDO_public  all  --  anywhere             anywhere            [goto]
FWDO_public  all  --  anywhere             anywhere            [goto]
FWDO_public  all  --  anywhere             anywhere            [goto]

Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target     prot opt source               destination

Chain FORWARD_direct (1 references)
target     prot opt source               destination

Chain FWDI_public (3 references)
target     prot opt source               destination
FWDI_public_log  all  --  anywhere             anywhere
FWDI_public_deny  all  --  anywhere             anywhere
FWDI_public_allow  all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere

Chain FWDI_public_allow (1 references)
target     prot opt source               destination

Chain FWDI_public_deny (1 references)
target     prot opt source               destination

Chain FWDI_public_log (1 references)
target     prot opt source               destination

Chain FWDO_public (3 references)
target     prot opt source               destination
FWDO_public_log  all  --  anywhere             anywhere
FWDO_public_deny  all  --  anywhere             anywhere
FWDO_public_allow  all  --  anywhere             anywhere

Chain FWDO_public_allow (1 references)
target     prot opt source               destination

Chain FWDO_public_deny (1 references)
target     prot opt source               destination

Chain FWDO_public_log (1 references)
target     prot opt source               destination

Chain INPUT_ZONES (1 references)
target     prot opt source               destination
IN_public  all  --  anywhere             anywhere            [goto]
IN_public  all  --  anywhere             anywhere            [goto]
IN_public  all  --  anywhere             anywhere            [goto]

Chain INPUT_ZONES_SOURCE (1 references)
target     prot opt source               destination

Chain INPUT_direct (1 references)
target     prot opt source               destination
REJECT     tcp  --  anywhere             anywhere             multiport dports ssh match-set fail2ban-sshd src reject-with icmp-port-unreachable

Chain IN_public (3 references)
target     prot opt source               destination
IN_public_log  all  --  anywhere             anywhere
IN_public_deny  all  --  anywhere             anywhere
IN_public_allow  all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere

Chain IN_public_allow (1 references)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh ctstate NEW

Chain IN_public_deny (1 references)
target     prot opt source               destination

Chain IN_public_log (1 references)
target     prot opt source               destination

Chain OUTPUT_direct (1 references)
target     prot opt source               destination

게스트 IP 라우팅:

ssh [email protected]
Last login: Sat Apr  8 05:29:55 2017 from 192.168.1.1
[centos@netstuff ~]$ ip r
default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.76
[centos@netstuff ~]$

게스트 NIC:

[centos@netstuff ~]$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 52:54:00:27:c4:22 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.76/24 brd 192.168.1.255 scope global dynamic eth0
       valid_lft 2978sec preferred_lft 2978sec
    inet6 fe80::5054:ff:fe27:c422/64 scope link
       valid_lft forever preferred_lft forever

답변1

NAT 없이는 이것이 불가능하다는 것이 밝혀져 defaultNetwork 를 사용하여 NAT를 다시 활성화했습니다 virsh net-start default. dnsmasq와 함께 libvirt를 사용할 때는 DHCP 서버가 자신이 생성한 인터페이스에서만 실행되도록 주의하세요. 그래서 호스트에 설정한 dnsmasq가 libvirt가 만든 dnsmasq를 방해하지 않는지 확인했습니다. 이를 위해 /etc/dnsmasq.confdnsmasq를 모드로 설정하고 bind-interfaces내가 제공한 고정 IP(192.168.1.1)를 표시하여 내가 만든 브리지(br0)에서 수신 대기하도록 강제했습니다.

listen-address=192.168.1.1
bind-interfaces

그리고 물론:

systemctl restart dnsmasq

dnsmasq FAQ와 Bind Interface 및 Bind Dynamics 설정은 여기를 참조하세요. http://www.thekelleys.org.uk/dnsmasq/docs/FAQ

관련 정보