Linux Network virtualization-gre vpn network method, grevpn

Source: Internet
Author: User

Linux Network virtualization-gre vpn network method, grevpn

This article does not detail gre and vpn principles. This section describes how to use the Linux gre virtual network device to implement your own vpn network.

1. Requirements

Assume that the requirements are as follows:

Figure 1

Lan 1 is located in Shanghai, lan 2 is located in Nanjing, and both networks are connected to the public network through routers. We simulate this network environment and use the Linux gre virtual network device to virtualize a layer-2 Data Link over the public network, that is, the green part in Figure 1, to create a vpn network.

2. Simulated networking Diagram

Figure 2

In, LinuxBridge is used to simulate the switch in Figure 1, VirtualBox is used to simulate the external public network with Only the host (Honst-Only) network, and the network stack of the host machine and the gretap device are used to implement the vpn, the focus of this article is the gretap device.

3. vpn network address planning
Network Name Vni Gateway DHCP address IP address range
Test-br-01 1000 172.16.0.1 172.16.0.2 172.16.0.3/24 ~ 172.16.0.50/24
4. Configure dnsmaq

Root login to the ubuntu-01 host in Figure 2, configure dnsmasq.

Create a file/etc/test-dnsmasq.conf and add the following:
# DNS listening port interface = test-veth-02 # bind-interfaces # network segment dhcp-range = 172.16.0.2, 172.16.0.50, 255.255.255.0, 12 h # manage IP address data file dhcp-leasefile =/var/lib/misc/test-dnsmasq.leases # gateway dhcp-option = option: router, 172.16.0.1
Run the following command to start dnsmasq:
ip link add test-veth-01 type veth peer name test-veth-02ip netns add test-ns-01ip link set test-veth-02 netns test-ns-01ip netns exec test-ns-01 ip addr add 172.16.0.2/24 dev test-veth-02ip netns exec test-ns-01 ip link set test-veth-02 upip netns exec test-ns-01 /usr/sbin/dnsmasq --conf-file=/etc/test-dnsmasq.conf
5. Create a vpn Network root login ubuntu-01 and execute the following command:
brctl addbr test-br-01ip link add gretap01 type gretap mode gre local 192.168.187.4 remote 192.168.187.3 ttl 255brctl addif test-br-01 test-veth-01brctl addif test-br-01 gretap01ip link set test-br-01 upip link set gretap01 upip link set test-veth-01 up

Pay special attention to the second line in the above Code. The gretap device is created here.

Root Login ubuntu-02, execute the following command:
brctl addbr test-br-01ip link add gretap01 type gretap mode gre local 192.168.187.3 remote 192.168.187.4 ttl 255brctl addif test-br-01 gretap01ip link set test-br-01 upip link set gretap01 up

In the above two pieces of code, when the local address is involved, it refers to the address on the enp0s8 Nic of the local machine, and remote refers to the IP address on the enp0s8 Nic of the Peer host. Also note that whether in the ubuntu-01 and ubuntu-02, the correct route table, CIDR Block 192.168.187.0/24 address, to be forwarded through enp0s8. For example, 3 red boxes:

Figure 3

From the above configuration process, we can see that the gre encapsulated data is finally forwarded from that Nic, depending on the contents of the route table. Now the vpn network has been set up. Hosts connected to test-br-01 networks, whether in Shanghai or Nanjing, logically form a large L2 network through vpn.

Large-Scale Price Reduction
  • 59% Max. and 23% Avg.
  • Price Reduction for Core Products
  • Price Reduction in Multiple Regions
undefined. /
Connect with us on Discord
  • Secure, anonymous group chat without disturbance
  • Stay updated on campaigns, new products, and more
  • Support for all your questions
undefined. /
Free Tier
  • Start free from ECS to Big Data
  • Get Started in 3 Simple Steps
  • Try ECS t5 1C1G
undefined. /

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.