Linux Network virtualization-gre vpn network method, grevpn

Linux Network virtualization-gre vpn network method, grevpn

This article does not detail gre and vpn principles. This section describes how to use the Linux gre virtual network device to implement your own vpn network.

1. Requirements

Assume that the requirements are as follows:

Figure 1

Lan 1 is located in Shanghai, lan 2 is located in Nanjing, and both networks are connected to the public network through routers. We simulate this network environment and use the Linux gre virtual network device to virtualize a layer-2 Data Link over the public network, that is, the green part in Figure 1, to create a vpn network.

2. Simulated networking Diagram

Figure 2

In, LinuxBridge is used to simulate the switch in Figure 1, VirtualBox is used to simulate the external public network with Only the host (Honst-Only) network, and the network stack of the host machine and the gretap device are used to implement the vpn, the focus of this article is the gretap device.

3. vpn network address planning

Network Name	Vni	Gateway	DHCP address	IP address range
Test-br-01	1000	172.16.0.1	172.16.0.2	172.16.0.3/24 ~ 172.16.0.50/24

4. Configure dnsmaq

Root login to the ubuntu-01 host in Figure 2, configure dnsmasq.

Create a file/etc/test-dnsmasq.conf and add the following:

# DNS listening port interface = test-veth-02 # bind-interfaces # network segment dhcp-range = 172.16.0.2, 172.16.0.50, 255.255.255.0, 12 h # manage IP address data file dhcp-leasefile =/var/lib/misc/test-dnsmasq.leases # gateway dhcp-option = option: router, 172.16.0.1

Run the following command to start dnsmasq:

ip link add test-veth-01 type veth peer name test-veth-02ip netns add test-ns-01ip link set test-veth-02 netns test-ns-01ip netns exec test-ns-01 ip addr add 172.16.0.2/24 dev test-veth-02ip netns exec test-ns-01 ip link set test-veth-02 upip netns exec test-ns-01 /usr/sbin/dnsmasq --conf-file=/etc/test-dnsmasq.conf

5. Create a vpn Network root login ubuntu-01 and execute the following command:

brctl addbr test-br-01ip link add gretap01 type gretap mode gre local 192.168.187.4 remote 192.168.187.3 ttl 255brctl addif test-br-01 test-veth-01brctl addif test-br-01 gretap01ip link set test-br-01 upip link set gretap01 upip link set test-veth-01 up

Pay special attention to the second line in the above Code. The gretap device is created here.

Root Login ubuntu-02, execute the following command:

brctl addbr test-br-01ip link add gretap01 type gretap mode gre local 192.168.187.3 remote 192.168.187.4 ttl 255brctl addif test-br-01 gretap01ip link set test-br-01 upip link set gretap01 up

In the above two pieces of code, when the local address is involved, it refers to the address on the enp0s8 Nic of the local machine, and remote refers to the IP address on the enp0s8 Nic of the Peer host. Also note that whether in the ubuntu-01 and ubuntu-02, the correct route table, CIDR Block 192.168.187.0/24 address, to be forwarded through enp0s8. For example, 3 red boxes:

Figure 3

From the above configuration process, we can see that the gre encapsulated data is finally forwarded from that Nic, depending on the contents of the route table. Now the vpn network has been set up. Hosts connected to test-br-01 networks, whether in Shanghai or Nanjing, logically form a large L2 network through vpn.