# modprobe ipip # ip tunnel add tunl0 mode ipip remote 172.16.232.172 local 172.16.232.194 # ip addr add 10.42.2.1/24 dev tunl0 # ip link set tunl0 up
为了保证我们通过创建的IPIP隧道来访问两个不同主机上的子网,我们需要手动添加如下静态路由:
A:
1
# ip route add 10.42.2.0/24 dev tunl0
B:
1
# ip route add 10.42.1.0/24 dev tunl0
现在主机AB的路由表如下所示:
A:
1 2 3 4 5
# ip route show default via 172.16.200.51 dev ens3 10.42.1.0/24 dev tunl0 proto kernel scope link src 10.42.1.1 10.42.2.0/24 dev tunl0 scope link 172.16.0.0/16 dev ens3 proto kernel scope link src 172.16.232.172
B:
1 2 3 4 5
# ip route show default via 172.16.200.51 dev ens3 10.42.1.0/24 dev tunl0 scope link 10.42.2.0/24 dev tunl0 proto kernel scope link src 10.42.2.1 172.16.0.0/16 dev ens3 proto kernel scope link src 172.16.232.194
到此我们就可以开始验证IPIP隧道是否正常工作:
A:
1 2 3 4 5 6 7 8
# ping 10.42.2.1 -c 2 PING 10.42.2.1 (10.42.2.1) 56(84) bytes of data. 64 bytes from 10.42.2.1: icmp_seq=1 ttl=64 time=0.269 ms 64 bytes from 10.42.2.1: icmp_seq=2 ttl=64 time=0.303 ms
--- 10.42.2.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1013ms rtt min/avg/max/mdev = 0.269/0.286/0.303/0.017 ms
B:
1 2 3 4 5 6 7 8
# ping 10.42.1.1 -c 2 PING 10.42.1.1 (10.42.1.1) 56(84) bytes of data. 64 bytes from 10.42.1.1: icmp_seq=1 ttl=64 time=0.214 ms 64 bytes from 10.42.1.1: icmp_seq=2 ttl=64 time=3.27 ms
--- 10.42.1.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1021ms rtt min/avg/max/mdev = 0.214/1.745/3.277/1.532 ms
是的,可以ping通,我们通过tcpdump在TUN设备抓取数据:
1 2 3 4 5 6 7
# tcpdump -n -i tunl0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tunl0, link-type RAW (Raw IP), capture size 262144 bytes 01:32:05.486835 IP 10.42.1.1 > 10.42.2.1: ICMP echo request, id 3460, seq 1, length 64 01:32:05.486868 IP 10.42.2.1 > 10.42.1.1: ICMP echo reply, id 3460, seq 1, length 64 01:32:06.509617 IP 10.42.1.1 > 10.42.2.1: ICMP echo request, id 3460, seq 2, length 64 01:32:06.509668 IP 10.42.2.1 > 10.42.1.1: ICMP echo reply, id 3460, seq 2, length 64
# modprobe ipip # ip tunnel add tunl0 mode ipip # ip link set tunl0 up # ip addr add 10.42.1.0/32 dev tunl0 # ip route add 10.42.2.0/24 via 172.16.165.244 dev tunl0 onlink # ip route add 10.42.3.0/24 via 172.16.168.113 dev tunl0 onlink
B:
1 2 3 4 5 6
# modprobe ipip # ip tunnel add tunl0 mode ipip # ip link set tunl0 up # ip addr add 10.42.2.0/32 dev tunl0 # ip route add 10.42.1.0/24 via 172.16.165.33 dev tunl0 onlink # ip route add 10.42.3.0/24 via 172.16.168.113 dev tunl0 onlink
C:
1 2 3 4 5 6
modprobe ipip ip tunnel add tunl0 mode ipip ip link set tunl0 up ip addr add 10.42.3.0/32 dev tunl0 ip route add 10.42.1.0/24 via 172.16.165.33 dev tunl0 onlink ip route add 10.42.2.0/24 via 172.16.165.244 dev tunl0 onlink
到此我们就可以开始验证我们搭建的IPIP隧道是否正常工作:
A:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
# try to ping IP in 10.42.2.0/24 on Node B # ping 10.42.2.1 -c 2 PING 10.42.2.1 (10.42.2.1) 56(84) bytes of data. 64 bytes from 10.42.2.1: icmp_seq=1 ttl=64 time=0.338 ms 64 bytes from 10.42.2.1: icmp_seq=2 ttl=64 time=0.302 ms
--- 10.42.2.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1028ms rtt min/avg/max/mdev = 0.302/0.320/0.338/0.018 ms ... # try to ping IP in 10.42.3.0/24 on Node C # ping 10.42.3.1 -c 2 PING 10.42.3.1 (10.42.3.1) 56(84) bytes of data. 64 bytes from 10.42.3.1: icmp_seq=1 ttl=64 time=0.315 ms 64 bytes from 10.42.3.1: icmp_seq=2 ttl=64 time=0.381 ms
--- 10.42.3.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1029ms rtt min/avg/max/mdev = 0.315/0.348/0.381/0.033 ms