Connecting Linux network namespaces via VRF device

Tobbe 0
Viewed 65

I'm trying to get my head around the Linux VRF device.

I'm trying to connect two Network Namespaces (on separate IP networks) to communicate via a VRF device. I connect each NetNS to a VRF device via a veth-pair. I setup routes in the VRF table to route traffic between the NetNs. Finally I try to run 'python -m http.server' in one NetNs and try to GET a file with 'wget' from the other NetNs. Using Tshark I can see that the end of the "client" veth-pair is ARP'ing for the the server IP/Eth address but no routing takes place. My setup looks like this:

sudo ip netns add east
sudo ip netns add west
sudo ip link add vrf-0 type vrf table 10
sudo ip link set dev vrf-0 up
sudo ip link add veth-east type veth peer name veth-east-vrf
sudo ip link add veth-west type veth peer name veth-west-vrf
sudo ip link add xcable type veth peer name xcable-vrf
sudo ip link set veth-east netns east
sudo ip link set veth-east-vrf master vrf-0
sudo ip link set veth-west netns west
sudo ip link set veth-west-vrf master vrf-0
sudo ip link set xcable-vrf master vrf-0
sudo ip -n east addr add 192.168.15.2/24 dev veth-east
sudo ip -n east link set veth-east up
sudo ip addr add 192.168.15.1/24 dev veth-east-vrf
sudo ip link set veth-east-vrf up
sudo ip -n east route add default dev veth-east
sudo ip route add 192.168.15.0/24 dev vrf-0
sudo ip -n west addr add 192.168.16.2/24 dev veth-west
sudo ip -n west link set veth-west up
sudo ip addr add 192.168.16.1/24 dev veth-west-vrf
sudo ip link set veth-west-vrf up
sudo ip -n west route add default dev veth-west
sudo ip route add 192.168.16.0/24 dev vrf-0
sudo ip addr add 192.168.99.2/24 dev xcable
sudo ip link set xcable up
sudo ip addr add 192.168.99.1/24 dev xcable-vrf
sudo ip link set xcable-vrf up

I'm not sure it is supposed to work like this so any insights would be great. The full script to recreate this can be found here: https://github.com/etnt/vrf-experiments

To summarize my question: On Linux, how do I setup IP communication between two Network Namespaces, having the traffic being routed via a VRF routing table?

ip routes linux
1 Answers

Ok, the solution was to change the default route setting in the NetNS, to:

sudo ip -n east route add default via 192.168.15.1
sudo ip -n west route add default via 192.168.16.1

still, on some Linux systems this was not enough and I could not figure out the reason. But then I used another approach using the unshare command that I picked up from https://stbuehler.de/blog/article/2020/02/29/using_vrf__virtual_routing_and_forwarding__on_linux.html . This solution is also available in my git repo at: https://github.com/etnt/vrf-experiments

Tobbe0
Related