Skip to content

Pod Networking

The networking inside of our 'virtual OpenStack environment' is pretty straight forward. IPv6 gets just routed to its destination and since IPv4 addresses got kind of expensive, we use NAT for our legacy IP stack.

Don't forget to turn on forwarding on you routers and server!

Keepalived

Since we have two border routers, we need to do some kind of magic, so our servers always reach a gateway. For that, you can use Keepalived. Once it is installed and configured on multiple machines (routers), the keepalived instances talk to each other and decide, which instance uses the VIP on the network.

Write your configuration for Keepalived to /etc/keepalived/keepalived.conf.

IfState has a very informative example in its documentation. The quick start guide from Keepalived should answer any questions, you might have.

Internal network configuration

Your server VM should contain one network namespace per virtual server. Create two of them for the beginning.

Each network namespace gets one IPv4 and one IPv6 address. For IPv4, take RFC 1918 subnets like 192.168.20.0/24. For IPv6, your assignment has a recommendation for that.

Since we only have one network interface on the server, we use Virtual Ethernet Devices for that. Check out the IfState chapter on how to configure them.

NAT

For the NAT of our IPv4 ressources, we use nftables.

You need to configure SNAT for the outbound traffic. Just map each server/namespace to one of the IP addresses of your assignment. Since you want to reach your services from the internet, you need DNAT. Use the same IP address mapping as with SNAT.

Remember to bind the (public) IP addresses used for NAT to you outbount network interface.

Feel free to come up with a nftables ruleset by yourself. If you need some inspiration, you can take a look at the spoiler below. 🙂

Example configuration

This example takes the outbound traffic from 192.168.20.2 (the IP used inside of the network namespace) and forwards it to the servers physical interface podnet with the IP address 212.111.xxx.yyy. For the inbound traffic it is the same thing, but the other way around: Any traffic on 212.111.xxx.yyy gets forwarded to 192.168.20.2 on the network interface veth-r1.

table ip nat {
    chain postrouting {
        type nat hook postrouting priority 100;
        ip saddr 192.168.20.2 oifname "podnet" snat to 212.111.xxx.yyy
        ip saddr 192.168.21.2 oifname "podnet" snat to 212.111.xxx.zzz
    }

    chain prerouting {
        type nat hook prerouting priority 100;
        ip daddr 212.111.xxx.yyy oifname "veth-r1" dnat to 192.168.20.2
        ip daddr 212.111.xxx.zzz oifname "veth-r2" dnat to 192.168.21.2
    }
}