I'm trying to setup a test scenario regarding linux bridges for which I need a full virtual IP stack. Basically, I'd like to simulate the network between a VM (or container) and its host, just without a VM, i.e. virtualization layer.
The host side is a bridge (
br0) with a configured IP address (the default gw of the simulated VM) as seen in other, working KVM setups. I've tried to simulate the VM-side of the connection as follows:
- using a
tapinterface (OpenVPN connection to another server, pinging from there)
vethpair with one end configured with an IP address and the other attached to the bridge
- a secondary
bridgewith an IP address connected to the primary bridge via
In none of these setups I was able to ping the host bridge (the VMs default gw). In all setups the problem was the same: the bridge interface didn't respond to ARP packets.
configuration (local veth):
+-----+ | br0 | | | +------+ +------+ | ==| vip1 |<-->| vip2 | +-----| +------+ +------+ br0: type=bridge, UP, 172.16.1.1/24 vip1: type=veth, UP vip2: type=veth peer, UP, 172.16.1.2/24 # brctl addbr br0 # ifconfig br0 172.16.1.1 netmask 255.255.255.0 up # ip link add vip1 type veth peer name vip2 # ifconfig vip2 172.16.1.2 netmask 255.255.255.0 up # brctl addif br0 vip1 # ifconfig vip1 up
Now I'm trying to
# [root@host ~]# ping -I vip2 172.16.1.1 # PING 172.16.1.1 (172.16.1.1) from 172.16.1.2 vip2: 56(84) bytes of data. # ^C # --- 172.16.1.1 ping statistics --- # 2 packets transmitted, 0 received, 100% packet loss, time 1493ms
tcpdump on the bridge:
# [root@host ~]# tcpdump -i br0 # tcpdump: verbose output suppressed, use -v or -vv for full protocol decode # listening on br0, link-type EN10MB (Ethernet), capture size 65535 bytes # 23:14:02.367624 ARP, Request who-has 172.16.1.1 tell 172.16.1.2, length 28 # 23:14:03.367657 ARP, Request who-has 172.16.1.1 tell 172.16.1.2, length 28 # 23:14:04.367345 ARP, Request who-has 172.16.1.1 tell 172.16.1.2, length 28 # ...
Which is rather strange, since the
br0 interface on which these packets arrive is
UP and should respond to the ARP requests.
# [root@host ~]# ifconfig br0 # br0 Link encap:Ethernet HWaddr F6:F3:5A:A7:A2:5B # inet addr:172.16.1.1 Bcast:172.16.1.255 Mask:255.255.255.0 # inet6 addr: fe80::f4f3:5aff:fea7:a25b/64 Scope:Link # UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 # RX packets:53 errors:0 dropped:0 overruns:0 frame:0 # TX packets:4 errors:0 dropped:0 overruns:0 carrier:0 # collisions:0 txqueuelen:0 # RX bytes:1580 (1.5 KiB) TX bytes:360 (360.0 b)
- OpenVPN tap interface (ping from another host through OpenVPN so packet arrive on tap interface vs. veth interface)
- another bridge (
br1), using a
vethpair to connect both bridges
net.ipv4.conf.all.arp_filterand others, but nothings seems to have an effect
ebtablesare empty and ACCEPT everything.
So I'm struggling to find out why this is not working an what's the difference to container or virtualization solutions. Any help is highly appreciated!