# How does a network host route packets to different network namespaces?

I am wondering how a network host routes packets to different OVS internal ports with the same IP address in different network namespaces. To better illustrate my question, here is an example picture from the webpage: http://imgur.com/eelU5gX . Sorry that I can't upload the picture directly into this question as I don't have enough points yet.

Consider that there are 2 OVS internal ports, each in its own separate network namespace, on br-int: tapXXX (in qdhcp-aaaa) and tapWWW (in qdhcp-cccc). One dnsmasq process is attached to each port for 2 different tenants (and thus 2 different Neutron networks). Suppose that both tenants define the same Neutron subnet range of 192.168.1.0/24, and that both the tapXXX and tapWWW have the same IP address of 192.168.1.1.

Now, given that each tenant has VMs running on separate hosts that are the compute nodes, how does the network host route a received packet with IP address 192.168.1.1?

In the webpage, it seems that the VM data network is segmented by VLAN, and I understand how br-int (and other virtual bridges) modify the VLAN tag for incoming and outgoing traffic according to each tenant's VMs. But I am not too sure how network namespaces fit into the whole neutron networking logic.

It would be best if someone could explain the path taken by a packet starting from eth0 of the VM of each tenant and ending at their own respective dnsmasq processes. Thanks!

edit retag close merge delete

Sort by » oldest newest most voted

You wrote :-

One dnsmasq process is attached to each port for 2 different tenants (and thus 2 different Neutron networks)

Mistake is here . Every tenants private network is served by it's own copy of dnsmasq daemon. As soon as tenant start VM on particular private subnet corresponding qdhcp-namespace will be created.  Each private net will have it's own tap-interface attached to br-int and will get it's own vlan tag .

VLANs are realized as packets on a specific physical network containing IEEE 802.1Q headers with a specific VLAN ID (VID) field value. VLAN networks sharing the same physical network are isolated from each other at L2, and can even have overlapping IP address spaces. Each distinct physical network supporting VLAN networks is treated as a separate VLAN trunk, with a distinct space of VID values. Valid VID values are 1 through 4094.


View also :- https://blogs.oracle.com/ronen/entry/...
Section "About network isolation" and bellow. This link is actually the most detailed explanation answering your question and at the same time the most hard to understand

OpenStack supports creation of multiple isolated networks and can use several mechanisms to isolate the networks from one another. The isolation mechanism can be VLANs, VxLANs or GRE tunnels, this is configured as part of the initial setup in our deployment we use VLANs. When using VLAN tagging as an isolation mechanism a VLAN tag is allocated by Neutron from a pre-defined VLAN tags pool and assigned to the newly created network. By provisioning VLAN tags to the networks Neutron allows creation of multiple isolated networks on the same physical link.  The big difference between this and other platforms is that the user does not have to deal with allocating and managing VLANs to networks. The VLAN allocation and provisioning is handled by Neutron which keeps track of the VLAN tags, and responsible for allocating and reclaiming VLAN tags. In the example above net1 has the VLAN tag 1000, this means that whenever a VM is created and connected to this network the packets from that VM will have to be tagged with VLAN tag 1000 to go on this particular network. This is true for namespace as well, if we would like to connect a namespace to a particular network we have to make sure that the packets to and from the namespace are correctly tagged when they reach the VM network

more

# Get to know Ask OpenStack

Resources for moderators

## Stats

Seen: 859 times

Last updated: Jan 18 '15