Тему немного подправил - может кому интересно, будет время обобщить можно...
"реальная" эмуляция сетевого интерфейса
Сначала надо хоть какой -нибудь сетевой интерфейс поднять в qemu... пробую.... smile
LinuxForum.Fans
Vde + Qemu + iptables
Автор: zenon
47 сообщений
15265 просмотров
http://xgu.ru/wiki/Man:qemu
http://jack.kiev.ua/docs/qemu-doc-ru.html
Пока это нарыл.
Поставил aqemu - разглядываю.
ы. Какой формат диска ему лучше делать? - qcow2, qcow, cow, raw, cloop, vmdk?
Це правильный перевод кашерного мануаля...
Во блин
$ apt-get install qemu
$ apt-get install uml-utilities # tunctl
$ apt-get install bridge-utils # bridge-utils
$ modprobe tun # to network QEMU
$ chmod 666 /dev/net/tun # make it accessible to all users
newzenon, лучше vde2, чем tunctl и классический подход через bridge-utils Нефиг интерфейсы плодить, когда для этого есть vde. В мануале про vde нет, мануаль старый (=
Второе, если даже без vde2, то uml-utils тож не нужен, т.к. можно запускать qemu с правами рута и тогда она сама интерфейсы добавлять будет.
Интересует?
Ну конечно же интересует.
newzenon, ну а где вопросы? Или уже сами разобрались?
Занят немного был, ...
Ставил вчера deb на qemu - первое что начало доставать - как ее ускорить - торомоза нереальные....
Про vde инфы и правда не много, man vde - нет, гугл толкового не нашел пока.
Везде инфа bridge + tap.
так и как с vde создать сетевой интерфейс?
Воот пока это нарыл - http://wiki.virtualsquare.org/index.php/VDE_Basic_Networking
По-русски ничего нет?
Или может виртуал бокс?
newzenon, для ускорения qemu используеться ядерный модуль kqemu. А лучше вместо qemu использовать kvm, если железо поддерживает wink
Я у себя подымаю сетевой интерфейс так (в /etc/networ/interfaces):
text
auto tap0
iface tap0 inet static
address 192.168.0.1
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255
pre-up /usr/sbin/vde_tunctl -t tap0
pre-up /usr/bin/vde_switch -x -n 5 -s /var/run/vde2/vde.ctl -g vde2-net -m 770 -d -p /var/run/vde2/vde.pid -t tap0
post-down /bin/kill `/bin/cat /var/run/vde2/vde.pid`
post-down /usr/sbin/vde_tunctl -d tap0Главное не забыть своего пользователя добавить в группе vde2-net.
newzenon, как видите сие есть готовое решение. Писал по памяти, так что, если что - ошибки в студию.
к виртуалке это подключаю так
text
qemu -net nic -net vde,sock=/var/run/vde2/vde.ctl...
pre-up /usr/bin/vde_switch -x -n 5 -s /var/run/vde2/vde.ctl -g vde2-net -m 770 -d -p /var/run/vde2/vde.pid -t tap0
-x - почему как хаб?
vde2-net - ???
kvm - стоит, поднимать также?
Вроде завелось:
text
`--# ifconfig
eth0 Link encap:Ethernet HWaddr 00:90:f5:67:5a:b1
inet6 addr: fe80::290:f5ff:fe67:5ab1/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4441186 errors:0 dropped:0 overruns:0 frame:0
TX packets:7038378 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1098574877 (1.0 GiB) TX bytes:8433725571 (7.8 GiB)
Interrupt:21 Base address:0xe800
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:123875 errors:0 dropped:0 overruns:0 frame:0
TX packets:123875 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:9741648 (9.2 MiB) TX bytes:9741648 (9.2 MiB)
ppp0 Link encap:Point-to-Point Protocol
inet addr:188.187.82.227 P-t-P:88.87.65.94 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
RX packets:259 errors:0 dropped:0 overruns:0 frame:0
TX packets:396 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:34773 (33.9 KiB) TX bytes:51198 (49.9 KiB)
tap0 Link encap:Ethernet HWaddr 3e:ff:95:30:7c:d5
inet addr:192.168.0.1 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::3cff:95ff:fe30:7cd5/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 B) TX bytes:468 (468.0 B)
---------------------------------------------------------------
Пинги ходят, по ssh управляется, nat никак не заведу.
Настраивал через arno-iptables-firewall
/etc/arno-iptables-firewall/debconf.cfg - правил
-x - почему как хаб?
А сами подумайте, виртуальный хаб проще обсчитать, чем виртуальный свитч.
vde2-net
Группа назначается такая на сокет vde
arno-iptables-firewall
Выкинуть. Правила обнулить. В общих чертах опишите. Я попробую помочь правила составить ручками.
Выкинул.
Запускаю kvm -net nic -net vde,sock=/var/run/vde2/vde.ctl -hda '/home/zion/qemu/hdd/deb.img'
zsh 1048 % sudo sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
iptables -P FORWARD ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
ssh root@192.168.0.2
Войти вошел, но интернета нет.
root@vzion:~# ping google.ru
ping: unknown host google.ru
------------------------------------------------------
По ходу дошло - следуещее забыли:
------------------------------------------------------
A VDE-Switch connected to the Internet
Slirp: a virtual NAT router as a process
The siplest way to connect your virtual network to the Internet is slirp. Slirp is a process that appear as a router on the virtual network. The slirp process forwards all the communications coming from the virtual network to the Internet.
Start slirpvde prior to boot the virtual machine as follows:
$ slirpvde -s /tmp/switch1 --dhcp
Now boot your virtual machines and let them keep their address using automatic configuration (dhcp). They'll receive addresses like 10.0.2.xxx and you'll be able to use your favourite networking commands to access the Internet (provided that they are IPv4 clients, IPv6 is unsupported yet).
------------------------------------------------------
Для нашего варианта:
zsh 1099 % sudo slirpvde -s /var/run/vde2/vde.ctl --dhcp
IP address of your DNS(s): 88.87.64.6, 88.87.65.3
------------------------------------------------------
interfaces:
post-up /usr/bin/slirpvde -s /var/run/vde2/vde.ctl --dhcp
------------------------------------------------------
Пробую пока.
Но это означает что "как настоящую" tap0 мы не сделали.... :(
------------------------------------------------------
Даммн....... работает, но это не то что хотел...
и вместе
vde_switch -x -n 5 -s /var/run/vde2/vde.ctl -g vde2-net -m 770 -d -p /var/run/vde2/vde.pid -t tap0
slirpvde -s /var/run/vde2/vde.ctl --dhcp
из interfaces это не запускается.
------------------------------------------------------
Нормально получается c работающем интернетом, но статик IP на виртуалке уже нет:
sudo slirpvde -s /var/run/vde2/vde.ctl --dhcp &
kvm -net nic -net vde,sock=/var/run/vde2/vde.ctl -hda '/home/zion/qemu/hdd/deb.img'
На виртулке в это время
auto eth0
iface eth0 inet dhcp
Вся бяка походу в dns...
-----------------------------------------------------------------------------
Вот еще нашел
-----------------------------------------------------------------------------
Показать
User-mode Networking
How to enable user-mode networking
The following commands will need to be run as root:
# vde_switch -tap tap0 -daemon
If you need to run a sniffer, just in case you want to analyze the traffic,
you can also run it like this:
# vde_switch -hub -tap tap0 -daemon
(The -hub option is not available for version 1.4.1 of VDE, you will need a
later version. I don't know what the minimal version is but 1.5.1 does support
this option.)
Then you must run this:
# ifconfig tap0 <ip>
# chmod 755 /tmp/vde.ctl
The vde_switch command will run VDE in the background. The -tap tap0
parameter tells VDE to set up the device tap0 using tuntap. -daemon runs
vde_switch in the background. -hub tells VDE to broadcast the message to all
segment, just like real hub that you use on real network.
<ip> is the ip address of the gateway you want to use for the guest
OS(es). For example:
# ifconfig tap0 192.168.254.254
will make 192.168.254.254 the gateway between guest and host, and your
guest OS(es) will belong to the subnet 192.168.254.0 with a netmask of 255.255.255.0
and an ip address of 192.168.254.XXX (where you get to pick the XXX). You must have
the IP of the qemu guest and the IP of the gateway on the same subnet! While it
may be possible to have them on separate subnets, it will certainly be harder
to configure (and you won't like the way your routing tables will look either).
[Sidebar: The "gateway" is actually the host OS itself on the tap0 interface.
The host on the tap0 interface, aka 192.168.254.254, routes between the guest
OS and the host's eth0 interface (which on is the real network). The host on the
eth0 interface (ex. 192.168.0.2) can then route between the tap0 interface and
the real network / the internet.]
(Note that you might be required to do this:
# ifconfig tap0 192.168.254.254 netmask 255.255.255.0
Normally ifconfig should pick the correct netmask for you, but if it doesn't
for some reason then you will have to specify it manually. See ifconfig(8) for
details.
)
Note that you must run this before you run your firewall. I found it helpful
to put this into a script, and have the script load before the firewall does.
Firewall configuration
You will need to enable masquerading between tap0 and your local area
network (for example, eth0). You will also need to enable masquerading between
tap0 and ppp0 if you use a dialup connection to the internet. The commands
# echo "1" > /proc/sys/net/ipv4/ip_forward
# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
will allow you to enable this manually.
-----------------------------------------------------------------------------
Slirp networking
What is slirp networking?
Slirp was an early program that existed before the masses knew of the internet.
Back then, those who knew of it could access it only in one way: through a
Unix shell account (or other such terminal account). This meant that one had to
do all the things they wanted to in that terminal window. Back then, there were
two dial up protocols: PPP and SLIP. PPP is now the standard but back then SLIP
was more common (as it was cheaper).
Slirp was designed to turn those shell accounts into SLIP connections. It worked
by converting SLIP packets into socket connections. What you had to do was to
run slirp on the computer you had the shell account on, and then connect your
SLIP driver/dialer to the terminal slirp was running on (normally this
'terminal' was in fact a modem). Slirp would then interpret the data that SLIP
sent and transfer the data between the user's computer and the internet. To
the user, it looked like they were actually connected directly to the internet
through a firewall.
Slirp is not used today (to the best of my knowledge) but the innovative idea it
had is used by both qemu and vde. Instead of converting SLIP packets however,
they convert ethernet packets. qemu's slirp networking is similar to vde's
but it is simpler to use and also limited to a single qemu instance (you can
not link multiple guest OSes together on the same network with slirp networking
unless you use VDE).
How to enable slirp networking?
This is very similar to TUNTAP networking in the previous section, but the
commands are slightly different. In addition, you do not need to set up
routing or firewall rules.
First off, you load vde_switch (no parameters are required for this case,
although you can pass the -unix parameter if you want to use a different
socket - required if you already have tuntap networking on the default
socket).
vde_switch
or
vde_switch -unix /tmp/unx.ctl
The latter is required if you are running both slirp and tuntap or multiple
slirp networks (for that matter, if you are running multiple tuntap networks).
More on that later.
Now you need the slirpvde command. slirpvde is the utilitry that provides the
slirp functionality - it intercepts ethernet packets on the network and
forwards them through the real network via emulation. To use it, you want
to do this:
slirpvde -s /tmp/unx.ctl -n 192.168.2.0 -d
The -s tells slirpvde that vde_switch is running on /tmp/unx.ctl [this switch
can be omitted if you called vde_switch by itself]. The -d switch tells
slirpvde to emulate a DHCP server. This is not required but it allows for
automatic configuration of the guest OS (it is basicly the same as qemu's
builtin DHCP server). Depending on your needs, you may be better off running
a real DHCP server in one of the guest OSes.
The last option, -n, tells slirpvde
what subnet the network should be on (this is also used by the DHCP server to
figure out what ip addresses to assign). The gateway ip when using slirpvde
is X.X.X.2 (where X.X.X equals the first 3 parts of the subnet you passed to
it via -n, in this example 192.168.2) and the default DNS server is X.X.X.3
You can not change the gateway ip to something other than .2 and the DNS ip
to something other than .3 unless you change the source in slirpvde and
recompile.
-----------------------------------------------------------------------------
Setting up qemu
How to set up the guest OS
Set up the guest OS so that the default route is through the gateway
ip, <ip> (for example 192.168.254.254). Also set up the subnet and netmask
parameters as appropriate (for example 192.168.254.0 and 255.255.255.0).
The guest OS should see the ethernet device and be able to use it to access
the gateway. (Caveat: I haven't been able to do this for MS-DOS, and for Minix
2.0.4 I had to apply a patch to qemu since Minix is broken. Uodate: Minix 2.0.4
is still broken but a patch has been released to fix it. Using this patch,
Minix works on a vanilla qemu.) Also don't forget to set up the IP of the guest
OS itself (for example 192.168.254.1).
-----------------------------------------------------------------------------
все сегодня уже неасилятор.... smile
В посту слишком много и не по делу. Давайте по этапам. Откатитесь до того, что я предлагал. Для начала, пинг из виртуалки до сетевухи tap0 (192.168.0.1) идёт?
ЗЫ: настройки vde верные. Не паникуем (=
Да, ладно все по делу... smile За ходом мысли можно проследить, откатываться особо и не надо, interfaces пока тот, что вверху, для slirpvde у меня второй гостевой образ.
Значит так:
kvm -net nic -net vde,sock=/var/run/vde2/vde.ctl -hda '/home/zion/qemu/hdd/deb1.img' &
гость запустился...
ssh root@192.168.0.2
root@192.168.0.2's password:
Linux vzion 2.6.32-trunk-486 #1 Sun Jan 10 05:53:18 UTC 2010 i686
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Jun 1 21:41:53 2010 from 192.168.0.1
root@vzion:~# ping google.com
ping: unknown host google.com
root@vzion:~#
И вот:
root@vzion:~# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
allow-hotplug eth0
iface eth0 inet static
address 192.168.0.2
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255
gateway 192.168.0.1
# dns-* options are implemented by the resolvconf package, if installed
dns-nameservers 192.168.0.1
ОК, ну всё правильно! Вы же не dns ему не подняли, ничего!
Ставьте dnsmasq и сконфигурьте его, там просто. Это даст dhcp и dns. Просто укажите ему интерфейс tap0.
Ну в общем да:
на хосте поставил dnsmasq - сам конфиг не трогал...
после
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
все поехало
воот, теперь попробовать надо порт пробросить -
т.е. смысл затеи - виртуальный интернет серверок, потому как допустим десктоп обычно место для тучи экспериментов, а тут все внутри, и ежели чего то поднять можно в две секунды...
хотя пока все это просто из интереса...
ы. А маскарад можно в post-up?
и да спасибо zerg, меня можно на ты.... smile
newzenon, для начала разберёмся с правилами iptables.
Ты можешь листинг дать от iptables-save?
text
# iptables-save > files.listtext
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o ppp0 -j MASQUERADE Вместо этого лучше одно
text
-A POSTROUTING -s 192.168.0.0/24 -j MASQUERADEВ /etc/network/interfaces добавь в качестве pre-up и post-down для eth0:
text
pre-up /sbin/iptables-restore < /etc/ip_rulles.lst
pre-up /sbin/ip6tables-restore < /etc/ip6_rulles.lst
post-down /sbin/ip6tables-save > /etc/ip6_rulles.lst
post-down /sbin/iptables-save > /etc/ip_rulles.lstПосле этого правила будут автоматом сохраняться после отключения интерфейсов и восстанавливаться перед их поднятием.
text
auto lo
iface lo inet loopback
auto dsl-provider
iface dsl-provider inet ppp
pre-up /sbin/ifconfig eth0 down
pre-up /sbin/ifconfig eth0 hw ether 00:90:f5:67:5a:b1
pre-up /sbin/ifconfig eth0 up # line maintained by pppoeconf
provider dsl-provider
auto eth0
iface eth0 inet manual
pre-up /sbin/iptables-restore < /etc/ip_rulles.lst
pre-up /sbin/ip6tables-restore < /etc/ip6_rulles.lst
post-down /sbin/ip6tables-save > /etc/ip6_rulles.lst
post-down /sbin/iptables-save > /etc/ip_rulles.lst
auto tap0
iface tap0 inet static
address 192.168.0.1
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255
pre-up /usr/sbin/vde_tunctl -t tap0
pre-up /usr/bin/vde_switch -x -n 5 -s /var/run/vde2/vde.ctl -g vde2-net -m 770 -d -p /var/run/vde2/vde.pid -t tap0
post-down /bin/kill `/bin/cat /var/run/vde2/vde.pid`
post-down /usr/sbin/vde_tunctl -d tap0
sudo iptables -F # Чистим - правильно?
sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE
Теперь при рестарте сети все должно сохраниться/восстановиться, так?
zsh 1009 % sudo /etc/init.d/networking restart
Running /etc/init.d/networking restart is deprecated because it may not enable again some interfaces ... (warning).
Reconfiguring network interfaces...Plugin rp-pppoe.so loaded.
TUNSETIFF: Device or resource busy
Failed to bring up tap0.
done.
После reboot'a все работает.
Кажется я iptables не почистил...
sudo iptables -F # Чистим - правильно?
Не правильно.
text
# iptables -t nat -F POSTROUTINGПробуем.
Как проверить, сохраняется ли? Файлы в /etc появились?
Войдите или зарегистрируйтесь, чтобы ответить.
