061、flannel的连通与隔离（2019-04-01 周一）

参考https://www.cnblogs.com/CloudMan6/p/7447716.html

 

flannel网络连通性测试

不同host上的容器可以通过flannel网络进行通信，需要借助host上面的路由表（该路由表是host动态从etcd数据库中获得的）

但是flannel网络不支持docker dns

 

root@host1:~# docker exec bbox1 ip r

default via 10.2.46.1 dev eth0

10.2.46.0/24 dev eth0 scope link  src 10.2.46.2

root@host1:~# docker exec bbox1 ping -c 2 10.2.44.2

PING 10.2.44.2 (10.2.44.2): 56 data bytes

64 bytes from 10.2.44.2: seq=0 ttl=62 time=0.365 ms

64 bytes from 10.2.44.2: seq=1 ttl=62 time=0.576 ms

--- 10.2.44.2 ping statistics ---

2 packets transmitted, 2 packets received, 0% packet loss

round-trip min/avg/max = 0.365/0.470/0.576 ms

root@host1:~# docker exec bbox1 traceroute 10.2.44.2

traceroute to 10.2.44.2 (10.2.44.2), 30 hops max, 46 byte packets

1  10.2.46.1 (10.2.46.1)  0.007 ms  0.033 ms  0.030 ms

2  10.2.44.0 (10.2.44.0)  0.335 ms  0.288 ms  0.170 ms

3  10.2.44.2 (10.2.44.2)  0.171 ms  0.289 ms  0.151 ms

root@host1:~# ip r

default via 10.12.28.6 dev ens160 onlink

10.2.27.0/24 via 10.2.27.0 dev flannel.1 onlink

10.2.44.0/24 via 10.2.44.0 dev flannel.1 onlink

10.2.46.0/24 dev docker0  proto kernel  scope link  src 10.2.46.1

10.12.28.0/22 dev ens160  proto kernel  scope link  src 10.12.31.211

172.22.0.0/16 via 10.12.28.1 dev ens160

root@host1:~# docker exec bbox1 ping -c 2 bbox2

ping: bad address 'bbox2'

 

 

root@host2:~# docker exec bbox2 ip r

default via 10.2.44.1 dev eth0

10.2.44.0/24 dev eth0 scope link  src 10.2.44.2

root@host2:~# ip r

default via 10.12.28.6 dev ens160 onlink

10.2.27.0/24 via 10.2.27.0 dev flannel.1 onlink

10.2.44.0/24 dev docker0  proto kernel  scope link  src 10.2.44.1

10.2.46.0/24 via 10.2.46.0 dev flannel.1 onlink

10.12.28.0/22 dev ens160  proto kernel  scope link  src 10.12.31.212

172.22.0.0/16 via 10.12.28.1 dev ens160

 

 

 

flannel网络隔离

 

flannel为每个主机分配了独立的subnet，但flannel.1 将这些subnet连接起来了，相互之间可以路由。本质上flannel将各host上相互独立的docker0容器网络组成了一个互通的大网络，实现了容器跨主机的通信。flannel并没有隔离功能

 

flannel与外网连通性

 

因为flannel网络利用的是host上默认的bridge网络，所以容器与外网的连通方式与bridge网络一样：

    1、容器通过docker0 NAT访问外网

    2、外网通过主机端口映射访问容器

 

root@host1:~# docker exec bbox1 ping -c 2 www.qq.com

PING www.qq.com (58.250.137.36): 56 data bytes

64 bytes from 58.250.137.36: seq=0 ttl=49 time=41.491 ms

64 bytes from 58.250.137.36: seq=1 ttl=49 time=41.424 ms

--- www.qq.com ping statistics ---

2 packets transmitted, 2 packets received, 0% packet loss

round-trip min/avg/max = 41.424/41.457/41.491 ms