构建KVM虚拟机NAT网络

现在的虚拟化架构越来越普遍了。最近摸索了下centos下如何构建KVM虚拟机NAT网络，在此记录下点滴。

1.硬件检测

KVM虚拟机需要CPU支持虚拟化技术。Intel的叫vmx,AMD的叫svm.

cat /proc/cpuinfo|grep svm

 

2.安装kvm内核

yum groupinstall KVM -y

安装完后载入确认

modprobe kvm-amd

lsmod|grep kvm

 

3.配置VNC
/etc/libvirt/qemu.conf
vnc_listen = "0.0.0.0"

/etc/init.d/libvirtd start

 

4.安装虚拟机：

virt-install --name os_11 --hvm --ram 512 --vcpus 2 --disk path=/opt/vms/os_11.img,size=20 --network network:default --accelerate --vnc --vncport=5911 --os-variant rhel5.4 --cdrom /root/ubuntu-11.04-server-amd64.iso -d
然后用VNC连接5911端口开始安装

 

5.克隆虚拟机：
virt-clone -o os_11 -n os_12 -f  /data/vm/os_12.img

virt-clone -o os_11 -n os_13 -f  /data/vm/os_13.img

修改虚拟机配置文件/etc/libvirt/qemu/os_12.xml的vnc端口

<domain type='kvm'>
  <name>os_12</name>
  <uuid>3aab5774-1810-9c67-4b97-24c9c9db071f</uuid>
  <memory>524288</memory>
  <currentMemory>524288</currentMemory>
  <vcpu>2</vcpu>
  <os>
    <type arch='x86_64' machine='rhel5.4.0'>hvm</type>
    <boot dev='hd'/>
  </os>
  <features>
    <acpi/>
    <apic/>
    <pae/>
  </features>
  <clock offset='utc'>
    <timer name='pit' tickpolicy='delay'/>
  </clock>
  <on_poweroff>destroy</on_poweroff>
  <on_reboot>restart</on_reboot>
  <on_crash>restart</on_crash>
  <devices>
    <emulator>/usr/libexec/qemu-kvm</emulator>
    <disk type='file' device='disk'>
      <driver name='qemu' type='raw' cache='none'/>
      <source file='/opt/vms/os_12.img'/>
      <target dev='hda' bus='ide'/>
      <address type='drive' controller='0' bus='0' unit='0'/>
    </disk>
    <disk type='file' device='cdrom'>
      <driver name='qemu' type='raw'/>
      <target dev='hdc' bus='ide'/>
      <readonly/>
      <address type='drive' controller='0' bus='1' unit='0'/>
    </disk>
    <controller type='ide' index='0'/>
    <interface type='network'>
      <mac address='FE:16:36:5E:54:30'/>
      <source network='default'/>
    </interface>
    <serial type='pty'>
      <target port='0'/>
    </serial>
    <console type='pty'>
      <target port='0'/>
    </console>
    <input type='mouse' bus='ps2'/>
    <graphics type='vnc' port='5912' autoport='no' keymap='en-us'/>
    <video>
      <model type='cirrus' vram='9216' heads='1'/>
    </video>
  </devices>
</domain>

 

 

6.启动虚拟机（ubuntu 11.04）：

virsh start os_11

virsh start os_12

virsh start os_13

 

7.查看virbr0的网段，默认192.168.122.1

vnc连接虚拟机设置os_11 IP：192.168.122.11

vnc连接虚拟机设置os_12 IP：192.168.122.12

vnc连接虚拟机设置os_13 IP：192.168.122.13

网卡配置文件：

auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
        address 192.168.122.11
        netmask 255.255.255.0
        network 192.168.122.0
        broadcast 192.168.122.255
        gateway 192.168.122.1

 

 

8.此时应该可以ssh到虚拟机了，并且虚拟机上也能上网了。

 

9.注意问题

  (1)确认安装libvirtd,virsh等相关依赖

  (2)在物理机上需要配置允许IP转发：

  echo 1 > /proc/sys/net/ipv4/ip_forward ,

  vi /etc/sysctl.conf  修改net.ipv4.ip_forward = 1

  (3)启用iptables服务，需要进行ip转发,重新设置ip转发用virsh net-start default,我的配置如下：

#iptables -L -vn
Chain INPUT (policy ACCEPT 1181K packets, 492M bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0           udp dpt:53 
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0           tcp dpt:53 
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0           udp dpt:67 
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0           tcp dpt:67 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   39 12560 ACCEPT     all  --  *      virbr0  0.0.0.0/0            192.168.122.0/24    state RELATED,ESTABLISHED 
   56  3833 ACCEPT     all  --  virbr0 *       192.168.122.0/24     0.0.0.0/0           
    0     0 ACCEPT     all  --  virbr0 virbr0  0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      virbr0  0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable 
    0     0 REJECT     all  --  virbr0 *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT 953K packets, 48M bytes)
 pkts bytes target     prot opt in     out     source               destination  

 

 

 (4)虚拟机的配置文件在/etc/libvirt/qemu/中，可以修改xml调整虚拟机的配置