haoningabc
- 浏览: 1482675 次
- 性别:
- 来自: 北京
-
文章分类
- 全部博客 (691)
- linux (207)
- shell (33)
- java (42)
- 其他 (22)
- javascript (33)
- cloud (16)
- python (33)
- c (48)
- sql (12)
- 工具 (6)
- 缓存 (16)
- ubuntu (7)
- perl (3)
- lua (2)
- 超级有用 (2)
- 服务器 (2)
- mac (22)
- nginx (34)
- php (2)
- 内核 (2)
- gdb (13)
- ICTCLAS (2)
- mac android (0)
- unix (1)
- android (1)
- vim (1)
- epoll (1)
- ios (21)
- mysql (3)
- systemtap (1)
- 算法 (2)
- 汇编 (2)
- arm (3)
- 我的数据结构 (8)
- websocket (12)
- hadoop (5)
- thrift (2)
- hbase (1)
- graphviz (1)
- redis (1)
- raspberry (2)
- qemu (31)
- opencv (4)
- socket (1)
- opengl (1)
- ibeacons (1)
- emacs (6)
- openstack (24)
- docker (1)
- webrtc (11)
- angularjs (2)
- neutron (23)
- jslinux (18)
- 网络 (13)
- tap (9)
- tensorflow (8)
- nlu (4)
- asm.js (5)
- sip (3)
- xl2tp (5)
- conda (1)
- emscripten (6)
- ffmpeg (10)
- srt (1)
- wasm (5)
- bert (3)
- kaldi (4)
- 知识图谱 (1)
最新评论
-
wahahachuang8：
我喜欢代码简洁易读，服务稳定的推送服务，前段时间研究了一下go ...
websocket的helloworld -
q114687576：
http://www.blue-zero.com/WebSoc ...
websocket的helloworld -
zhaoyanzimm：
感谢您的分享，给我提供了很大的帮助，在使用过程中发现了一个问题 ...
nginx的helloworld模块的helloworld -
haoningabc：
leebyte 写道太NB了，期待早日用上Killinux！么 ...
qemu+emacs+gdb调试内核 -
leebyte：
太NB了，期待早日用上Killinux！
qemu+emacs+gdb调试内核
copy from http://members.ferrara.linux.it/pioppo/howto/iproute2tunnel-en.html
Tunnels with iproute2
by Simone Piunno
1. iproute2
iproute2 is a package for advanced network management under linux. In practice, it is composed of a bunch of small utilities to dinamically configure the kernel by means of rtnetlink sockets - a modern and powerful interface for the configuration of the networking stack implemented by Alexey Kuznetsov starting from the 2.2 kernel series.
The most interesting feature of iproute2 is that it replaces with a single integrated and organic command all the functionalities we were used to find in ifconfig, arp, route and iptunnel (and it even adds some more!).
Nowadays iproute2 is installed by default on most major distributions, even if their initialization scripts are still built on commands from the old net-tools package (e.g. ifconfig or iptunnel - the latter is actually deprecated). If your distribution doesn't include this important package, you can always download it from ftp://ftp.inr.ac.ru/ip-routing/ and compile it yourself.
As the time of this writing, the worst defect of iproute2 is a relative lack of documentation, partially compensated by the fact that the syntax of the ip command is very easy and similar to the english language. We believe that people used to ifconfig and route shouldn't encounter any problem using ip and that they will feel at home in a matter of hours. In this document we will suppose that the reader has already a good knowledge of basic networking concepts and has used ifconfig and route in the past.
2. Introduction tu tunnels
Let's imagine two Internet nodes wanting to exchange data traffic over a protocol different from IPv4 or directed to a private LAN using non-globally-valid IP addresses. This problem is typically solved using a virtual point-to-point connection between the two nodes and we call this configuration a tunnel.
You can think to every packet traveling over the network like it was an envelope with a few bits inside and the sender's and receiver's addresses written on. Tunnels simply hide this envelope inside an additional one, with different sender and receiver, effectively diverting the packet's trip. When the packet arrives to the external receiver (the one written on the external envelope), the external envelope is removed and thrown away, so that the packet can continue its travel to the real destinantion.
The two nodes putting and removing the additional envelope are called endpoints and need to have a known IPv4 address. This is why tunnels generally don't work when traversing a network address translation (NAT). Moreover, if the tunnel is built throuh a firewall, the latter must be configured ad hoc to permit this kind of traffic.
A typical tunnel usage is connecting two IPv6 nodes through an IPv4-only network. The two nodes can build an IPv6-in-IPv4 tunnel pretending to have a real direct point-to-point IPv6 connection, and this way they can link together two IPv6 islands (6bone works this way, a web of tunnels). Tunnels for IPv6-over-IPv4 transport come in two different flawors: automatic (RFC2373) and manually configured. In this document we will talk only of the latter type.
3. Creating tunnels
Creating tunnels with iproute2 is very easy. First of all you need a name for your tunnel. If you choose to name it foo then you can create the tunnel with the command:
This way, you created a sit (IPv6-in-IPv4) tunnel with a remote endpoint at the IP address 192.168.1.42. Notice that we have not specified which IP address to use for the local side of the tunnel, which interface, and so on. The result can be viewed with the command ip tunnel show:
Our tunnel is the one in the 2nd row. Now we can also ask a list of all available interfaces, regardless if they are real network adapters or software simulations:
The fact that should get your attention is that while lo and eth0 are marked as being up, our tunnel is not. To double check, the good old ifconfig says only:
So we must remember that the ip link command shows all available interfaces, regardless of them being activated or not. To activate foo, we use the command:
and to deactivate it:
To completely discard our tunnel we use:
4. Special tunnels
In the previous paragraph, we've seen how to build an IPv6-in-IPv4 tunnel, now we'll examine a few different situations.
4.1. GRE tunnels
If you don't need IPv6 but for example you want to carry normal IPv4 traffic through a non-cooperating transit network, then you'd better use mode gre instead of mode sit. For example:
GRE is a particular tunnelling protocol supported by Cisco routers which is capable to carry different protocols over IPv4. There's another kind of tunnels implemented by linux: ipip. The latter is also useful for IPv4-in-IPv4 encapsulation, but it's implemented only by linux and does only unicast IP over IP (so you can't transport for example IPX or broadcasts). In general, GRE is better.
4.2. Explicit local endpoint
Even if the kernel is smart enough to choose for you, it could be a good idea to explicitly force the local IP address and interface we're going to use for tunneling. To do that, we can use the local and dev parameters:
Please notice that now the interface is labeled as foo@eth0, to remind us where the tunnel has been explicitly connected.
4.3. Time-to-live
When using tunnels, creating accidental loops in the network it's easy. To limit the problem, it's fundamental to generate packets with a low TTL value. Initial TTL can be specified by the ttl parameter in ip tunnel add. The default value is inherited from the network interface the tunnel is associated to. The Internet Assigned Numbers Authority suggests using 64 for TTL.
5. Assigning an IP address to the interface
Like any other network interface, tunnels can have one or more addresses assigned to them.
5.1. Main address
Assigning the main address is straightforward:
The number immediately following the slash is to suggest to the kernel the network prefix we prefer, useful to automatically compute broadcast address and netmask on IPv4 LANs (this is called CIDR notation). However, tunnels are point-to-point interfaces and this number is then ignored.
Note: to be able to assign an IP address to an interface, first you need to activate the interface using ip link set interfacename up.
To remove an address from an interface, you can obviously use del instead of add:
We can even ask for a list of all the IP addresses in use on our server:
5.2. Aliasing
When using multiple addresses on a single interface, people used to ifconfig will be surprised noting that multiple ip addr add commands do not generate fictitious interfaces like eth0:1, eth0:2 and so on. This is a legacy naming scheme coming from the 2.0 kernel version and nowadays no more mandated. For example:
Our addictional IP address is reported by ip addr show and works, but ifconfig doesn't even know of its existence! To solve the problem we can use the label parameter:
Notice that we can choose any arbitrary string as the label. We're not forced to use the 2.0 naming scheme; we must comply to it only if we care having backward compatibility with ifconfig.
5.3. Which IP for the tunnel.
Choosing a global/public IP address (respectively an IPv6 address for SIT/IPv6-in-IPv4 tunnels and an IPv4 address for GRE/IPv4-in-IPv4 tunnels) for the local endpoint of the tunnel is probably the best thing we can do when our computer is a single host and not a router providing IPv6 connectivity to a whole LAN.
Instead, if we're configuring a router, we'd better use a link-local address for SIT/IPv6-in-IPv4 tunnels (in IPv6 link-local addresses are assigned automatically by means of stateless address autoconfiguration or manually configured) and a private address for GRE/IPv4-in-IPv4 tunnels (IPv4 has no link-local addresses). The valid address will then be only on eth0 (or the interface on the LAN side). Notice that in this configuration you need to activate forwarding among interfaces, using these commands:
You can even decide to enable forwarding only between a couple of interfaces, in this case you could use these commands:
6. Routing
Now that our tunnel is configured, we have to specify which traffic will be directed through it. For IPv6 the most common choice is the following:
This way all IPv6 traffic going to addresses starting with 3 bits equal to 001 (that is, all global unicast IPv6 address space) will be directed to the foo interface. This is only one 8th of the available IPv6 address space, but you are guaranteed that every possible remote host will be in this range.
We can see the IPv4 routing table this way:
and the IPv6 routing table this way:
If you need to specify a gateway (this is not for tunnels) then you can add the via parameter, for example:
To remove a route you can obviously use ip route del but be careful: if you write ip route del default you're removing the default IPv4 route, not the IPv6 one! To remove the IPv6 default destination you need to use ip -6 route del default.
7. A complete example
This is a typical IPv6 tunnel for 6bone:
where $TUNNEL is an arbitrary name assigned to the tunnel, $V4_REMOTEADDR is the IPv4 address of the remote end of the tunnel and $V6_LOCALADDR is the IPv6 local address assigned to our host. We've used the any value for the local endpoint address because this way we can handle a dynamic IPv4 address (e.g. assigned by a dialup connection to the ISP). Obviosly we need to inform our tunnel broker when our address changes but this is out of the scope of this writing, also because there's no general standard procedure.
To shut down the tunnel:
also automatically removes the routing entry and the address.
8. Links
Project6
Internet assigned numbers authority
iproute2
RFC2784 - Generic Routing Encapsulation (GRE)
RFC2373 - IP Version 6 Addressing Architecture
RFC2893 - Transition Mechanisms for IPv6 Hosts and Routers
An overview of the introduction of IPv6 in the Internet
ngnet
$Id: iproute2tunnel-en.html,v 1.2 2002/08/04 15:39:44 pioppo Exp $
Tunnels with iproute2
by Simone Piunno
1. iproute2
iproute2 is a package for advanced network management under linux. In practice, it is composed of a bunch of small utilities to dinamically configure the kernel by means of rtnetlink sockets - a modern and powerful interface for the configuration of the networking stack implemented by Alexey Kuznetsov starting from the 2.2 kernel series.
The most interesting feature of iproute2 is that it replaces with a single integrated and organic command all the functionalities we were used to find in ifconfig, arp, route and iptunnel (and it even adds some more!).
Nowadays iproute2 is installed by default on most major distributions, even if their initialization scripts are still built on commands from the old net-tools package (e.g. ifconfig or iptunnel - the latter is actually deprecated). If your distribution doesn't include this important package, you can always download it from ftp://ftp.inr.ac.ru/ip-routing/ and compile it yourself.
As the time of this writing, the worst defect of iproute2 is a relative lack of documentation, partially compensated by the fact that the syntax of the ip command is very easy and similar to the english language. We believe that people used to ifconfig and route shouldn't encounter any problem using ip and that they will feel at home in a matter of hours. In this document we will suppose that the reader has already a good knowledge of basic networking concepts and has used ifconfig and route in the past.
2. Introduction tu tunnels
Let's imagine two Internet nodes wanting to exchange data traffic over a protocol different from IPv4 or directed to a private LAN using non-globally-valid IP addresses. This problem is typically solved using a virtual point-to-point connection between the two nodes and we call this configuration a tunnel.
You can think to every packet traveling over the network like it was an envelope with a few bits inside and the sender's and receiver's addresses written on. Tunnels simply hide this envelope inside an additional one, with different sender and receiver, effectively diverting the packet's trip. When the packet arrives to the external receiver (the one written on the external envelope), the external envelope is removed and thrown away, so that the packet can continue its travel to the real destinantion.
The two nodes putting and removing the additional envelope are called endpoints and need to have a known IPv4 address. This is why tunnels generally don't work when traversing a network address translation (NAT). Moreover, if the tunnel is built throuh a firewall, the latter must be configured ad hoc to permit this kind of traffic.
A typical tunnel usage is connecting two IPv6 nodes through an IPv4-only network. The two nodes can build an IPv6-in-IPv4 tunnel pretending to have a real direct point-to-point IPv6 connection, and this way they can link together two IPv6 islands (6bone works this way, a web of tunnels). Tunnels for IPv6-over-IPv4 transport come in two different flawors: automatic (RFC2373) and manually configured. In this document we will talk only of the latter type.
3. Creating tunnels
Creating tunnels with iproute2 is very easy. First of all you need a name for your tunnel. If you choose to name it foo then you can create the tunnel with the command:
ip tunnel add foo mode sit remote 192.168.1.42
This way, you created a sit (IPv6-in-IPv4) tunnel with a remote endpoint at the IP address 192.168.1.42. Notice that we have not specified which IP address to use for the local side of the tunnel, which interface, and so on. The result can be viewed with the command ip tunnel show:
[root@abulafia root]# ip tunnel show sit0: ipv6/ip remote any local any ttl 64 nopmtudisc foo: ipv6/ip remote 192.168.1.42 local any ttl inherit
Our tunnel is the one in the 2nd row. Now we can also ask a list of all available interfaces, regardless if they are real network adapters or software simulations:
[root@abulafia root]# ip link show
1: lo: <loopback,up> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <broadcast,multicast,up> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:48:54:1b:25:30 brd ff:ff:ff:ff:ff:ff
4: sit0@none: <noarp> mtu 1480 qdisc noop
link/sit 0.0.0.0 brd 0.0.0.0
6: foo@none: <pointopoint,noarp> mtu 1480 qdisc noop
link/sit 0.0.0.0 peer 192.168.1.42
The fact that should get your attention is that while lo and eth0 are marked as being up, our tunnel is not. To double check, the good old ifconfig says only:
[root@abulafia root]# ifconfig
eth0 link encap:ethernet hwaddr 00:48:54:1b:25:30
inet addr:192.168.0.1 bcast:192.168.0.255 mask:255.255.255.0
inet6 addr: fe80::248:54ff:fe1b:2530/10 scope:link
up broadcast running multicast mtu:1500 metric:1
rx packets:0 errors:0 dropped:0 overruns:0 frame:0
tx packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
rx bytes:0 (0.0 b) tx bytes:528 (528.0 b)
interrupt:9 base address:0x5000
lo link encap:local loopback
inet addr:127.0.0.1 mask:255.0.0.0
inet6 addr: ::1/128 scope:host
up loopback running mtu:16436 metric:1
rx packets:35402 errors:0 dropped:0 overruns:0 frame:0
tx packets:35402 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
rx bytes:3433996 (3.2 mb) tx bytes:3433996 (3.2 mb)
So we must remember that the ip link command shows all available interfaces, regardless of them being activated or not. To activate foo, we use the command:
ip link set foo up
and to deactivate it:
ip link set foo down
To completely discard our tunnel we use:
ip tunnel del foo
4. Special tunnels
In the previous paragraph, we've seen how to build an IPv6-in-IPv4 tunnel, now we'll examine a few different situations.
4.1. GRE tunnels
If you don't need IPv6 but for example you want to carry normal IPv4 traffic through a non-cooperating transit network, then you'd better use mode gre instead of mode sit. For example:
[root@abulafia root]# ip tunnel add foo4 mode gre remote 192.168.1.42
[root@abulafia root]# ip tunnel show
gre0: gre/ip remote any local any ttl inherit nopmtudisc
foo4: gre/ip remote 192.168.1.42 local any ttl inherit
[root@abulafia root]# ip link show
1: lo: <loopback,up> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <broadcast,multicast,up> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:48:54:1b:25:30 brd ff:ff:ff:ff:ff:ff
7: gre0@none: <noarp> mtu 1476 qdisc noop
link/gre 0.0.0.0 brd 0.0.0.0
9: foo4@none: <pointopoint,noarp> mtu 1476 qdisc noop
link/gre 0.0.0.0 peer 192.168.1.42
GRE is a particular tunnelling protocol supported by Cisco routers which is capable to carry different protocols over IPv4. There's another kind of tunnels implemented by linux: ipip. The latter is also useful for IPv4-in-IPv4 encapsulation, but it's implemented only by linux and does only unicast IP over IP (so you can't transport for example IPX or broadcasts). In general, GRE is better.
4.2. Explicit local endpoint
Even if the kernel is smart enough to choose for you, it could be a good idea to explicitly force the local IP address and interface we're going to use for tunneling. To do that, we can use the local and dev parameters:
[root@abulafia root]# ip tunnel add foo mode sit local 192.168.0.1 remote 192.168.1.42 dev eth0 [root@abulafia root]# ip tunnel show sit0: ipv6/ip remote any local any ttl 64 nopmtudisc foo: ipv6/ip remote 192.168.1.42 local 192.168.0.1 dev eth0 ttl inherit [root@abulafia root]# ip link show 1: lo: <loopback,up> mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: eth0: <broadcast,multicast,up> mtu 1500 qdisc pfifo_fast qlen 100 link/ether 00:48:54:1b:25:30 brd ff:ff:ff:ff:ff:ff 4: sit0@none: <noarp> mtu 1480 qdisc noop link/sit 0.0.0.0 brd 0.0.0.0 11: foo@eth0: <pointopoint,noarp> mtu 1480 qdisc noop link/sit 192.168.0.1 peer 192.168.1.42
Please notice that now the interface is labeled as foo@eth0, to remind us where the tunnel has been explicitly connected.
4.3. Time-to-live
When using tunnels, creating accidental loops in the network it's easy. To limit the problem, it's fundamental to generate packets with a low TTL value. Initial TTL can be specified by the ttl parameter in ip tunnel add. The default value is inherited from the network interface the tunnel is associated to. The Internet Assigned Numbers Authority suggests using 64 for TTL.
5. Assigning an IP address to the interface
Like any other network interface, tunnels can have one or more addresses assigned to them.
5.1. Main address
Assigning the main address is straightforward:
ip addr add 3ffe:9001:210:3::42/64 dev foo ip addr add 192.168.0.2/24 dev foo4 ip addr add 10.20.30.40/8 dev eth0
The number immediately following the slash is to suggest to the kernel the network prefix we prefer, useful to automatically compute broadcast address and netmask on IPv4 LANs (this is called CIDR notation). However, tunnels are point-to-point interfaces and this number is then ignored.
Note: to be able to assign an IP address to an interface, first you need to activate the interface using ip link set interfacename up.
To remove an address from an interface, you can obviously use del instead of add:
ip addr del 3ffe:9001:210:3::42/64 dev foo ip addr del 192.168.0.2/24 dev foo4
We can even ask for a list of all the IP addresses in use on our server:
[root@abulafia root]# ip addr show
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
inet6 ::1/128 scope host
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:48:54:1b:25:30 brd ff:ff:ff:ff:ff:ff
inet 192.168.0.1/24 brd 192.168.0.255 scope global eth0
inet6 fe80::248:54ff:fe1b:2530/10 scope link
4: sit0@NONE: <NOARP> mtu 1480 qdisc noop
link/sit 0.0.0.0 brd 0.0.0.0
5: foo@NONE: <POINTOPOINT,NOARP> mtu 1480 qdisc noop
link/sit 0.0.0.0 peer 192.168.1.42
inet6 3ffe:9001:210:3::42/64 scope global
inet6 fe80::c0a8:1/10 scope link
5.2. Aliasing
When using multiple addresses on a single interface, people used to ifconfig will be surprised noting that multiple ip addr add commands do not generate fictitious interfaces like eth0:1, eth0:2 and so on. This is a legacy naming scheme coming from the 2.0 kernel version and nowadays no more mandated. For example:
[root@abulafia root]# ip addr add 192.168.0.11/24 dev eth0
[root@abulafia root]# ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:48:54:1b:25:30 brd ff:ff:ff:ff:ff:ff
inet 192.168.0.1/24 brd 192.168.0.255 scope global eth0
inet 192.168.0.11/24 scope global secondary eth0
inet6 fe80::248:54ff:fe1b:2530/10 scope link
[root@abulafia root]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:48:54:1B:25:30
inet addr:192.168.0.1 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::248:54ff:fe1b:2530/10 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 b) TX bytes:528 (528.0 b)
Interrupt:9 Base address:0x5000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:34732 errors:0 dropped:0 overruns:0 frame:0
TX packets:34732 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3386912 (3.2 Mb) TX bytes:3386912 (3.2 Mb)
foo Link encap:IPv6-in-IPv4
inet6 addr: 3ffe:9001:210:3::42/64 Scope:Global
inet6 addr: fe80::c0a8:1/10 Scope:Link
UP POINTOPOINT RUNNING NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Our addictional IP address is reported by ip addr show and works, but ifconfig doesn't even know of its existence! To solve the problem we can use the label parameter:
[root@abulafia root]# ip addr add 192.168.0.11/24 label eth0:1 dev eth0
[root@abulafia root]# ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:48:54:1b:25:30 brd ff:ff:ff:ff:ff:ff
inet 192.168.0.1/24 brd 192.168.0.255 scope global eth0
inet 192.168.0.11/24 scope global secondary eth0:1
inet6 fe80::248:54ff:fe1b:2530/10 scope link
[root@abulafia root]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:48:54:1B:25:30
inet addr:192.168.0.1 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::248:54ff:fe1b:2530/10 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 b) TX bytes:528 (528.0 b)
Interrupt:9 Base address:0x5000
eth0:1 Link encap:Ethernet HWaddr 00:48:54:1B:25:30
inet addr:192.168.0.11 Bcast:0.0.0.0 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Interrupt:9 Base address:0x5000
Notice that we can choose any arbitrary string as the label. We're not forced to use the 2.0 naming scheme; we must comply to it only if we care having backward compatibility with ifconfig.
5.3. Which IP for the tunnel.
Choosing a global/public IP address (respectively an IPv6 address for SIT/IPv6-in-IPv4 tunnels and an IPv4 address for GRE/IPv4-in-IPv4 tunnels) for the local endpoint of the tunnel is probably the best thing we can do when our computer is a single host and not a router providing IPv6 connectivity to a whole LAN.
Instead, if we're configuring a router, we'd better use a link-local address for SIT/IPv6-in-IPv4 tunnels (in IPv6 link-local addresses are assigned automatically by means of stateless address autoconfiguration or manually configured) and a private address for GRE/IPv4-in-IPv4 tunnels (IPv4 has no link-local addresses). The valid address will then be only on eth0 (or the interface on the LAN side). Notice that in this configuration you need to activate forwarding among interfaces, using these commands:
sysctl -w net.ipv4.conf.all.forwarding=1 # for GRE (IPv4-in-IPv4) sysctl -w net.ipv6.conf.all.forwarding=1 # for SIT (IPv6-in-IPv4)
You can even decide to enable forwarding only between a couple of interfaces, in this case you could use these commands:
sysctl -w net.ipv6.conf.eth0.forwarding=1 sysctl -w net.ipv6.conf.pippo.forwarding=1
6. Routing
Now that our tunnel is configured, we have to specify which traffic will be directed through it. For IPv6 the most common choice is the following:
ip route add 2000::/3 dev foo
This way all IPv6 traffic going to addresses starting with 3 bits equal to 001 (that is, all global unicast IPv6 address space) will be directed to the foo interface. This is only one 8th of the available IPv6 address space, but you are guaranteed that every possible remote host will be in this range.
We can see the IPv4 routing table this way:
[root@abulafia root]# ip route 192.168.0.0/24 dev eth0 scope link 127.0.0.0/8 dev lo scope link
and the IPv6 routing table this way:
[root@abulafia root]# ip -6 route 2000::/3 dev foo proto kernel metric 256 mtu 1480 advmss 1420 fe80::/10 dev eth0 proto kernel metric 256 mtu 1500 advmss 1440 fe80::/10 dev foo proto kernel metric 256 mtu 1480 advmss 1420 ff00::/8 dev eth0 proto kernel metric 256 mtu 1500 advmss 1440 ff00::/8 dev foo proto kernel metric 256 mtu 1480 advmss 1420 default dev eth0 proto kernel metric 256 mtu 1500 advmss 1440 unreachable default dev lo metric -1 error -101
If you need to specify a gateway (this is not for tunnels) then you can add the via parameter, for example:
ip route add 192.168.1.0/24 via 192.168.0.254 dev eth0
To remove a route you can obviously use ip route del but be careful: if you write ip route del default you're removing the default IPv4 route, not the IPv6 one! To remove the IPv6 default destination you need to use ip -6 route del default.
7. A complete example
This is a typical IPv6 tunnel for 6bone:
ip tunnel add $TUNNEL mode sit local any remote $V4_REMOTEADDR ttl 64 ip link set $TUNNEL up ip addr add $V6_LOCALADDR dev $TUNNEL ip route add 2000::/3 dev $TUNNEL
where $TUNNEL is an arbitrary name assigned to the tunnel, $V4_REMOTEADDR is the IPv4 address of the remote end of the tunnel and $V6_LOCALADDR is the IPv6 local address assigned to our host. We've used the any value for the local endpoint address because this way we can handle a dynamic IPv4 address (e.g. assigned by a dialup connection to the ISP). Obviosly we need to inform our tunnel broker when our address changes but this is out of the scope of this writing, also because there's no general standard procedure.
To shut down the tunnel:
ip tunnel del $TUNNEL
also automatically removes the routing entry and the address.
8. Links
Project6
Internet assigned numbers authority
iproute2
RFC2784 - Generic Routing Encapsulation (GRE)
RFC2373 - IP Version 6 Addressing Architecture
RFC2893 - Transition Mechanisms for IPv6 Hosts and Routers
An overview of the introduction of IPv6 in the Internet
ngnet
$Id: iproute2tunnel-en.html,v 1.2 2002/08/04 15:39:44 pioppo Exp $
分享到：
发表评论
-
建立tap设备的c的代码
2019-01-08 19:09 480tapper.c #include <stdio.h& ... -
jslinux总结帖
2019-01-04 21:33 1160注意个问题： chrome不要用两个tab页，否则ping不通 ... -
br0和tap0的互相影响
2019-01-02 19:17 819转载 http://www.cnblogs.com/wlei/ ... -
jslinux-deobfuscated-network
2017-02-13 22:37 733基础知识 查看网络包 tcpdump -i eth0 -e ... -
qemu用tap方式启动vm的网络试验(ip route)
2016-09-14 11:29 2832ip route add 192.168.8.0/24 via ... -
socket的方式使用qemu建立虚拟机
2016-06-24 17:54 1931qemu的-net参数 -net nic 必须有，基本配置mo ... -
tap的方式使用qemu建立虚拟机NAT网络
2016-06-23 18:03 9901基本概念： vm:虚拟机 ... -
qemu用nat的方式使用tap建立虚拟机
2016-06-23 16:15 11普通桥接参考 http://haoningabc.iteye. ... -
tap的方式使用qemu建立虚拟机桥接网络
2016-06-22 20:53 7883需求：建立一个虚拟机，使网络和内网一样，当一台普通接入内网的服 ... -
websocket和tap使用select关联
2016-06-14 22:01 753c语言的socket基础http://haoningabc.i ... -
socket基础和select(python)
2016-06-14 17:21 1807上接 c语言的socket基础ht ... -
socket基础（c语言）
2016-06-14 16:45 1007不使用select 普通的基础socket连接，对多个客户端的 ... -
tap和tun
2016-06-04 22:42 829tun在网络层 tap在二层 ls ...
相关推荐
- 在“Host Name (or IP address)”框中输入目标服务器的地址。 - 选择所需的协议（默认为SSH）。 2. **配置端口映射**： - 转到左侧导航栏中的“Connection > SSH > Tunnels”选项。 - 在“Source port”框中...
Tunnel Hunter: Detecting application-layer tunnels with statistical fingerprinting
NetBox是一款开源的IP地址管理和网络资源编排平台，它允许网络管理员以结构化的方式跟踪和管理网络基础设施。而netbox-tunnels-plugin则是NetBox的一个扩展插件，专门用于处理网络隧道配置和管理。这个插件的版本号...
Road Tunnels.pdf
2. **配置连接**：打开PuTTY，输入远程服务器的IP地址，选择SSH作为连接类型，并设置好用户名。 3. **创建Tunnel**：在“SSH”菜单下找到“Tunnels”选项，设置源端口和目标地址。源端口是你本地机器上要转发的端口...
IEC 60287-2-3-2017 Thermal resistance – Cables installed in ventilated tunnels.pdf
guide-to-road-tunnels.pdf
Internet structure, Multihomed routing domains, Tunnels, Private links, Multicast Routing, Intranets. Chapter 8: Security in IPv6 Security functions, Authentication Header (AH), Authentication ...
SSH Mastery_ OpenSSH, PuTTY, Tunnels and Keys. 12-Tilted Windmill Press (2018).epub
「安全分析」Scanners，Tunnels，and Sims，Oh My - 渗透测试 自动化 防火墙 安全分析 红蓝对抗 安全运营
TCP和连接的UDPLinux内核实现通过各种应用程序层协议（HTTP，SOCKS4 / 5）进行中继。
NULL 博文链接：https://meizhi.iteye.com/blog/599529
《Tunnels: 免费VideoCall应用的开发与实现》 Tunnels是一款专为大众设计的免费VideoCall应用，旨在提供便捷、高效的视频通话服务。作为一个在持续开发中的项目，Tunnels致力于打破距离的限制，让人们无论身处何...
在IT行业中，"Right-Room-Tunnels"这个标题似乎是指一个特定的项目或技术，但没有足够的信息来详细解释其具体含义。然而，结合提供的描述"右室隧道"，我们可以尝试推测这可能是一个与网络隧道或者虚拟路径相关的技术...
Oracle Solaris 11.3 Administering TCP/IP Networks, IPMP, and IP Tunnels in Oracle Solaris 11.3-136
SSH隧道的可视指南带有可视解释的SSH隧道示例和用例这是一个正在进行的工作。 参见执照麻省理工学院
启动cordova-hcp server报错 Could not create tunnel: { Error: ngrok is not yet ready to start tunnels 时，将路径 下的cordova-hot-code-push-cli文件下用下载的文件替换就可以了
热更新时，我们执行命令 npm install -g cordova-hot-code-push-cli安装插件，但运行cordova-hcp server会报错，如：Could not create tunnel: { Error: ngrok is not yet ready to start tunnels...，这时我们找到...
2. **安装与配置**：首先，你需要安装Node.js，因为Cordova是通过npm（Node包管理器）进行安装的。接着，使用`npm install -g cordova`全局安装Cordova。之后，创建一个新的Cordova项目，通过`cordova create <项目...
泛用化或扩展IT渗透测试工具的做法因过于关注网络（尤其是TCP/IP），而忽视了其他众多攻击向量。此外，这些工具通常没有维护非Web界面、串行接口和专有接口的测试功能，扩展工具也需要大量的时间和经验。 因此，...