{"id":479,"date":"2016-10-20T22:41:37","date_gmt":"2016-10-20T21:41:37","guid":{"rendered":"http:\/\/www.flat-planet.net\/?p=479"},"modified":"2016-10-20T22:43:27","modified_gmt":"2016-10-20T21:43:27","slug":"host-guest-networking-with-macvtap","status":"publish","type":"post","link":"https:\/\/flat-planet.net\/?p=479","title":{"rendered":"Host-Guest Networking with macvtap"},"content":{"rendered":"<p>I&#8217;ve been working with a lot of VMs lately and was using the &#8220;new&#8221; macvtap + bridge mode for the VM networking as this is supposed to offer great performance, while being simpler to configure. A key point is that each macvtap has its own mac address on the same Ethernet segment &#8211; think of this as an Ethernet sub-interface.\u00a0The physical interface to which the macvlan is attached is often referred to as &#8220;the lower device&#8221;, with the macvtap itself referred to as the &#8220;upper device&#8221;.<\/p>\n<p>macvtap has a number of different modes that it can be run in;<\/p>\n<ul>\n<li>Bridge: this works almost like a traditional bridge, in that data received on a macvlan in bridge mode and destined for another macvlan of the same lower device is sent directly to the target (if the target macvlan is also in bridge mode), rather than being sent outside. Basically no learning, and no STP &#8211; simple and fast<\/li>\n<li>VEPA: <em>Virtual Ethernet Port Aggregator<\/em> is the default mode. If the lower device receives data from a macvlan in VEPA mode, this data is always sent &#8220;out&#8221; to the upstream switch or bridge, even if it&#8217;s destined for another macvlan in the same lower device. The benefit to this is that the traffic between VMs becomes visible externally, the downside being that the external switch must support hair-pin mode (a.k.a reflective relay).<\/li>\n<li>Private: this is essentially like VEPA mode, but with the added feature that no macvlans on the same lower device can communicate, regardless of where the packets come from &#8211; basically think of it as acting like a private VLAN.<\/li>\n<li>Passthrough: No idea yet about this mode<\/li>\n<\/ul>\n<p>There is one big disadvantage to macvlan though &#8211; by design it is not possible for the host to connect directly with the guests.<\/p>\n<p>There is however a workaround &#8211; we add a new macvtap interface to the host, and route all VM communications through that bridge. Basic steps are;<\/p>\n<p>Create a new macvlan bridge and bring it up<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nsudo ip link add link eth0 macvlan0 type macvlan mode bridge\r\nsudo ifconfig macvlan0 up\r\nsudo ifconfig macvlan0\r\nmacvlan0\u00a0 Link encap:Ethernet\u00a0 HWaddr fa:ab:14:97:fd:ec\r\ninet6 addr: fe80::f8ab:14ff:fe97:fdec\/64 Scope:Link\r\nUP BROADCAST RUNNING MULTICAST\u00a0 MTU:1500\u00a0 Metric:1\r\nRX packets:0 errors:0 dropped:0 overruns:0 frame:0\r\nTX packets:6 errors:0 dropped:0 overruns:0 carrier:0\r\ncollisions:0 txqueuelen:0\r\nRX bytes:0 (0.0 B)\u00a0 TX bytes:508 (508.0 B)\r\n<\/pre>\n<p>Assign an IP address to the macvtap interface (192.168.1.3), and add a static host route towards the VM IP (192.168.1.10)<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nsudo ifconfig macvlan0 192.168.1.3 netmask 255.255.255.0\r\nsudo ip route add 192.168.1.10\/32 via 192.168.1.3 dev macvlan0\r\n<\/pre>\n<p>And there you go &#8211; host-guest communications via macvtap interfaces<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nping 192.168.1.10\r\nPING 192.168.1.10 (192.168.1.10) 56(84) bytes of data.\r\n64 bytes from 192.168.1.10: icmp_seq=1 ttl=64 time=0.282 ms\r\n64 bytes from 192.168.1.10: icmp_seq=2 ttl=64 time=0.134 ms\r\n<\/pre>\n<p>The downside to this being;<\/p>\n<ol>\n<li>You lose 1 extra IP address on the host, so it can network to the guest<\/li>\n<li>You have to add a lot of static routes unless you further subnet your network between VM and non-VM hosts, and route the VM subnet through the macvap interface<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;ve been working with a lot of VMs lately and was using the &#8220;new&#8221; macvtap + bridge mode for the VM networking as this is supposed to offer great performance, while being simpler to configure. A key point is that each macvtap has its own mac address on the same Ethernet segment &#8211; think of [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,38,95],"tags":[301,302,23,40,42,43,298,299,300],"series":[],"class_list":["post-479","post","type-post","status-publish","format-standard","hentry","category-virtualisation","category-linux","category-data-networking","tag-host-guest-networking","tag-bridging","tag-virtualisation-2","tag-networking","tag-linux-2","tag-routing-2","tag-virtualization","tag-macvtap","tag-macvlan"],"_links":{"self":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts\/479","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=479"}],"version-history":[{"count":5,"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts\/479\/revisions"}],"predecessor-version":[{"id":488,"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts\/479\/revisions\/488"}],"wp:attachment":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=479"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=479"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=479"},{"taxonomy":"series","embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fseries&post=479"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}