使用tinc+quagga搭建個人SD-WAN網絡
拓撲如下
(圖檔可點選放大檢視)
一、tinc安裝與配置
1、CentOS7雲主機安裝tinc
(圖檔可點選放大檢視)
(圖檔可點選放大檢視)
yum install tinc (圖檔可點選放大檢視)
mkdir -p /etc/tinc/tincnet/
mkdir /etc/tinc/tincnet/hosts
cd /etc/tinc/tincnet/
ll
vi tinc.conf
Name = Server_Node
Interface = tinctun
AddressFamily = ipv4
Mode = switch
ConnectTo = Slave_Node
Compression=9
Cipher = aes-256-cbc
Digest = sha256
PrivateKeyFile=/etc/tinc/tincnet/rsa_key.priv (圖檔可點選放大檢視)
vi tinc-up
#!/bin/sh
ip link set $INTERFACE up
ip addr add 10.254.254.2/24 dev $INTERFACE
ip route add 10.254.254.0/24 dev $INTERFACE
vi tinc-down
#!/bin/sh
ip route del 10.254.254.0/24 dev $INTERFACE
ip addr del 10.254.254.2/24 dev $INTERFACE
ip link set $INTERFACE down
chmod 755 tinc* (圖檔可點選放大檢視)
cd /etc/tinc/tincnet/hosts
vi Server_Node
Address = 129.211.209.82
Subnet = 10.254.254.2/32
Port = 655 (圖檔可點選放大檢視)
通過tincd生成非對稱密鑰
#通過tincd生成非對稱密鑰
tincd -n tincnet -K 4096 (圖檔可點選放大檢視)
2、分支節點安裝配置tinc
配置與上面類似，不再贅述，截圖如下
(圖檔可點選放大檢視)
(圖檔可點選放大檢視)
(圖檔可點選放大檢視)
(圖檔可點選放大檢視)
3、保證兩個節點的hosts檔案夾都有全部節點的hosts資訊
scp /etc/tinc/tincnet/hosts/Slave_Node [email protected]:/etc/tinc/tincnet/hosts/
scp [email protected]:/etc/tinc/tincnet/hosts/Server_Node /etc/tinc/tincnet/hosts (圖檔可點選放大檢視)
4、配置etc/sysctl.conf檔案
net.ipv4.ip_forward = 1 (圖檔可點選放大檢視)
5、防火牆放通655端口
(圖檔可點選放大檢視)
(圖檔可點選放大檢視)
6、啟動tinc服務
systemctl start tinc@tincnet
systemctl status tinc@tincnet (圖檔可點選放大檢視)
(圖檔可點選放大檢視)
二、手工靜态路由方式實作互訪
添加路由前截圖
(圖檔可點選放大檢視)
例如分支節點上添加靜态路由
route add -net 10.106.0.0/20 dev tinctun (圖檔可點選放大檢視)
三、安裝quagga配置ospf實作互通
1、兩節點均安裝并配置quagga
yum install quagga
cd /etc/quagga/
cp /usr/share/doc/quagga-0.99.22.4/zebra.conf.sample ./
cp /usr/share/doc/quagga-0.99.22.4/ospfd.conf.sample ./
cp zebra.conf.sample zebra.conf
cp ospfd.conf.sample ospfd.conf
chmod 777 *.conf
chmod 777 /var/log/ospfd/
systemctl enable zebra
systemctl enable ospfd
systemctl start zebra
systemctl start ospfd (圖檔可點選放大檢視)
(圖檔可點選放大檢視)
2、vtysh進行配置ospf
(圖檔可點選放大檢視)
主節點配置步驟如下
VM-0-17-centos# conf t
VM-0-17-centos(config)# interface eth0
VM-0-17-centos(config-if)# description Server_eth0
VM-0-17-centos(config-if)# no shut
VM-0-17-centos(config-if)# exit
VM-0-17-centos(config)# interface tinctun
VM-0-17-centos(config-if)# description Server_tinctun
VM-0-17-centos(config-if)# no shut
VM-0-17-centos(config-if)# exit
VM-0-17-centos(config)# router ospf
VM-0-17-centos(config-router)# router-id 1.1.1.1
VM-0-17-centos(config-router)# network 10.254.254.0/24 area 0
VM-0-17-centos(config-router)# network 10.206.0.17/20 area 0
VM-0-17-centos(config-router)# exit
VM-0-17-centos(config)# log file /var/log/quagga/ospfd.log
VM-0-17-centos(config)# exit
VM-0-17-centos# wr
Building Configuration...
Configuration saved to /etc/quagga/zebra.conf
Configuration saved to /etc/quagga/ospfd.conf
[OK] (圖檔可點選放大檢視)
分支節點配置步驟如下
vtysh
Hello, this is Quagga (version 0.99.22.4).
Copyright 1996-2005 Kunihiro Ishiguro, et al.
centos.walkingcloud.cn# conf t
centos.walkingcloud.cn(config)# interface ens33
centos.walkingcloud.cn(config-if)# description Slave_ens33
centos.walkingcloud.cn(config-if)# no shut
centos.walkingcloud.cn(config-if)# exit
centos.walkingcloud.cn(config)# interface tinctun
centos.walkingcloud.cn(config-if)# description Slave_tinctun
centos.walkingcloud.cn(config-if)# no shut
centos.walkingcloud.cn(config-if)# exit
centos.walkingcloud.cn(config)#
centos.walkingcloud.cn(config)# exit
centos.walkingcloud.cn# conf t
centos.walkingcloud.cn(config)# router ospf
centos.walkingcloud.cn(config-router)# router-id 2.2.2.2
centos.walkingcloud.cn(config-router)# network 192.168.31.0/24 area 0
centos.walkingcloud.cn(config-router)# network 10.254.254.0/24 area 0
centos.walkingcloud.cn(config-router)# network 192.168.1.1/24 area 0
centos.walkingcloud.cn(config-router)# exit
centos.walkingcloud.cn(config)# log file /var/log/quagga/ospfd.log
centos.walkingcloud.cn(config)# exit
centos.walkingcloud.cn# wr
Building Configuration...
Configuration saved to /etc/quagga/zebra.conf
[OK]
centos.walkingcloud.cn# exit (圖檔可點選放大檢視)
3、防火牆放通ospf協定
firewall-cmd --permanent --zone=public --add-protocol=ospf
firewall-cmd --reload 并重新開機ospf和zebra服務
systemctl restart zebra
systemctl restart ospfd (圖檔可點選放大檢視)
4、ospf狀态檢查
可以用vtysh中
show ip ospf neighbor檢查鄰居是否建立
show ip route檢視對方是否學習到對方的ospf路由
show ip ospf neighbor
show ip route (圖檔可點選放大檢視)
(圖檔可點選放大檢視)
5、最後進行連通性測試
(圖檔可點選放大檢視)
四、總結
-
- 1、本文隻是測試使用quagga并使用ospf協定，實際中為了簡單起見，可以直接使用靜态路由即可
- 2、當然個人家庭網絡中不會把Linux伺服器作為出口路由使用，可以openwrt路由器安裝tinc來實作