Method and system for accelerating SDWAN container based on VPP

Abstract

The present invention discloses a method and system for accelerating SDWAN containers based on VPP, which relates to the field of SDWAN network virtualization technology, including: S1 base network forwarding module forwards data packets through VPP, and builds a POP container image based on this; S2 POP container fully packages the overall data plane function of POP, builds an executable POP container image and provides it to the controller; S3 controller deploys the POP container image on the network server. This method effectively solves the problems of serious resource waste, poor network quality, and high operation and maintenance costs in the prior art, solves the problem of automatic deployment of POP nodes, realizes efficient automatic deployment and dynamic expansion and contraction of the SDWAN POP container data plane, reduces operation and maintenance costs, and greatly improves the stability and availability of the entire system. It can be used in multiple scenarios such as cloud native direction acceleration of container networks.

Description

Technical Field

[0001] The present invention relates to the technical field of SDWAN network virtualization, and in particular to a method and system for accelerating SDWAN containers based on VPP. Background Art

[0002] Software Defined Wide Area Network (SDWAN) is an emerging software-defined network (WAN) technology. SDWAN connects the branch sites of an enterprise (tenant) and multiple clouds. It can be applied to different types of WAN links, such as the Internet, Multi-Protocol Label Switching (MPLS), 5G, Long Term Evolution (LTE), etc., providing enterprises with exclusive WAN access, multi-location networking, flexible configuration, and intelligent scheduling and management services.

[0003] At present, SDWAN POP is almost always deployed in physical machine mode. However, in the process of implementing the technical solution of the invention in the embodiment of the present application, the inventors of the present application found that the above technology has at least the following technical problems: Due to system differences, the installation and deployment of a POP node requires the installation of the dependent environment in advance, and the operation and maintenance personnel also need to be very familiar with the business networking of POP. At the same time, due to different operating systems, some dependent packages are different, and related environmental issues need to be debugged during the installation process, which makes it take a long time to deploy a POP node. At present, SDWAN POP is built on an x86 server, and only one POP node runs on a single server, which wastes the server resources to a great extent, and is almost completely incapable of dynamic expansion and contraction of POP nodes. Summary of the invention

[0004] The embodiments of the present application solve the problems of serious resource waste, poor network quality, and high operation and maintenance costs in the prior art by providing a method and system for accelerating SDWAN containers based on VPP, solve the problem of automatic deployment of POP nodes, and realize efficient deployment of the SDWAN POP container data plane.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: A method for accelerating SDWAN containers based on VPP, comprising:

[0006] The method is carried out according to the following steps:

[0007] S1: The base network forwarding module forwards data packets through VPP and builds a POP container image based on it;

[0008] S2: The POP container completely packages the overall data plane functions of the POP, builds an executable POP container image, and provides it to the controller;

[0009] S3: The controller deploys the POP container image on a network server.

[0010] Furthermore, the VPP-based base network forwarding module uses vector processing of data packets, and simultaneously uses zero copy, branch prediction, large page memory, and binding core-related operations to improve forwarding performance.

[0011] Furthermore, the S1 is performed according to the following steps:

[0012] S11: The network interface controller (NIC) of the VPP receives the data packet;

[0013] S12: The network interface controller of the VPP starts the POP container and creates a virtualized network interface controller (vNIC) according to the number of started POP containers;

[0014] S13: VPP Layer 3 routing forwarding processing;

[0015] S14: The network interface controller of the VPP configures IP / routing for the base network;

[0016] S15: The network interface controller of the VPP configures the Network Address Translation (NAT) rules for the POP container, including Source Network Address Translation (SNAT) and Destination Network Address Translation (DNAT);

[0017] S16: NAT rule matching, if the match fails, the data packet is discarded, otherwise it goes to S17;

[0018] S17: If the SNAT rule matches successfully, the source address and source port of the data packet are converted, and after the route query, the physical interface is selected for forwarding according to the data packets in different directions, otherwise, it goes to S18;

[0019] S18: DNAT rule matching is successful, the destination address and destination port of the data packet are converted, and different POP container network interfaces are selected for forwarding after routing query.

[0020] Furthermore, the interface of the virtual network card in S12 adopts two types: vhost-user / virtio-user and memif, and the two interfaces share memory to meet the different requirements of SDWAN POP for network processing performance.

[0021] Furthermore, the vhost-user / virtio-user interface of the virtual network card simulates software multi-queues, simulates rss at the software level, and the user-mode virtual driver provided by the Data Plane Development Kit (DPDK) realizes data transmission through a lock-free ring vring, which is consistent with the POP container packet receiving and sending method;

[0022] The memif interface of the virtual network card is a virtual IO dedicated to the container network, and the packet sending and receiving functions with the POP container are implemented by the relevant applications of VPP.

[0023] Furthermore, the specific execution steps in S17 are as follows:

[0024] S61: Convert the source address and source port of the data packet;

[0025] S62: query the route to determine whether the physical network card on the x86 server host supports being taken over by DPDK. If so, VPP takes over the physical network card of the x86 server host through DPDK as an interface for interacting with the external network card to forward data packets. Otherwise, proceed to S63.

[0026] S63: forward the data packet using the AF_PACKET or AF_XDP method provided by VPP.

[0027] Furthermore, the specific execution steps of forwarding the data packet in the AF_PACKET mode in S63 are as follows:

[0028] S71: Use mmap memory mapping to obtain data packets from the Linux kernel and send them to the VPP for processing;

[0029] S72: Send the data message processed by the VPP to the Linux kernel through the above space to realize the interaction of data messages.

[0030] Furthermore, the specific execution steps of forwarding the data packet in the AF_XDP mode in S63 are as follows:

[0031] S81: Before the data packet enters the kernel protocol stack, the data packet is bypassed to VPP using Linux eBPF;

[0032] S82: Linux sends the data message processed by VPP.

[0033] The present invention also provides a virtual device for accelerating SDWAN container based on VPP, including:

[0034] Base network forwarding module: used to receive data packets through VPP, select network interface to forward network data packets, and start POP container;

[0035] POP container module: used to completely package the overall data plane functions of POP, build an executable POP container image, and provide it to the controller;

[0036] Controller module: used to deploy the POP container image on the network server.

[0037] The present invention also provides a system for accelerating SDWAN containers based on VPP, including a computer body and a server, wherein the computer body and the server are connected via a network:

[0038] The computer body includes a base network forwarding unit, a POP container unit, and a controller unit;

[0039] The base network forwarding unit receives data packets sent by the host through VPP, selects a network interface to forward network data packets, and starts the POP container;

[0040] The POP container unit completely packages the overall data plane functions of the POP, builds an executable POP container image, and provides it to the controller;

[0041] The controller unit deploys the POP container image on the server; the server receives the control unit to deploy the POP container;

[0042] The network connects the computer body and the server.

[0043] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0044] 1. Since VPP is used as the network forwarding base of the POP container, the underlying network protocol stack from the host to the POP container is in user mode, and the CPU does not need to participate in the copying of data packets. Therefore, the problem of poor forwarding data packets at the current stage is effectively solved, thereby realizing efficient forwarding of the SDWAN POP data plane.

[0045] 2. Since POP nodes are deployed using POP containers, multiple POP containers can be run on a single server, and the utilization rate of a single physical server is maximized. Therefore, the problems of serious resource waste and difficulty in dynamically scaling POP nodes are effectively solved, thereby achieving efficient deployment and dynamic scaling of POP nodes.

[0046] 3. Since POP nodes are deployed using POP containers, the controller automatically manages the POP containers, so that each POP container can be started and stopped quickly. Therefore, the problem of POP function unavailability due to the unfamiliarity of operation and maintenance personnel and developers with the environment is effectively solved, thereby realizing the fully automated deployment of POP nodes, reducing operation and maintenance costs, and greatly improving the stability and availability of the entire system. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is an overall flow chart of the method for accelerating SDWAN containers based on VPP according to the present invention;

[0048] Figure 2 It is a flow chart of the base network forwarding module based on VPP according to the present invention;

[0049] Figure 3 This is a flow chart of the DNAT rule of the present invention;

[0050] Figure 4 The figure is a flow chart of the SNAT rules described in the present invention. DETAILED DESCRIPTION

[0051] The present invention introduces VPP as the network base, and the SDWAN containerized network solution deploys POP nodes. Multiple POP nodes can run on one x86 server, which greatly reduces resource waste, improves network quality, and increases the bandwidth of a single server. At the same time, it solves the problem of automatic deployment of POP nodes, reduces maintenance costs, and thus realizes efficient forwarding of the SDWAN POP data plane.

[0052] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0053] This embodiment discloses a method for accelerating SDWAN containers based on VPP. Figure 1 ,include:

[0054] S1: The base network forwarding module forwards data packets through VPP and builds a POP container image based on it;

[0055] S2: The POP container completely packages the overall data plane functions of the POP, builds an executable POP container image, and provides it to the controller;

[0056] S3: The controller deploys the POP container image on a network server.

[0057] In this implementation scheme, through: S1, the base network forwarding module forwards the data packet through VPP, and builds a POP container image based on this; S2, the POP container completely packages the overall data plane function of POP, builds an executable POP container image and provides it to the controller; S3, the controller deploys the POP container image on the network server, realizing efficient forwarding of the SDWAN POP data plane.

[0058] Specifically, the VPP-based base network forwarding module uses vector processing for data packets, and uses zero copy, branch prediction, large page memory, and binding core-related operations to improve forwarding performance.

[0059] Specifically, Figure 2 , S1 proceeds as follows:

[0060] S11: VPP’s NIC receives the data packet;

[0061] S12: The network interface controller of the VPP starts the POP container and creates a vNIC according to the number of started POP containers;

[0062] S13: VPP Layer 3 routing forwarding processing;

[0063] S14: The network interface controller of the VPP configures IP / routing for the base network;

[0064] S15: The network interface controller of the VPP configures NAT rules for the POP container, including SNAT and DNAT.

[0065] S16: NAT rule matching, if the match fails, the data packet is discarded, otherwise it goes to S17;

[0066] S17: If the SNAT rule matches successfully, the source address and source port of the data packet are converted, and after the route query, the physical interface is selected for forwarding according to the data packets in different directions, otherwise, it goes to S18;

[0067] S18: DNAT rule matching is successful, the destination address and destination port of the data packet are converted, and different POP container network interfaces are selected for forwarding after routing query.

[0068] Specifically, the interfaces of the virtual network card in S12 adopt two types: vhost-user / virtio-user and memif. The two interfaces share memory to meet the different requirements of SDWAN POP for network processing performance.

[0069] Specifically, the vhost-user / virtio-user interface of the virtual network card simulates software multi-queues and rss at the software level. The user-mode virtual driver provided by DPDK implements data transmission through a lock-free ring vring, which is consistent with the way the POP container sends and receives packets.

[0070] The memif interface of the virtual network card is a virtual IO dedicated to the container network, and the packet sending and receiving functions with the POP container are implemented by the relevant applications of VPP.

[0071] In this embodiment, if Figure 3 , DNAT rule matching is successful, the destination address and destination port of the data packet are converted, and different POP container network interfaces are selected for forwarding after routing query. Figure 3 vhost-tx / virtio-tx and memif-tx respectively indicate that the data packet is forwarded from the network card that receives the data packet.

[0072] Specifically, Figure 4 , the specific execution steps in S17 are as follows:

[0073] S61: Convert the source address and source port of the data packet;

[0074] S62: query routing;

[0075] S63: Select a physical interface. If the physical network card on the x86 server host supports being taken over by DPDK, VPP takes over the physical network card of the x86 server host through DPDK as an interface for interacting with the external network card to forward data packets. Otherwise, go to S64.

[0076] S64: forward the data packet using the AF_PACKET or AF_XDP method provided by VPP.

[0077] In this implementation, if the physical network card on the x86 server host supports being taken over by DPDK, VPP takes over the physical network card of the x86 server host through DPDK as an interface for interacting with the external network card to implement data packet forwarding. Figure 4 In the dpdk-tx, the NIC that receives the data packet forwards the data packet through DPDK. If the physical NIC on the x86 server host does not support being taken over by DPDK, the AF_XDP or AF_PACKET method provided by VPP is used to forward the data packet. Figure 4 In the above, XDP-tx and af_packet-tx respectively indicate that the network card that received the data packet forwards the data packet through AF_XDP and AF_PACKET.

[0078] Specifically, the specific execution steps of forwarding a data packet in AF_PACKET mode in S64 are as follows:

[0079] S71: Use mmap memory mapping to obtain data packets from the Linux kernel and send them to the VPP for processing;

[0080] S72: Send the data message processed by the VPP to the Linux kernel through the above space to realize the interaction of data messages.

[0081] Specifically, the specific execution steps of forwarding data packets in AF_XDP mode in S64 are as follows:

[0082] S81: Before the data packet enters the kernel protocol stack, the data packet is bypassed to VPP using Linux eBPF;

[0083] S82: Linux sends the data message processed by VPP.

[0084] A virtual device based on VPP to accelerate SDWAN container, comprising:

[0085] Base network forwarding module: used to receive data packets through VPP, select network interface to forward network data packets, and start POP container;

[0086] POP container module: used to completely package the overall data plane functions of POP, build an executable POP container image, and provide it to the controller;

[0087] Controller module: used to deploy the POP container image on the network server.

[0088] In this embodiment, the POP container module completely packages the overall data plane functions of POP, builds an executable POP container image and provides it to the controller, which then deploys the POP container image on the network server. Since POP containers are used to deploy POP nodes, multiple POP containers can be run on a single server, and the utilization rate of a single physical server is maximized. Therefore, the problems of serious resource waste and difficulty in dynamically scaling POP nodes are effectively solved, thereby achieving efficient deployment and dynamic scaling of POP nodes.

[0089] A system for accelerating SDWAN containers based on VPP includes a computer body and a server, wherein the computer body and the server are connected via a network:

[0090] The computer body includes a base network forwarding unit, a POP container unit, and a controller unit;

[0091] The base network forwarding unit receives data packets sent by the host through VPP, selects a network interface to forward network data packets, and starts the POP container;

[0092] The POP container unit completely packages the overall data plane functions of the POP, builds an executable POP container image, and provides it to the controller;

[0093] The controller unit deploys the POP container image on the server; the server receives the control unit to deploy the POP container;

[0094] The network connects the computer body and the server.

[0095] In this implementation scheme, the system based on VPP to accelerate the SDWAN container uses POP containers to deploy POP nodes. The controller automatically manages the POP containers so that each POP container can be started and stopped quickly. Therefore, the problem of POP function unavailability due to the unfamiliarity of operation and maintenance personnel and developers with the environment is effectively solved, thereby realizing the fully automated deployment of POP nodes, reducing operation and maintenance costs, and greatly improving the stability and availability of the entire system.

[0096] Software-defined WAN is an emerging software-defined network WAN technology that connects the branch sites of enterprises (tenants) and multiple clouds. It can be applied to different types of WAN links, such as the Internet, multi-protocol label switching, 5G, long-term evolution, etc., to provide enterprises with exclusive WAN access, multi-site networking, flexible configuration, and intelligent scheduling and management services. At present, SDWAN POP is almost always deployed in a physical machine mode. Due to system differences, the installation and deployment of a POP node requires the installation of the dependent environment in advance, and the operation and maintenance personnel also need to be very familiar with the business networking of POP. At the same time, due to different operating systems, some dependent packages are different, and related environmental issues need to be debugged during the installation process, which makes it take a long time to deploy a POP node. At present, SDWAN POP is built on an x86 server, and only one POP node is running on a single server, which greatly wastes server resources and is almost completely incapable of dynamic expansion and contraction of POP nodes. In view of the shortcomings of the prior art, the method proposed in the present invention first forwards data packets through VPP by the base network forwarding module, and builds a POP container image based on this; then, the POP container completely packages the overall data plane function of POP, builds an executable POP container image and provides it to the controller; finally, the controller deploys the POP container image on the network server. This method uses VPP as the network forwarding base of the POP container, so that the underlying network protocol stack from the host machine to the POP container is in user mode, and the CPU does not need to participate in the copy of data packets. The POP container deploys the POP node, and the controller automatically manages the POP container. Multiple POP containers can be run on a single server, which effectively solves the problems of serious resource waste, poor network quality, and high operation and maintenance costs in the prior art, solves the problem of automatic deployment of POP nodes, and realizes the efficient automatic deployment and dynamic expansion and contraction of the SDWAN POP container data plane, reduces the operation and maintenance costs, and greatly improves the stability and availability of the entire system. The patent of this invention combines user-mode virtualized networks and containers, and SDWAN can be moved down from SDWAN POP to edge computing nodes in scenarios that require large-scale integrated deployment, thereby improving automated deployment capabilities; the container cloud network forwarding architecture can be used to accelerate container networks in the cloud-native direction; other forwarding network elements of cloud computing can be constructed and implemented with reference to the patent of this invention; at the same time, in telecommunications-level networks such as vBRAS, 5G core network UPF, and 5G base station CU / DU, the patent of this invention can be used to accelerate the data plane while realizing lightweight network element construction.

[0097] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0101] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0102] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for accelerating SDWAN containers based on VPP, characterized in that: The method is carried out according to the following steps: S1: The base network forwarding module forwards data packets through VPP and builds a POP container image based on it; S2: The POP container completely packages the overall data plane functions of the POP, builds an executable POP container image, and provides it to the controller; S3: The controller deploys the POP container image on the network server; The S1 is performed as follows: S11: The network interface controller of the VPP receives a data packet; S12: The network interface controller of the VPP starts the POP container and creates a virtual network card according to the number of started POP containers; S13: VPP Layer 3 routing forwarding processing; S14: The network interface controller of the VPP configures IP / routing for the base network; S15: The network interface controller of the VPP configures NAT rules for the POP container, including SNAT and DNAT. S16: NAT rule matching, if the match fails, the data packet is discarded, otherwise it goes to S17; S17: If the SNAT rule matches successfully, the source address and source port of the data packet are converted, and after the route query, the physical interface is selected for forwarding according to the data packets in different directions, otherwise, it goes to S18; S18: DNAT rule matching is successful, the destination address and destination port of the data packet are converted, and different POP container network interfaces are selected for forwarding after routing query.

2. According to claim 1, a method for accelerating SDWAN containers based on VPP is characterized in that: The VPP-based base network forwarding module uses vector processing data packets, and uses zero copy, branch prediction, large page memory, and binding core-related operations to improve forwarding performance.

3. The method for accelerating SDWAN container based on VPP according to claim 1, characterized in that: The interfaces of the virtual network card in S12 adopt vhost-user / virtio-user and memif. The two interfaces share memory to meet the different requirements of SDWAN POP for network processing performance.

4. The method for accelerating SDWAN container based on VPP according to claim 3, characterized in that: The vhost-user / virtio-user interface of the virtual network card simulates software multi-queues and rss at the software level. The user-mode virtual driver provided by DPDK implements data transmission in a lock-free ring vring, which is consistent with the POP container packet receiving and sending method. The memif interface of the virtual network card is a virtual IO dedicated to the container network, and the packet sending and receiving functions with the POP container are implemented by the relevant applications of VPP.

5. The method for accelerating SDWAN container based on VPP according to claim 1, characterized in that: The specific execution steps in S17 are as follows: S61: Convert the source address and source port of the data packet; S62: query the route to determine whether the physical network card on the x86 server host supports being taken over by DPDK. If so, VPP takes over the physical network card of the x86 server host through DPDK as an interface for interacting with the external network card to forward data packets. Otherwise, proceed to S63. S63: forward the data packet using the AF_PACKET or AF_XDP method provided by VPP.

6. The method for accelerating SDWAN container based on VPP according to claim 5, characterized in that: The specific execution steps of forwarding the data packet in the AF_PACKET mode in S63 are as follows: S71: Use mmap memory mapping to obtain data packets from the Linux kernel and send them to the VPP for processing; S72: Send the data message processed by the VPP to the Linux kernel through the above space to realize the interaction of data messages.

7. The method for accelerating SDWAN container based on VPP according to claim 5, characterized in that: The specific execution steps of forwarding the data packet in the AF_XDP mode in S63 are as follows: S81: Before the data packet enters the kernel protocol stack, the data packet is bypassed to VPP using Linux eBPF; S82: Linux sends the data message processed by VPP.

8. A virtual device based on VPP to accelerate SDWAN container, characterized in that: The virtual device comprises: Base network forwarding module: used to receive data packets through VPP, select network interface to forward network data packets, and start POP container; POP container module: used to completely package the overall data plane functions of POP, build an executable POP container image, and provide it to the controller; Controller module: used to deploy the POP container image on the network server; The functions of the base network forwarding module specifically include: The network interface controller of the VPP receives the data packet; The network interface controller of VPP starts the POP container and creates a virtual network card according to the number of started POP containers; VPP Layer 3 routing and forwarding processing; The network interface controller of the VPP configures IP / routing for the base network; The network interface controller of VPP configures NAT rules for the POP container, including SNAT and DNAT; NAT rule matching, if the match fails, the data packet is discarded, otherwise it goes to S17; If the SNAT rule matches successfully, the source address and source port of the data packet are converted, and after the route query, the physical interface is selected for forwarding according to the data packets in different directions, otherwise it goes to S18; The DNAT rule matches successfully, converts the destination address and destination port of the data packet, and selects different POP container network interfaces for forwarding after routing query.

9. A system for accelerating SDWAN containers based on VPP, characterized in that: The system includes a computer body and a server, and the computer body and the server are connected via a network: The computer body includes a base network forwarding unit, a POP container unit, and a controller unit; The base network forwarding unit receives data packets sent by the host through the VPP, selects a network interface to forward the network data packets, and starts a POP container; The POP container unit completely packages the overall data plane function of the POP, builds it into an executable POP container image and provides it to the controller; The controller unit deploys the POP container image on the server; the server receives the control unit to deploy the POP container; The network connects the computer body and the server; The functions of the base network forwarding unit specifically include: The network interface controller of the VPP receives the data packet; The network interface controller of VPP starts the POP container and creates a virtual network card according to the number of started POP containers; VPP Layer 3 routing and forwarding processing; The network interface controller of the VPP configures IP / routing for the base network; The network interface controller of VPP configures NAT rules for the POP container, including SNAT and DNAT; NAT rule matching, if the match fails, the data packet is discarded, otherwise it goes to S17; If the SNAT rule matches successfully, the source address and source port of the data packet are converted, and after the route query, the physical interface is selected for forwarding according to the data packets in different directions, otherwise it goes to S18; The DNAT rule matches successfully, converts the destination address and destination port of the data packet, and selects different POP container network interfaces for forwarding after routing query.

Images