Methods and implementation systems for accessing external networks using floating IP addresses

Abstract

This invention discloses a method and system for accessing external networks using floating IPs, belonging to the field of network virtualization technology. The technical problem it addresses is how to reduce the occupancy of external network IPs on switches and improve network security. The method includes the following steps: adding an extension for the egress gateway in OpenStack, creating a soft router virtual machine for the egress gateway, and establishing a BGP connection between the soft router virtual machine and the switch; the user creates a virtual router, virtual network, and virtual machine, and binds the virtual machine port to the floating IP; the underlying layer adds a policy route pointing to the soft router virtual machine for the corresponding floating IP in the virtual router's namespace and publishes the floating IP route to the soft router virtual machine; when the virtual machine communicates via the floating IP, traffic is forwarded to the soft router virtual machine through the policy routing table, and then forwarded to the switch from the soft router virtual machine.

Description

Technical Field

[0001] This invention relates to the field of network virtualization technology, specifically to a method and system for accessing external networks via floating IP addresses. Background Technology

[0002] In OpenStack cloud networks, virtual machines (VMs) communicate with the external network via floating IPs. A floating IP is bound to the VM's internal IP. Traffic originating from the VM's internal IP undergoes NAT translation within the virtual router's namespace, converting the source IP to the floating IP before being forwarded. When the external network needs to access the VM, it directly accesses the floating IP, and the traffic undergoes NAT translation within the virtual router's namespace, converting the destination IP to the VM's internal IP. This communication method requires configuring the gateway for the network containing the floating IP on the switch connected to the network node, consuming an IP address. Furthermore, since this network is an external network, it needs to be directly accessible from the public internet, and the IP address needs to be fixed.

[0003] How to reduce the occupancy of external network IPs on switches and improve network security is a technical problem that needs to be solved. Summary of the Invention

[0004] The technical objective of this invention is to address the above-mentioned shortcomings by providing a method and system for accessing external networks using floating IP addresses, thereby solving the technical problem of reducing the occupancy of external network IP addresses on switches and improving network security.

[0005] In a first aspect, the present invention provides a method for accessing an external network using a floating IP address, comprising the following steps:

[0006] S100. Add an extension to the egress gateway in the OpenStack neutron component, create a soft router virtual machine for the egress gateway, bind it to the BGP interconnection network, and establish a BGP connection between the soft router virtual machine and the switch.

[0007] S200: Users create virtual routers, virtual networks, and virtual machines, and bind virtual machine ports to floating IPs;

[0008] S300: The underlying layer adds policy routes pointing to the soft router virtual machine for the corresponding floating IP in the virtual router's namespace, disables the default route, configures the default route and static route into the low-priority policy route, and publishes the floating IP route to the soft router virtual machine.

[0009] S400: When a virtual machine communicates via a floating IP, traffic is forwarded to the soft router virtual machine through the policy routing table, and then forwarded to the switch in the soft router virtual machine.

[0010] Preferably, step S100 includes the following operations:

[0011] Create a VLAN-type BGP interconnection network bgp-net, add subnets, and establish BGP connections between IP users and switches in bgp-net;

[0012] Create an external network of type VLAN, external-net, and add subnets. The IP address in external-net is used to provide a floating IP address and communicate with the external network.

[0013] Create a VXLAN type internal interconnect network connect-net to connect the software router virtual machine and the virtual router;

[0014] Create two virtual software routers for the outbound gateways and add ports for the connect-net and bgp-net networks;

[0015] Add a BGP remote IP and remote AS number to the egress gateway virtual machine and establish a BGP neighbor.

[0016] Preferably, step S300 includes the following operations:

[0017] After receiving the message that the floating IP and virtual machine port are bound, l3-agent creates policy routing table 16 at the underlying level, modifies the iptables rules of the internal interconnection port of l3-agent, and forwards the traffic from the virtual machine to the software router virtual machine. Among them, all floating IPs share the policy routing in table 16, and table 16 matches the default route.

[0018] After receiving the message that the floating IP address is bound to the virtual machine port, out_gateway publishes the route of the floating IP address to the switch in the soft router virtual machine and configures the next hop of the return route to the port of the Internet-net in the namespace of the virtual router.

[0019] The next hop is the IP address of the software router virtual machine. The IP address of the software router virtual machine is a virtual IP address that can be switched between two software router virtual machines. When keepalived detects that the primary software router virtual machine has failed to connect, it switches the IP address of the primary software router virtual machine to the backup software router virtual machine.

[0020] As a preferred option, after the OpenStack cloud platform is deployed and before the user creates tenant resources, create two soft router virtual machines for the egress gateway;

[0021] Multiple users' floating IPs can share a single software router virtual machine;

[0022] Two software router virtual machines establish BGP connections with their respective uplink switches, and enable bidirectional forwarding detection when establishing BGP connections.

[0023] As a preferred option, after the soft router virtual machine publishes the route of the floating IP to the switch, it finds the internal interconnect port on the virtual router by the relationship between the floating IP and the virtual router, and uses it as the next-hop address for the floating IP return route.

[0024] In a second aspect, the present invention provides a system for implementing floating IP access to external networks, used to perform the method for floating IP access to external networks as described in any of the first aspects, the system comprising:

[0025] The software configuration module is used to perform the following: add an extension to the egress gateway in the OpenStack neutron component, create a soft router virtual machine for the egress gateway, bind it to the BGP interconnection network, and establish a BGP connection between the soft router virtual machine and the switch.

[0026] The user configuration module is used to create virtual routers, virtual networks, and virtual machines, and to bind virtual machine ports to floating IPs.

[0027] The underlying configuration module is used to add policy routes pointing to the soft router virtual machine for the corresponding floating IP in the namespace of the virtual router, disable the default route, configure the default route and static route to the low-priority policy route, and publish the route of the floating IP to the soft router virtual machine.

[0028] The routing forwarding module is used to perform the following: when the virtual machine communicates via floating IP, the traffic is forwarded to the soft router virtual machine through the policy routing table, and then forwarded to the switch in the soft router virtual machine.

[0029] Preferably, the software configuration module is used to perform the following:

[0030] Create a VLAN-type BGP interconnection network bgp-net, add subnets, and establish BGP connections between IP users and switches in bgp-net;

[0031] Create an external network of type VLAN, external-net, and add subnets. The IP address in external-net is used to provide a floating IP address and communicate with the external network.

[0032] Create a VXLAN type internal interconnect network connect-net to connect the software router virtual machine and the virtual router;

[0033] Create two virtual software routers for the outbound gateways and add ports for the connect-net and bgp-net networks;

[0034] Add a BGP remote IP and remote AS number to the egress gateway virtual machine and establish a BGP neighbor.

[0035] Preferably, the underlying configuration module is used to perform the following:

[0036] After receiving the message that the floating IP and virtual machine port are bound, l3-agent creates policy routing table 16, modifies the iptables rules of the internal interconnect port of l3-agent, and forwards the traffic from the virtual machine to the soft router virtual machine. Among them, all floating IPs share the policy routing in table 16, and table 16 matches the default route.

[0037] After receiving the message that the floating IP address is bound to the virtual machine port, out_gateway publishes the route of the floating IP address to the switch in the soft router virtual machine and configures the next hop of the return route to the port of the Internet-net in the namespace of the virtual router.

[0038] The next hop is the IP address of the software router virtual machine. The IP address of the software router virtual machine is a virtual IP address that can be switched between two software router virtual machines. When keepalived detects that the primary software router virtual machine has failed to connect, it switches the IP address of the primary software router virtual machine to the backup software router virtual machine.

[0039] As a preferred option, after the OpenStack cloud platform is deployed and before the user creates tenant resources, the software configuration module is used to create soft router virtual machines for the two egress gateways;

[0040] Multiple users' floating IPs can share a single software router virtual machine;

[0041] Two software router virtual machines establish BGP connections with their respective uplink switches, and enable bidirectional forwarding detection when establishing BGP connections.

[0042] Preferably, after the soft router virtual machine publishes the route of the floating IP to the switch, the underlying configuration module is used to find the internal interconnection port on the virtual router through the relationship between the floating IP and the virtual router, and use it as the next-hop address of the floating IP backhaul route.

[0043] The method and implementation system for accessing external networks using floating IP addresses of the present invention have the following advantages:

[0044] 1. By using a software router virtual machine and a switch in OpenStack to establish BGP, the traffic communicating between the virtual machine and the external network no longer needs to be configured with a gateway on the switch. Instead, it communicates through BGP, which reduces the consumption of external network IPs and reduces the complexity of configuration on the switch.

[0045] 2. The switch learns the routes of the floating IP via BGP, which improves network security. The external gateway of this network cannot be directly accessed from the public network (because it does not exist). Traffic accessing the floating IP can also be managed in the software router virtual machine.

[0046] 3. The two soft router virtual machines of the egress gateway use keepalived to achieve HA (high availability). When one virtual machine or network node fails, traffic will automatically switch to the other virtual machine.

[0047] 4. Provides more secure and reliable floating IP communication in OpenStack. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] The invention will be further described below with reference to the accompanying drawings.

[0050] Figure 1 This is a flowchart illustrating the BGP communication process used by the floating IP in a method for accessing an external network using a floating IP in Example 1.

[0051] Figure 2 This is a schematic diagram of the BGP communication principle used by the floating IP in Example 1, a method for accessing an external network using a floating IP. Detailed Implementation

[0052] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0053] This invention provides a method and system for accessing external networks using floating IP addresses, which addresses the technical problem of reducing the occupancy of external network IP addresses on switches and improving network security.

[0054] Example 1:

[0055] This invention discloses a method for accessing an external network using a floating IP address, comprising the following steps:

[0056] S100. Add an extension to the egress gateway in the OpenStack neutron component, create a soft router virtual machine for the egress gateway, bind it to the BGP interconnection network, and establish a BGP connection between the soft router virtual machine and the switch.

[0057] S200: Users create virtual routers, virtual networks, and virtual machines, and bind virtual machine ports to floating IPs;

[0058] S300: The underlying layer adds policy routes pointing to the soft router virtual machine for the corresponding floating IP in the virtual router's namespace, disables the default route, configures the default route and static route into the low-priority policy route, and publishes the floating IP route to the soft router virtual machine.

[0059] S400: When a virtual machine communicates via a floating IP, traffic is forwarded to the soft router virtual machine through the policy routing table, and then forwarded to the switch in the soft router virtual machine.

[0060] The method in this embodiment forwards the traffic of the virtual machine accessing the external network to a soft router virtual machine, then establishes a BGP connection between the soft router virtual machine and the switch, and publishes routes of floating IPs through the BGP connection.

[0061] BGP is a path vector protocol used between autonomous systems. It can publish routing information within its own autonomous system to the other autonomous system and is an application layer protocol.

[0062] In OpenStack, the Neutron component handles network-related functions, while the Nova component manages the virtual machine's lifecycle. Therefore, an extension for an egress gateway is added to Neutron. This extension interacts with the Nova component to create a soft router virtual machine for the egress gateway. Within this soft router virtual machine, a BGP connection can be established with the switch. When a user binds a floating IP address to a virtual machine, a policy route pointing to that floating IP address is added to the virtual router's namespace. The soft router virtual machine then publishes this route to the switch via BGP.

[0063] As a specific implementation of the method in this embodiment, the following specific operations are included:

[0064] (1) Create a VLAN-type BGP interconnection network bgp-net and add subnets. Establish BGP connections between IP users and switches in bgp-net.

[0065] (2) Create an external network of type VLAN, external-net, and add subnets. The IP address in external-net is used to provide a floating IP address and communicate with the external network.

[0066] (3) Create a VXLAN type internal interconnection network connect-net to connect the software router virtual machine and the virtual router;

[0067] (4) Create two soft router virtual machines for the two egress gateways and add ports for the connect-net and bgp-net networks;

[0068] (5) Add BGP remote IP and remote AS number to the egress gateway virtual machine and establish BGP neighbor;

[0069] (6) Create a virtual router and a virtual tenant network, and bind the virtual tenant network and the interconnect network to the virtual router;

[0070] (7) Create a virtual machine in the tenant network and create a floating IP address, then bind the floating IP address to the tenant virtual machine;

[0071] (8) After receiving the message that the floating IP and virtual machine port are bound, l3-agent creates policy routing table 16 at the bottom layer, modifies the iptables rules of the internal interconnection port of l3-agent, and forwards the traffic from the virtual machine to the soft router virtual machine. Among them, all floating IPs share the policy routing of table 16, and table 16 matches the default route.

[0072] (9) After receiving the message that the floating IP and virtual machine port are bound, out_gateway publishes the route of the floating IP to the switch in the soft router virtual machine and configures the next hop of the return route to the port of the interconnect network connect-net in the namespace of the virtual router.

[0073] The next hop is the IP address of the software router virtual machine. The IP address of the software router virtual machine is a virtual IP address that can be switched between two software router virtual machines. When keepalived detects that the primary software router virtual machine has failed to connect, it switches the IP address of the primary software router virtual machine to the backup software router virtual machine.

[0074] In the specific operation of this embodiment, the creation of the soft router virtual machine in operation (4) needs to be carried out after the cloud platform is deployed and before the user creates the tenant resources. Multiple users' floating IPs can share a soft router virtual machine. At the same time, the two egress gateway soft router virtual machines created need to be specified to two network nodes respectively.

[0075] In operation (5), the two soft router virtual machines need to establish BGP with their respective uplink switches. At the same time, when establishing the BGP connection, BFD (Bidirectional Forwarding Detection) needs to be enabled to reduce the time consumption of BGP master-slave switching.

[0076] In operation (9), after the soft router virtual machine publishes the route of the floating IP to the switch, it needs to find the internal interconnection port on the virtual router through the relationship between the floating IP and the virtual router, and use it as the next-hop address of the return route of the floating IP.

[0077] The method in this embodiment eliminates the need for external network configuration on the switch by creating a soft router virtual machine and establishing BGP between the soft router virtual machine and the switch. The routes of the floating IP are advertised to the switch through BGP.

[0078] This embodiment configures policy routing in the namespace of the virtual router and modifies the original method of adding static routes, transforming the original static routes into policy routes as well. This avoids the problem that static routes, due to their higher priority, will be matched before policy routes, causing traffic to be unable to be forwarded to the software router virtual machine.

[0079] Example 2:

[0080] The present invention provides a system for implementing floating IP access to external networks, comprising a software configuration module, a user configuration module, an underlying configuration module, and a routing and forwarding module. The system can execute the method disclosed in Embodiment 1.

[0081] The software configuration module is used to perform the following: add an extension for the egress gateway in the OpenStack neutron component, create a soft router virtual machine for the egress gateway, bind it to the BGP interconnect network, and establish a BGP connection between the soft router virtual machine and the switch.

[0082] In a specific implementation, the software configuration module is used to perform the following:

[0083] (1) Create a VLAN-type BGP interconnection network bgp-net and add subnets. Establish BGP connections between IP users and switches in bgp-net.

[0084] (2) Create an external network of type VLAN, external-net, and add subnets. The IP address in external-net is used to provide a floating IP address and communicate with the external network.

[0085] (3) Create a VXLAN type internal interconnection network connect-net to connect the software router virtual machine and the virtual router;

[0086] (4) Create two soft router virtual machines for the two egress gateways and add ports for the connect-net and bgp-net networks;

[0087] (5) Add BGP remote IP and remote AS number to the egress gateway virtual machine and establish BGP neighbor.

[0088] In operation (4), the creation of the soft router virtual machine needs to be carried out after the cloud platform is deployed and before the user creates the tenant resources. Multiple users' floating IPs can share a soft router virtual machine. At the same time, the two egress gateway soft router virtual machines created need to be specified to two network nodes respectively.

[0089] In operation (5), the two soft router virtual machines need to establish BGP with their respective uplink switches. At the same time, when establishing the BGP connection, BFD (Bidirectional Forwarding Detection) needs to be enabled to reduce the time consumption of BGP master-slave switching.

[0090] The user configuration module is used to create virtual routers, virtual networks, and virtual machines, and to bind virtual machine ports to floating IPs.

[0091] The underlying configuration module is used to add policy routes pointing to the soft router virtual machine for the corresponding floating IP in the namespace of the virtual router, disable the default route, configure the default route and static route to the low-priority policy route, and publish the route of the floating IP to the soft router virtual machine.

[0092] In a specific implementation, the underlying configuration module is used to execute the following:

[0093] (1) After receiving the message that the floating IP and the virtual machine port are bound, l3-agent creates policy routing table 16, modifies the iptables rules of the internal interconnection port of l3-agent, and forwards the traffic from the virtual machine to the soft router virtual machine. Among them, all floating IPs share the policy routing of table 16, and table 16 matches the default route.

[0094] (2) After receiving the message that the floating IP and virtual machine port are bound, out_gateway publishes the route of the floating IP to the switch in the soft router virtual machine and configures the next hop of the return route to the port of the interconnect network connect-net in the namespace of the virtual router.

[0095] The next hop is the IP address of the software router virtual machine. The IP address of the software router virtual machine is a virtual IP address that can be switched between two software router virtual machines. When keepalived detects that the primary software router virtual machine has failed to connect, it switches the IP address of the primary software router virtual machine to the backup software router virtual machine.

[0096] After the software router virtual machine publishes the floating IP route to the switch, the underlying configuration module is used to find the internal interconnect port on the virtual router through the relationship between the floating IP and the virtual router, and use it as the next-hop address for the floating IP return route.

[0097] The routing and forwarding module is used to perform the following: when a virtual machine communicates via a floating IP, the traffic is forwarded to the soft router virtual machine through the policy routing table, and then forwarded to the switch in the soft router virtual machine.

[0098] The system in this embodiment forwards the traffic of the virtual machine to the external network to a soft router virtual machine, then establishes a BGP connection between the soft router virtual machine and the switch, and publishes routes of floating IP through the BGP connection.

[0099] The present invention has been shown and described in detail above with reference to the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above embodiments, those skilled in the art will know that more embodiments of the present invention can be obtained by combining the means in the different embodiments described above, and these embodiments are also within the protection scope of the present invention.

Claims

1. A method for accessing an external network using a floating IP address, characterized in that, Includes the following steps: S100. Add an extension to the egress gateway in the OpenStack neutron component, create a soft router virtual machine for the egress gateway, bind it to the BGP interconnection network, and establish a BGP connection between the soft router virtual machine and the switch. S200: Users create virtual routers, virtual networks, and virtual machines, and bind virtual machine ports to floating IPs; S300: The underlying layer adds policy routes pointing to the soft router virtual machine for the corresponding floating IP in the virtual router's namespace, disables the default route, configures the default route and static route into the low-priority policy route, and publishes the floating IP route to the soft router virtual machine. S400: When a virtual machine communicates via a floating IP, the traffic is forwarded to the soft router virtual machine through the policy routing table, and then forwarded to the switch in the soft router virtual machine. Step S300 includes the following operations: After receiving the message that the floating IP and virtual machine port are bound, l3-agent creates policy routing table 16 at the underlying level, modifies the iptables rules of the internal interconnection port of l3-agent, and forwards the traffic from the virtual machine to the software router virtual machine. Among them, all floating IPs share the policy routing in table 16, and table 16 matches the default route. After receiving the message that the floating IP address is bound to the virtual machine port, out_gateway publishes the route of the floating IP address to the switch in the soft router virtual machine and configures the next hop of the return route to the port of the Internet-net in the namespace of the virtual router. The next hop is the IP address of the software router virtual machine. The IP address of the software router virtual machine is a virtual IP address that can be switched between two software router virtual machines. When keepalived detects that the primary software router virtual machine has failed to connect, it switches the IP address of the primary software router virtual machine to the backup software router virtual machine.

2. The method for accessing an external network using a floating IP address according to claim 1, characterized in that, Step S100 includes the following operations: Create a VLAN-type BGP interconnection network bgp-net, add subnets, and establish BGP connections between IP users and switches in bgp-net; Create an external network of type VLAN, external-net, and add subnets. The IP address in external-net is used to provide a floating IP address and communicate with the external network. Create a VXLAN type internal interconnect network connect-net to connect the software router virtual machine and the virtual router; Create two virtual software routers for the outbound gateways and add ports for the connect-net and bgp-net networks; Add BGP remote IP and remote AS number to the software router virtual machines of the two outbound gateways to establish BGP neighbors.

3. The method for accessing an external network using a floating IP address according to claim 2, characterized in that, After the OpenStack cloud platform is deployed and before the user creates tenant resources, create two soft router virtual machines for the egress gateway; Multiple users' floating IPs can share a single software router virtual machine; Two software router virtual machines establish BGP connections with their respective uplink switches, and enable bidirectional forwarding detection when establishing BGP connections.

4. The method for accessing an external network using a floating IP address according to claim 2, characterized in that, After the software router virtual machine advertises the floating IP route to the switch, it uses the relationship between the floating IP and the virtual router to find the internal interconnect port on the virtual router, which is then used as the next-hop address for the floating IP return route.

5. A system for implementing floating IP access to external networks, characterized in that, The system includes: The software configuration module is used to perform the following: add an extension to the egress gateway in the OpenStack neutron component, create a soft router virtual machine for the egress gateway and bind it to the BGP interconnection network, and establish a BGP connection between the soft router virtual machine and the switch. The user configuration module is used to create virtual routers, virtual networks, and virtual machines, and to bind virtual machine ports to floating IPs. The underlying configuration module is used to add policy routes pointing to the soft router virtual machine for the corresponding floating IP in the namespace of the virtual router, disable the default route, configure the default route and static route to the low-priority policy route, and publish the route of the floating IP to the soft router virtual machine. The routing forwarding module is used to perform the following: when the virtual machine communicates via a floating IP, the traffic is forwarded to the soft router virtual machine through the policy routing table, and then forwarded to the switch in the soft router virtual machine; The underlying configuration module is used to perform the following: After receiving the message that the floating IP and virtual machine port are bound, l3-agent creates policy routing table 16, modifies the iptables rules of the internal interconnect port of l3-agent, and forwards the traffic from the virtual machine to the soft router virtual machine. Among them, all floating IPs share the policy routing in table 16, and table 16 matches the default route. After receiving the message that the floating IP address is bound to the virtual machine port, out_gateway publishes the route of the floating IP address to the switch in the soft router virtual machine and configures the next hop of the return route to the port of the Internet-net in the namespace of the virtual router. The next hop is the IP address of the software router virtual machine. The IP address of the software router virtual machine is a virtual IP address that can be switched between two software router virtual machines. When keepalived detects that the primary software router virtual machine has failed to connect, it switches the IP address of the primary software router virtual machine to the backup software router virtual machine.

6. The system for implementing floating IP access to external networks according to claim 5, characterized in that, The software configuration module is used to perform the following: Create a VLAN-type BGP interconnection network bgp-net, add subnets, and establish BGP connections between IP users and switches in bgp-net; Create an external network of type VLAN, external-net, and add subnets. The IP address in external-net is used to provide a floating IP address and communicate with the external network. Create a VXLAN type internal interconnect network connect-net to connect the software router virtual machine and the virtual router; Create two virtual software routers for the outbound gateways and add ports for the connect-net and bgp-net networks; Add BGP remote IP and remote AS number to the software router virtual machines of the two outbound gateways to establish BGP neighbors.

7. The system for implementing floating IP access to external networks according to claim 6, characterized in that, After the OpenStack cloud platform is deployed and before the user creates tenant resources, the software configuration module is used to create two soft router virtual machines for the egress gateways. Multiple users' floating IPs can share a single software router virtual machine; Two software router virtual machines establish BGP connections with their respective uplink switches, and enable bidirectional forwarding detection when establishing BGP connections.

8. The system for implementing floating IP access to external networks according to claim 6, characterized in that, After the soft router virtual machine publishes the route of the floating IP to the switch, the underlying configuration module is used to find the internal interconnect port on the virtual router through the relationship between the floating IP and the virtual router, and use it as the next-hop address of the floating IP backhaul route.

Images