XUEGAONET v1.x混合云网络架构详解

{
    "iptables": false,
    "bridge": "none"
}

[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
BindsTo=containerd.service
After=network-online.target firewalld.service
Wants=network-online.target
Requires=docker.socket

[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd -g /data/docker -H fd://
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always

# Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.
# Both the old, and new location are accepted by systemd 229 and up, so using the old location
# to make them work for either version of systemd.
StartLimitBurst=3

# Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.
# Both the old, and new name are accepted by systemd 230 and up, so using the old name to make
# this option work for either version of systemd.
StartLimitInterval=60s

# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity

# Comment TasksMax if your systemd version does not supports it.
# Only systemd 226 and above support this option.
TasksMax=infinity

# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes

# kill only the docker process, not all processes in the cgroup
KillMode=process

[Install]
WantedBy=multi-user.target

vyos@T1:~$ show configuration commands 
set firewall all-ping 'enable'
set firewall broadcast-ping 'disable'
set firewall config-trap 'disable'
set firewall ipv6-receive-redirects 'disable'
set firewall ipv6-src-route 'disable'
set firewall ip-src-route 'disable'
set firewall log-martians 'enable'
set firewall name Test default-action 'drop'
set firewall receive-redirects 'disable'
set firewall send-redirects 'enable'
set firewall source-validation 'disable'
set firewall syn-cookies 'enable'
set firewall twa-hazards-protection 'disable'
set interfaces bridge br0 address '8.8.4.4/32'
set interfaces ethernet eth0 address '100.1.1.1/30'
set interfaces ethernet eth0 hw-id '00:0c:29:1b:68:dc'
set interfaces loopback lo address '1.1.1.1/32'
set interfaces wireguard wg0 address '10.1.1.1/30'
set interfaces wireguard wg0 description 'T2'
set interfaces wireguard wg0 peer T2 allowed-ips '0.0.0.0/0'
set interfaces wireguard wg0 peer T2 pubkey 'bLvNfwEmtDrMdNy3Inwv7U+W3QMgu0iXouoJqPCHGzo='
set interfaces wireguard wg0 port '1111'
set interfaces wireguard wg0 private-key 'T1'
set protocols bgp 65503 address-family ipv4-unicast network 8.8.4.4/32
set protocols bgp 65503 neighbor 2.1.1.1 ebgp-multihop '5'
set protocols bgp 65503 neighbor 2.1.1.1 remote-as '65502'
set protocols bgp 65503 neighbor 2.1.1.1 update-source 'lo'
set protocols bgp 65503 parameters router-id '1.1.1.1'
set protocols static route 2.1.1.1/32 next-hop 10.1.1.2 next-hop-interface 'wg0'
set system config-management commit-revisions '100'
set system console device ttyS0 speed '115200'
set system host-name 'T1'
set system login user vyos authentication encrypted-password '密码我还是脱敏下吧'
set system login user vyos authentication plaintext-password ''
set system ntp server 0.pool.ntp.org
set system ntp server 1.pool.ntp.org
set system ntp server 2.pool.ntp.org
set system syslog global facility all level 'info'
set system syslog global facility protocols level 'debug'

vyos@T2:~$ show configuration commands 
set firewall
set interfaces bridge br0 address '8.8.8.8/32'
set interfaces ethernet eth0 address '100.1.1.2/30'
set interfaces ethernet eth0 hw-id '00:0c:29:38:b6:90'
set interfaces loopback lo address '2.1.1.1/32'
set interfaces wireguard wg0 address '10.1.1.2/30'
set interfaces wireguard wg0 peer T1 address '100.1.1.1'
set interfaces wireguard wg0 peer T1 allowed-ips '0.0.0.0/0'
set interfaces wireguard wg0 peer T1 persistent-keepalive '10'
set interfaces wireguard wg0 peer T1 port '1111'
set interfaces wireguard wg0 peer T1 pubkey '9mfj6golC2iy3Hv/+TEOGH3vwrRS4LKAbBBPij0gyDg='
set interfaces wireguard wg0 private-key 'T2'
set protocols bgp 65502 address-family ipv4-unicast network 8.8.8.8/32
set protocols bgp 65502 neighbor 1.1.1.1 ebgp-multihop '5'
set protocols bgp 65502 neighbor 1.1.1.1 remote-as '65503'
set protocols bgp 65502 neighbor 1.1.1.1 update-source 'lo'
set protocols bgp 65502 parameters router-id '2.1.1.1'
set protocols static route 1.1.1.1/32 next-hop 10.1.1.1 next-hop-interface 'wg0'
set service
set system config-management commit-revisions '100'
set system console device ttyS0 speed '115200'
set system host-name 'T2'
set system login user vyos authentication encrypted-password '密码我还是脱敏下吧'
set system login user vyos authentication plaintext-password ''
set system ntp server 0.pool.ntp.org
set system ntp server 1.pool.ntp.org
set system ntp server 2.pool.ntp.org
set system syslog global facility all level 'info'
set system syslog global facility protocols level 'debug'

#!/bin/bash
# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES
#
# It is highly advisable to create own systemd services or udev rules
# to run scripts during boot instead of using this file.
#
# In contrast to previous versions due to parallel execution during boot
# this script will NOT be run after all other services.
#
# Please note that you must run 'chmod +x /etc/rc.d/rc.local' to ensure
# that this script will be executed during boot.

ifconfig lo:10 1.1.1.1/32

touch /var/lock/subsys/local

# sysctl settings are defined through files in
# /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.
#
# Vendors settings live in /usr/lib/sysctl.d/.
# To override a whole file, create a new file with the same in
# /etc/sysctl.d/ and put new settings there. To override
# only specific settings, add a file with a lexically later
# name in /etc/sysctl.d/ and put new settings there.
#
# For more information, see sysctl.conf(5) and sysctl.d(5).
#
net.ipv4.ip_forward=1
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr

wget https://ci1.netdef.org/artifact/LIBYANG-YANGRELEASE/shared/build-10/CentOS-7-x86_64-Packages/libyang-0.16.111-0.x86_64.rpm
wget https://ci1.netdef.org/artifact/LIBYANG-YANGRELEASE/shared/build-10/CentOS-7-x86_64-Packages/libyang-devel-0.16.111-0.x86_64.rpm
yum install ./liby*
yum install git autoconf automake libtool make patch readline-devel texinfo net-snmp-devel groff pkgconfig   json-c-devel pam-devel bison flex pytest c-ares-devel   python-devel systemd-devel python-sphinx libcap-devel
groupadd -g 92 frr
groupadd -r -g 85 frrvty
useradd -u 92 -g 92 -M -r -G frrvty -s /sbin/nologin   -c "FRR FRRouting suite" -d /var/run/frr frr
wget https://github.com/FRRouting/frr/archive/frr-7.2.tar.gz
tar xvf frr-7.2.tar.gz
cd frr-frr-7.2/
./bootstrap.sh
./configure     --bindir=/usr/bin     --sbindir=/usr/lib/frr     --sysconfdir=/etc/frr     --libdir=/usr/lib/frr     --libexecdir=/usr/lib/frr     --localstatedir=/var/run/frr     --with-moduledir=/usr/lib/frr/modules     --enable-snmp=agentx     --enable-multipath=64     --enable-user=frr     --enable-group=frr     --enable-vty-group=frrvty     --enable-systemd=yes     --disable-exampledir     --disable-ldpd     --enable-fpm      --with-pkg-extra-version=-XUEGAONET     SPHINXBUILD=/usr/bin/sphinx-build
make
make check
make install
mkdir /etc/frr
touch /etc/frr/zebra.conf
touch /etc/frr/bgpd.conf
touch /etc/frr/ospfd.conf
touch /etc/frr/ospf6d.conf
touch /etc/frr/isisd.conf
touch /etc/frr/ripd.conf
touch /etc/frr/ripngd.conf
touch /etc/frr/pimd.conf
touch /etc/frr/nhrpd.conf
touch /etc/frr/eigrpd.conf
touch /etc/frr/babeld.conf
chown -R frr:frr /etc/frr/
touch /etc/frr/vtysh.conf
chown frr:frrvty /etc/frr/vtysh.conf
chmod 640 /etc/frr/*.conf
install -p -m 644 tools/etc/frr/daemons /etc/frr/
install -p -m 644 tools/frr.service /usr/lib/systemd/system/frr.service
chown frr:frr /etc/frr/daemons
systemctl daemon-reload
systemctl status frr
systemctl preset frr.service
systemctl enable frr

#!/bin/bash

ip link add dev CORE type vrf table 200
ip link set dev ens224 master CORE
ip link set dev wg0 master CORE

ifconfig CORE up

net.ipv4.tcp_l3mdev_accept=1
net.ipv4.udp_l3mdev_accept=1
net.ipv4.ip_forward=1

wget https://github.com/WireGuard/wireguard-tools/archive/v1.0.20200513.tar.gz
tar xvf v1.0.20200513.tar.gz
cd wireguard-tools-1.0.20200513/src
make
make install

wg genkey > private.key
chmod 077 private.key
wg pubkey < private.key > public.key

cat >> /etc/wireguard/wg0.conf << EOF
[Interface]
PrivateKey = [私钥]
ListenPort = [端口号]
MTU = 1412
Table = off  # 不要让wg-quick自作主张添加规则

[Peer]
PublicKey = [公钥]
AllowedIPs = 0.0.0.0/0
EOF

systemctl enable wg-quick@wg0

[Unit]
Description=XGN Interface
After=wg-quick@wg0.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/data/interface.sh

[Install]
WantedBy=multi-user.target

ip link add vxlan1000 type vxlan id 1000 local x.x.x.x remote x.x.x.x dstport 4789 
ifconfig vxlan1000 hw ether aa:bb:cc:dd:ee:ff mtu 1500 up
ip link set dev vxlan1000 master CORE

ifconfig eth1 hw ether xx:xx:xx:xx:xx:xx

ip route del default
ip route add default via x.x.x.x

docker network create -d macvlan --subnet=x.x.x.x/x --gateway x.x.x.x -o parent=vxlan100 network-name

docker network connect --ip x.x.x.x network-name container-name

docker run -it -d -e container=docker --dns="x.x.x.x" --privileged --memory="512m" --memory-swap="768m" --tmpfs /run --tmpfs /tmp -v /sys/fs/cgroup:/sys/fs/cgroup:ro --network network-name --ip x.x.x.x  --stop-signal SIGRTMIN+3  --restart always --sysctl net.ipv4.ip_forward=1 --name container-name image-name