LinuxCon 2015 Stateful NAT with OVS
5 likes•4,195 views
The document discusses Open vSwitch, its stateful NAT options, and connection tracking capabilities, particularly focusing on the integration with the Linux conntrack module. It outlines the functionalities of Open vSwitch, its use in managing overlay networks, and the implementation of a distributed firewall for enhanced performance and visibility. Additionally, it hints at future developments including native stateful NAT and customizable NAT through eBPF.
LinuxCon 2015 Stateful NAT with OVS
- 1. Stateful NAT with Open vSwitch LinuxCon 2015, Seattle Thomas Graf Kernel & Open vSwitch Team Noiro Networks (Cisco)
- 2. Agenda ● What is Open vSwitch ● Stateful NAT options for Open vSwitch ● Demo ● Q&A
- 4. ● Highly scaleable multi layer virtual switch for hypervisors – Apache License (User Space), GPL (Kernel) ● Extensive flow table programming capabilities – OpenFlow 1.0 – 1.5 (some partial) – Vendor extensions ● Designed to manage overlay networks – VXLAN (+ extensions), GRE, Geneve, LISP, STT, VLAN, ... ● Remote management protocol (OVSDB) ● Monitoring capabilities Open vSwitch in a Nutshell
- 5. NAT Dependency: Connection Tracking ● We are adding the ability to use the conntrack module from Linux – Stateful tracking of flows – Supports ALGs to punch holes for related “data” channels ● FTP, TFTP, SIP ● Implement a distributed firewall with enforcement at the edge – Better performance – Better visibility ● Introduce new OpenFlow extensions: – Action to send to conntrack – Match fields on state of connection ● Have prototype working. Expect to ship as part of OVS in next release.
- 6. Netfilter Conntrack Integration OVS Flow Table Netfilter Connection Tracker CT Table Userspace Netlink API Create & Update CT entries Connection State (conn_state=) conntrack() Recirculation 1 2 3 4
- 7. Zone 1 Connection Tracking Zones OVS Flow Table CT Table Zone 2 CT Table Netfilter Connection Tracker
- 8. ● Route packets through separate NAT network namespace ● Utilize Netfilter chains to perform NAT ● Pro: Working now ● Con: Requires linear Netfilter chain traversal NAT with Open vSwitch The Now ● Native OpenFlow NAT action ● Pro: Fast, clean & available to orchestration tools ● Con: Tricky to get right The Future
- 9. Possible Future 1: Native stateful NAT OVS Flow Table Netfilter Connection Tracker CT Table Create & Update CT entries conntrack() Recirculation 1 2 3 4 Netfilter NAT nat()
- 10. Possible Future 2: Customizable NAT through eBPF OVS Flow Table Netfilter Connection Tracker CT Table Create & Update CT entries conntrack() Recirculation 1 2 3 4 BPF prog performing NAT bpf()
- 11. What is available now: NAT with Netfilter OVS Flow Table Netfilter Connection Tracker CT Table Create & Update CT entries conntrack() Final L2/L3 decision 1 2 3 Namespace w/ -j SNAT / -j DNAT output() to internal port 5 4 Routing: ip rule add iif nat-gw lookup 100 ip route add 1.1.1.1/32 dev nat-gw ip route add default via 1.1.1.1 table 100
- 12. Demo
- 13. Q&A Contact: ● E-Mail: [email protected] ● Twitter: @tgraf__