{"id":72,"date":"2026-11-01T12:00:32","date_gmt":"2026-11-01T20:00:32","guid":{"rendered":"\/?p=72"},"modified":"2026-11-01T12:00:32","modified_gmt":"2026-11-01T20:00:32","slug":"post-mvxay2yk","status":"publish","type":"post","link":"https:\/\/www.woiov.cn\/?p=72","title":{"rendered":"\u591a\u79df\u6237\u5bb9\u5668\u7f51\u7edc\u7684\u56db\u6b21\u8fd4\u5de5\uff1an\u00b2 \u6761\u89c4\u5219\u3001SDN\u3001\u548c\u4e00\u4e2a\u6ca1\u89e3\u5f00\u7684 vlan \u7f51\u5173"},"content":{"rendered":"<p>\u7ed9\u6bcf\u4e2a\u5ba2\u6237\u5f00\u4e00\u4e2a\u5bb9\u5668\uff0c\u6700\u96be\u7684\u4ece\u6765\u4e0d\u662f\u5f00\u5bb9\u5668\uff0c\u662f\u8ba9\u4ed6\u4eec\u5f7c\u6b64\u770b\u4e0d\u89c1\u3002<\/p>\n<p>\u8fd9\u4e00\u8f6e\u6211\u4eec\u4e3a\u591a\u79df\u6237\u5bb9\u5668\u505a\u4e86\u56db\u6b21\u65b9\u6848\u8fd4\u5de5\uff0c\u628a\u8fc7\u7a0b\u8bb0\u4e0b\u6765\u2014\u2014\u8e29\u8fc7\u7684\u5751\u6bd4\u7ed3\u8bba\u6709\u7528\u3002<\/p>\n<h3>\u7b2c\u4e00\u6b21\uff1a\u5168\u6302\u5728\u540c\u4e00\u4e2a\u7f51\u6865\u4e0a<\/h3>\n<p>\u6700\u5f00\u59cb\u56fe\u7701\u4e8b\uff0c\u6240\u6709\u5ba2\u6237\u5bb9\u5668\u90fd\u63a5\u5728\u5bbf\u4e3b\u7684\u4e3b\u7f51\u6865\u4e0a\uff0c\u8ddf\u8282\u70b9\u81ea\u5df1\u540c\u4e00\u4e2a\u4e8c\u5c42\u5e7f\u64ad\u57df\u3002<\/p>\n<p>\u540e\u679c\u5f88\u76f4\u63a5\uff1a\u5ba2\u6237 A \u7684\u5bb9\u5668\u80fd\u626b\u5230\u5ba2\u6237 B \u7684\u7aef\u53e3\uff0c\u8fd8\u80fd\u626b\u5230\u5bbf\u4e3b\u7684 SSH\u3002\u8fd9\u5728\u6258\u7ba1\u4e1a\u52a1\u91cc\u4e0d\u662f\u6027\u80fd\u95ee\u9898\uff0c\u662f\u4e8b\u6545\u7ea7\u7684\u5b89\u5168\u95ee\u9898\u3002<\/p>\n<h3>\u7b2c\u4e8c\u6b21\uff1a\u6bcf\u5ba2\u6237\u4e00\u4e2a\u88f8\u7f51\u6865<\/h3>\n<p>\u65b9\u6848\u662f\u7ed9\u6bcf\u4e2a\u5ba2\u6237\u5efa\u4e00\u4e2a\u72ec\u7acb\u7f51\u6865\uff0c\u4e0d\u63a5\u4efb\u4f55\u7269\u7406\u53e3\uff0c\u914d\u81ea\u5df1\u7684\u7f51\u6bb5\u548c\u7f51\u5173\u5730\u5740\uff0c\u518d\u6302\u4e00\u5c0f\u7ec4 iptables \u89c4\u5219\u505a\u53cc\u5411\u9694\u79bb\u3002<\/p>\n<p>\u6838\u5fc3\u51e0\u6761\uff1a<\/p>\n<pre class=\"wp-block-code\"><code>\n# \u5efa\u72ec\u7acb\u7f51\u6865\uff0c\u4e0d\u63a5\u7269\u7406\u53e3\nip link add vmbrN type bridge\nip link set vmbrN up\nip addr add 10.NN.0.1\/24 dev vmbrN\n\n# \u51fa\u7f51\uff1a\u53ea\u653e\u884c\u300c\u51fa\u53bb\u300d\u548c\u300c\u56de\u7a0b\u300d\niptables -t nat -A POSTROUTING -s 10.NN.0.0\/24 -o vmbr0 -j MASQUERADE\niptables -A FORWARD -i vmbrN -o vmbr0 -j ACCEPT\niptables -A FORWARD -i vmbr0 -o vmbrN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\n\n# \u540c\u7ec4\u4e92\u901a\uff0c\u8de8\u7ec4\u4e00\u5f8b\u4e22\u5f03\niptables -A FORWARD -i vmbrN -o vmbrM -j DROP\n<\/code><\/pre>\n<p>\u5b9e\u6d4b\u4e0b\u6765\u4e94\u6761\u90fd\u5bf9\uff1a\u540c\u7ec4\u5bb9\u5668\u4e92\u901a\u3001\u8de8\u7ec4\u4e0d\u901a\u3001\u8bbf\u95ee\u5bbf\u4e3b\u4e0d\u901a\u3001\u8bbf\u95ee\u540c\u7f51\u6bb5\u7684\u522b\u5bb6\u5bb9\u5668\u4e0d\u901a\u3001\u516c\u7f51\u6b63\u5e38\u3002<\/p>\n<p>\u4f46\u8d26\u5355\u5728\u540e\u5934\u3002\u4e0a\u9762\u90a3\u6761\u300c\u8de8\u7ec4\u4e22\u5f03\u300d\u6211\u5199\u6210\u4e86\u53cc\u5c42\u5faa\u73af\u2014\u2014\u6bcf\u4e24\u4e2a\u7f51\u6865\u4e4b\u95f4\u914d\u4e00\u6761\u89c4\u5219\uff0cn \u4e2a\u5ba2\u6237\u5c31\u662f n\u00b2 \u6761\uff1a<\/p>\n<pre class=\"wp-block-code\"><code>\nfor i in $(seq 1 $N); do\n  for j in $(seq 1 $N); do\n    [ \"$i\" = \"$j\" ] &amp;&amp; continue\n    iptables -A LU-FWD -i vmbr$i -o vmbr$j -j DROP\n  done\ndone\n<\/code><\/pre>\n<p>\u7b97\u4e00\u4e0b\u89c4\u6a21\u5c31\u660e\u767d\u95ee\u9898\u5728\u54ea\uff1a<\/p>\n<figure class=\"wp-block-table\">\n<table>\n<thead>\n<tr>\n<th>\u5ba2\u6237\u6570<\/th>\n<th>DROP \u89c4\u5219\u6570<\/th>\n<th>\u8f6c\u53d1\u8def\u5f84\u8981\u8fc7\u7684\u89c4\u5219<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>10<\/td>\n<td>90<\/td>\n<td>\u53ef\u5ffd\u7565<\/td>\n<\/tr>\n<tr>\n<td>20<\/td>\n<td>380<\/td>\n<td>\u5f00\u59cb\u6709\u611f<\/td>\n<\/tr>\n<tr>\n<td>50<\/td>\n<td>2450<\/td>\n<td>\u6bcf\u4e2a\u5305\u987a\u7740\u8d70\u4e00\u904d<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<p>iptables \u662f\u7ebf\u6027\u5339\u914d\u3002\u8fd9\u4e0d\u662f\u300c\u4ee5\u540e\u4f18\u5316\u300d\u7684\u95ee\u9898\uff0c\u8fd9\u662f\u89c4\u6a21\u5929\u82b1\u677f\u3002<\/p>\n<h3>\u7b2c\u4e09\u6b21\uff1a\u4e0a PVE \u539f\u751f SDN<\/h3>\n<p>\u65e2\u7136\u5bbf\u4e3b\u662f PVE\uff0c\u7b2c\u4e00\u53cd\u5e94\u662f\u2014\u2014\u8ba9\u5bbf\u4e3b\u81ea\u5df1\u7ba1\u3002PVE \u4ece 6.x \u8d77\u5c31\u5e26 SDN\uff0c\u80fd\u5b9a\u4e49 zone \u548c vnet\u3002<\/p>\n<p>\u5148\u8bd5 simple zone\uff0c\u76f4\u63a5\u62a5\u9519\uff1a<\/p>\n<pre class=\"wp-block-code\"><code>\nunexpected property 'bridge'\n<\/code><\/pre>\n<p>\u7ffb\u6e90\u7801\u624d\u660e\u767d\uff0csimple zone \u7684\u5c5e\u6027\u53ea\u6709 <code>dns<\/code> \/ <code>reversedns<\/code> \/ <code>dnszone<\/code> \/ <code>dhcp<\/code> \u56db\u4e2a\uff0c\u538b\u6839\u4e0d\u5403 bridge \u53c2\u6570\u3002\u5b83\u7684\u5b9a\u4f4d\u662f\u300c\u6bcf\u4e2a vnet \u4e00\u4e2a\u88f8\u7f51\u6865\uff0c\u4e0d\u505a VLAN\u300d\u2014\u2014\u672c\u8d28\u4e0a\u5c31\u662f\u7b2c\u4e8c\u6b21\u90a3\u5957\u65b9\u6848\uff0c\u53ea\u662f\u6362\u6210 PVE \u6765\u7ba1\u3002<\/p>\n<p>\u5b83\u540c\u6837\u4e0d\u914d\u7f51\u5173 IP\uff0c\u540c\u6837\u4e0d\u505a NAT\u3002<\/p>\n<p>\u771f\u6b63\u80fd\u7701\u89c4\u5219\u7684\u662f vlan zone\uff1a\u53ea\u7528\u4e00\u4e2a\u7269\u7406\u7f51\u6865\uff0c\u6bcf\u4e2a\u5ba2\u6237\u6253\u4e00\u4e2a VLAN tag\uff0c\u9694\u79bb\u4ea4\u7ed9\u7f51\u6865\u7684 vlan filter \u5b8c\u6210\u3002\u8fd9\u6761\u8def\u4e0a\u89c4\u5219\u6570\u662f O(n)\uff0c\u4e0d\u662f n\u00b2\u3002<\/p>\n<h3>\u7b2c\u56db\u6b21\uff1a\u5f00 vlan-aware\uff0c\u7136\u540e\u5361\u5728\u6700\u540e\u4e00\u6b65<\/h3>\n<p>vlan zone \u8981\u6c42\u5e95\u5c42\u7f51\u6865\u652f\u6301 VLAN \u8fc7\u6ee4\uff0c\u5f97\u5148\u7ed9\u4e3b\u7f51\u6865\u52a0\u4e00\u884c\uff1a<\/p>\n<pre class=\"wp-block-code\"><code>\niface vmbr0 inet static\n\taddress 192.168.2.6\/24\n\tgateway 192.168.2.1\n\tbridge-ports nic1\n\tbridge-stp off\n\tbridge-fd 0\n\tbridge-vlan-aware yes\n<\/code><\/pre>\n<p>\u7136\u540e <code>ifreload -a<\/code>\u3002\u8fd9\u4e00\u6b65\u6709\u65ad\u7f51\u98ce\u9669\u2014\u2014\u7f51\u6865\u8981\u91cd\u5efa\u3002\u5b9e\u6d4b\u7ed3\u679c\u8fd8\u7b97\u6e29\u548c\uff1a\u91cd\u8f7d\u5b8c <code>bridge\/vlan_filtering<\/code> \u8bfb\u5230 <code>1<\/code>\uff0c\u8282\u70b9\u7f51\u7edc\u6b63\u5e38\uff0c\u8dd1\u5728\u4e0a\u9762\u7684\u5bb9\u5668\u6ca1\u6709\u6389\u7ebf\u3002<\/p>\n<p>\u63a5\u7740\u5efa zone \u548c\u4e24\u4e2a vnet\uff1a<\/p>\n<pre class=\"wp-block-code\"><code>\npvesh create \/cluster\/sdn\/zones --zone lu --type vlan --bridge vmbr0\npvesh create \/cluster\/sdn\/vnets --vnet lu0101 --zone lu --tag 101\npvesh create \/cluster\/sdn\/vnets --vnet lu0102 --zone lu --tag 102\npvesh set \/cluster\/sdn\n<\/code><\/pre>\n<p>PVE \u81ea\u52a8\u751f\u6210\u914d\u7f6e\uff0c\u843d\u76d8\u957f\u8fd9\u6837\uff1a<\/p>\n<pre class=\"wp-block-code\"><code>\nauto lu0101\niface lu0101\n\tbridge_ports vmbr0.101\n\tbridge_stp off\n\tbridge_fd 0\n<\/code><\/pre>\n<p>\u5230\u8fd9\u4e00\u6b65\uff0c\u5bb9\u5668\u52a0 <code>bridge=lu0101<\/code> \u5c31\u80fd\u6302\u4e0a\uff0c\u9694\u79bb\u7531 VLAN \u5b8c\u6210\uff0c\u89c4\u5219\u6570\u964d\u5230 O(n)\u3002<\/p>\n<p>\u7136\u540e\u5361\u5728\u6700\u540e\u4e00\u6b65\uff1a\u7ed9 <code>vmbr0.101<\/code> \u914d\u7f51\u5173\u5730\u5740\u3002<\/p>\n<p><code>ifup vmbr0.101<\/code> \u4e0d\u62a5\u9519\u3001\u4e0d\u8f93\u51fa\u3001\u4e5f\u4e0d\u914d\u3002ifdown \u518d\u6765\u4e00\u904d\uff0c\u4e00\u6837\u3002\u539f\u56e0\u4e0d\u96be\u731c\u2014\u2014ifupdown2 \u8ba4\u4e3a\u8fd9\u4e2a\u8bbe\u5907\u5df2\u7ecf\u7531 SDN \u521b\u5efa\u3001\u5e76\u4e14\u4f5c\u4e3a <code>lu0101<\/code> \u7684 port \u5b58\u5728\uff0c\u4e8e\u662f\u8df3\u8fc7 inet \u6bb5\u3002<\/p>\n<p>\u8bd5\u8fc7\u8d70 SDN \u7684 subnet \u63a5\u53e3\uff1a<\/p>\n<pre class=\"wp-block-code\"><code>\npvesh create \/cluster\/sdn\/vnets\/lu0101\/subnets \\\n  --subnet 10.10.0.0\/24 --type subnet --gateway 10.10.0.1\n<\/code><\/pre>\n<p>\u5b83\u53ea\u662f\u5199\u8fdb IPAM \u8bb0\u5f55\uff0c\u4e0d\u4f1a\u78b0\u5bbf\u4e3b\u63a5\u53e3\u3002<\/p>\n<h3>\u56db\u79cd\u65b9\u6848\u653e\u4e00\u8d77<\/h3>\n<figure class=\"wp-block-table\">\n<table>\n<thead>\n<tr>\n<th>\u65b9\u6848<\/th>\n<th>\u89c4\u5219\u590d\u6742\u5ea6<\/th>\n<th>\u9694\u79bb\u5f3a\u5ea6<\/th>\n<th>\u7f51\u5173 IP<\/th>\n<th>NAT \u51fa\u7f51<\/th>\n<th>\u5224\u65ad<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u5168\u5728\u4e00\u4e2a\u7f51\u6865<\/td>\n<td>\u65e0<\/td>\n<td>\u65e0<\/td>\n<td>\u73b0\u6210<\/td>\n<td>\u73b0\u6210<\/td>\n<td>\u5426\u51b3\uff0c\u5b89\u5168\u4e0d\u5408\u683c<\/td>\n<\/tr>\n<tr>\n<td>\u6bcf\u5ba2\u6237\u88f8\u7f51\u6865<\/td>\n<td>n\u00b2<\/td>\n<td>\u5f3a<\/td>\n<td>\u624b\u914d<\/td>\n<td>\u624b\u914d<\/td>\n<td>\u53ef\u8dd1\uff0c20 \u6237\u4ee5\u5185<\/td>\n<\/tr>\n<tr>\n<td>SDN simple zone<\/td>\n<td>n\u00b2<\/td>\n<td>\u5f3a<\/td>\n<td>\u624b\u914d\uff08\u5f85\u9a8c\uff09<\/td>\n<td>\u624b\u914d<\/td>\n<td>\u53ea\u662f\u6362\u4e86\u4e2a\u7ba1\u5bb6<\/td>\n<\/tr>\n<tr>\n<td>SDN vlan zone<\/td>\n<td>n<\/td>\n<td>\u5f3a<\/td>\n<td>\u5361\u4f4f<\/td>\n<td>\u624b\u914d<\/td>\n<td>\u5f85\u89e3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<h3>\u4e24\u4e2a\u7ed3\u8bba<\/h3>\n<p><strong>\u4e00\uff0cSDN \u53ea\u7ba1\u62d3\u6251\u548c\u9694\u79bb\uff0c\u4e0d\u7ba1\u7f51\u5173 IP \u548c NAT\u3002<\/strong><\/p>\n<p>\u8fd9\u4e24\u4ef6\u4e8b\u5b83\u6ca1\u6709\u5f00\u5173\u3002\u6240\u8c13\u300c\u5168\u4ea4\u7ed9 PVE\u300d\u662f\u4e2a\u5e7b\u89c9\u2014\u2014\u4f60\u80fd\u7701\u6389\u7684\u662f\u7f51\u6865\u548c\u89c4\u5219\u7684\u7ef4\u62a4\uff0c\u7701\u4e0d\u6389\u7684\u662f\u5730\u5740\u89c4\u5212\u548c\u51fa\u7f51\u7b56\u7565\u3002\u60f3\u6e05\u695a\u8fd9\u4e00\u70b9\uff0c\u5c31\u4e0d\u4f1a\u6307\u671b\u67d0\u4e00\u5c42\u80fd\u66ff\u4f60\u515c\u5e95\u3002<\/p>\n<p><strong>\u4e8c\uff0c\u89c4\u5219\u6570\u624d\u662f\u89c4\u6a21\u7684\u5929\u82b1\u677f\u3002<\/strong><\/p>\n<p>\u5341\u6237\u7684\u65f6\u5019 n\u00b2 \u65e0\u6240\u8c13\uff0c\u4e94\u5341\u6237\u5c31\u662f\u4e24\u5343\u591a\u6761\uff0c\u6bcf\u4e2a\u5305\u90fd\u8981\u987a\u7740\u8d70\u4e00\u904d\u3002\u8981\u5f80\u4e0a\u8d70\uff0c\u53ea\u6709\u4e09\u6761\u8def\uff1aiptables \u52a0 ipset \u505a\u96c6\u5408\u5339\u914d\u3001\u6362 nftables \u7528\u539f\u751f set\u3001\u6216\u8005\u5e72\u8106\u4ea4\u7ed9 VLAN\u3002<\/p>\n<p>\u4e0b\u4e00\u6b65\uff1a\u518d\u8bd5\u4e00\u6b21 simple zone\u2014\u2014\u90a3\u79cd vnet \u662f\u88f8\u7f51\u6865\uff0cIP \u5e94\u8be5\u80fd\u76f4\u914d\u3002\u5982\u679c\u4e5f\u4e0d\u901a\uff0c\u5c31\u9000\u56de\u88f8\u7f51\u6865\u52a0 ipset\uff0c\u81f3\u5c11\u5148\u628a\u89c4\u5219\u6570\u538b\u5230 O(n)\u3002<\/p>\n<p>\u6ca1\u89e3\u5f00\u7684\u5751\u4e5f\u662f\u5751\uff0c\u8bb0\u4e0b\u6765\u6bd4\u5047\u88c5\u6ca1\u6709\u5f3a\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u7ed9\u6bcf\u4e2a\u5ba2\u6237\u5f00\u4e00\u4e2a\u5bb9\u5668\uff0c\u6700\u96be\u7684\u4ece\u6765\u4e0d\u662f\u5f00\u5bb9\u5668\uff0c\u662f\u8ba9\u4ed6\u4eec\u5f7c\u6b64\u770b\u4e0d\u89c1\u3002 \u8fd9\u4e00\u8f6e\u6211\u4eec\u4e3a\u591a\u79df\u6237\u5bb9\u5668\u505a\u4e86\u56db\u6b21\u65b9\u6848\u8fd4\u5de5\uff0c\u628a\u8fc7\u7a0b\u2026<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-72","post","type-post","status-publish","format-standard","hentry","category-cat-e68a80e69cafe697"],"_links":{"self":[{"href":"https:\/\/www.woiov.cn\/index.php?rest_route=\/wp\/v2\/posts\/72","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.woiov.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.woiov.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.woiov.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.woiov.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=72"}],"version-history":[{"count":0,"href":"https:\/\/www.woiov.cn\/index.php?rest_route=\/wp\/v2\/posts\/72\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.woiov.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=72"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.woiov.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=72"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.woiov.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=72"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}