Week 3

Virtual Networking and Linux Networking Fundamentals

OPS3 - Virtualization and Cloud Infrastructure

Welcome to Week 3!

What You'll Learn This Week

1. Runtime vs. Persistent Networking (ip vs nmcli)

1.1 The Kernel Layer: ip (Runtime)

The ip command is part of the iproute2 suite. It communicates directly with the Linux Kernel via Netlink sockets. When you run an ip command, you are modifying the direct, in-memory state of the network stack.

Key Commands:

1.2 The Configuration Layer: nmcli (Persistent)

To make settings permanent, we need a daemon that reads config files and applies them at boot. In modern Linux (including RHEL/CentOS and many Debian setups), this is NetworkManager. The command-line tool for this is nmcli.

Hands-On Example: Use nmcli to set a static IP, ensuring the server always boots with the same address.

Section 1 Checkpoint

Summary:

Reflection:

Resources:

2. Network Namespaces (The "Containers" of Networking)

2.1 The "Tenant Problem"

Imagine you are hosting Amazon Web Services. Customer A wants a private network using the IP range 192.168.1.0/24. Customer B also wants to use 192.168.1.0/24. On a normal OS, you cannot have the same IP address twice. It would cause an IP conflict.

Figure 2.1: Visualizing Isolation of Network Resources within a Single Linux Kernel.

2.2 Hands-On Example

We will create a "sandbox" namespace to demonstrate this total isolation.

Section 2 Checkpoint

Summary:

Reflection:

Resources:

3. Connecting the Dots: Veth Pairs and Bridges

3.1 The Virtual Cable (veth)

Hands-On Example: Connecting the Sandbox to the Host.

3.2 The Virtual Switch (bridge)

How devices plug in:

Example: Manually creating a TAP interface (What Proxmox does behind the scenes)

Hands-On Example: Connecting Two Namespaces (Red & Blue) We will act as a "Virtual Switch" administrator. We want to connect two isolated namespaces so they can talk to each other.

Section 3 Checkpoint

Summary:

Reflection:

Resources:

4. Container Networking in Practice (Docker, Podman, LXC)

4.1 Docker (The Standard Bridge)

When you install Docker, it creates a Linux Bridge named docker0.

CLI Comparison:

Action Manual Linux Command Docker Command
Create Net ip link add br0 type bridge docker network create mynet
Create NS ip netns add container1 docker run --name container1 ...
Connect ip link set veth master br0 Auto-connected to docker0 or custom net

4.2 Podman (Rootless Networking)

Podman often manages containers without root privileges. Standard bridges require root. How does it work?

4.3 LXC (System Containers)

LXC is closer to Proxmox's approach. It typically uses lxcbr0.

Section 4 Checkpoint

Summary:

Reflection:

Resources:

5. Advanced Linux Operations

5.1 Link Aggregation (Bonding/LACP)

Hardware fails. Cables get cut, SFP modules burn out, and switch ports die. If your Hypervisor is connected via a single cable, you have a Single Point of Failure (SPOF).

Bonding allows you to combine multiple physical interfaces (e.g., eno1 and eno2) into a single virtual interface (bond0).

Configuration:

5.2 IP Forwarding & Routing

A Linux server usually behaves like an End Host—it consumes packets sent to it and ignores the rest. However, in virtualization (specifically NAT Mode), the Linux host must act as a Router. It needs to accept packets from VMs and forward them to the Internet.

To do this, we must toggle a specialized kernel parameter: ip_forward. We also need to manipulate the Routing Table to tell the kernel where networks live.

Commands:

5.3 The Linux Firewall (iptables)

Hands-On Example: securing a host.

Modern Frontends: firewalld vs iptables While iptables (and its successor nftables) is the low-level tool, managing thousands of rules manually is hard. Modern distros use "Frontend Controllers":

These tools write the underlying iptables/nftables rules for you.

5.4 Network Reconnaissance (ss & nmap)

Before you can analyze traffic, you often need to know what ports are open or who is listening.

Socket Statistics (ss) ss is the modern replacement for the deprecated netstat. It allows you to see which processes on your server are listening for connections.

Network Mapper (nmap) nmap is the industry standard for network discovery. Unlike ss (which looks locally), nmap allows you to scan remote servers to see what they are exposing.

5.5 Traffic Analysis (tcpdump)

When networking breaks, it often fails silently. A firewall drops a packet without an error message. A route sends traffic into a black hole. To fix this, we need Packet Capture.

tcpdump is the CLI version of Wireshark. It puts the network card into "Promiscuous Mode," allowing it to see every packet on the wire, not just those addressed to it.

Commands:

Section 5 Checkpoint

Summary:

Reflection:

Resources:

Now that we have dismantled the Linux kernel concepts, we can look at how Proxmox Virtual Environment (PVE) uses them to manage VM networking. Proxmox does not invent its own networking stack; it "orchestrates" standard Linux tools (Bridges, OVS, IPTables) via a web interface.

6. Open vSwitch (OVS): The Cloud Switch

6.1 Architecture: Control Plane vs. Data Plane

6.2 Installing OVS

Unlike the standard bridge, OVS is not always installed by default.

6.3 The Power of Flows

Standard bridges forward based on MAC addresses. OVS forwards based on Flow Rules. A flow rule matches a packet's header fields and performs an action.

Example Scenario: You want to block a specific "Bad Neighbor" VM (IP 10.0.0.66) from sending traffic, but allow everything else.

6.4 SDN Controller Integration

OVS is designed to be controlled remotely by an SDN Controller (like OpenDaylight or ONOS). This allows a central brain to program the switches across the entire datacenter.

Section 6 Checkpoint

Summary:

Reflection:

Resources:

7. Proxmox Networking

7.1 Networking Modes

When configuring a VM's hardware, you choose how it connects to the bridge. We primarily see three patterns.

This is the standard configuration for 90% of deployments. The VM becomes a full peer on the physical network.

Packet Flow: [VM eth0] -> [Host tap100i0] -> [Linux Bridge vmbr0] -> [Physical NIC eno1] -> [Physical Switch]

Detailed Configuration: In /etc/network/interfaces, a Bridge looks like this:

Implication:

Sometimes you cannot get extra public IPs (e.g., in a data center giving you only 1 IP). You need to create a private network inside the host and share the single public IP.

Packet Flow: [VM eth0] -> [Host tap100i0] -> [Private Bridge vmbr1] -> [Host Routing/NAT] -> [Physical NIC eno1] -> Internet

Detailed Configuration: This mode requires Masquerading (Source NAT) in iptables.

VLANs allow multiple logical networks to share one physical cable. To do this, we insert a 4-byte "Tag" into the Ethernet Frame Header.

Processing Flow:

You can create VLAN interfaces on standard Linux without a bridge using the ip command. This creates a virtual interface that automatically tags/untags packets.

Egress (Host -> Switch): The packet leaves eno1 with the tag attached. The physical switch reads "20" and puts it in the correct broadcast domain.

VLAN Aware Bridge: Modern Proxmox uses "VLAN Aware" bridges. Instead of creating vmbr0.10, vmbr0.20, etc., you toggle bridge-vlan-aware yes. The bridge then acts like a "Trunk Port", capable of carrying all VLANs simultaneously.

Section 7 Checkpoint

Summary:

Reflection:

Resources:

8. Additional Resources

9. Lab Exercises

Summary

Review the key concepts covered in this week's material

Questions?