0

I am trying to create virtual interfaces (type MACVLAN) such that all communication between the interfaces is sent out of the host towards the eternal default gateway. There is plenty of writeups describing "private" mode such as here

Private: Filter all incoming packets so that no MAC VLAN bound to an interface can communicate with each other (drop all packets ingressing over the interface that have a source MAC address that matches one of the MAC VLAN interfaces).

I configured a couple of interfaces and it looks like the "private" mode isn't working as advertised. Am I doing something wrong? The host is Ubuntu 18.04 Bionic release.

The packets are getting switched within the host ignoring the "mode private" command. It is simple to reproduce with just 4 commands. Any help would be appreciated.

root@ubnt-bkp:/home/super# uname -a
Linux ubnt-bkp 4.15.0-96-generic #97-Ubuntu SMP Wed Apr 1 03:25:46 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

root@ubnt-bkp:/home/super# ip link add link ens160 address 38:94:ed:99:99:1A ens160.3 type macvlan mode private
root@ubnt-bkp:/home/super# ip link set ens160.3 up
root@ubnt-bkp:/home/super# ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 08:4f:a9:99:99:02 brd ff:ff:ff:ff:ff:ff
...
...
18: ens160.3@ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP **mode** **DEFAULT** group default qlen 1000
    link/ether 38:94:ed:99:99:1a brd ff:ff:ff:ff:ff:ff

Commands to reproduce the problem

root@ubnt-bkp:/home/super# ip link add link ens160 address 38:94:ed:99:99:1B ens160.5 type macvlan mode private
root@ubnt-bkp:/home/super# ip link set ens160.5 up
root@ubnt-bkp:/home/super# dhclient ens160.5
root@ubnt-bkp:/home/super# ip link add link ens160 address 38:94:ed:99:99:1C ens160.6 type macvlan mode private
root@ubnt-bkp:/home/super# ip link set ens160.6 up
root@ubnt-bkp:/home/super# dhclient ens160.6

Then ping using -I option:

root@ubnt-bkp:/home/super#ping -I <IP address of ens160.5> <IP address of ens160.6>

(replace ens160 with your ethernet interface name, e.g. eth0, when trying to reproduce)

0

The commands you are using for creating the MACVLAN interfaces are correct.

However, using ping -I is not going to help you verify this. When both source and destination interfaces are on the same host (and in the same namespace, as in your case), ping will always succeed.

How do you test this, then? By placing your MACVLAN interfaces in different, non-default, namespaces. Then execute ping from the namespace.

Lets assume that you start off with your physical interface (ens160) with IP address 192.0.2.2/24. Lets also assume that your router gateway address is 192.0.2.1.

Now:

# Create namespace named "ns5"
ip netns add ns5

# Create the macvlan interface as usual
ip link add link ens160 address 38:94:ed:99:99:1B ens160.5 type macvlan mode private

# Move the just-created macvlan interface into the "ns5" namespace
ip link set ens160.5 netns ns5

# Set the link up. Observe the "ip netns exec ns5" prefix.
ip netns exec ns5 ip link set ens160.5 up

# Set the IP address for the macvaln interface.  Observe the "ip netns exec ns5" prefix.
ip netns exec ns5 ip address add dev ens160.5 192.0.2.205/24


# Repeat above for another macvlan interface, this one in another namespace
# called "ns6"

ip netns add ns6
ip link add link ens160 address 38:94:ed:99:99:1C ens160.6 type macvlan mode private
ip link set ens160.6 netns ns6
ip netns exec ns6 ip link set ens160.6 up
ip netns exec ns6 ip address add dev ens160.6 192.0.2.206/24

From this point on, both the macvtap interfaces will be able to successfully ping the gateway:

ip netns exec ns5 ping 192.0.2.1
ip netns exec ns6 ping 192.0.2.1

If you have access to the gateway device, you should be able to confirm that the ARP entries for 192.0.2.205 and 192.0.2.6 show the MAC addresses of the macvlan interfaces.

However, since the macvlan interfaces are in private mode, the following commands will both fail:

# Try to reach ens160.6 from ens160.5
ip netns exec ns5 ping 192.0.2.206

# Try to reach ens160.5 from ens160.6
ip netns exec ns6 ping 192.0.2.205

Repeat the experiment with bridge instead of private; you will observe that the last two ping commands will succeed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.