Tuntap Drivers With A

Tuntap Drivers With A

It replaces the combination of the tuntap and bridge drivers with a single module based on the macvlan device driver.

A macvtap endpoint is a character device that largely follows the tuntap ioctl interface and can be used directly by kvmqemu and other hypervisors that support the tuntap interface.

The endpoint extends an existing network interface, the lower device, and has its own mac address on the same ethernet segment.

Typically, this is used to make both the guest and the host show up directly on the switch that the host is connected to.

If that switch supports the hairpin mode, the frames get sent back to the lower device and from there to the destination endpoint.

Most switches today do not support hairpin mode, so the two endpoints are not able to exchange ethernet frames, although they might still be able to communicate using an tcpip router.

A linux host used as the adjacent bridge can be put into hairpin mode by writing to sysclassnet dev brif port hairpinmode.

Bridge mode: this works almost like a traditional bridge, in that data received on a macvlan in bridge mode and destined for another macvlan of the same lower device is sent directly to the target (if the target macvlan is also in bridge mode), rather than being sent outside.

This of course works well with non-hairpin switches, and inter-VM traffic has better performance than VEPA mode, since the external round-trip is avoided.

Private mode: this is essentially like VEPA mode, but with the added feature that no macvlans on the same lower device can communicate, regardless of where the packets come from (so even if inter-VM traffic is sent back by a hairpin switch or an IP router, the target macvlan is prevented from receiving it).

This mode is useful, of course, if we really want macvlan isolation.

Im not 100 clear on whats the problem passthru mode tries to solve, as I was able to set promiscuous mode, create bridges, vlans and sub-macvlan,tap interfaces in KVM guests using a plain macvtap in VEPA mode for their networking (so no need for passthru).

Since Im surely missing something, more information (as usual) is welcome.

Example: sudo ip link add link eth0 name macvtap0 address 52:54:00:b8:9c:58 type macvtap mode bridge.

To start a guest on the interface from the above example, we need to pass the device node as an open file descriptor to qemu and tell it about the mac address.

The scripts normally used for bridge configuration must be disabled.

A bash redirect can be used to open the character device in readwrite mode and pass it as file descriptor 3.

Tuntap Driver For Mac