Computer Network

Computer Network

Overview

This part does not aim to explain a basic theory of computer networking but try to explain what we were missed since starting work from a company.

Link Local Address

You may have heard about the "Link Local Address" if you have experience with cloud computing services (especially AWS. EC2 Metadata service).

Generally, we use the UNIX domain socket for inter-process communication. Because, it provides almost similar application programming interaces to the network application programming interface.

However, sometimes we may need to use some kind of protocols, such as the HTTP protocol, for communicating with the other processes.

Unfortunately it is not always possible to port such service daemons to run on the UNIX domain socket interfaces with protocols.

In the case of AWS, a metadata service provided to each EC2 machine to make it possible to get credentials (IAM Role) for accessing other AWS services.

And the metadata service exposed via link-local rfc3927 address 169.254.169.254.

The application service running in the ec2 gets credentials from 169.254.169.254 via the HTTP protocol.

In this chapter, we will get how to setup the metadata service.

First of all, we should assign link local address to an ethernet interface (ens0). linklocal

How to add a link local address to the interface

First of all, we have to assign the link local address to the interface linklocal . The following command will help you to do it.

lstlisting caption= Add Link-Local address ,style=bash

ip address add dev ens0 scope link 169.254.169.254/32

ip address add dev ens0 scope link fe80::21b:21ff:febb:5db0/64

lstlisting

If your problem is that you don't know what exact address you should use as the link-local address: These addresses are typically derived from the hardware (MAC) address of the interface.

Take the MAC address of the interface (the "link/ether" field in the result of "ip link show dev ..."), and convert it to Modified EUI-64 according to this procedure.

Then add "fe80::" (standard link-local prefix) to the left and "/64" (as the subnet prefix length) to the right.

IP Masquerading (DNAT)

First of all, you have to enable ip forwarding options.

lstlisting caption= Enable IPv4 Forwarding ,style=bash

echo "1" > /proc/sys/net/ipv4/ip_forward

lstlisting

After that, you have to build up the iptables network routing chains

caption= IP Masquerading ,style=bash examples/qemu/iptables.cmd

Tun/Tap

The difference between a tap interface and a tun interface is that a tap interface outputs (and must be given) full ethernet frames, while a tun interface outputs (and must be given) raw IP packets (and no ethernet headers are added by the kernel). Whether an interface functions like a tun interface or like a tap interface is specified with a flag when the interface is created. tuntap

firewall

I spent a week to solve the firewall issue.

The issue is started after I reboot the machine.

The machine cannot recover the network and it stucks for long time.

At last I cannot connect to the master node through ssh service.

So I attached a monitor and a keyboard to the machine directly, and I get the console.

The machine works well. Only except the network.

I tried to pull down all network interface and try to find why the packet are not going in and out well.

And the 3 days passed.

Finally I found a clue.

That when the iptable _nat module is loaded, the default FORWARD policy is DROP.

It means any forwarded packets are going to be dropped.

The most easiest way of figuring this issue out is change the default FORWARD policy to ACCEPT.

lstlisting caption= Change the iptable FORWARD policy ,style=bash

iptables --policy FORWARD ACCEPT

lstlisting