Network virtualization is a technology that abstracts network capabilities away from dedicated network hardware. The underlying hardware only needs to provide basic packet forwarding services. Network virtualization provides various network services, including data switching, routing, security groups, firewalls, and more, achieving an experience comparable to a physical network.

ZStack Cloud abstracts the network model into Layer 2 (L2) networks and Layer 3 (L3) networks. An L2 network is a layer 2 broadcast domain and offers layer 2 isolation. An L3 network primarily corresponds to network services from Layer 4 to Layer 7 of the OSI model. Technologies providing layer 2 isolation such as NoVLAN, VLAN, VXLAN, and SDN can serve as L2 networks. Creating an L2 network requires deploying corresponding virtual switches on all hosts in the cluster attached to the L2 network to provide a broadcast domain. Built on top of L2 networks, L3 networks come in several types: flat network, public network, and VPC network. Various network services based on L3 networks can be provided, such as DHCP, DNS, elastic IP (EIP), port forwarding, and load balancing.

L3 networks include: flat network, public network, and VPC network.

A flat network assigns private network addresses to VM instances, while allowing VM instances to access the public network through distributed elastic IPs (EIPs). Flat networks support network services such as DHCP, User Data, security groups, EIPs, and port mirroring.

A VPC network is a customizable network space that enables tenants to build an isolated, self-managed virtual network within the cloud platform. It offers greater control over configuration and policy, enhancing the security of cloud resources. VPC vRouters provide VPC networks and their services. A single VPC vRouter can host multiple isolated VPC networks, providing VM instances with network services such as DHCP, DNS, SNAT, routing tables, security groups, VPC firewalls, EIPs, port forwarding, load balancing, IPsec, Netflow, OSPF and multicast routing.

A VPC vRouter is a dedicated VM instance running a customized Linux operating system and a management service agent. A single VPC vRouter can provide multiple isolated VPC networks. Each VPC vRouter contains a management service agent that receives commands from management nodes via the HTTP protocol to configure network services. VPC vRouters provide VM instances with network services including DHCP, DNS, SNAT, routing tables, security groups, VPC firewalls, EIPs, port forwarding, load balancing, IPsec, Netflow, OSPF, and multicast routing.

In traditional data centers, networks divide into trusted zones, DMZ zones, and untrusted zones. Perimeter firewalls enforce traffic control to ensure network security. In virtualized data centers, perimeter firewalls may struggle to handle scenarios such as network isolation between different tenants and access control between different services within the same tenant flexibly. Therefore, ZStack Cloud introduces a new component: security group. A security group is a distributed firewall focused on controlling east-west traffic and supports inbound and outbound traffic control at the VM instance NIC level.

A VPC firewall controls north-south traffic within a VPC network. Based on iptables, VPC firewall rules deploy on the VPC vRouter. When you enable the VPC firewall for a VPC vRouter, ZStack Cloud automatically delivers a default rule (priority 10000) and system rules (priority 4000 to 9999) to the VPC vRouter. The default rule and system rules ensure mutual access between the VPC network and external networks by default.

The default rule supports modification only. System rules do not support modification, addition, or deletion, except disablement​​. After configuring custom rules, you can modify the default rule or disable system rules as needed. Before executing above operations, ensure that the custom rules meet expectations. Otherwise, your business may be affected.

You can configure custom rules on either the public network or the VPC network as needed.

Configure security rules between a VPC network and external networks on the public network. For example, to block VM instance-1 from accessing external networks and to allow external networks to access VM instance-2, configure the rules on the outbound direction of the public network.

Configure security rules between VPC networks on the VPC network. For example, to block VPC network-1 from accessing VPC network-2, configure a deny rule on the inbound direction of VPC network-1 or on the outbound direction of VPC network-2.

Typically, flat networks and public networks cannot communicate at layer 2 and cannot route to each other at layer 3. VM instances on a flat network cannot access the public network, and the public network cannot actively access VM instances on the flat network. To bridge the flat network and the public network, you need an elastic IP (EIP).

Similarly, VPC networks and public networks cannot communicate at layer 2 and cannot route to each other at layer 3. If you enable the SNAT functionality on the VPC vRouter, VM instances on the VPC network can access the public network, but the public network cannot actively access the VPC network. To bridge the VPC network and the public network, you need an EIP.

Technical Principles

EIP applies the Linux Netfilter framework. Netfilter is a networking subsystem in the Linux kernel, which provides packet filtering, NAT, and other network-related Hook functions. Netfilter inserts a series of Hook points into the packet forwarding path. You can use the iptables tool to add rules at these Hook points to control how packets get forwarded.

For flat networks, EIP is achieved through Linux Namespaces. You need to create a Linux Namespace on the underlying host of a VM instance. This Linux namespace maps the IP address of a VM instance to its EIP.

For VPC networks, EIP is achieved through the VPC vRouter. The VPC vRouter maps the IP address of a VM instance to its EIP without requiring creating a Linux Namespace.

Typically, flat networks and public networks cannot communicate at layer 2 and cannot route to each other at layer 3. VM instances on a flat network cannot access the public network, and the public network cannot actively access VM instances on the flat network. To bridge the flat network and the public network, you need an EIP. Flat networks do not provide port forwarding.

Similarly, VPC networks and public networks cannot communicate at layer 2 and cannot route to each other at layer 3. If you enable the SNAT functionality on the VPC vRouter, VM instances on the VPC network can access the public network, but the public network cannot actively access the VPC network. To bridge the VPC network and the public network, you need an EIP. If you want the public network to access specific ports on a VM instance, you can use port forwarding.

Technical Principles

Similar to EIP, port forwarding is achieved through the Linux Netfilter. Netfilter is a networking subsystem in the Linux kernel, which provides packet filtering, NAT, and other network-related hook functions. Netfilter inserts a series of Hook points into the packet forwarding path. You can use the iptables tool to add rules at these Hook points to control how packets get forwarded.

Flat networks do not provide port forwarding.

For VPC networks, port forwarding is achieved through the VPC router. Suppose you have a VM instance listening on TCP port 80, and want external users to access this service without exposing all other TCP ports on the VM instance. You can use port mapping. Port forwarding supports two mapping modes: one-to-one port mapping and port range mapping.

Load balancing employs various flexible algorithms to distribute all network requests evenly across backend server groups. Efficient traffic distribution reduces the load on individual servers to support high-traffic and high-concurrency accesses, meeting various business requirements.

If you deploy ZStack Cloud in multiple regions, or both use a ZStack CloudPrivate Cloud and purchase Public Cloud services, you can connect these multi-cloud environments conveniently using an IPsec tunnel. It enables layer 3 communication between multi-cloud networks and ensures the confidentiality and security of data transmission between clouds.

Port mirroring copies and forwards packets from a source port to a designated observation port. This allows data or traffic analysis to be performed on the second port or forwarded remotely for further inspection, minimizing impact on the original packet forwarding path.

The port through which the original packets pass is called the mirror port, also known as the monitored port. The second port that receives the copied data is called the observer port, also known as the collection port or monitoring port.

Technical Principle

ZStack Cloud implements network virtualization based on the open-source Linux operating system. The corresponding port mirroring functionality is implemented using tools and libraries from the Linux ecosystem.

Assume that virtual NIC vNIC 1.0 is the mirror port and NIC Recv 1.0 is the observer port. To mirror (copy and forward) traffic from the vNIC 1.0 port of VM instance 1 to the vNIC 3.0 port of VM instance 2, follow these steps:

1. Create another port on host 1: Send 1.0.
2. Create a special network independent of the service network: the traffic network.
3. Mirror the traffic from vNIC 1.0 to Send 1.0.
4. Establish a GRE tunnel between Send 1.0 and Recv 1.0.
5. The mirrored data is forwarded to VM instance 2 through the GRE tunnel.

Among these steps, flow mirroring is implemented using the Linux Traffic Control (TC) tool. The GRE tunnel operates on the independent traffic network, enabling packets and traffic to be copied and forwarded to any location within ZStack Cloud.

Netflow is a traffic statistics technology widely used in network traffic statistics, network planning, network security, and other fields. Netflow originated as a proprietary technology developed by Cisco and is now commonly supported by other network equipment vendors. The most widely used versions of Netflow are V5 and V9. For example, the IETF technical standard IPFIX (IP Flow Information Export) is based on the V9 version.

In ZStack Cloud, the VPC vRouter can act as a Netflow exporter, sending Netflow information to a collector.

Technical Principle

The VPC vRouter provides the Netflow service using the open-source software Pmacct. Pmacct includes two parts:

• Kernel Module: Adds iptables rules to direct traffic to the Nflog target. Example:

  iptables -t raw -A VYATTA_CT_PREROUTING_HOOK -i eth1 -j NFLOG --nflog-group 2
  
  # A line of network configuration automatically generated when each Netflow service is created.
  # eth1: The interface name of the corresponding network inside the VPC vRouter.
  # nflog-group 2: Specifies an NFLOG ID, which must match the iptables and Pmacctd configuration.

• User-Space Program: The user-space program Pmacctd reads traffic data from the kernel via the NFLOG Netlink interface, then processes and converts it into Netflow format for export to a collector.

This chapter focuses on the OSPF dynamic routing protocol.

Therefore, multicast technology effectively solves the problem of single-point transmission and multi-point reception. This technology is widely used in fields with high demands for bandwidth and real-time data interaction, such as internet TV, live streaming, distance education, telemedicine, and real-time video conferences.

QoS (Quality of Service) involves bandwidth management and quality assurance. In modern network environments, QoS is key to ensuring network efficiency and performance. Effective bandwidth control optimizes resource allocation and improves user experience, which is particularly important in multimedia transmission and enterprise-level applications.