Hello, what kind of everyone? I'm Fernando. I'm a
kind of network engineer at Sousa and today I'm here to talk about
channels and light weight tunnel infrastructure with NFTables so let's start with
topic. So what's light weight tunnel? Well it's something that has been around
the camera since 2015. It's not new and it allows to ingest this
touch encapsulation instructions to routes originally. We will go back to that
later and it has support in multiple kind of tunnels like IP, IP, DX, Lange, and many
others. So why is this useful? This is useful for virtualized environment. If you are
familiar with Kubernetes or environments with a lot of VMs, usually all the
connection is tunnels in enterprise networks. You have the machines, VMs or
bare metal connected to switches connected to a huge network and it's
common that you want to connect everything together or in Kubernetes. It's also quite
common to have bought bought or no-to-not communication tunnel and also there
is a lot of work in business networking like OBS that works through tunnels. So in
essence the initial support was something like what's other there. You added the
route to a specific endpoint and you added some encapsulation instructions. So for
example here we are in the DSABX line, you add the ID and you add the
destination endpoint and then the device that is going to handle this. So the good
thing about this and if you are familiar with DX line is that usually or with an
tunnel actually is that usually you won't need to create one interface
where a tunnel that you create. So you have for let's say every endpoint that you
want to connect, you have one tunnel interface that have source destination,
some options and then on the other end you have another tunnel with source
destination and so options and then then working the middle. The good thing is that
this other unit create a single device, it could be an IPAP, the X-Long
or whatever and that single device can be used for different endpoints and this
super useful in Kubernetes for example when you need to create a managed
a huge amount of interfaces so you can reduce that amount of interfaces and in
a sense make it more simple and efficient. All right so what new by
I'm talking about this in 2026, 11 years later, well we have other support
to unafita and ftables for it and it's true that lightweight tunneling is not
very well documented, it's hard to find documentation how it works, how it
configures it and if you are an expert on virtualizing and working then it's
easier but usually it's pretty hard to be able to figure out how to use it.
So there is a lot of option rate as I say probably to do it to the lack of documentation
and I must explain that the kind of leader documentation in NFTables is not that good
so that's on my side I'm working on it sorry and I would try to
have a patch of it to to improve that documentation and the things that in IP route
the implementation and configuration it's sometimes not very compatible with
never manager because never manager is touching also routes and all this stuff so
there are conflicts and things sometimes doesn't work pretty well so either you
cannot use it or you can you need to drop network manager and in this case as the
implementation in NFTables does not touch the routes what it does is create a
rule set of NFTables and inject the encapsulation instructions there it's completely
compatible with this kind of engines like never manager is systemDener where the
and so on so that's another thing well NFTables it's going to be the supporting
NFTables is more flexible because it's not dependent on routes anymore you pull match
on any characteristic that you want to split the traffic and it doesn't necessarily need to be
the source and the destination it could be the ID or it could be whatever all the stuff that
you want to touch and it's other you also to combine it with some features like the maps,
the sets, dynamic sets, dynamic maps and actually any NFTables expression that you want to use
and this helps you to well scale up and simplify the configuration from the CCR administrator
point of view so also by the way in NFT this is an object so it's not like a standard
expression it's an object statement and what is good about this is that it supports the update
operation so imagine that you have a one tunnel created with one tunnel template that we're looking
to that data and you want to update some of the fields configure you can do it using the
transactions system that NFTables support so you won't have intermediate states like people have
for example in IP rules because you got an executing commands in your specific order if you have
high flow traffic that could be some packets in the middle that suffer some drops or or some
connectivity issues all right so first let's look at what we did in the corner so this is
the key piece of the work which in essence we just take the NFTNL object information we get the
SKB when we have a evaluation and evaluation it's in essence a match and we drop initially the
DSD metadata that is attached to the SKB and we put our well we get a reference of the
of the metadata that we have generated and we attach it to the SKB and this sounds super simple but
well first ND it's a metadata structure it's in essence it contains an IP tunnel info
and it parts all the information of the tunnel and this comes from generic things like I say
say source address IP 4 and IP 6 destination port ID, BTL or other stuff but also the specific
of that tunnel let's see for example if you have the need you know that you can have multiple
options configure if you have BX line you have the GBP configure so all of that it's contained
and the hard work that is doing NFTables is in essence when you're from the users space
configure the tunnel it's validates all of that and make sure that you are not configuring something
wrong in the terms of that it makes sense like you're not mixing IP 4 with IP 6 or you are not
to think in valid values and it's passing all of that into the correct tunnel type and then
inside to need but I'll tell you so before attaching it to the SKB it's kind of trivial thanks
to all the mechanisms that we already have because actually without them it will be quite complex
so let's look at a real NFT tunnel object so this is a generic template this is not
this could be used for example for any kind of tunnel IPIP, PX line, Geneva and so on because it doesn't
have a specific options for it but of course this is not configuring any of the specific options
and if you want to confirm and the default will be whatever is defined on the on the driver of the tunnel
so if you want to confirm it we'll look at the later so in essence we have a table in that table
we create the the object that will be the tunnel we put the name and we can define the ID
source address and destination address this examples IPv4 but IPv6 is supported
and then the destination port and TTL that's it we are going to look later on how to use this
object but they're variants so as I say if you want to define some of the options that are more
specific to the tunnel type like for example the VX line GBP option you need to add the
section so you add a small section under the tunnel definition and you put the X line GBP in this
case 100 and for Geneva people will be the same Geneva and the options configure
so all right what are the real world samples that we can deal with with this guy in off
tunneling so we have two games that are connected to each other like for example in a cabin
that is a cluster which are the nodes then these VMs has a BX line and there are containers
configure with a better to allow our container communication with the host of the VM with the
guest VM sorry so here we will use the template to allow that encapsulation and be able to communicate
and the good thing is that if we have three or four containers we could use the same BX line
interface we would need to create one pair pair container all right so this will be the rule set
for that specific scenario as I say we have the definition of the tunnel and then we need to
redirect the traffic to the tunnel and from the tunnel because here we need to redirect
from container and to the container so we in essence match the address and that address will be
that is computer on the containers and after that we define right we want to the the tunnel
object to kick in and we define tunnel name the name of the tunnel and later we forward E to
BX line 0 so BX line BX line the bias line the bias we be able to look at the encapsulation
instructions that are defined there and do proper encapsulation but we also need to do something else
when we get the traffic from the other container we need to do for one it for what it
to the the best in the host so it's actually it lands in the container so you have traffic in the
both ways this by the way cool if you use IP route to do this you will need to use probably TC
to ready the traffic from the guest to the container when you are listening it because with a
route and on it's usually not enough another example that I'm not going to get in very much
it's yeah the simple tunnel example you have two VMs connected to a switch connected to a network
and you create a VX line and therefore you encapsulate the traffic between them so
let's look at a real example for this specification area
so this recorded with this demo aski with aski cinema so I'm going to explain what's happening
so first I'm going to log into one of the VMs because we need to configure both VMs
right so what we have known here finishes me going to try to make it be here fine okay yeah so
what we have known here is to create few names places okay they are right more okay okay that's fine
so we have created two names spaces those names spaces have the best configures and so on
and we have used the NSS the ruleset that we show before but instead having only one address we
are having two others because both containers has different others and in essence yeah this is the
ruleset and now I'm going to log in the other machine to configure the other end
okay yeah so it's configure and now I'm going to pick being from the containers to the other
container using the tunnel which should be happening so yes all right so I'm going to
name space this is done this is done with names space that's a VM works kind of the same way
all right and as you can see I'm able to ping from the container to the other end and from
here the container to the other one so both ends and I'm going to show you now that I only
using one BX line and also yeah here you can see there is only one which doesn't have any IP
configure and I have the both best on the host the both pairs on the host and the physical
nick that I'm using with the others configure and no rules well the default rules of course for
connectivity and yeah that's that's basically it we were able to achieve our connections
from different endpoints using a single BX line and this can be a scale app to a very very
big hand-hound of containers and endpoints so yeah all right so that's it thank you very much
everyone here thank you for listening and also thank you for all the volunteers and
organizers of different
Thank you.
So, we're just wondering if from which tunnel version is this supported in NF chambers?
So, with the latest bug fixes, I believe it is 618.
So, we fixed some bugs in Geneva.
But for BX then, you should be able to use it since 64.
Or something like that from the top of my mind, maybe it's a little bit off.
But if you want to use NF, 618.
Thank you.
So, suppose that some person from neighbor room hosting VBPF will come here and ask a question,
is it possible to port this implementation from NF tables to some XDP or BPF program?
Is it possible?
Probably.
I don't know.
I'm not a BBF expert.
So, I don't know.
But I'm pretty sure that someone could do it.
It's not rocket science to be honest.
So, there's just manipulation with the packet, right?
No, no.
Yeah.
It's manipulation of the packet in essence.
Well, actually, I'm not very sure that you can do it,
because if I know where I'm from BBF or BBF context,
you cannot see the SGB, which is the packet representation on the kernel.
And what we are doing here is touching the instruction,
let me tell you the instructions to do the encapsulation to that SGB structure.
So, actually, I don't know.
Okay.
Maybe you can go to the angaster.
He might know better.
Thank you very much.
Alright.
Thank you.