使用tinc+quagga搭建个人SD-WAN网络

拓扑如下

一、tinc安装与配置

1、CentOS7云主机安装tinc

yum install tinc

mkdir -p /etc/tinc/tincnet/
mkdir  /etc/tinc/tincnet/hosts
cd /etc/tinc/tincnet/
ll

vi tinc.conf

Name = Server_Node 
Interface = tinctun 
AddressFamily = ipv4
Mode = switch 
ConnectTo = Slave_Node
Compression=9 
Cipher = aes-256-cbc 
Digest = sha256 
PrivateKeyFile=/etc/tinc/tincnet/rsa_key.priv

vi tinc-up
#!/bin/sh
ip link set $INTERFACE up
ip addr add 10.254.254.2/24 dev $INTERFACE
ip route add 10.254.254.0/24 dev $INTERFACE

vi tinc-down 
#!/bin/sh
ip route del 10.254.254.0/24 dev $INTERFACE
ip addr del 10.254.254.2/24 dev $INTERFACE
ip link set $INTERFACE down

chmod 755 tinc*

cd /etc/tinc/tincnet/hosts
vi Server_Node

Address = 129.211.209.82
Subnet = 10.254.254.2/32
Port = 655

通过tincd生成非对称密钥

#通过tincd生成非对称密钥
tincd -n tincnet -K 4096

2、分支节点安装配置tinc

配置与上面类似，不再赘述，截图如下

3、保证两个节点的hosts文件夹都有全部节点的hosts信息

scp /etc/tinc/tincnet/hosts/Slave_Node root@129.211.209.82:/etc/tinc/tincnet/hosts/

scp root@129.211.209.82:/etc/tinc/tincnet/hosts/Server_Node /etc/tinc/tincnet/hosts

4、配置etc/sysctl.conf文件

net.ipv4.ip_forward = 1

5、防火墙放通655端口

6、启动tinc服务

systemctl start tinc@tincnet
systemctl status tinc@tincnet

二、手工静态路由方式实现互访

添加路由前截图

例如分支节点上添加静态路由

route add -net 10.106.0.0/20 dev tinctun

三、安装quagga配置ospf实现互通

1、两节点均安装并配置quagga

yum install quagga

cd /etc/quagga/
cp /usr/share/doc/quagga-0.99.22.4/zebra.conf.sample ./
cp /usr/share/doc/quagga-0.99.22.4/ospfd.conf.sample ./
cp zebra.conf.sample zebra.conf
cp ospfd.conf.sample ospfd.conf

chmod 777 *.conf
chmod 777 /var/log/ospfd/

systemctl enable zebra
systemctl enable ospfd

systemctl start zebra
systemctl start ospfd

2、vtysh进行配置ospf

主节点配置步骤如下

VM-0-17-centos# conf t
VM-0-17-centos(config)# interface  eth0
VM-0-17-centos(config-if)# description  Server_eth0
VM-0-17-centos(config-if)# no shut
VM-0-17-centos(config-if)# exit
VM-0-17-centos(config)# interface  tinctun
VM-0-17-centos(config-if)# description  Server_tinctun
VM-0-17-centos(config-if)# no shut
VM-0-17-centos(config-if)# exit
VM-0-17-centos(config)# router ospf 
VM-0-17-centos(config-router)# router-id  1.1.1.1
VM-0-17-centos(config-router)# network  10.254.254.0/24 area 0
VM-0-17-centos(config-router)# network  10.206.0.17/20  area 0
VM-0-17-centos(config-router)# exit
VM-0-17-centos(config)# log file /var/log/quagga/ospfd.log
VM-0-17-centos(config)# exit
VM-0-17-centos# wr
Building Configuration...
Configuration saved to /etc/quagga/zebra.conf
Configuration saved to /etc/quagga/ospfd.conf
[OK]

分支节点配置步骤如下 vtysh

Hello, this is Quagga (version 0.99.22.4).
Copyright 1996-2005 Kunihiro Ishiguro, et al.

centos.walkingcloud.cn# conf t
centos.walkingcloud.cn(config)# interface  ens33
centos.walkingcloud.cn(config-if)# description  Slave_ens33
centos.walkingcloud.cn(config-if)# no shut
centos.walkingcloud.cn(config-if)# exit
centos.walkingcloud.cn(config)# interface tinctun
centos.walkingcloud.cn(config-if)# description  Slave_tinctun
centos.walkingcloud.cn(config-if)# no shut
centos.walkingcloud.cn(config-if)# exit
centos.walkingcloud.cn(config)# 
centos.walkingcloud.cn(config)# exit
centos.walkingcloud.cn# conf t
centos.walkingcloud.cn(config)# router ospf 
centos.walkingcloud.cn(config-router)# router-id  2.2.2.2
centos.walkingcloud.cn(config-router)# network  192.168.31.0/24 area  0
centos.walkingcloud.cn(config-router)# network  10.254.254.0/24 area 0
centos.walkingcloud.cn(config-router)# network 192.168.1.1/24 area 0
centos.walkingcloud.cn(config-router)# exit
centos.walkingcloud.cn(config)# log file  /var/log/quagga/ospfd.log
centos.walkingcloud.cn(config)# exit
centos.walkingcloud.cn# wr
Building Configuration...
Configuration saved to /etc/quagga/zebra.conf
[OK]
centos.walkingcloud.cn# exit

3、防火墙放通ospf协议

firewall-cmd --permanent --zone=public --add-protocol=ospf
firewall-cmd --reload

并重启ospf和zebra服务

systemctl restart zebra
systemctl restart ospfd

4、ospf状态检查

可以用vtysh中 show ip ospf neighbor检查邻居是否建立

show ip route查看对方是否学习到对方的ospf路由

show ip ospf neighbor
show ip route

5、最后进行连通性测试

四、总结

• 1、本文只是测试使用quagga并使用ospf协议，实际中为了简单起见，可以直接使用静态路由即可
• 2、当然个人家庭网络中不会把Linux服务器作为出口路由使用，可以openwrt路由器安装tinc来实现