How to create isolated mutlitenand network with public ip mapping

(Jörg Bode) #1

Hi together,

I just came accross opennebula and think it is the simplicity I am searching for my little project. I will setup a multinode (2 - X) enviroment for our customers and projects.

My goal is to create a “providernetwork” which is reachable from everywhere in our house. In the cluster i want to create numbers of projects and teams. This projects and teams have to have all isolated private network addresses and do not need to talk with each other. I think here I have to create a single openvswitch bridge with vxlan, right?

So, my customers then just start instances and create their own “mini infrastructure”. If they need to connect directly to a VM, they should be able to catch an ip-address from mthe “provider” network and map it to the VM. How can I realize this?

Actually I seems that I have to create 3 network bridges. 1 simple linux Bridge for the provider network, 1 openvswitch/vxlan brdige to be able to isolate the different networks from my tenants and connect the virtual networks between the different hypervisors and 1 simple linux bridge to realize my storage/management network.

Have someone any suggestions for me if my setup should work?

(Jörg Bode) #2

To be a little bit more complete, here is a simple example-chart of the infrastructure I want to build.

Customers should be able to create their networks and all vms should talk to each other - no matter which host you are on.

If this work fine and a customer want to connect directly to a service on a vm, he should be able to “request” an public IP and map this to the Service.

It is a little bit similar to what Docker/Kubernetes does…

(Alejandro Huertas) #3

Hello @Jorg_Bode

Maybe IPAM driver can help you, please take a look!

(Jörg Bode) #4

Hi,

thank you for the idea with IPAM. I think this is not what I want. ONE is able to manage addresses in virtual networks. My task is to isolate the networks from each other without touching all the switches everytime to implement new vlans.

When this task is finished, I have to find a way to “map” adresses of the public network to a vm. Just like setting up the DMZ Zone of a homerouter…

(Jörg Bode) #5

Perhaps I simply do not understand how I can isolate the “cloud” virtual networks. I want to minimize the workload when creating new tenants.

(Alejandro Huertas) #6

I don’t know if I’m understanding well.

If you want to isolate 2 networks, you just have to create 2 different virtual networks in OpenNebula and then use different bridges in your physical hosts.

(Jörg Bode) #7

I do not want to isolate only 2 networks. I want to realize this:

1 Network for public acces. This is only a simple bridge.
1 Network for server/managment communication. This is only a simple bridge oder single nic.
1 Network for the different tenant networks. Here I have to separate alle the networks from each other which my tenants create. This is the part I do not understand.

(Jörg Bode) #8

The second part is to create the connectivity to “the outer world”. I think the “floating-ip” concept like Openstack do is not available? In this case I want to “map” an external IP through a virtual router to the VM. Is this possible?