061、flannel的连通与隔离（2019-04-01 周一）
flannel网络连通性测试
不同host上的容器可以通过flannel网络进行通信，需要借助host上面的路由表（该路由表是host动态从etcd数据库中获得的）
但是flannel网络不支持docker dns
root@host1:~# docker exec bbox1 ip r
default via 10.2.46.1 dev eth0
10.2.46.0/24 dev eth0 scope link src 10.2.46.2
root@host1:~# docker exec bbox1 ping -c 2 10.2.44.2
PING 10.2.44.2 (10.2.44.2): 56 data bytes
64 bytes from 10.2.44.2: seq=0 ttl=62 time=0.365 ms
64 bytes from 10.2.44.2: seq=1 ttl=62 time=0.576 ms
--- 10.2.44.2 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.365/0.470/0.576 ms
root@host1:~# docker exec bbox1 traceroute 10.2.44.2
traceroute to 10.2.44.2 (10.2.44.2), 30 hops max, 46 byte packets
1 10.2.46.1 (10.2.46.1) 0.007 ms 0.033 ms 0.030 ms
2 10.2.44.0 (10.2.44.0) 0.335 ms 0.288 ms 0.170 ms
3 10.2.44.2 (10.2.44.2) 0.171 ms 0.289 ms 0.151 ms
root@host1:~# ip r
default via 10.12.28.6 dev ens160 onlink
10.2.27.0/24 via 10.2.27.0 dev flannel.1 onlink
10.2.44.0/24 via 10.2.44.0 dev flannel.1 onlink
10.2.46.0/24 dev docker0 proto kernel scope link src 10.2.46.1
10.12.28.0/22 dev ens160 proto kernel scope link src 10.12.31.211
172.22.0.0/16 via 10.12.28.1 dev ens160
root@host1:~# docker exec bbox1 ping -c 2 bbox2
ping: bad address 'bbox2'
root@host2:~# docker exec bbox2 ip r
default via 10.2.44.1 dev eth0
10.2.44.0/24 dev eth0 scope link src 10.2.44.2
root@host2:~# ip r
default via 10.12.28.6 dev ens160 onlink
10.2.27.0/24 via 10.2.27.0 dev flannel.1 onlink
10.2.44.0/24 dev docker0 proto kernel scope link src 10.2.44.1
10.2.46.0/24 via 10.2.46.0 dev flannel.1 onlink
10.12.28.0/22 dev ens160 proto kernel scope link src 10.12.31.212
172.22.0.0/16 via 10.12.28.1 dev ens160
flannel网络隔离
flannel为每个主机分配了独立的subnet，但flannel.1 将这些subnet连接起来了，相互之间可以路由。本质上flannel将各host上相互独立的docker0容器网络组成了一个互通的大网络，实现了容器跨主机的通信。flannel并没有隔离功能
flannel与外网连通性
因为flannel网络利用的是host上默认的bridge网络，所以容器与外网的连通方式与bridge网络一样：
1、容器通过docker0 NAT访问外网
2、外网通过主机端口映射访问容器
root@host1:~# docker exec bbox1 ping -c 2 www.qq.com
PING www.qq.com (58.250.137.36): 56 data bytes
64 bytes from 58.250.137.36: seq=0 ttl=49 time=41.491 ms
64 bytes from 58.250.137.36: seq=1 ttl=49 time=41.424 ms
--- www.qq.com ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 41.424/41.457/41.491 ms
