OVS Changes #2 - getting Docker containers to attach to the OVS bridges

Now that I have been successful with KVM VMs and their connections to the OVS bridges, I need to figure out how to do much of the same thing with Docker containers.  One of the reasons that I run ubuntuServer is because it is very easy (so they say) to get Docker containers running.  So now, what I am going to attempt is to startup a Docker container attached to one of the OVS bridges, used on a pfSense KVM VM.

So according to the site, http://containertutorials.com/network/ovs_docker.html, I have to do the following steps:

Install OVS (already done on my system) -

Install OVS-docker utility (already done on my system) -

Create an OVS bridge (already done on my system, except the bridge doesn't have an IP address) -

Create the docker container

Connect the container to the OVS bridge, such as

$ ovs-docker add-port ovs-br1 eth1 <container_name> --ipaddress=<ip_address_for_container>

OVS Changes #1 - Updating the ubuntuServer to use OVS bridges

One of the things that I wanted to do with my network was to be able to access multiple vlans while I was away on trips or from the office.  I hit upon the use of OpenVSwitch (OVS) as a means of connecting an Ubuntu VM running under VMWare on my Windows 10 laptop.  In addition, I wanted to be able to run a set of Docker containers from my Mac Mini server and have them connected to the ubuntuServer.  So, in effect I have a SDN within my house that can be connected to through my VPN server.

I had setup bridges to multiple Ethernet ports using the following template:

iface <ethernet-port-name> inet manual

auto <bridge-name>

iface <bridge-name> inet manual

        bridge_ports <ethernet-port-name>

The setup is in a number of bridge definition files located in /etc/network/interfaces.d/; one file per interface.  The only template that is in /etc/network/interfaces is the one that I have for my day-to-day network activities.  Again, I separate out vlans for different purposes making sure that the vlans do not talk to each other except in controlled instances.

What I did to use an OVS generated bridge was to remove the bridge definition file from /etc/network/interfaces.d/ and then delete the previous bridge using:

sudo ip link set <bridge-name> down

sudo brctl delbr <bridge-name>

sudo brctl show

and then perform the following command (note the ovs addition to differentiate it):

sudo ovs-vsctl add-br <bridge-name-ovs>

sudo ovs-vsctl add-port <bridge-name-ovs> <ethernet-port-name>
sudo ovs-vsctl show

Which is done for each port that I have defined, except for the day-to-day port.  It turns out that you can use the Virtual Machine Manager to pull up the VM, reset the bridge designations from the pull-down list, hit apply, then launch the VM.  Works very well with pfSense.  The interesting thing is that the <bridge-name-ovs> will now show up in an ifconfig command, where as before (when first created with OVS) would not.  Also, there are now tap devices that show up in ifconfig, like macvtap0 and macvtap1.  Those correspond to the tap device attached to the KVM VM; created from the use of Virtual Machine Manager.  I still need to figure out how to do this with Docker.

Anyway it works!  I am able to pull up the VMs on the correct vlan now.

Thinking about distributing the network servers

I have been reading up on openvswitch, openflow, and docker and it occurs to me that I might want to take advantage of some of the concepts available to me.  I have a VM Server currently that pretty much limits things to the KVM world, each connected to a specific bridge to a hardware port.  Those hardware ports in turn are connected to a managed switch.  I can do a lot with this setup but I can do better.

One thing that I want to do is distribute the data plane between different VMs and allow for usage of different file servers across my network.  I have plenty of space available to me for various files but because of the need to distribute the VMs between different vlans it becomes more difficult without having several hardware routers in the network.  I want to use SDN and openvswitch to be able to spread the VM connections around to places that I need them as well as give myself the ability to access any device that I want to.  So how would I go about doing this?  I have decided to use openvswitch to spread the network access plane around my house without changing the physical network layout of routers and switches.  I will instead go the virtual route and apply some Software Defined Network (SDN) concepts.

More Later.

Tips #0 - Wow - Amazing Find to Convert VMWare to KVM

I just happened to have enough time over the weekend to look around for some ways to convert from multiple VMWare vmdks to qcow2 and I stumbled across this site.  Now that I have found this site I can go about getting some of my VMs into a KVM setup.  The bash code that I am using is:

#!/bin/bash

for i in *.vmdk; do qemu-img convert -f vmdk $i -O raw $i.raw; done
cat *.raw > tmpImage.raw
qemu-img convert tmpImage.raw finalImage.qcow2
rm *.raw

I cant tell you how much I needed to find this in order to ease the process.  Thanks to Kees Cook and muru for the code.

Also found this to convert spaces in names to underscores:

for f in *\ *; do mv "$f" "${f// /_}"; done

Update: I spent a good portion of the day converting VMWare VMs to qcow2 and then to KVM images.  Life is once again good to me.  I was able to get a number of different VMs related to Penetration Testing completed as well as set up a bridge that could be used for the same.