Question about traffic redirect for VMs

[GrigoriyMikhalkin]

Hi!

I have a couple of (probably) silly questions. I read @hellt article about redirecting frames between interfaces. Thing that caught my eyes is how traffic redirection implemented with tc.

As i understand, goal is to redirect ingress traffic to container to VM, and egress traffic from VM to container interface.

Redirecting container interface ingress traffic to VM is done by tc filter add dev eth0 parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev tap1 command -- it sends traffic from ingress qdisc of eth0 to egress(root?) qdisc of VM's interface. But shouldn't it redirect ingress traffic to ingress qdisc of VM's interface instead?

Second part (as i understand) should redirect egress traffic to egress qdisc of container interface. tc filter add dev tap0 parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev eth1 -- but it, seemingly, redirects ingress traffic to egress.

Would like to understand, what i'm missing here.

[hellt]

Hi @GrigoriyMikhalkin
for the traffic that is ingressing to container's interface eth0 we mirror it to the VM's tap0 interface. So you got it right, we move it from container that hosts a VM to that VM that sits inside of it.

Here is the actual code snippet
https://github.com/hellt/vrnetlab/blob/64488e4ed9e1766e10354abade9fe036c5ebe703/common/vrnetlab.py#L328-L351

PS. Sorry I only noticed the question today, the missing counter on discussions make it tricky to see if there are unanswered questions

[GrigoriyMikhalkin]

Thanks for response!

I was trying to create container with VM inside to use it with containerlab. What in the end worked for me is binding macvtap interface(i.e. running interface in passthrough mode) to container interface created by clab.