VPN for containers and virtual machines in local area networks
View Patent ↗A method, system and computer program product for a VPN for containers and VMs implemented on different network node. A number of network hardware nodes have containers and VMs running on them. The containers and VMs are aggregated into VPNs assembled across the hardware nodes. Each hardware node has a network edge programmable switch configured to route packets to containers and VMs only inside a particular VPN. The switch detects a number of the VPN inside the packet header, replaces this number by a standard broadcast header number and multi-casts the packet to the containers and the VMs inside the VPN.
1. A computer-implemented method for combining Virtual Environments (VEs) into a Virtual Private Network (VPN), the method comprising:
connecting at least two host nodes into an Ethernet network;
launching at least two VEs on each of the hosts;
combining the VEs from both hosts into a VPN;
assigning a number to the VPN;
configuring a software switch on each of the hosts to route packets to VEs that subscribe to the VPN;
using a self-taught switch connected to the software switches of the hardware nodes to join different hardware nodes into a segment of the Ethernet network;
analyzing an incoming broadcast packet by the software switch;
replacing a standard MAC address in a packet header by a number of the VPN to which a source VE belongs;
based on the MAC addresses of the packet, changing a destination address of the packet to the VPN number; and
multi-casting the packet to VEs included into the VPN,
wherein the hardware nodes receive VE-related traffic via an ARP proxy.
2. The method of claim 1 , further comprising discarding the packet when it reaches a VE that is not associated with the VPN.
3. The method of claim 1 , wherein the Virtual Environments of the VPN include both VMs and Containers on the same node.
4. The method of claim 1 , wherein the VEs are Virtual Machines, each Virtual Machine having its own guest operating system kernel.
5. The method of claim 1 , wherein the VEs are containers, wherein multiple containers share a host operating system of their hardware node.
6. The method of claim 1 , wherein the VEs on the same node belong to different VPNs.
7. The method of claim 1 , wherein the VPN comprises multiple VEs on each hardware node, and wherein at least one of the VEs on one node is a Virtual Machine and at least one of the VEs on the same node is a Container.
8. The method of claim 1 , wherein multiple VEs on each hardware node subscribe to multiple different VPNs, and wherein each of the different VPNs includes at least one Virtual Machine and at least one Container.
9. The method of claim 1 , wherein the VPN comprises multiple VEs on each hardware node, wherein the VEs on the same node belong to different VPNs.
10. The method of claim 1 , wherein the VPN comprises multiple VEs on each hardware node, and wherein at least one of the VEs on one node is a Virtual Machine and at least one of the VEs on the same node is a Container.
11. The method of claim 1 , wherein the programmable network switch is a self-taught switch configured to route subsequent packets only to the VEs subscribed to the VPN.
12. A computer program product comprising a non-transitory computer readable medium containing code for implementing the steps of:
connecting at least two host nodes into an Ethernet network;
launching at least two VEs on each of the hosts;
combining the VEs from both hosts into a VPN;
assigning a number to the VPN;
configuring a software switch on each of the hosts to route packets to VEs that subscribe to the VPN;
using a self-taught switch connected to the software switches of the hardware nodes to join different hardware nodes into a segment of the Ethernet network;
analyzing an incoming broadcast packet by the software switch;
replacing a standard MAC address in a packet header by a number of the VPN to which a source VE belongs;
based on MAC addresses of the packet, changing a destination address of the packet to the VPN number; and
multi-casting the packet to VEs included into the VPN,
wherein the hardware nodes receive VE-related traffic via an ARP proxy.