1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["1506"],{27416:function(e,t,a){a.r(t),a.d(t,{frontMatter:()=>s,toc:()=>c,default:()=>l,metadata:()=>n,assets:()=>d,contentTitle:()=>i});var n=JSON.parse('{"id":"reference/architecture/data-path","title":"\'The Calico data path: IP routing and iptables\'","description":"Learn how packets flow between workloads in a datacenter, or between a workload and the internet.","source":"@site/calico_versioned_docs/version-3.28/reference/architecture/data-path.mdx","sourceDirName":"reference/architecture","slug":"/reference/architecture/data-path","permalink":"/calico/3.28/reference/architecture/data-path","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico_versioned_docs/version-3.28/reference/architecture/data-path.mdx","tags":[],"version":"3.28","frontMatter":{"description":"Learn how packets flow between workloads in a datacenter, or between a workload and the internet."},"sidebar":"calicoSidebar","previous":{"title":"Component architecture","permalink":"/calico/3.28/reference/architecture/overview"},"next":{"title":"Network design","permalink":"/calico/3.28/reference/architecture/design/"}}'),r=a(37937),o=a(17869);let s={description:"Learn how packets flow between workloads in a datacenter, or between a workload and the internet."},i="'The Calico data path: IP routing and iptables'",d={},c=[{value:"Is that all?",id:"is-that-all",level:2}];function h(e){let t={code:"code",h1:"h1",h2:"h2",header:"header",img:"img",p:"p",pre:"pre",...(0,o.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.header,{children:(0,r.jsx)(t.h1,{id:"the-calico-data-path-ip-routing-and-iptables",children:"'The Calico data path: IP routing and iptables'"})}),"\n",(0,r.jsx)(t.p,{children:"One of Calico\u2019s key features is how packets flow between workloads in a\ndata center, or between a workload and the Internet, without additional\nencapsulation."}),"\n",(0,r.jsx)(t.p,{children:"In the Calico approach, IP packets to or from a workload are routed and\nfirewalled by the Linux routing table and iptables or eBPF infrastructure on the\nworkload\u2019s host. For a workload that is sending packets, Calico ensures\nthat the host is always returned as the next hop MAC address regardless\nof whatever routing the workload itself might configure. For packets\naddressed to a workload, the last IP hop is that from the destination\nworkload\u2019s host to the workload itself."}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Calico datapath",src:a(97711).A+"",width:"762",height:"143"})}),"\n",(0,r.jsx)(t.p,{children:"Suppose that IPv4 addresses for the workloads are allocated from a\ndatacenter-private subnet of 10.65/16, and that the hosts have IP\naddresses from 172.18.203/24. If you look at the routing table on a host:"}),"\n",(0,r.jsx)(t.pre,{children:(0,r.jsx)(t.code,{className:"language-bash",children:"route -n\n"})}),"\n",(0,r.jsx)(t.p,{children:"You will see something like this:"}),"\n",(0,r.jsx)(t.pre,{children:(0,r.jsx)(t.code,{children:"Kernel IP routing table\nDestination Gateway Genmask Flags Metric Ref Use Iface\n0.0.0.0 172.18.203.1 0.0.0.0 UG 0 0 0 eth0\n10.65.0.0 0.0.0.0 255.255.0.0 U 0 0 0 ns-db03ab89-b4\n10.65.0.21 172.18.203.126 255.255.255.255 UGH 0 0 0 eth0\n10.65.0.22 172.18.203.129 255.255.255.255 UGH 0 0 0 eth0\n10.65.0.23 172.18.203.129 255.255.255.255 UGH 0 0 0 eth0\n10.65.0.24 0.0.0.0 255.255.255.255 UH 0 0 0 tapa429fb36-04\n172.18.203.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0\n"})}),"\n",(0,r.jsx)(t.p,{children:"There is one workload on this host with IP address 10.65.0.24, and\naccessible from the host via a TAP (or veth, etc.) interface named\ntapa429fb36-04. Hence there is a direct route for 10.65.0.24, through\ntapa429fb36-04. Other workloads, with the .21, .22 and .23 addresses,\nare hosted on two other hosts (172.18.203.126 and .129), so the routes\nfor those workload addresses are via those hosts."}),"\n",(0,r.jsx)(t.p,{children:"The direct routes are set up by a Calico agent named Felix when it is\nasked to provision connectivity for a particular workload. A BGP client\n(such as BIRD
1) then notices those and distributes them \u2013 perhaps via a\nroute reflector \u2013 to BGP clients running on other hosts, and hence the\nindirect routes appear also."}),"\n",(0,r.jsx)(t.h2,{id:"is-that-all",children:"Is that all?"}),"\n",(0,r.jsx)(t.p,{children:"As far as the static data path is concerned, yes. It\u2019s just a\ncombination of responding to workload ARP requests with the host MAC, IP\nrouting and iptables or eBPF. There\u2019s a great deal more to Calico in terms of\nhow the required routing and security information is managed, and for\nhandling dynamic things such as workload migration \u2013 but the basic data\npath really is that simple."})]})}function l(e={}){let{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(h,{...e})}):h(e)}},97711:function(e,t,a){a.d(t,{A:()=>n});let n=a.p+"assets/images/calico-datapath-164f6f29c7b21889c1d4b517a2695533.png"},17869:function(e,t,a){a.d(t,{R:()=>s,x:()=>i});var n=a(82645);let r={},o=n.createContext(r);function s(e){let t=n.useContext(o);return n.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:s(e.components),n.createElement(o.Provider,{value:t},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.