比如我們在虛機中ping 8.8.8.8 。首先在虛機中查詢路由，和第一種情況一樣，虛機會發送給閘道器。傳送的包如下： Dest IP: 8.8.8.8 Souce IP: 10.0.1.5 Dest MAC: MAC of 10.0.1.1 Source MAC: MAC of 10.0.1.5 檢視ip rule: [email protected]:~# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip rule 
0: from all lookup local 
32766: from all lookup main 
32767: from all lookup default 
32768: from 10.0.1.5 lookup 16 
32769: from 10.0.2.3 lookup 16 
167772417: from 10.0.1.1/24 lookup 167772417 
167772417: from 10.0.1.1/24 lookup 167772417 
167772673: from 10.0.2.1/24 lookup 167772673 在main表中沒有合適的路由：

[email protected]:~# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip route list table main 
10.0.1.0/24 dev qr-ddbdc784-d7 proto kernel scope link src 10.0.1.1 
10.0.2.0/24 dev qr-001d0ed9-01 proto kernel scope link src 10.0.2.1 
169.254.31.28/31 dev rfp-0fbb351e-a proto kernel scope link src 169.254.31.28 由於包是從10.0.1.5發來的之後會檢視table 16:

[email protected]:~# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip route list table 16 
default via 169.254.31.29 dev rfp-0fbb351e-a 包會命中這條路由。 路由之後會通過netfilter的POSTROUTING鏈中進行SNAT： [email protected]:~# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa iptables -nvL -t nat 。。。 Chain neutron-l3-agent-float-snat (1 references)  pkts bytes target prot opt in out source destination     0 0 SNAT all -- * * 10.0.2.3 0.0.0.0/0 to:172.24.4.7     0 0 SNAT all -- * * 10.0.1.5 0.0.0.0/0 to:172.24.4.5 。。。 之後就可以看到包會通過rfp-0fbb351e-a傳送給169.254.31.29。 埠rfp-0fbb351e-a和fpr-0fbb351e-a是一對veth pair。在fip namespace中你可以看到這個介面：

[email protected]:~# ip netns exec fip-fbd46644-c70f-4227-a414-862a00cbd1d2 ifconfig
fg-081d537b-06 Link encap:Ethernet  HWaddr fa:16:3e:a4:eb:6b  
          inet addr:172.24.4.6  Bcast:172.24.4.255  Mask:255.255.255.0
          inet6 addr: fe80::f816:3eff:fea4:eb6b/64 Scope:Link
          UP BROADCAST RUNNING  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:50 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:2512 (2.5 KB)


fpr-0fbb351e-a Link encap:Ethernet  HWaddr 42:0d:9f:49:63:c6  
          inet addr:169.254.31.29  Bcast:0.0.0.0  Mask:255.255.255.254
          inet6 addr: fe80::400d:9fff:fe49:63c6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:12 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1116 (1.1 KB)  TX bytes:1116 (1.1 KB)


lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:13 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1250 (1.2 KB)  TX bytes:1250 (1.2 KB)

到了fip的namespace之後，會查詢路由， 這裡有通往公網的預設路由： [email protected]:~# ip netns exec fip-fbd46644-c70f-4227-a414-862a00cbd1d2 ip route 
default via 172.24.4.1 dev fg-081d537b-06 
169.254.31.28/31 dev fpr-0fbb351e-a proto kernel scope link src 169.254.31.29 
172.24.4.0/24 dev fg-081d537b-06 proto kernel scope link src 172.24.4.6 
172.24.4.5 via 169.254.31.28 dev fpr-0fbb351e-a 
172.24.4.7 via 169.254.31.28 dev fpr-0fbb351e-a 通過fg-081d537b-06 傳送到br-ex。這是從虛機發送到公網的過程。 反過來，從外網發起連線到虛機時，在fip的namespace會做arp代理： [email protected]:~# ip netns exec fip-fbd46644-c70f-4227-a414-862a00cbd1d2 sysctl net.ipv4.conf.fg-081d537b-06.proxy_arp 
net.ipv4.conf.fg-081d537b-06.proxy_arp = 1 可以看到介面的arp代理是開啟的，對於floating ip 有以下兩條路由： [email protected]:~# ip netns exec fip-fbd46644-c70f-4227-a414-862a00cbd1d2 ip route 
。。。
172.24.4.5 via 169.254.31.28 dev fpr-0fbb351e-a 
172.24.4.7 via 169.254.31.28 dev fpr-0fbb351e-a 。。。 ARP會去通過VETH Pair到IR的namespace中去查詢，在IR中可以看到，介面rfp-0fbb351e-a配置了floating ip: [email protected]:~# ip netns exec qrouter-0fbb351e-a65b-4790-a409-8fb219ce16aa ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: rfp-0fbb351e-a: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether ea:5c:56:9a:36:9c brd ff:ff:ff:ff:ff:ff
    inet 169.254.31.28/31 scope global rfp-0fbb351e-a
       valid_lft forever preferred_lft forever
    inet 172.24.4.5/32 brd 172.24.4.5 scope global rfp-0fbb351e-a
       valid_lft forever preferred_lft forever
    inet 172.24.4.7/32 brd 172.24.4.7 scope global rfp-0fbb351e-a
       valid_lft forever preferred_lft forever
    inet6 fe80::e85c:56ff:fe9a:369c/64 scope link 
       valid_lft forever preferred_lft forever
17: qr-ddbdc784-d7: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default 
    link/ether fa:16:3e:66:13:af brd ff:ff:ff:ff:ff:ff
    inet 10.0.1.1/24 brd 10.0.1.255 scope global qr-ddbdc784-d7
       valid_lft forever preferred_lft forever
    inet6 fe80::f816:3eff:fe66:13af/64 scope link 
       valid_lft forever preferred_lft forever
19: qr-001d0ed9-01: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default 
    link/ether fa:16:3e:69:b4:05 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.1/24 brd 10.0.2.255 scope global qr-001d0ed9-01
       valid_lft forever preferred_lft forever
    inet6 fe80::f816:3eff:fe69:b405/64 scope link 
       valid_lft forever preferred_lft forever