Service Function Chain (SFC)

Virtual Network Functions (VNFs) are used to construct Service Function Chains (SFC), enabling network packets to sequentially traverse VNF instances on the chain. VNF chains improve deployment efficiency while minimizing system resource consumption, allowing service providers to introduce VNF features rapidly without altering source code.

The Service Function Chain page supports two operation modes:

• Virtual WAN (vWAN) Mode: Connects one or more containers in series, passing network traffic from Container 1 to Container 2 through Container N.
• Virtual Bridge (vBridge) Mode: Establishes container-based bridging between different VLANs.

Creating a vWAN Service Function Chain

1. Go to Networking > Forwarding > Service Function Chain.
2. Click the "Add" button.
3. Enter the Chain name.
4. Select vWAN mode.
5. Enter the vWAN IP address.
6. Enter Gateway and Netmask.
7. Click "Add VNF Node" to append containers to the service function chain.
8. Click "Apply".

Configuration Example 1: OpenVPN Service Function Chain

With an OpenVPN container deployed on the device, client devices connected to the CPE can establish VPN connectivity to a corporate OpenVPN server without local client configuration.

1. Add the OpenVPN template and install the OpenVPN app via App Store.

2. Go to Application > Information > Container.
3. Click the Action icon for the OpenVPN App and select "Edit" to pop up the "Edit Container" dialog box.
4. Configure the Egress WAN Interface.

   !NOTENote: If the OpenVPN server resides on the corporate internal network, the Egress WAN Interface must not be assigned to the internal corporate interface.

5. Add Command to supply the OpenVPN username and password.
6. Add Device /dev/net/tun. Click "Apply".

7. Go to Application > Volume.
8. Select the target volume (e.g., OpenVPN-0318_OpenVPN_vpn).
9. Click the upload icon to upload the .ovpn configuration file required for the VPN tunnel.

10. Go to Networking > Forwarding > Service Function Chain.
11. Click "Add".
12. Enter Chain name, select vWAN mode.
13. Enter IP, Gateway, and Netmask.
14. Click "Add VNF Node" to add the OpenVPN container to the chain.
15. Click "Apply".

16. Go to Networking > Forwarding > Service Function Chain.
17. Click the OpenVPN App Action icon and select "Start" to launch the chain.

18. Go to Networking > Forwarding > WAN Binding.
19. Move OpenVPN WAN from Available WAN to In Use WAN.
20. Click "Apply".

21. Connect a laptop to the LAN SSID and ping the gateway at the OpenVPN server site to verify VPN connectivity.

Configuration Example 2: AdGuard Ad-Blocking Service Function Chain

AdGuard is an ad-blocking application that suppresses pop-ups, banners, and video ads. To deploy AdGuard as a VNF node on an SFC, an Alpine container running DNAT rules is positioned ahead of AdGuard to redirect incoming DNS query traffic to AdGuard.

Steps to Deploy Alpine and AdGuard Containers:

1. Go to Application > Template > Container > Add Template.
2. Add an Alpine container template containing DNAT iptables rules. Fill in App Name, App Description, and upload an App Icon.

3. Configure Service settings:
   • Service Name: Alpine
   • Registry: hub.docker.com
   • Image Name: alpine
   • Image Tag: 3.13
   • Resource Limitation: Low: 0.2 Cores CPU + 128 MB Memory
   • Network Endpoint: bridge
   • Egress WAN Interface: Default (Highest Priority WAN)
   • Add Device: /dev/net/tun (grants NET_ADMIN and NET_RAW capabilities to execute iptables).
4. Click "Apply".

5. Go to Application > Template > Container > Add Template.
6. Add the AdGuard container template:
   • App Name: Adguard
   • App Description: Network-wide ads & trackers blocking DNS server
   • Service Name: Adguard
   • Registry: hub.docker.com
   • Image Name: adguard/adguardhome
   • Image Tag: latest
   • Resource Limitation: Medium: 0.5 Cores CPU + 512 MB Memory
   • Network Endpoint: bridge
   • Egress WAN Interface: Mobile Network (internet)
   • Environment Variable: PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
   • Port Binding: Protocol TCP, Public Port 3000, Private Port 3000, HTTP(s) Port Yes.
7. Click "Apply".

!NOTE

• Egress WAN Interface: AdGuard is the egress VNF container on the chain; therefore, a specific WAN interface must be selected (cannot use Default).
• Device /dev/net/tun: Grants NET_ADMIN and NET_RAW privileges for iptables usage.

8. Go to Application > App Store > Application > Container and install Alpine and AdGuard.
9. Go to Application > Information > Container.
10. Click the AdGuard port mapping link (http://CPE_IP:3000) to access the AdGuard interface.

11. Click the Console icon under Alpine Action, and execute iptables commands to redirect Port 53 DNS traffic to the AdGuard container IP:

apk update
apk add iptables
iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to-destination Adguard_IP:53

12. Go to Networking > Forwarding > Service Function Chain, click "Add".
13. Enter Chain Name, select vWAN mode, and specify IP, Gateway, and Netmask.
14. Click "Add VNF Node" to add Alpine as Container 1.
15. Click "Add VNF Node" to add AdGuard as Container 2.
16. Click "Apply".

17. Click Action icon to start the AdGuard service function chain.
18. Go to Networking > Forwarding > WAN Binding and bind the AdGuard interface to active WAN to route LAN device traffic through AdGuard.

19. Open YouTube on a LAN device to verify traffic passing through AdGuard.

20. Go to the Filter page in AdGuard and enable the YouTube blocking rule.

21. Test pinging YouTube from a LAN device; no response is received, confirming YouTube access is blocked.

Configuration Example 3: vBridge Mode Connection

vBridge mode establishes container-mediated bridging between two separate VLANs.

1. Go to Networking > Forwarding > Port Type, and move eth1 and eth2 from WAN to LAN.

2. Go to Networking > LAN > VLAN, and create VLAN 10 and VLAN 20.
3. Edit eth1 to bind Access VLAN 10; edit eth2 to bind Access VLAN 20.

4. Connect Laptop 1 to eth1 and assign IP 192.168.10.10.
5. Connect Laptop 2 to eth2 and assign IP 192.168.10.20.
6. Go to Application > App Store and install Nginx and Python applications.
7. Go to Networking > Forwarding > Service Function Chain, click "Add".
8. Set Mode to vBridge, enter Chain Name.
9. Click "Add VNF Node" to select Nginx, followed by Python.
10. Set Left VLAN to 10 and Right VLAN to 10.

11. Start the SFC via the Action icon.

12. Ping Laptop 2 IP (192.168.10.20) from Laptop 1 to receive responses.
13. Ping Laptop 1 IP (192.168.10.10) from Laptop 2 to verify cross-VLAN bridging functionality.