ROS搭建SNAT网关使专有网络访问Internet-阿里云开发者社区

开发者社区> 云计算> 正文

ROS搭建SNAT网关使专有网络访问Internet

简介: 利用ROS自动给VPC网络创建和配置SNAT网关以便让专有网络的ECS实例访问公网

背景

专有网络环境下,云服务器ECS实例不能直接访问公网,一种方法是给需要访问公网的ECS实例申请弹性IP,但是如果有大量的ECS实例同时需要访问公网,这种方法就不可行。今天将介绍一种SNAT网关访问公网的方式。如下图所示 :

screenshot

这种方法需要申请一台额外的ECS实例绑定EIP做VPC网络的SNAT网关。首先这台ECS实例要在指定的VPC网络中,要绑定EIP,配置这台ECS实例上的iptables, 最后在指定VPC网络的路由表中添加下一跳是这台ECS的路由项。详细的手动配置过程请参考这里

ROS资源介绍

下面将介绍如何通过ROS自动化创建配置VPC SNAT网关。在模版中使用了ROS的如下资源:

ALIYUN::ECS::EIP

  • InternetChargeType:计费方式,按带宽或者按照流量
  • Bandwidth: 带宽在[1~200]取值,单位是Mbps

创建EIP资源

ALIYUN::ECS::EIPAssociation

  • AllocationId:分配的EIP ID
  • InstanceId: 需要绑定EIP的ECS instance ID

本资源资源将绑定EIP到指定的ECS实例

ALIYUN::ECS::Route

  • RouteId: 指定VPC网络中的路由器ID
  • RouteTableId: 指定VPC网络中路由表ID
  • DestinationCidrBlock: 路由项的目标网段
  • NextHopId:路由项的下一跳

本资源将会添加一条路由到指定VPC网络的路由表中,它的下一跳是SNAT网关

ALIYUN::ECS::InstanceGroup

  • 本例中主要使用了UserData属性,用户通过指定脚本给UserData,当ECS启动的时候,就会自动配置iptables。

本资源就是创建SNAT网关

编写ROS模版

在模版中,首先说明此stack需要一个EIP资源,一台ECS实例,并且把EIP绑定到ECS资源上,最终通过执行我们传给ECS的UserData脚本自动化的配置iptbales,最终把下一跳指向ECS的路由项添加到VPC路由器的路由表里面。最终的ROS模版如下:

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": "一键创建SNAT网关",
  "Parameters": {
    "SecurityGroupId": {
      "Description": "安全组ID",
      "Type": "String"
    },
    "RouteTableId": {
      "Description": "专有网络中路由器ID",
      "Type": "String"
    },
    "RouteId": {
      "Description": "专有网络中路由器ID",
      "Type": "String"
    },
    "EIPBandwidth": {
      "Default": 5,
      "MinValue": 1,
      "Description": "弹性公网IP的限速,默认为 5Mbps。",
      "Type": "Number",
      "MaxValue": 200
    },
    "ECSZoneId": {
      "Description": "可用区, , <a href='#/product/cn-shenzhen/list/zoneList' target='_blank'>查看可用区</a>",
      "Type": "String"
    },
    "ECSPassword": {
      "NoEcho": true,
      "MaxLength": 30,
      "Description": "实例的密码",
      "Type": "String",
      "ConstraintDescription": "8-30个字符, 必须同时包含三项(大、小写字母,数字和特殊符号).",
      "MinLength": 8
    },
    "VSwitchId": {
      "Type": "String"
    },
    "VpcId": {
      "Type": "String"
    },
    "VSwitchCidrBlock": {
      "Description": "通过SNAT网关访问外网的VSwitch网段,此网段必须属于VPC",
      "Type": "String"
    },
    "EIPInternetChargeType": {
      "Default": "PayByTraffic",
      "AllowedValues": [
        "PayByBandwidth",
        "PayByTraffic"
      ],
      "Description": "弹性公网IP计费类型,PayByBandwidth(按固定带宽计费),PayByTraffic(按使用流量计费),固定带宽的费用以天计,使用流量的费用以小时计",
      "Type": "String"
    },
    "ECSSysDiskSize": {
      "Default": 40,
      "MinValue": 40,
      "Description": "系统盘大小,40-500之间",
      "Type": "Number",
      "MaxValue": 500
    },
    "ECSDiskCategory": {
      "Default": "cloud_efficiency",
      "AllowedValues": [
        "cloud",
        "cloud_efficiency",
        "cloud_ssd"
      ],
      "Description": "系统盘的磁盘种类, 普通云盘(cloud)、高效云盘(cloud_efficiency)或SSD云盘(cloud_ssd)",
      "Type": "String"
    },
    "ECSInstanceType": {
      "Default": "ecs.s2.large",
      "AllowedValues": [
        "ecs.t1.small",
        "ecs.s1.small",
        "ecs.s1.medium",
        "ecs.s1.large",
        "ecs.s2.small",
        "ecs.s2.large",
        "ecs.s2.xlarge",
        "ecs.s2.2xlarge",
        "ecs.s3.medium",
        "ecs.s3.large",
        "ecs.m1.medium",
        "ecs.m2.medium",
        "ecs.m1.xlarge",
        "ecs.c1.small",
        "ecs.c1.large",
        "ecs.c2.medium",
        "ecs.c2.large",
        "ecs.c2.xlarge",
        "ecs.n1.tiny",
        "ecs.n1.small",
        "ecs.n1.medium",
        "ecs.n1.large",
        "ecs.n1.xlarge"
      ],
      "Description": "实例规格, <a href='#/product/cn-shenzhen/list/typeList' target='_blank'>查看实例规格</a>",
      "Type": "String"
    },
    "ECSImageId": {
      "Default": "ubuntu1404_64_40G_cloudinit_20160427.raw",
      "Description": "镜像文件 ID,表示启动实例时选择的镜像资源, <a href='#/product/cn-shenzhen/list/imageList' target='_blank'>查看实例规格</a>",
      "Type": "String"
    },
    "ECSTag": {
      "Description": "ECS的标签",
      "Type": "String"
    }
  },
  "Resources": {
    "ElasticIpAssociation": {
      "Type": "ALIYUN::ECS::EIPAssociation",
      "Properties": {
        "InstanceId": {
          "Fn::Select": [
            "0",
            {
              "Fn::GetAtt": [
                "ECSSnatGateWay",
                "InstanceIds"
              ]
            }
          ]
        },
        "AllocationId": {
          "Fn::GetAtt": [
            "ElasticIp",
            "AllocationId"
          ]
        }
      }
    },
    "VRoute": {
      "Type": "ALIYUN::ECS::Route",
      "Properties": {
        "NextHopId": {
          "Fn::Select": [
            "0",
            {
              "Fn::GetAtt": [
                "ECSSnatGateWay",
                "InstanceIds"
              ]
            }
          ]
        },
        "RouteId": {
          "Ref": "RouteId"
        },
        "RouteTableId": {
          "Ref": "RouteTableId"
        },
        "DestinationCidrBlock": "0.0.0.0/0"
      }
    },
    "ECSSnatGateWay": {
      "Type": "ALIYUN::ECS::InstanceGroup",
      "Properties": {
        "SecurityGroupId": {
          "Ref": "SecurityGroupId"
        },
        "ImageId": {
          "Ref": "ECSImageId"
        },
        "Password": {
          "Ref": "ECSPassword"
        },
        "MinAmount": "1",
        "InternetMaxBandwidthIn": 100,
        "UserData": {
          "Fn::Replace": [
            {
              "ros-notify": {
                "Fn::GetAtt": [
                  "ECSSnatGateWayConditionHandle",
                  "CurlCli"
                ]
              }
            },
            {
              "Fn::Join": [
                "",
                [
                  "#!/bin/sh",
                  "\n",
                  "PostRouting=",
                  {
                    "Ref": "VSwitchCidrBlock"
                  },
                  "\n",
                  "SourceRouting=`ifconfig eth0|grep inet|awk '{print $2}'|tr -d 'addr:'`",
                  "\n",
                  "echo 'net.ipv4.ip_forward=1'>> /etc/sysctl.conf \n",
                  "sysctl -p \n",
                  "iptables -t nat -I POSTROUTING -s $PostRouting -j SNAT --to-source $SourceRouting \n",
                  "apt-get update\n",
                  "apt-get install -y curl\n",
                  "ros-notify -d '{\"data\" : \" docker swarm created\"}'\n"
                ]
              ]
            }
          ]
        },
        "ZoneId": {
          "Ref": "ECSZoneId"
        },
        "VSwitchId": {
          "Ref": "VSwitchId"
        },
        "InternetChargeType": "PayByTraffic",
        "VpcId": {
          "Ref": "VpcId"
        },
        "InstanceType": {
          "Ref": "ECSInstanceType"
        },
        "SystemDisk_Category": {
          "Ref": "ECSDiskCategory"
        },
        "IoOptimized": "optimized",
        "Tags": [
          {
            "Value": {
              "Ref": "ECSTag"
            },
            "Key": "ECS_SNAT_GATEWAY"
          }
        ],
        "InternetMaxBandwidthOut": 100,
        "SystemDisk_Size": {
          "Ref": "ECSSysDiskSize"
        },
        "MaxAmount": "1"
      }
    },
    "ECSSnatGateWayConditionHandle": {
      "Type": "ALIYUN::ROS::WaitConditionHandle"
    },
    "ECSSnatGateWayGroupWaitCondition": {
      "Type": "ALIYUN::ROS::WaitCondition",
      "DependsOn": "ECSSnatGateWay",
      "Properties": {
        "Handle": {
          "Ref": "ECSSnatGateWayConditionHandle"
        },
        "Timeout": 600,
        "Count": 1
      }
    },
    "ElasticIp": {
      "Type": "ALIYUN::ECS::EIP",
      "Properties": {
        "InternetChargeType": {
          "Ref": "EIPInternetChargeType"
        },
        "Bandwidth": {
          "Ref": "EIPBandwidth"
        }
      }
    }
  },
  "Outputs": {
    "ECSSnatGateWay_INNER_IPS": {
      "Value": {
        "Fn::GetAtt": [
          "ECSSnatGateWay",
          "PrivateIps"
        ]
      },
      "Description": "Inner IP address of the ECS instance."
    },
    "ECSSnatGateWay_InstanceIds": {
      "Value": {
        "Fn::GetAtt": [
          "ECSSnatGateWay",
          "InstanceIds"
        ]
      },
      "Description": "The instance id of created ecs instance"
    },
    "EipAddress": {
      "Value": {
        "Fn::GetAtt": [
          "ElasticIp",
          "EipAddress"
        ]
      },
      "Description": "IP address of created EIP."
    },
    "ECSSnatGateWay_ZoneIds": {
      "Value": {
        "Fn::GetAtt": [
          "ECSSnatGateWay",
          "ZoneIds"
        ]
      },
      "Description": "Zone id of created instance."
    }
  }
}

版权声明:本文内容由阿里云实名注册用户自发贡献,版权归原作者所有,阿里云开发者社区不拥有其著作权,亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容,填写侵权投诉表单进行举报,一经查实,本社区将立刻删除涉嫌侵权内容。

分享:
云计算
使用钉钉扫一扫加入圈子
+ 订阅

时时分享云计算技术内容,助您降低 IT 成本,提升运维效率,使您更专注于核心业务创新。

其他文章