仅出站的负载均衡器配置Outbound-only load balancer configuration

使用内部和外部标准负载均衡器的组合为内部负载均衡器后面的 VM 创建出站连接。Use a combination of internal and external standard load balancers to create outbound connectivity for VMs behind an internal load balancer.

此配置为内部负载均衡器方案提供出站 NAT,为后端池生成“仅出口”设置。This configuration provides outbound NAT for an internal load balancer scenario, producing an "egress only" setup for your backend pool.

Figure depicts a egress only load balancer configuration.

图:“仅出口”负载均衡器配置Figure: Egress only load balancer configuration

所需步骤如下:The steps required are:

  1. 使用堡垒主机创建虚拟网络。Create a virtual network with a bastion host.
  2. 创建仅带有专用 IP 的虚拟机。Create a virtual machine with only a private IP.
  3. 创建内部和公共两种标准负载均衡器。Create both internal and public standard load balancers.
  4. 将后端池添加到这两种负载均衡器,并将 VM 放入每个池。Add backend pools to both load balancers and place the VM into each pool.
  5. 通过堡垒主机连接到 VM,并执行以下操作:Connect to your VM through the bastion host and:
    1. 测试出站连接,Test outbound connectivity,
    2. 在公共负载均衡器上配置出站规则。Configure an outbound rule on the public load balancer.
    3. 重新测试出站连接。Retest outbound connectivity.

创建虚拟网络和虚拟机Create virtual network and virtual machine

创建包含两个子网的虚拟网络:Create a virtual network with two subnets:

  • 主子网Primary subnet
  • 堡垒子网Bastion subnet

在新的虚拟网络中创建虚拟机。Create a virtual machine in the new virtual network.

创建虚拟网络Create the virtual network

  1. 登录 Azure 门户。Sign in to the Azure portal.

  2. 在屏幕的左上方选择“创建资源”>“网络”>“虚拟网络”,或者在搜索框中搜索“虚拟网络”。 On the upper-left side of the screen, select Create a resource > Networking > Virtual network or search for Virtual network in the search box.

  3. 在“创建虚拟网络” 的“基本信息”选项卡中输入或选择以下信息 :In Create virtual network, enter or select this information in the Basics tab:

    设置Setting Value
    项目详细信息Project Details
    订阅Subscription 选择 Azure 订阅Select your Azure subscription
    资源组Resource Group 选择“新建”。Select Create new.
    输入“myResourceGroupLB”。Enter myResourceGroupLB.
    选择“确定”。Select OK.
    实例详细信息Instance details
    名称Name 输入“myVNet”Enter myVNet
    区域Region 选择“中国东部 2” Select China East 2
  4. 选择“IP 地址”选项卡 ,或选择页面底部的“下一步: IP 地址”按钮。Select the IP Addresses tab or select the Next: IP Addresses button at the bottom of the page.

  5. 在“IP 地址” 选项卡上,输入以下信息:In the IP Addresses tab, enter this information:

    设置Setting Value
    IPv4 地址空间IPv4 address space 输入“10.1.0.0/16”Enter 10.1.0.0/16
  6. 在“子网名称”下,选择词语“默认”。Under Subnet name, select the word default.

  7. 在“编辑子网”中输入以下信息: In Edit subnet, enter this information:

    设置Setting Value
    子网名称Subnet name 输入“myBackendSubnet”Enter myBackendSubnet
    子网地址范围Subnet address range 输入“10.1.0.0/24”Enter 10.1.0.0/24
  8. 选择“保存” 。Select Save.

  9. 选择“安全”选项卡。Select the Security tab.

  10. 在“BastionHost”下,选择“启用” 。Under BastionHost, select Enable. 输入此信息:Enter this information:

    设置Setting Value
    Bastion 名称Bastion name 输入“myBastionHost”Enter myBastionHost
    AzureBastionSubnet 地址空间AzureBastionSubnet address space 输入“10.1.1.0/24”Enter 10.1.1.0/24
    公共 IP 地址Public IP Address 选择“新建”。Select Create new.
    对于“名称”,请输入“myBastionIP” 。For Name, enter myBastionIP.
    选择“确定”。Select OK.
  11. 选择“查看 + 创建”选项卡,或选择“查看 + 创建”按钮。Select the Review + create tab or select the Review + create button.

  12. 选择“创建”。Select Create.

创建虚拟机Create a virtual machine

  1. 在门户的左上方,选择“创建资源” > “计算” > “虚拟机” 。On the upper-left side of the portal, select Create a resource > Compute > Virtual machine.

  2. 在“创建虚拟机”中,在“基本信息”选项卡中键入或选择值:In Create a virtual machine, type or select the values in the Basics tab:

    设置Setting “值”Value
    项目详细信息Project Details
    订阅Subscription 选择 Azure 订阅Select your Azure subscription
    资源组Resource Group 选择“myResourceGroupLB”Select myResourceGroupLB
    实例详细信息Instance details
    虚拟机名称Virtual machine name 输入“myVM”Enter myVM
    区域Region 选择“中国东部 2” Select China East 2
    可用性选项Availability Options 选择“无需基础结构冗余”Select No infrastructure redundancy required
    映像Image 选择“Windows Server 2019 Datacenter”Select Windows Server 2019 Datacenter
    大小Size 选择 VM 大小或采用默认设置Choose VM size or take default setting
    管理员帐户Administrator account
    用户名Username 输入用户名Enter a username
    密码Password 输入密码Enter a password
    确认密码Confirm password 重新输入密码Reenter password
    入站端口规则Inbound port rules
    公共入站端口Public inbound ports 选择“允许所选端口”Select Allow selected ports
    选择入站端口Select inbound ports 选择“RDP (3389)”Select RDP (3389)
  3. 选择“网络”选项卡,或选择“下一步: 磁盘”,然后选择“下一步: 网络”。Select the Networking tab, or select Next: Disks, then Next: Networking.

  4. 在“网络”选项卡中,选择或输入:In the Networking tab, select or enter:

    设置Setting “值”Value
    网络接口Network interface
    虚拟网络Virtual network myVNetmyVNet
    子网Subnet myBackendSubnetmyBackendSubnet
    公共 IPPublic IP 选择“无”。Select None.
    NIC 网络安全组NIC network security group 选择“无”Select None
    是否将此虚拟机置于现有的负载均衡解决方案之后?Place this virtual machine behind an existing load-balancing solution? 请选择“否”Select No
  5. 选择“管理”选项卡,或者选择“下一步” > “管理”。Select the Management tab, or select Next > Management.

  6. 在“管理”选项卡中,选择或输入:In the Management tab, select or enter:

    设置Setting “值”Value
    MonitoringMonitoring
    启动诊断Boot diagnostics 选择“关闭”Select Off
  7. 选择“查看 + 创建”。Select Review + create.

  8. 检查设置,然后选择“创建”。Review the settings, and then select Create.

创建负载均衡器并测试连接Create load balancers and test connectivity

使用 Azure 门户创建:Use the Azure portal to create:

  • 内部负载均衡器Internal load balancer
  • 公共负载均衡器Public load balancer

将创建的 VM 添加到每个负载均衡器的后端池。Add your created VM to the backend pool of each. 然后设定配置以便只允许来自 VM 的出站连接(在设定该配置之前和之后执行测试)。You'll then set up a configuration to only permit outbound connectivity from your VM, testing before and after.

创建内部负载均衡器Create internal load balancer

  1. 在屏幕的左上方,选择“创建资源” > “网络” > “负载均衡器” 。On the top left-hand side of the screen, select Create a resource > Networking > Load Balancer.

  2. 在“创建负载均衡器”页的“基本信息”选项卡中,输入或选择以下信息:In the Basics tab of the Create load balancer page, enter, or select the following information:

    设置Setting “值”Value
    订阅Subscription 选择订阅。Select your subscription.
    资源组Resource group 选择在上一步中创建的 myResourceGroupLB。Select myResourceGroupLB created in the previous step.
    名称Name 输入“myInternalLoadBalancer”Enter myInternalLoadBalancer
    区域Region 选择“中国东部 2”。Select China East 2.
    类型Type 选择“内部”。Select Internal.
    SKUSKU 选择“标准”Select Standard
    虚拟网络Virtual network 选择在上一步中创建的 myVNet。Select myVNet created in the previous step.
    子网Subnet 选择在上一步中创建的 myBackendSubnet。Select myBackendSubnet created in the previous step.
    IP 地址分配IP address assignment 选择“动态”。Select Dynamic.
  3. 接受剩余设置的默认值,然后选择“查看 + 创建”。Accept the defaults for the remaining settings, and then select Review + create.

  4. 在“查看 + 创建”选项卡中,选择“创建”。In the Review + create tab, select Create.

创建公共负载均衡器Create public load balancer

  1. 在屏幕的左上方,选择“创建资源” > “网络” > “负载均衡器” 。On the top left-hand side of the screen, select Create a resource > Networking > Load Balancer.

  2. 在“创建负载均衡器”页的“基本信息”选项卡中,输入或选择以下信息:In the Basics tab of the Create load balancer page, enter, or select the following information:

    设置Setting “值”Value
    订阅Subscription 选择订阅。Select your subscription.
    资源组Resource group 选择“新建”并在文本框中输入 myResourceGroupLB 。Select Create new and enter myResourceGroupLB in the text box.
    名称Name 输入“myPublicLoadBalancer”Enter myPublicLoadBalancer
    区域Region 选择“中国东部 2”。Select China East 2.
    类型Type 选择“公共”。Select Public.
    SKUSKU 选择“标准”Select Standard
    公共 IP 地址Public IP address 选择“新建”。Select Create new.
    公共 IP 地址名称Public IP address name 在文本框中输入“myFrontendIP”。Enter myFrontendIP in the text box.
    添加一个公共 IPv6 地址Add a public IPv6 address 请选择“否”。Select No.
  3. 接受剩余设置的默认值,然后选择“查看 + 创建”。Accept the defaults for the remaining settings, and then select Review + create.

  4. 在“查看 + 创建”选项卡中,选择“创建”。In the Review + create tab, select Create.

创建内部后端地址池Create internal backend address pool

创建后端地址池“myInternalBackendPool”:Create the backend address pool myInternalBackendPool:

  1. 在左侧菜单中选择“所有服务”,选择“所有资源”,然后从资源列表中选择“myInternalLoadBalancer” 。Select All services in the left-hand menu, select All resources, and then select myInternalLoadBalancer from the resources list.

  2. 在“设置”下,依次选择“后端池”、“添加”。Under Settings, select Backend pools, then select Add.

  3. 在“添加后端池”页面上,为名称键入“myInternalBackendPool”,作为后端池的名称 。On the Add a backend pool page, for name, type myInternalBackendPool, as the name for your backend pool.

  4. 在“虚拟网络”中,选择“myVNet”。In Virtual network, select myVNet.

  5. 在“虚拟机”下,选择“添加”并选择“myVM” 。Under Virtual machines, select Add and choose myVM.

  6. 选择“添加”。select Add.

创建公共后端地址池Create public backend address pool

创建后端地址池“myPublicBackendPool”:Create the backend address pool myPublicBackendPool:

  1. 在左侧菜单中选择“所有服务”,选择“所有资源”,然后从资源列表中选择“myPublicLoadBalancer” 。Select All services in the left-hand menu, select All resources, and then select myPublicLoadBalancer from the resources list.

  2. 在“设置”下,依次选择“后端池”、“添加”。Under Settings, select Backend pools, then select Add.

  3. 在“添加后端池”页面上,为名称键入“myPublicBackendPool”,作为后端池的名称 。On the Add a backend pool page, for name, type myPublicBackendPool, as the name for your backend pool.

  4. 在“虚拟网络”中,选择“myVNet”。In Virtual network, select myVNet.

  5. 在“虚拟机”下,选择“添加”并选择“myVM” 。Under Virtual machines, select Add and choose myVM.

  6. 选择“添加”。select Add.

在出站规则之前测试连接Test connectivity before outbound rule

  1. 在左侧菜单中选择“所有服务”,选择“所有资源”,然后从资源列表中选择位于“myResourceGroupLB”资源组中的“myVM”。 Select All services in the left-hand menu, select All resources, and then from the resources list, select myVM that is located in the myResourceGroupLB resource group.

  2. 在“概述”页上,选择“连接”,然后选择“Bastion” 。On the Overview page, select Connect, then Bastion.

  3. 输入在 VM 创建过程中输入的用户名和密码。Enter the username and password entered during VM creation.

  4. 选择“连接”。Select Connect.

  5. 打开 Internet Explorer。Open Internet Explorer.

  6. 在地址栏中输入“https://whatsmyip.org”。Enter https://whatsmyip.org in the address bar.

  7. 该连接应该会失败。The connection should fail. 默认情况下,标准公共负载均衡器在没有已定义的出站规则的情况下不允许有出站流量By default, standard public load balancer doesn't allow outbound traffic without a defined outbound rule.

创建公共负载均衡器出站规则Create a public load balancer outbound rule

  1. 在左侧菜单中选择“所有服务”,选择“所有资源”,然后从资源列表中选择“myPublicLoadBalancer” 。Select All services in the left-hand menu, select All resources, and then select myPublicLoadBalancer from the resources list.

  2. 在“设置”下,依次选择“出站规则”、“添加”。Under Settings, select Outbound rules, then select Add.

  3. 使用以下值配置出站规则:Use these values to configure the outbound rules:

    设置Setting Value
    名称Name 输入 myOutboundRule。Enter myOutboundRule.
    前端 IP 地址Frontend IP address 选择“LoadBalancerFrontEnd”。Select LoadBalancerFrontEnd.
    空闲超时(分钟)Idle timeout (minutes) 将滑块移动到 15 分钟。Move slider to 15 minutes.
    TCP 重置TCP Reset 选择“启用”。Select Enabled.
    后端池Backend pool 选择“myPublicBackendPool”。Select myPublicBackendPool.
    端口分配 -> 端口分配Port allocation -> Port allocation 选择“使用默认出站端口数”Select Use the default number of outbound ports
  4. 选择“添加” 。Select Add.

在出站规则之后测试连接Test connectivity after outbound rule

  1. 在左侧菜单中选择“所有服务”,选择“所有资源”,然后从资源列表中选择位于“myResourceGroupLB”资源组中的“myVM”。 Select All services in the left-hand menu, select All resources, and then from the resources list, select myVM that is located in the myResourceGroupLB resource group.

  2. 在“概述”页上,选择“连接”,然后选择“Bastion” 。On the Overview page, select Connect, then Bastion.

  3. 输入在 VM 创建过程中输入的用户名和密码。Enter the username and password entered during VM creation.

  4. 选择“连接”。Select Connect.

  5. 打开 Internet Explorer。Open Internet Explorer.

  6. 在地址栏中输入“https://whatsmyip.org”。Enter https://whatsmyip.org in the address bar.

  7. 该连接应该会成功。The connection should succeed.

  8. 显示的 IP 地址应该是 myPublicLoadBalancer 的前端 IP 地址。The IP address displayed should be the frontend IP address of myPublicLoadBalancer.

清理资源Clean up resources

如果不再需要资源组、负载均衡器、VM 及所有相关资源,请将其删除。When no longer needed, delete the resource group, load Balancers, VM, and all related resources.

为此,请选择资源组“myResourceGroupLB”,然后选择“删除” 。To do so, select the resource group myResourceGroupLB and then select Delete.

后续步骤Next steps

在本教程中,你已通过公共和内部两种负载均衡器的组合创建了一个“仅出口”配置。In this tutorial, you created an "egress only" configuration with a combination of public and internal load balancers.

利用此配置,你可以将传入的内部流量负载均衡到后端池,而同时仍阻止任何公共入站连接。This configuration allows you to load balance incoming internal traffic to your backend pool while still preventing any public inbound connections.