使用 Azure CLI 通过路由表路由网络流量Route network traffic with a route table using the Azure CLI

默认情况下,Azure 自动在虚拟网络中的所有子网之间路由流量。Azure automatically routes traffic between all subnets within a virtual network, by default. 可以创建自己的路由来覆盖 Azure 的默认路由。You can create your own routes to override Azure's default routing. 创建自定义路由的功能非常有用,例如,可以通过网络虚拟设备 (NVA) 在子网之间路由流量。The ability to create custom routes is helpful if, for example, you want to route traffic between subnets through a network virtual appliance (NVA). 在本文中,学习如何:In this article, you learn how to:

  • 创建路由表Create a route table
  • 创建路由Create a route
  • 创建包含多个子网的虚拟网络Create a virtual network with multiple subnets
  • 将路由表关联到子网Associate a route table to a subnet
  • 创建用于流量路由的 NVACreate an NVA that routes traffic
  • 将虚拟机 (VM) 部署到不同子网Deploy virtual machines (VM) into different subnets
  • 通过 NVA 将从一个子网的流量路由到另一个子网Route traffic from one subnet to another through an NVA

如果没有 Azure 订阅,可在开始前创建一个试用帐户If you don't have an Azure subscription, create a trial account before you begin.

备注

在 Azure China 中使用 Azure CLI 2.0 之前,请首先运行 az cloud set -n AzureChinaCloud 更改云环境。Before you can use Azure CLI 2.0 in Azure China, please run az cloud set -n AzureChinaCloud first to change the cloud environment. 如果要切换回全局 Azure,请再次运行 az cloud set -n AzureCloudIf you want to switch back to Global Azure, run az cloud set -n AzureCloud again.

如果选择在本地安装并使用 CLI,本快速入门要求运行 Azure CLI 2.0.28 或更高版本。If you choose to install and use the CLI locally, this quickstart requires that you are running the Azure CLI version 2.0.28 or later. 若要查找版本,请运行 az --versionTo find the version, run az --version. 如果需要进行安装或升级,请参阅安装 Azure CLIIf you need to install or upgrade, see Install Azure CLI.

创建路由表Create a route table

在创建路由表之前,请使用 az group create 针对本文中创建的所有资源创建一个资源组。Before you can create a route table, create a resource group with az group create for all resources created in this article.

# Create a resource group.
az group create \
  --name myResourceGroup \
  --location chinaeast

使用 az network route-table create 创建路由表。Create a route table with az network route-table create. 以下示例创建名为 myRouteTablePublic 的路由表。The following example creates a route table named myRouteTablePublic.

# Create a route table
az network route-table create \
  --resource-group myResourceGroup \
  --name myRouteTablePublic

创建路由Create a route

使用 az network route-table route create 在路由表中创建路由。Create a route in the route table with az network route-table route create.

az network route-table route create \
  --name ToPrivateSubnet \
  --resource-group myResourceGroup \
  --route-table-name myRouteTablePublic \
  --address-prefix 10.0.1.0/24 \
  --next-hop-type VirtualAppliance \
  --next-hop-ip-address 10.0.2.4

将路由表关联到子网Associate a route table to a subnet

将路由表关联到子网之前,必须先创建虚拟网络和子网。Before you can associate a route table to a subnet, you have to create a virtual network and subnet. 使用 az network vnet create 创建包含一个子网的虚拟网络。Create a virtual network with one subnet with az network vnet create.

az network vnet create \
  --name myVirtualNetwork \
  --resource-group myResourceGroup \
  --address-prefix 10.0.0.0/16 \
  --subnet-name Public \
  --subnet-prefix 10.0.0.0/24

使用 az network vnet subnet create 创建两个附加的子网。Create two additional subnets with az network vnet subnet create.

# Create a private subnet.
az network vnet subnet create \
  --vnet-name myVirtualNetwork \
  --resource-group myResourceGroup \
  --name Private \
  --address-prefix 10.0.1.0/24

# Create a DMZ subnet.
az network vnet subnet create \
  --vnet-name myVirtualNetwork \
  --resource-group myResourceGroup \
  --name DMZ \
  --address-prefix 10.0.2.0/24

使用 az network vnet subnet updatemyRouteTablePublic 路由表关联到公共子网。Associate the myRouteTablePublic route table to the Public subnet with az network vnet subnet update.

az network vnet subnet update \
  --vnet-name myVirtualNetwork \
  --name Public \
  --resource-group myResourceGroup \
  --route-table myRouteTablePublic

创建 NVACreate an NVA

NVA 是执行网络功能(如路由、防火墙或 WAN 优化)的 VM。An NVA is a VM that performs a network function, such as routing, firewalling, or WAN optimization.

使用 az vm createDMZ 子网中创建 NVA。Create an NVA in the DMZ subnet with az vm create. 创建 VM 时,Azure 默认会创建一个公共 IP 地址并将其分配到该 VM。When you create a VM, Azure creates and assigns a public IP address to the VM, by default. --public-ip-address "" 参数指示 Azure 不要创建公共 IP 地址并将其分配到该 VM,因为不需要从 Internet 连接到该 VM。The --public-ip-address "" parameter instructs Azure not to create and assign a public IP address to the VM, since the VM doesn't need to be connected to from the internet. 如果默认密钥位置中尚不存在 SSH 密钥,该命令会创建它们。If SSH keys do not already exist in a default key location, the command creates them. 若要使用特定的一组密钥,请使用 --ssh-key-value 选项。To use a specific set of keys, use the --ssh-key-value option.

az vm create \
  --resource-group myResourceGroup \
  --name myVmNva \
  --image UbuntuLTS \
  --public-ip-address "" \
  --subnet DMZ \
  --vnet-name myVirtualNetwork \
  --generate-ssh-keys

创建 VM 需要几分钟时间。The VM takes a few minutes to create. 在 Azure 完成创建 VM 并返回有关 VM 的输出之前,请不要继续下一步。Do not continue to the next step until Azure finishes creating the VM and returns output about the VM.

要使网络接口能够转发发送给它的、而不是发往其自身 IP 地址的网络流量,必须为该网络接口启用 IP 转发。For a network interface to be able to forward network traffic sent to it, that is not destined for its own IP address, IP forwarding must be enabled for the network interface. 使用 az network nic update 为网络接口启用 IP 转发。Enable IP forwarding for the network interface with az network nic update.

az network nic update \
  --name myVmNvaVMNic \
  --resource-group myResourceGroup \
  --ip-forwarding true

在 VM 中,VM 中运行的操作系统或应用程序也必须能够转发网络流量。Within the VM, the operating system, or an application running within the VM, must also be able to forward network traffic. 使用 az vm extension set 在 VM 的操作系统中启用 IP 转发:Enable IP forwarding within the VM's operating system with az vm extension set:

az vm extension set \
  --resource-group myResourceGroup \
  --vm-name myVmNva \
  --name customScript \
  --publisher Microsoft.Azure.Extensions \
  --settings '{"commandToExecute":"sudo sysctl -w net.ipv4.ip_forward=1"}'

执行该命令最长需要花费一分钟时间。The command may take up to a minute to execute.

创建虚拟机Create virtual machines

在虚拟网络中创建两个 VM,以便可以在后续步骤中验证来自公共子网的流量是否通过 NVA 路由到专用子网。 Create two VMs in the virtual network so you can validate that traffic from the Public subnet is routed to the Private subnet through the NVA in a later step.

使用 az vm create 在公共子网中创建一个 VM。Create a VM in the Public subnet with az vm create. --no-wait 参数支持 Azure 在后台中执行命令,因此可以继续执行下一个命令。The --no-wait parameter enables Azure to execute the command in the background so you can continue to the next command. 为了简化本文的内容,此处使用了密码。To streamline this article, a password is used. 在生产部署中通常使用密钥。Keys are typically used in production deployments. 如果使用密钥,还必须配置 SSH 代理转发。If you use keys, you must also configure SSH agent forwarding. 有关详细信息,请参阅 SSH 客户端的文档。For more information, see the documentation for your SSH client. 将以下命令中的 <replace-with-your-password> 替换为所选的密码。Replace <replace-with-your-password> in the following command with a password of your choosing.

adminPassword="<replace-with-your-password>"

az vm create \
  --resource-group myResourceGroup \
  --name myVmPublic \
  --image UbuntuLTS \
  --vnet-name myVirtualNetwork \
  --subnet Public \
  --admin-username azureuser \
  --admin-password $adminPassword \
  --no-wait

在专用子网中创建一个 VM 。Create a VM in the Private subnet.

az vm create \
  --resource-group myResourceGroup \
  --name myVmPrivate \
  --image UbuntuLTS \
  --vnet-name myVirtualNetwork \
  --subnet Private \
  --admin-username azureuser \
  --admin-password $adminPassword

创建 VM 需要几分钟时间。The VM takes a few minutes to create. 创建 VM 之后,Azure CLI 将显示类似于以下示例的信息:After the VM is created, the Azure CLI shows information similar to the following example:

{
  "fqdns": "",
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVmPrivate",
  "location": "chinaeast",
  "macAddress": "00-0D-3A-23-9A-49",
  "powerState": "VM running",
  "privateIpAddress": "10.0.1.4",
  "publicIpAddress": "13.90.242.231",
  "resourceGroup": "myResourceGroup"
}

记下 publicIpAddress。 Take note of the publicIpAddress. 在后面的步骤中会使用此地址通过 Internet 访问 VM。This address is used to access the VM from the internet in a later step.

通过 NVA 路由流量Route traffic through an NVA

使用以下命令创建与 myVmPrivate VM 的 SSH 会话。Use the following command to create an SSH session with the myVmPrivate VM. <publicIpAddress> 替换为 VM 的公共 IP 地址。Replace <publicIpAddress> with the public IP address of your VM. 在上面的示例中,IP 地址为 13.90.242.231In the example above, the IP address is 13.90.242.231.

ssh azureuser@<publicIpAddress>

当系统提示输入密码时,请输入在创建虚拟机中选择的密码。When prompted for a password, enter the password you selected in Create virtual machines.

使用以下命令在 myVmPrivate VM 上安装跟踪路由:Use the following command to install trace route on the myVmPrivate VM:

sudo apt-get install traceroute

使用以下命令测试从 myVmPrivate VM 发往 myVmPublic VM 的网络流量的路由。Use the following command to test routing for network traffic to the myVmPublic VM from the myVmPrivate VM.

traceroute myVmPublic

其响应类似于如下示例:The response is similar to the following example:

traceroute to myVmPublic (10.0.0.4), 30 hops max, 60 byte packets
1  10.0.0.4 (10.0.0.4)  1.404 ms  1.403 ms  1.398 ms

可以看到流量从 myVmPrivate VM 直接路由到 myVmPublic VM。You can see that traffic is routed directly from the myVmPrivate VM to the myVmPublic VM. Azure 的默认路由,直接在子网之间路由流量。Azure's default routes, route traffic directly between subnets.

使用以下命令从 myVmPrivate VM 通过 SSH 连接到 myVmPublic VM:Use the following command to SSH to the myVmPublic VM from the myVmPrivate VM:

ssh azureuser@myVmPublic

使用以下命令在 myVmPublic VM 上安装跟踪路由:Use the following command to install trace route on the myVmPublic VM:

sudo apt-get install traceroute

使用以下命令测试从 myVmPublic VM 发往 myVmPrivate VM 的网络流量的路由。Use the following command to test routing for network traffic to the myVmPrivate VM from the myVmPublic VM.

traceroute myVmPrivate

其响应类似于如下示例:The response is similar to the following example:

traceroute to myVmPrivate (10.0.1.4), 30 hops max, 60 byte packets
1  10.0.2.4 (10.0.2.4)  0.781 ms  0.780 ms  0.775 ms
2  10.0.1.4 (10.0.0.4)  1.404 ms  1.403 ms  1.398 ms

可以看到,第一个跃点为 10.0.2.4,即 NVA 的专用 IP 地址。You can see that the first hop is 10.0.2.4, which is the NVA's private IP address. 第二个跃点为 10.0.1.4,即 myVmPrivate VM 的专用 IP 地址。The second hop is 10.0.1.4, the private IP address of the myVmPrivate VM. 添加到 myRouteTablePublic 路由表并关联到公共子网的路由导致 Azure 通过 NVA 路由流量,而不是直接将流量路由到专用子网。 The route added to the myRouteTablePublic route table and associated to the Public subnet caused Azure to route the traffic through the NVA, rather than directly to the Private subnet.

同时关闭与 myVmPublic VM 和 myVmPrivate VM 的 SSH 会话。Close the SSH sessions to both the myVmPublic and myVmPrivate VMs.

清理资源Clean up resources

如果不再需要资源组及其包含的所有资源,可以使用 az group delete 将其删除。When no longer needed, use az group delete to remove the resource group and all of the resources it contains.

az group delete --name myResourceGroup --yes

后续步骤Next steps

在本文中,我们创建了一个路由表并将其关联到了某个子网。In this article, you created a route table and associated it to a subnet. 还创建了一个简单 NVA,用于将流量从公共子网路由到专用子网。You created a simple NVA that routed traffic from a public subnet to a private subnet. Azure 市场部署各种执行网络功能(例如防火墙和 WAN 优化)的预配置 NVA。Deploy a variety of pre-configured NVAs that perform network functions such as firewall and WAN optimization from the Azure Marketplace. 若要了解有关路由的详细信息,请参阅路由概述管理路由表To learn more about routing, see Routing overview and Manage a route table.

尽管可以在一个虚拟网络中部署多个 Azure 资源,但无法将某些 Azure PaaS 服务的资源部署到虚拟网络。While you can deploy many Azure resources within a virtual network, resources for some Azure PaaS services cannot be deployed into a virtual network. 不过,仍可以限制为只允许来自某个虚拟网络子网的流量访问某些 Azure PaaS 服务的资源。You can still restrict access to the resources of some Azure PaaS services to traffic only from a virtual network subnet though. 若要了解如何操作,请参阅限制对 PaaS 资源的网络访问To learn how, see Restrict network access to PaaS resources.