教程:使用 Azure 门户通过路由表路由网络流量Tutorial: Route network traffic with a route table using the Azure portal

默认情况下,Azure 会在虚拟网络中的所有子网之间路由流量。Azure routes traffic between all subnets within a virtual network, by default. 可以创建自己的路由来覆盖 Azure 的默认路由。You can create your own routes to override Azure's default routing. 创建自定义路由的功能非常有用,例如,可以通过网络虚拟设备 (NVA) 在子网之间路由流量。The ability to create custom routes is helpful if, for example, you want to route traffic between subnets through a network virtual appliance (NVA). 本教程介绍如何执行下列操作:In this tutorial, you learn how to:

  • 创建路由表Create a route table
  • 创建路由Create a route
  • 创建包含多个子网的虚拟网络Create a virtual network with multiple subnets
  • 将路由表关联到子网Associate a route table to a subnet
  • 创建用于流量路由的 NVACreate an NVA that routes traffic
  • 将虚拟机 (VM) 部署到不同子网Deploy virtual machines (VM) into different subnets
  • 通过 NVA 将从一个子网的流量路由到另一个子网Route traffic from one subnet to another through an NVA

如果需要,可以使用 Azure CLIAzure PowerShell 完成本教程。If you prefer, you can finish this tutorial using the Azure CLI or Azure PowerShell.

如果没有 Azure 订阅,可在开始前创建一个试用帐户If you don't have an Azure subscription, create a trial account before you begin.

登录 AzureSign in to Azure

登录到 Azure 门户Sign in to the Azure portal.

创建路由表Create a route table

  1. 在 Azure 门户菜单中,选择“创建资源” 。From the Azure portal menu, select Create a resource.

  2. 在搜索框中,输入“路由表” 。In the search box, enter Route table. 当“路由表”出现在搜索结果中时,请选择它。 When Route table appears in the search results, select it.

  3. 在“路由表” 页中,选择“创建” 。In the Route table page, select Create.

  4. 在“创建路由表”中,输入或选择以下信息 :In Create route table, enter or select this information:

    设置Setting ValueValue
    名称Name 输入 myRouteTablePublicEnter myRouteTablePublic.
    订阅Subscription 选择订阅。Select your subscription.
    资源组Resource group 选择“新建”,输入 myResourceGroup,然后选择“确定” 。Select Create new, enter myResourceGroup, and select OK.
    位置Location 选择“中国东部”。 Select China East.
    虚拟网络网关路由传播Virtual Network Gateway route propagation 保留默认值“已启用”。 Leave the default Enabled.
  5. 选择“创建” 。Select Create.

创建路由Create a route

  1. 在门户的搜索栏中,输入 myRouteTablePublicIn the portal's search bar, enter myRouteTablePublic.

  2. 当“myRouteTablePublic”出现在搜索结果中时,请选择它。 When myRouteTablePublic appears in the search results, select it.

  3. 在“myRouteTablePublic”中的“设置”下,选择“路由” > “+ 添加”。 In myRouteTablePublic under Settings, select Routes > + Add.

    添加路由

  4. 在“添加路由”中,输入或选择以下信息 :In Add route, enter or select this information:

    设置Setting ValueValue
    路由名称Route name 输入 ToPrivateSubnetEnter ToPrivateSubnet.
    地址前缀Address prefix 输入 10.0.1.0/24Enter 10.0.1.0/24.
    下一跃点类型Next hop type 选择“虚拟设备”。 Select Virtual appliance.
    下一跃点地址Next hop address 输入 10.0.2.4Enter 10.0.2.4.
  5. 选择“确定” 。Select OK.

将路由表关联到子网Associate a route table to a subnet

将路由表关联到子网之前,必须先创建虚拟网络和子网。Before you can associate a route table to a subnet, you have to create a virtual network and subnet.

创建虚拟网络Create a virtual network

  1. 在屏幕的左上方,选择“创建资源” > “网络” > “虚拟网络” 。On the upper-left side of the screen, select Create a resource > Networking > Virtual network.

  2. 在“创建虚拟网络” 中,输入或选择以下信息:In Create virtual network, enter or select this information:

    设置Setting ValueValue
    名称Name 输入 myVirtualNetwork 。Enter myVirtualNetwork.
    地址空间Address space 输入 10.0.0.0/16Enter 10.0.0.0/16.
    订阅Subscription 选择订阅。Select your subscription.
    资源组Resource group 选择“选择现有项” > “myResourceGroup”。 Select Select existing > myResourceGroup.
    位置Location 保留默认值“中国东部”。 Leave the default China East.
    子网 - 名称Subnet - Name 输入“公共”。 Enter Public.
    子网 - 地址范围Subnet - Address range 输入 10.0.0.0/24Enter 10.0.0.0/24.
  3. 将剩余的字段保留默认设置,然后选择 “创建”Leave the rest of the defaults and select Create.

将子网添加到虚拟网络Add subnets to the virtual network

  1. 在门户的搜索栏中,输入 myVirtualNetworkIn the portal's search bar, enter myVirtualNetwork.

  2. 当“myVirtualNetwork”出现在搜索结果中时,将其选中。 When myVirtualNetwork appears in the search results, select it.

  3. 在“myVirtualNetwork”中的“设置”下,选择“子网” > “+ 子网”。 In myVirtualNetwork, under Settings, select Subnets > + Subnet.

    添加子网

  4. 在“添加子网”中输入以下信息: In Add subnet, enter this information:

    设置Setting ValueValue
    名称Name 输入“专用”。 Enter Private.
    地址空间Address space 输入 10.0.1.0/24Enter 10.0.1.0/24.
  5. 将剩余的字段保留默认设置,然后选择“确定”。 Leave the rest of the defaults and select OK.

  6. 再次选择“+ 子网”。 Select + Subnet again. 这一次请输入以下信息:This time, enter this information:

    设置Setting ValueValue
    名称Name 输入“外围网络”。 Enter DMZ.
    地址空间Address space 输入 10.0.2.0/24Enter 10.0.2.0/24.
  7. 与上次一样,将剩余的字段保留默认值,然后选择“确定”。 Like the last time, leave the rest of the defaults and select OK.

    Azure 显示三个子网:“公共”、“专用”和“外围网络”。 Azure shows the three subnets: Public, Private, and DMZ.

将 myRouteTablePublic 关联到“公共”子网Associate myRouteTablePublic to your Public subnet

  1. 选择“公共”。 Select Public.

  2. 在“公共”中,选择“路由表” > “MyRouteTablePublic” > “保存”。 In Public, select Route table > MyRouteTablePublic > Save.

    关联路由表

创建 NVACreate an NVA

NVA 是帮助实现网络功能(例如路由和防火墙优化)的 VM。NVAs are VMs that help with network functions like routing and firewall optimization. 如果需要,可以选择不同的操作系统。You can select a different operating system if you want. 本教程假设使用 Windows Server 2016 DatacenterThis tutorial assumes you're using Windows Server 2016 Datacenter.

  1. 在屏幕的左上方,选择“创建资源” > “虚拟机” > “Windows Server 2016 Datacenter”。 On the upper-left side of the screen, select Create a resource > Virtual Machines > Windows Server 2016 Datacenter.

  2. 在“创建虚拟机 - 基本信息” 中,输入或选择以下信息:In Create a virtual machine - Basics, enter or select this information:

    设置Setting ValueValue
    项目详细信息PROJECT DETAILS
    订阅Subscription 选择订阅。Select your subscription.
    资源组Resource group 选择“myResourceGroup”。 Select myResourceGroup.
    实例详细信息INSTANCE DETAILS
    虚拟机名称Virtual machine name 输入 myVmNvaEnter myVmNva.
    区域Region 选择“中国东部”。 Select China East.
    可用性选项Availability options 保留默认值“不需要基础结构冗余” 。Leave the default No infrastructure redundancy required.
    映像Image 保留默认值“Microsoft Windows Server 2016 Datacenter” 。Leave the default Windows Server 2016 Datacenter.
    大小Size 保留默认值“标准 DS1 v2” 。Leave the default Standard DS1 v2.
    管理员帐户ADMINISTRATOR ACCOUNT
    用户名Username 输入所选用户名。Enter a user name of your choosing.
    密码Password 输入所选密码。Enter a password of your choosing. 密码必须至少 12 个字符长,且符合定义的复杂性要求The password must be at least 12 characters long and meet the defined complexity requirements.
    确认密码Confirm Password 重新输入密码。Reenter password.
    入站端口规则INBOUND PORT RULES
    公共入站端口Public inbound ports 选择“无”。 Select None.
    节省资金SAVE MONEY
    已有 Windows 许可证?Already have a Windows license? 保留默认值“否” 。Leave the default No.
  3. 选择“下一步:磁盘”Select Next : Disks.

  4. 在“创建虚拟机 - 磁盘”中,选择符合需求的设置。 In Create a virtual machine - Disks, select the settings that are right for your needs.

  5. 选择“下一步: 网络”。Select Next : Networking.

  6. 在“创建虚拟机 - 基本信息” 中,选择以下信息:In Create a virtual machine - Networking, select this information:

    设置Setting ValueValue
    虚拟网络Virtual network 保留默认值“myVirtualNetwork” 。Leave the default myVirtualNetwork.
    子网Subnet 选择“外围网络(10.0.2.0/24)”。 Select DMZ (10.0.2.0/24).
    公共 IPPublic IP 选择“无”。 Select None. 不需要公共 IP 地址。You don't need a public IP address. VM 不会通过 Internet 进行连接。The VM won't connect over the internet.
  7. 将剩余的字段保留默认值,然后选择“下一步:管理”Leave the rest of the defaults and select Next : Management.

  8. 在“创建虚拟机 - 管理”中,为“诊断存储帐户”选择“新建” 。In Create a virtual machine - Management, for Diagnostics storage account, select Create New.

  9. 在“创建存储帐户”中,输入或选择以下信息 :In Create storage account, enter or select this information:

    设置Setting ValueValue
    名称Name 输入 mynvastorageaccountEnter mynvastorageaccount.
    帐户类型Account kind 保留默认值“存储(常规用途 v1)” 。Leave the default Storage (general purpose v1).
    性能Performance 保留默认值“标准” 。Leave the default Standard.
    复制Replication 保留默认值“本地冗余存储(LRS)” 。Leave the default Locally-redundant storage (LRS).
  10. 选择“确定” Select OK

  11. 选择“查看 + 创建” 。Select Review + create. 随后你会转到“查看 + 创建”页,Azure 将验证配置 。You're taken to the Review + create page and Azure validates your configuration.

  12. 显示“验证通过”时,请选择“创建” 。When you see that Validation passed, select Create.

    创建 VM 需要几分钟时间。The VM takes a few minutes to create. 请等到 Azure 创建完 VM 为止。Don't keep going until Azure finishes creating the VM. “部署正在进行”页会显示部署详细信息。 The Your deployment is underway page will show you deployment details.

  13. VM 准备就绪后,选择“转到资源”。 When your VM is ready, select Go to resource.

启用 IP 转发Turn on IP forwarding

myVmNva 启用 IP 转发。Turn on IP forwarding for myVmNva. 当 Azure 向 myVmNva 发送网络流量时,如果流量发往不同的 IP 地址,则 IP 转发会将流量发送到正确的位置。When Azure sends network traffic to myVmNva, if the traffic is destined for a different IP address, IP forwarding will send the traffic to the correct location.

  1. 在“myVmNva”中的“设置”下,选择“网络” 。On myVmNva, under Settings, select Networking.

  2. 选择“myvmnva123”。 Select myvmnva123. 这是 Azure 为 VM 创建的网络接口。That's the network interface Azure created for your VM. 该接口带有一个数字字符串,使其名称保持唯一。It will have a string of numbers to make it unique for you.

    VM 网络

  3. 在“设置”下选择“IP 配置”。 Under Settings, select IP configurations.

  4. 在“myvmnva123 - IP 配置”中,对“IP 转发”选择“已启用”,然后选择“保存”。 On myvmnva123 - IP configurations, for IP forwarding, select Enabled and then select Save.

    启用 IP 转发

创建公共和专用虚拟机Create public and private virtual machines

在虚拟网络中创建公共 VM 和专用 VM。Create a public VM and a private VM in the virtual network. 稍后,我们将使用这些 VM 来查看 Azure 如何通过 NVA 将“公共”子网流量路由到“专用”子网。 Later, you'll use them to see that Azure routes the Public subnet traffic to the Private subnet through the NVA.

完成创建 NVA 的步骤 1-12。Complete steps 1-12 of Create an NVA. 为大多数字段使用相同的设置。Use most of the same settings. 但以下值必须不同:These values are the ones that have to be different:

设置Setting ValueValue
公共 VMPUBLIC VM
基础BASICS
虚拟机名称Virtual machine name 输入 myVmPublicEnter myVmPublic.
网络NETWORKING
子网Subnet 选择“公共(10.0.0.0/24)”。 Select Public (10.0.0.0/24).
公共 IP 地址Public IP address 接受默认值。Accept the default.
公共入站端口Public inbound ports 选择“允许所选端口” 。Select Allow selected ports.
选择入站端口Select inbound ports 选择“HTTP”和“RDP”。 Select HTTP and RDP.
管理MANAGEMENT
诊断存储帐户Diagnostics storage account 保留默认值“mynvastorageaccount”。 Leave the default mynvastorageaccount.
专用 VMPRIVATE VM
基础BASICS
虚拟机名称Virtual machine name 输入 myVmPrivateEnter myVmPrivate.
网络NETWORKING
子网Subnet 选择“专用(10.0.1.0/24)” 。Select Private (10.0.1.0/24).
公共 IP 地址Public IP address 接受默认值。Accept the default.
公共入站端口Public inbound ports 选择“允许所选端口” 。Select Allow selected ports.
选择入站端口Select inbound ports 选择“HTTP”和“RDP”。 Select HTTP and RDP.
管理MANAGEMENT
诊断存储帐户Diagnostics storage account 保留默认值“mynvastorageaccount”。 Leave the default mynvastorageaccount.

在 Azure 创建 myVmPublic VM 时,你可以创建 myVmPrivate VM。You can create the myVmPrivate VM while Azure creates the myVmPublic VM. 在 Azure 创建完两个 VM 之前,请不要继续执行剩余的步骤。Don't continue with the rest of the steps until Azure finishes creating both VMs.

通过 NVA 路由流量Route traffic through an NVA

通过远程桌面登录到 myVmPrivateSign in to myVmPrivate over remote desktop

  1. 在门户的搜索栏中,输入 myVmPrivateIn the portal's search bar, enter myVmPrivate.

  2. 当“myVmPrivate”VM 出现在搜索结果中时,请选择它。 When the myVmPrivate VM appears in the search results, select it.

  3. 选择“连接”,以便与 myVmPrivate VM 建立远程桌面连接。 Select Connect to create a remote desktop connection to the myVmPrivate VM.

  4. 在“连接到虚拟机”中,选择“下载 RDP 文件”。 In Connect to virtual machine, select Download RDP File. Azure 会创建远程桌面协议 ( .rdp) 文件,并将其下载到计算机。Azure creates a Remote Desktop Protocol (.rdp) file and downloads it to your computer.

  5. 打开下载的 .rdp 文件。Open the downloaded .rdp file.

    1. 出现提示时,选择“连接” 。If prompted, select Connect.

    2. 输入创建专用 VM 时指定的用户名和密码。Enter the user name and password you specified when creating the Private VM.

    3. 可能需要选择“更多选项” > “使用其他帐户”才能使用专用 VM 的凭据。 You may need to select More choices > Use a different account, to use the Private VM credentials.

  6. 选择“确定” 。Select OK.

    在登录过程中可能会收到证书警告。You may receive a certificate warning during the sign in process.

  7. 请选择“是”以连接到 VM。 Select Yes to connect to the VM.

允许 ICMP 通过 Windows 防火墙Enable ICMP through the Windows firewall

在稍后的步骤中,我们将使用跟踪路由工具来测试路由。In a later step, you'll use the trace route tool to test routing. 跟踪路由使用 Internet 控制消息协议 (ICMP),而 Windows 防火墙默认拒绝该协议。Trace route uses the Internet Control Message Protocol (ICMP), which the Windows Firewall denies by default. 启用通过 Windows 防火墙的 ICMP。Enable ICMP through the Windows firewall.

  1. myVmPrivate 的远程桌面中,打开 PowerShell。In the Remote Desktop of myVmPrivate, open PowerShell.

  2. 输入以下命令:Enter this command:

    New-NetFirewallRule -DisplayName "Allow ICMPv4-In" -Protocol ICMPv4
    

    在本教程中,我们将使用跟踪路由来测试路由。You're using trace route to test routing in this tutorial. 对于生产环境,我们不建议允许通过 Windows 防火墙的 ICMP。For production environments, we don't recommend allowing ICMP through the Windows Firewall.

在 myVmNva 中启用 IP 转发Turn on IP forwarding within myVmNva

我们已使用 Azure 为 VM 的网络接口启用了 IP 转发You turned on IP forwarding for the VM's network interface using Azure. VM 的操作系统也必须转发网络流量。The VM's operating system also has to forward network traffic. 使用以下命令为 myVmNva VM 的操作系统启用 IP 转发。Turn on IP forwarding for myVmNva VM's operating system with these commands.

  1. myVmPrivate VM 中的命令提示符下,打开远程桌面并连接到 myVmNva VM:From a command prompt on the myVmPrivate VM, open a remote desktop to the myVmNva VM:

    mstsc /v:myvmnva
    
  2. myVmNva 上的 PowerShell 中输入以下命令,以启用 IP 转发:From PowerShell on the myVmNva, enter this command to turn on IP forwarding:

    Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters -Name IpEnableRouter -Value 1
    
  3. 重启 myVmNva VM。Restart the myVmNva VM. 在任务栏中,选择“开始”按钮 > “电源”按钮 >“其他(已计划)” > “继续”。 From the taskbar, select Start button > Power button, Other (Planned) > Continue.

    这也会断开远程桌面会话的连接。That also disconnects the remote desktop session.

  4. 重启 myVmNva VM 后,与 myVmPublic VM 建立远程桌面会话。After the myVmNva VM restarts, create a remote desktop session to the myVmPublic VM. 在仍与 myVmPrivate VM 保持连接的情况下,打开命令提示符并运行以下命令:While still connected to the myVmPrivate VM, open a command prompt and run this command:

    mstsc /v:myVmPublic
    
  5. myVmPublic 的远程桌面中,打开 PowerShell。In the Remote Desktop of myVmPublic, open PowerShell.

  6. 输入以下命令,启用通过 Windows 防火墙的 ICMP:Enable ICMP through the Windows firewall by entering this command:

    New-NetFirewallRule -DisplayName "Allow ICMPv4-In" -Protocol ICMPv4
    

测试网络流量的路由Test the routing of network traffic

首先,让我们测试从 myVmPublic VM 到 myVmPrivate VM 的网络流量路由。First, let's test routing of network traffic from the myVmPublic VM to the myVmPrivate VM.

  1. myVmPublic VM 上的 PowerShell 中,输入以下命令:From PowerShell on the myVmPublic VM, enter this command:

    tracert myVmPrivate
    

    响应类似于以下示例:The response is similar to this example:

    Tracing route to myVmPrivate.vpgub4nqnocezhjgurw44dnxrc.bx.internal.chinacloudapp.cn [10.0.1.4]
    over a maximum of 30 hops:
    
    1    <1 ms     *        1 ms  10.0.2.4
    2     1 ms     1 ms     1 ms  10.0.1.4
    
    Trace complete.
    

    可以看到,第一个跃点为路由到 10.0.2.4。You can see the first hop is to 10.0.2.4. 此地址是 NVA 的专用 IP 地址。It's NVA's private IP address. 第二个跃点为路由到 myVmPrivate VM 的专用 IP 地址:10.0.1.4。The second hop is to the private IP address of the myVmPrivate VM: 10.0.1.4. 前面我们已将路由添加到 myRouteTablePublic 路由表,并已将它关联到“公共”子网。 Earlier, you added the route to the myRouteTablePublic route table and associated it to the Public subnet. 因此,Azure 通过 NVA 发送了流量,而不是直接将流量发送到“专用”子网。 As a result, Azure sent the traffic through the NVA and not directly to the Private subnet.

  2. 关闭与 myVmPublic VM 建立的远程桌面会话,这样,就会与 myVmPrivate VM 保持连接。Close the remote desktop session to the myVmPublic VM, which leaves you still connected to the myVmPrivate VM.

  3. myVmPrivate VM 中的命令提示符下,输入以下命令:From a command prompt on the myVmPrivate VM, enter this command:

    tracert myVmPublic
    

    该命令测试从 myVmPrivate VM 到 myVmPublic VM 的网络流量路由。It tests the routing of network traffic from the myVmPrivate VM to the myVmPublic VM. 响应类似于以下示例:The response is similar to this example:

    Tracing route to myVmPublic.vpgub4nqnocezhjgurw44dnxrc.bx.internal.chinacloudapp.cn [10.0.0.4]
    over a maximum of 30 hops:
    
    1     1 ms     1 ms     1 ms  10.0.0.4
    
    Trace complete.
    

    可以看到,Azure 直接将流量从 myVmPrivate VM 路由到了 myVmPublic VM。You can see Azure routes traffic directly from the myVmPrivate VM to the myVmPublic VM. 默认情况下,Azure 直接在子网之间路由流量。By default, Azure routes traffic directly between subnets.

  4. 关闭与 myVmPrivate VM 建立的远程桌面会话。Close the remote desktop session to the myVmPrivate VM.

清理资源Clean up resources

不再需要资源组时,可将资源组及其包含的所有资源一并删除:When no longer needed, delete the resource group and all resources it has:

  1. 在门户的搜索栏中,输入 myResourceGroupIn the portal's search bar, enter myResourceGroup.

  2. 当在搜索结果中看到“myResourceGroup”时,将其选中。 When you see myResourceGroup in the search results, select it.

  3. 选择“删除资源组” 。Select Delete resource group.

  4. 对于“键入资源组名称:”,输入“myResourceGroup”,然后选择“删除”。 Enter myResourceGroup for TYPE THE RESOURCE GROUP NAME: and select Delete.

后续步骤Next steps

在本教程中,你创建了一个路由表并将其关联到了某个子网。In this tutorial, you created a route table and associated it to a subnet. 还创建了一个简单 NVA,用于将流量从公共子网路由到专用子网。You created a simple NVA that routed traffic from a public subnet to a private subnet. 了解如何执行该操作后,可以部署 Azure 市场中提供的其他预配置 NVA。Now that you know how to do that, you can deploy different pre-configured NVAs from the Azure Marketplace. 这些 NVA 可以执行许多有用的网络功能。They carry out many network functions you'll find useful. 若要了解有关路由的详细信息,请参阅路由概述管理路由表To learn more about routing, see Routing overview and Manage a route table.

尽管可以在一个虚拟网络中部署多个 Azure 资源,但 Azure 无法将某些 PaaS 服务的资源部署到虚拟网络。While you can deploy many Azure resources within a virtual network, Azure can't deploy resources for some PaaS services into a virtual network. 可以限制访问某些 Azure PaaS 服务的资源。It's possible to restrict access to the resources of some Azure PaaS services. 不过,只能对来自虚拟网络子网的流量进行这种限制。The restriction must only be traffic from a virtual network subnet though. 若要了解如何限制 Azure PaaS 资源的网络访问,请继续学习下一篇教程。To learn how to restrict network access to Azure PaaS resources, advance to the next tutorial.