教程:使用 Azure 门户通过路由表路由网络流量Tutorial: Route network traffic with a route table using the Azure portal

默认情况下,Azure 会在虚拟网络中的所有子网之间路由流量。Azure routes traffic between all subnets within a virtual network, by default. 可以创建自己的路由来覆盖 Azure 的默认路由。You can create your own routes to override Azure's default routing. 自定义路由非常有用,例如,它可以让你通过网络虚拟设备 (NVA) 在子网之间路由流量。Custom routes are helpful when, for example, you want to route traffic between subnets through a network virtual appliance (NVA). 在本教程中,你将了解如何执行以下操作:In this tutorial, you learn how to:

  • 创建用于流量路由的 NVACreate an NVA that routes traffic
  • 创建路由表Create a route table
  • 创建路由Create a route
  • 将路由表关联到子网Associate a route table to a subnet
  • 将虚拟机 (VM) 部署到不同子网Deploy virtual machines (VM) into different subnets
  • 通过 NVA 将从一个子网的流量路由到另一个子网Route traffic from one subnet to another through an NVA

本教程使用 Azure 门户This tutorial uses the Azure portal. 你也可使用 Azure CLIAzure PowerShellYou can also use Azure CLI or Azure PowerShell.

如果没有 Azure 订阅,可在开始前创建一个试用帐户If you don't have an Azure subscription, create a trial account before you begin.

创建 NVACreate an NVA

网络虚拟设备 (NVA) 是帮助提供网络功能(例如路由和防火墙优化)的虚拟机。Network virtual appliances (NVAs) are virtual machines that help with network functions, such as routing and firewall optimization. 本教程假设使用 Windows Server 2016 DatacenterThis tutorial assumes you're using Windows Server 2016 Datacenter. 如果需要,可以选择不同的操作系统。You can select a different operating system if you want.

  1. Azure 门户菜单或“主页”中,选择“创建资源”。 On the Azure portal menu or from the Home page, select Create a resource.

  2. 选择“安全性” > “Windows Server 2016 Datacenter”。 Choose Security > Windows Server 2016 Datacenter.

    Windows Server 2016 Datacenter,创建 VM,Azure 门户

  3. 在“创建虚拟机”页中的“基本信息”下,输入或选择以下信息: In the Create a virtual machine page, under Basics, enter or select this information:

    部分Section 设置Setting 操作Action
    项目详细信息Project details 订阅Subscription 选择订阅。Choose your subscription.
    资源组Resource group 选择“新建”,输入 myResourceGroup,然后选择“确定” 。Select Create new, enter myResourceGroup, and select OK.
    实例详细信息Instance details 虚拟机名称Virtual machine name 输入 myVmNvaEnter myVmNva.
    区域Region 选择“中国东部”。Choose China East.
    可用性选项Availability options 选择“无需基础结构冗余”。Choose No infrastructure redundancy required.
    映像Image 选择“Windows Server 2016 Datacenter”。Choose Windows Server 2016 Datacenter.
    大小Size 保留默认值“标准 DS1 v2”。Keep the default, Standard DS1 v2.
    管理员帐户Administrator account 用户名Username 输入所选用户名。Enter a user name of your choosing.
    密码Password 输入所选的密码,该密码必须至少包含 12 个字符,且符合定义的复杂性要求Enter a password of your choosing, which must be at least 12 characters long and meet the defined complexity requirements.
    确认密码Confirm Password 再次输入密码。Enter the password again.
    入站端口规则Inbound port rules 公共入站端口Public inbound ports 选择“无”。Pick None.
    节省资金Save money 已有 Windows Server 许可证?Already have a Windows Server license? 选取“否”。Pick No.

    “基本信息”,创建虚拟机,Azure 门户

    然后选择页面底部的“下一步:磁盘 >”。Then select Next : Disks >.

  4. 在“磁盘”下选择符合需求的设置,然后选择“下一步: 网络 >”。Under Disks, select the settings that are right for your needs, and then select Next : Networking >.

  5. 在“网络”下:Under Networking:

    1. 对于“虚拟网络”,请选择“新建”。 For Virtual network, select Create new.

    2. 在“创建虚拟网络”对话框中的“名称”下,输入 myVirtualNetworkIn the Create virtual network dialog box, under Name, enter myVirtualNetwork.

    3. 在“地址空间”中,将现有的地址范围替换为 10.0.0.0/16In Address space, replace the existing address range with 10.0.0.0/16.

    4. 在“子网”中,选择“删除”图标删除现有子网,然后输入“子网名称”和“地址范围”的以下组合。 In Subnets, select the Delete icon to delete the existing subnet, and then enter the following combinations of Subnet name and Address range. 输入有效的名称和范围后,该子网下面会出现一个新的空行。Once a valid name and range is entered, a new empty row appears below it.

      子网名称Subnet name 地址范围Address range
      公共Public 10.0.0.0/2410.0.0.0/24
      专用Private 10.0.1.0/2410.0.1.0/24
      外围网络DMZ 10.0.2.0/2410.0.2.0/24
    5. 选择“确定”退出对话框。Select OK to exit the dialog box.

    6. 在“子网”中选择“外围网络(10.0.2.0/24)”。 In Subnet, choose DMZ (10.0.2.0/24).

    7. 在“公共 IP”中选择“无”,因为此 VM 不会通过 Internet 进行连接。 In Public IP, choose None, since this VM won't connect over the internet.

    8. 选择“下一步: 管理 >”。Select Next : Management >.

  6. 在“管理”下:Under Management:

    1. 在“诊断存储帐户”中选择“新建”。 In Diagnostics storage account, select Create New.

    2. 在“创建存储帐户”对话框中,输入或选择以下信息:In the Create storage account dialog box, enter or select this information:

      设置Setting Value
      名称Name mynvastorageaccountmynvastorageaccount
      帐户类型Account kind “存储(常规用途 v1)”Storage (general purpose v1)
      性能Performance StandardStandard
      复制Replication 本地冗余存储 (LRS)Locally-redundant storage (LRS)
    3. 选择“确定”退出对话框。Select OK to exit the dialog box.

    4. 选择“查看 + 创建”。Select Review + create. 随后你会转到“查看 + 创建”页,Azure 将验证配置。You're taken to the Review + create page, and Azure validates your configuration.

  7. 看到“验证通过”消息时,选择“创建” 。When you see the Validation passed message, select Create.

    创建 VM 需要几分钟时间。The VM takes a few minutes to create. 等到 Azure 创建完 VM 为止。Wait until Azure finishes creating the VM. “部署正在进行”页会显示部署详细信息。The Your deployment is underway page shows you deployment details.

  8. VM 准备就绪后,选择“转到资源”。When your VM is ready, select Go to resource.

创建路由表Create a route table

  1. Azure 门户菜单或“主页”中,选择“创建资源”。 On the Azure portal menu or from the Home page, select Create a resource.

  2. 在搜索框中,输入“路由表”。In the search box, enter Route table. 当“路由表”出现在搜索结果中时,请选择它。When Route table appears in the search results, select it.

  3. 在“路由表”页中,选择“创建”。In the Route table page, select Create.

  4. 在“创建路由表”中,输入或选择以下信息:In Create route table, enter or select this information:

    设置Setting Value
    名称Name myRouteTablePublicmyRouteTablePublic
    订阅Subscription 订阅Your subscription
    资源组Resource group myResourceGroupmyResourceGroup
    位置Location 中国东部China East
    虚拟网络网关路由传播Virtual network gateway route propagation 已启用Enabled

    创建路由表,Azure 门户

  5. 选择“创建”。Select Create.

创建路由Create a route

  1. 转到 Azure 门户来管理路由表。Go to the Azure portal to manage your route table. 搜索并选择“路由表”。Search for and select Route tables.

  2. 选择路由表的名称 (myRouteTablePublic)。Pick the name of your route table (myRouteTablePublic).

  3. 选择“路由” > “添加”。 Choose Routes > Add.

    创建路由,路由表,Azure 门户

  4. 在“添加路由”中,输入或选择以下信息:In Add route, enter or select this information:

    设置Setting Value
    路由名称Route name ToPrivateSubnetToPrivateSubnet
    地址前缀Address prefix 10.0.1.0/24(前面创建的“专用”子网的地址范围)10.0.1.0/24 (the address range of the Private subnet created earlier)
    下一跃点类型Next hop type 虚拟设备Virtual appliance
    下一跃点地址Next hop address 10.0.2.4(“外围网络”子网地址范围内的某个地址)10.0.2.4 (an address within the address range of the DMZ subnet)
  5. 选择“确定”。Select OK.

将路由表关联到子网Associate a route table to a subnet

  1. 转到 Azure 门户来管理虚拟网络。Go to the Azure portal to manage your virtual network. 搜索并选择“虚拟网络”。Search for and select Virtual networks.

  2. 选择虚拟网络的名称 (myVirtualNetwork)。Pick the name of your virtual network (myVirtualNetwork).

  3. 在虚拟网络的菜单栏中选择“子网”。In the virtual network's menu bar, choose Subnets.

  4. 在虚拟网络的子网列表中选择“公共”。In the virtual network's subnet list, choose Public.

  5. 在“路由表”中选择创建的路由表 (myRouteTablePublic),然后选择“保存”以将路由表关联到“公共”子网。 In Route table, choose the route table you created (myRouteTablePublic), and then select Save to associate your route table to the Public subnet.

    关联路由表,子网列表,虚拟网络,Azure 门户

启用 IP 转发Turn on IP forwarding

接下来,为新的 NVA 虚拟机 myVmNva 启用 IP 转发。Next, turn on IP forwarding for your new NVA virtual machine, myVmNva. 当 Azure 向 myVmNva 发送网络流量时,如果流量发往不同的 IP 地址,则 IP 转发会将流量发送到正确的位置。When Azure sends network traffic to myVmNva, if the traffic is destined for a different IP address, IP forwarding sends the traffic to the correct location.

  1. 转到 Azure 门户来管理 VM。Go to the Azure portal to manage your VM. 搜索并选择“虚拟机”。Search for and select Virtual machines.

  2. 选择 VM 的名称 (myVmNva)。Pick the name of your VM (myVmNva).

  3. 在 NVA 虚拟机的菜单栏中选择“网络”。In your NVA virtual machine's menu bar, select Networking.

  4. 选择“myvmnva123”。Select myvmnva123. 这是 Azure 为 VM 创建的网络接口。That's the network interface Azure created for your VM. Azure 将添加数字来确保接口的名称保持唯一。Azure adds numbers to ensure a unique name.

    网络,网络虚拟设备 (NVA) 虚拟机 (VM),Azure 门户

  5. 在网络接口菜单栏中选择“IP 配置”。In the network interface menu bar, select IP configurations.

  6. 在“IP 配置”页中,将“IP 转发”设置为“已启用”,然后选择“保存”。 In the IP configurations page, set IP forwarding to Enabled, and select Save.

    启用 IP 转发,IP 配置,网络接口,网络虚拟设备 (NVA) 虚拟机 (VM),Azure 门户

创建公共和专用虚拟机Create public and private virtual machines

在虚拟网络中创建公共 VM 和专用 VM。Create a public VM and a private VM in the virtual network. 稍后,我们将使用这些 VM 来查看 Azure 如何通过 NVA 将“公共”子网流量路由到“专用”子网。 Later, you'll use them to see that Azure routes the Public subnet traffic to the Private subnet through the NVA.

若要创建公共 VM 和专用 VM,请遵循前面所述的创建 NVA 的步骤。To create the public VM and the private VM, follow the steps of Create an NVA earlier. 无需等待部署完成,也不需要转到 VM 资源。You don't need to wait for deployment to finish or go to the VM resource. 使用的大多数设置与前面所述相同,但下述设置除外。You'll use most of the same settings, except as described below.

在选择“创建”来创建公共或专用 VM 之前,请转到以下两个子部分(公共 VM专用 VM),其中列出了必须修改的值。Before you select Create to create the public or private VM, go to the following two subsections (Public VM and Private VM), which show the values that have to be different. 在 Azure 部署完这两个 VM 之后,你可以转到下一部分(通过 NVA 路由流量)。You may continue to the next section (Route traffic through an NVA) after Azure finishes deploying both VMs.

公共 VMPublic VM

选项卡Tab 设置Setting Value
基础Basics 资源组Resource group myResourceGroupmyResourceGroup
虚拟机名称Virtual machine name myVmPublicmyVmPublic
公共入站端口Public inbound ports “允许选定的端口”Allow selected ports
选择入站端口Select inbound ports RDPRDP
网络Networking 虚拟网络Virtual network myVirtualNetworkmyVirtualNetwork
子网Subnet “公共(10.0.0.0/24)”Public (10.0.0.0/24)
公共 IP 地址Public IP address 默认值The default
管理Management 诊断存储帐户Diagnostics storage account mynvastorageaccountmynvastorageaccount

专用 VMPrivate VM

选项卡Tab 设置Setting Value
基础Basics 资源组Resource group myResourceGroupmyResourceGroup
虚拟机名称Virtual machine name myVmPrivatemyVmPrivate
公共入站端口Public inbound ports “允许选定的端口”Allow selected ports
选择入站端口Select inbound ports RDPRDP
网络Networking 虚拟网络Virtual network myVirtualNetworkmyVirtualNetwork
子网Subnet “专用(10.0.1.0/24)”Private (10.0.1.0/24)
公共 IP 地址Public IP address 默认值The default
管理Management 诊断存储帐户Diagnostics storage account mynvastorageaccountmynvastorageaccount

通过 NVA 路由流量Route traffic through an NVA

通过远程桌面登录到 myVmPrivateSign in to myVmPrivate over remote desktop

  1. 转到 Azure 门户来管理专用 VM。Go to the Azure portal to manage your private VM. 搜索并选择“虚拟机”。Search for and select Virtual machines.

  2. 选择专用 VM 的名称 (myVmPrivate)。Pick the name of your private VM (myVmPrivate).

  3. 选择 VM 菜单栏中“连接”,以便与专用 VM 建立远程桌面连接。In the VM menu bar, select Connect to create a remote desktop connection to the private VM.

  4. 在“使用 RDP 连接”页中,选择“下载 RDP 文件”。 In the Connect with RDP page, select Download RDP File. Azure 会创建远程桌面协议 ( .rdp) 文件,并将其下载到计算机。Azure creates a Remote Desktop Protocol (.rdp) file and downloads it to your computer.

  5. 打开下载的 .rdp 文件。Open the downloaded .rdp file. 出现提示时,选择“连接”。If prompted, select Connect. 选择“更多选项” > “使用其他帐户”,然后输入创建专用 VM 时指定的用户名和密码。 Select More choices > Use a different account, and then enter the user name and password you specified when creating the private VM.

  6. 选择“确定”。Select OK.

  7. 如果在登录过程中看到证书警告,请选择“是”以连接到 VM。If you receive a certificate warning during the sign-in process, select Yes to connect to the VM.

允许 ICMP 通过 Windows 防火墙Enable ICMP through the Windows firewall

在稍后的步骤中,我们将使用跟踪路由工具来测试路由。In a later step, you'll use the trace route tool to test routing. 跟踪路由使用 Internet 控制消息协议 (ICMP),而 Windows 防火墙默认拒绝该协议。Trace route uses the Internet Control Message Protocol (ICMP), which the Windows Firewall denies by default. 启用通过 Windows 防火墙的 ICMP。Enable ICMP through the Windows firewall.

  1. myVmPrivate 的远程桌面中,打开 PowerShell。In the Remote Desktop of myVmPrivate, open PowerShell.

  2. 输入以下命令:Enter this command:

    New-NetFirewallRule -DisplayName "Allow ICMPv4-In" -Protocol ICMPv4
    

    本教程将使用跟踪路由来测试路由。You'll be using trace route to test routing in this tutorial. 对于生产环境,我们不建议允许通过 Windows 防火墙的 ICMP。For production environments, we don't recommend allowing ICMP through the Windows Firewall.

在 myVmNva 中启用 IP 转发Turn on IP forwarding within myVmNva

我们已使用 Azure 为 VM 的网络接口启用了 IP 转发You turned on IP forwarding for the VM's network interface using Azure. VM 的操作系统也必须转发网络流量。The VM's operating system also has to forward network traffic. 使用以下命令为 myVmNva VM 的操作系统启用 IP 转发。Turn on IP forwarding for myVmNva VM's operating system with these commands.

  1. myVmPrivate VM 中的命令提示符下,打开远程桌面并连接到 myVmNva VM:From a command prompt on the myVmPrivate VM, open a remote desktop to the myVmNva VM:

    mstsc /v:myvmnva
    
  2. myVmNva VM 上的 PowerShell 中输入以下命令,以启用 IP 转发:From PowerShell on the myVmNva VM, enter this command to turn on IP forwarding:

    Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters -Name IpEnableRouter -Value 1
    
  3. 重启 myVmNva VM:在任务栏中,选择“开始” > “电源”,然后选择“其他(计划内)” > “继续”。 Restart the myVmNva VM: From the taskbar, select Start > Power, Other (Planned) > Continue.

    这也会断开远程桌面会话的连接。This also disconnects the remote desktop session.

  4. 重启 myVmNva VM 后,与 myVmPublic VM 建立远程桌面会话。After the myVmNva VM restarts, create a remote desktop session to the myVmPublic VM. 在仍与 myVmPrivate VM 保持连接的情况下,打开命令提示符并运行以下命令:While still connected to the myVmPrivate VM, open a command prompt and run this command:

    mstsc /v:myVmPublic
    
  5. myVmPublic 的远程桌面中打开 PowerShell。In the remote desktop of myVmPublic, open PowerShell.

  6. 输入以下命令,启用通过 Windows 防火墙的 ICMP:Enable ICMP through the Windows firewall by entering this command:

    New-NetFirewallRule -DisplayName "Allow ICMPv4-In" -Protocol ICMPv4
    

测试网络流量的路由Test the routing of network traffic

首先,让我们测试从 myVmPublic VM 到 myVmPrivate VM 的网络流量路由。First, let's test routing of network traffic from the myVmPublic VM to the myVmPrivate VM.

  1. myVmPublic VM 上的 PowerShell 中,输入以下命令:From PowerShell on the myVmPublic VM, enter this command:

    tracert myVmPrivate
    

    响应类似于以下示例:The response is similar to this example:

    Tracing route to myVmPrivate.vpgub4nqnocezhjgurw44dnxrc.bx.internal.chinacloudapp.cn [10.0.1.4]
    over a maximum of 30 hops:
    
    1    <1 ms     * 1 ms  10.0.2.4
    2     1 ms     1 ms     1 ms  10.0.1.4
    
    Trace complete.
    

    可以看到,第一个跃点连接到 10.0.2.4,即 NVA 的专用 IP 地址。You can see the first hop is to 10.0.2.4, which is NVA's private IP address. 第二个跃点为路由到 myVmPrivate VM 的专用 IP 地址:10.0.1.4。The second hop is to the private IP address of the myVmPrivate VM: 10.0.1.4. 前面我们已将路由添加到 myRouteTablePublic 路由表,并已将它关联到“公共”子网。Earlier, you added the route to the myRouteTablePublic route table and associated it to the Public subnet. 因此,Azure 通过 NVA 发送了流量,而不是直接将流量发送到“专用”子网。As a result, Azure sent the traffic through the NVA and not directly to the Private subnet.

  2. 关闭与 myVmPublic VM 建立的远程桌面会话,这样,就会与 myVmPrivate VM 保持连接。Close the remote desktop session to the myVmPublic VM, which leaves you still connected to the myVmPrivate VM.

  3. myVmPrivate VM 中的命令提示符下,输入以下命令:From a command prompt on the myVmPrivate VM, enter this command:

    tracert myVmPublic
    

    此命令测试从 myVmPrivate VM 到 myVmPublic VM 的网络流量路由。This command tests the routing of network traffic from the myVmPrivate VM to the myVmPublic VM. 响应类似于以下示例:The response is similar to this example:

    Tracing route to myVmPublic.vpgub4nqnocezhjgurw44dnxrc.bx.internal.chinacloudapp.cn [10.0.0.4]
    over a maximum of 30 hops:
    
    1     1 ms     1 ms     1 ms  10.0.0.4
    
    Trace complete.
    

    可以看到,Azure 直接将流量从 myVmPrivate VM 路由到了 myVmPublic VM。You can see that Azure routes traffic directly from the myVmPrivate VM to the myVmPublic VM. 默认情况下,Azure 直接在子网之间路由流量。By default, Azure routes traffic directly between subnets.

  4. 关闭与 myVmPrivate VM 建立的远程桌面会话。Close the remote desktop session to the myVmPrivate VM.

清理资源Clean up resources

不再需要 myResourceGroup 时,请删除该资源组及其包含的所有资源:When the resource group is no longer needed, delete myResourceGroup and all resources it has:

  1. 转到 Azure 门户来管理资源组。Go to the Azure portal to manage your resource group. 搜索并选择“资源组”。Search for and select Resource groups.

  2. 选择资源组的名称 (myResourceGroup)。Pick the name of your resource group (myResourceGroup).

  3. 选择“删除资源组”。Select Delete resource group.

  4. 在确认对话框中,在“键入资源组名称”中输入 myResourceGroup,然后选择“删除”。 In the confirmation dialog box, enter myResourceGroup for TYPE THE RESOURCE GROUP NAME, and then select Delete. Azure 将删除 myResourceGroup 以及绑定到该资源组的所有资源,包括路由表、存储帐户、虚拟网络、VM、网络接口和公共 IP 地址。Azure deletes the myResourceGroup and all resources tied to that resource group, including your route tables, storage accounts, virtual networks, VMs, network interfaces, and public IP addresses.

后续步骤Next steps

在本教程中,你创建了一个路由表并将其关联到了某个子网。In this tutorial, you created a route table and associated it to a subnet. 还创建了一个简单 NVA,用于将流量从公共子网路由到专用子网。You created a simple NVA that routed traffic from a public subnet to a private subnet. 现在,可以从 Azure 市场部署不同的预配置 NVA,其中提供了许多有用的网络功能。Now you can deploy different preconfigured NVAs from the Azure Marketplace, which provide many useful network functions. 若要了解有关路由的详细信息,请参阅路由概述管理路由表To learn more about routing, see Routing overview and Manage a route table.

尽管可以在一个虚拟网络中部署多个 Azure 资源,但 Azure 无法将某些 PaaS 服务的资源部署到虚拟网络。While you can deploy many Azure resources within a virtual network, Azure can't deploy resources for some PaaS services into a virtual network. 可以限制对某些 Azure PaaS 服务的资源的访问,不过,只能对来自虚拟网络子网的流量实施这种限制。It's possible to restrict access to the resources of some Azure PaaS services, though the restriction must only be traffic from a virtual network subnet. 若要了解如何限制对 Azure PaaS 资源的网络访问,请参阅下一篇教程。To learn how to restrict network access to Azure PaaS resources, see the next tutorial.