使用 Azure 资源管理器部署模型配置强制隧道Configure forced tunneling using the Azure Resource Manager deployment model

借助强制隧道,可以通过站点到站点 VPN 隧道,将全部 Internet 绑定流量重定向或“强制”返回到本地位置,以进行检查和审核。Forced tunneling lets you redirect or "force" all Internet-bound traffic back to your on-premises location via a Site-to-Site VPN tunnel for inspection and auditing. 这是很多企业 IT 策略的关键安全要求。This is a critical security requirement for most enterprise IT policies. 没有强制隧道,来自 Azure 中 VM 的 Internet 绑定流量会始终通过 Azure 网络基础结构直接连接到 Internet。如果没有该选项,则无法对流量进行检查或审核。Without forced tunneling, Internet-bound traffic from your VMs in Azure always traverses from Azure network infrastructure directly out to the Internet, without the option to allow you to inspect or audit the traffic. 未经授权的 Internet 访问可能会导致信息泄漏或其他类型的安全漏洞。Unauthorized Internet access can potentially lead to information disclosure or other types of security breaches.

Azure 当前使用两种部署模型:Resource Manager 部署模型和经典部署模型。Azure currently works with two deployment models: Resource Manager and classic. 这两个模型相互不完全兼容。The two models are not completely compatible with each other. 在开始之前,需要知道所要使用的模型。Before you begin, you need to know which model that you want to work in. 有关部署模型的信息,请参阅了解部署模型For information about the deployment models, see Understanding deployment models. 如果不熟悉 Azure,建议使用 Resource Manager 部署模型。If you are new to Azure, we recommend that you use the Resource Manager deployment model.

本文将演示如何配置使用 Resource Manager 部署模型创建的虚拟网络的强制隧道。This article walks you through configuring forced tunneling for virtual networks created using the Resource Manager deployment model. 强制隧道可以使用 PowerShell(不通过门户)来配置。Forced tunneling can be configured by using PowerShell, not through the portal. 如果想要配置用于经典部署模型的强制隧道,请通过下面的下拉列表选择与经典模型相关的文章:If you want to configure forced tunneling for the classic deployment model, select classic article from the following dropdown list:

关于强制隧道About forced tunneling

下图说明了强制隧道的工作方式。The following diagram illustrates how forced tunneling works.


在上面的示例中,前端子网没有使用强制隧道。In the example above, the Frontend subnet is not forced tunneled. 前端子网中的工作负载可以继续直接接受并响应来自 Internet 的客户请求。The workloads in the Frontend subnet can continue to accept and respond to customer requests from the Internet directly. 中间层和后端子网会使用强制隧道。The Mid-tier and Backend subnets are forced tunneled. 任何从这两个子网到 Internet 的出站连接将通过一个 S2S VPN 隧道重定向或强制返回到本地站点。Any outbound connections from these two subnets to the Internet will be forced or redirected back to an on-premises site via one of the S2S VPN tunnels.

这样,在继续支持所需的多层服务体系结构的同时,可以限制并检查来自虚拟机或 Azure 云服务的 Internet 访问。This allows you to restrict and inspect Internet access from your virtual machines or cloud services in Azure, while continuing to enable your multi-tier service architecture required. 如果在虚拟网络中没有面向 Internet 的工作负荷,也能对整个虚拟网络应用强制隧道。If there are no Internet-facing workloads in your virtual networks, you also can apply forced tunneling to the entire virtual networks.

要求和注意事项Requirements and considerations

在 Azure 中,通过虚拟网络用户定义路由配置强制隧道。Forced tunneling in Azure is configured via virtual network user-defined routes. 将流量重定向到本地站点,这是 Azure VPN 网关的默认路由。Redirecting traffic to an on-premises site is expressed as a Default Route to the Azure VPN gateway. 有关用户定义路由和虚拟网络的详细信息,请参阅用户定义路由和 IP 转发For more information about user-defined routing and virtual networks, see User-defined routes and IP forwarding.

  • 每个虚拟网络子网具有内置的系统路由表。Each virtual network subnet has a built-in, system routing table. 系统路由表具有以下三组路由:The system routing table has the following three groups of routes:

    • 本地 VNet 路由:直接路由到同一个虚拟网络中的目标 VM 。Local VNet routes: Directly to the destination VMs in the same virtual network.
    • 本地路由:路由到 Azure VPN 网关 。On-premises routes: To the Azure VPN gateway.
    • 默认路由: 直接路由到 Internet。Default route: Directly to the Internet. 如果要将数据包发送到不包含在前面两个路由中的专用 IP 地址,数据包会被删除。Packets destined to the private IP addresses not covered by the previous two routes are dropped.
  • 此过程使用用户定义路由 (UDR) 来创建路由表以添加默认路由,并将路由表关联到 VNet 子网,在这些子网中启用强制隧道。This procedure uses user-defined routes (UDR) to create a routing table to add a default route, and then associate the routing table to your VNet subnet(s) to enable forced tunneling on those subnets.

  • 强制隧道必须关联到具有基于路由的 VPN 网关的 VNet。Forced tunneling must be associated with a VNet that has a route-based VPN gateway. 需要在连接到虚拟网络的跨界本地站点中,设置一个“默认站点”。You need to set a "default site" among the cross-premises local sites connected to the virtual network. 此外,必须使用 作为流量选择器配置本地 VPN 设备。Also, the on-premises VPN device must be configured using as traffic selectors.

  • ExpressRoute 强制隧道不是通过此机制配置的,而是通过 ExpressRoute BGP 对等会话播发默认路由来启用的。ExpressRoute forced tunneling is not configured via this mechanism, but instead, is enabled by advertising a default route via the ExpressRoute BGP peering sessions. 有关详细信息,请参阅 ExpressRoute 文档For more information, see the ExpressRoute Documentation.

配置概述Configuration overview

以下过程可帮助创建资源组和 VNet。The following procedure helps you create a resource group and a VNet. 然后,将创建 VPN 网关,并配置强制隧道。You'll then create a VPN gateway and configure forced tunneling. 在本过程中,虚拟网络“MultiTier-VNet”具有三个子网:“Frontend”、“Midtier”和“Backend”,并且具有四个跨界连接:一个“DefaultSiteHQ”和三个“Branches”。In this procedure, the virtual network 'MultiTier-VNet' has three subnets: 'Frontend', 'Midtier', and 'Backend', with four cross-premises connections: 'DefaultSiteHQ', and three Branches.

以下过程步骤将“DefaultSiteHQ”设置为使用强制隧道的默认站点连接,并将“Midtier”和“Backend”子网配置为使用强制隧道。The procedure steps set the 'DefaultSiteHQ' as the default site connection for forced tunneling, and configure the 'Midtier' and 'Backend' subnets to use forced tunneling.

准备工作Before you begin

安装最新版本的 Azure 资源管理器 PowerShell cmdlet。Install the latest version of the Azure Resource Manager PowerShell cmdlets. 有关安装 PowerShell cmdlet 的详细信息,请参阅 如何安装和配置 Azure PowerShellSee How to install and configure Azure PowerShell for more information about installing the PowerShell cmdlets.


需要安装 PowerShell cmdlet 的最新版本。Installing the latest version of the PowerShell cmdlets is required. 否则,运行某些 cmdlet 时可能会收到验证错误。Otherwise, you may receive validation errors when running some of the cmdlets.

登录To log in

使用提升的权限打开 PowerShell 控制台。Open your PowerShell console with elevated privileges.

可以在本地运行 Azure PowerShell,请连接到 Azure 帐户。You can run Azure PowerShell locally, connect to your Azure account. Connect-AzureRmAccount cmdlet 会提示输入凭据 。The Connect-AzAccount cmdlet prompts you for credentials. 进行身份验证后,它会下载帐户设置,以便 Azure PowerShell 可以使用这些设置。After authenticating, it downloads your account settings so that they are available to Azure PowerShell.

Connect-AzAccount -Environment AzureChinaCloud

如果有多个订阅,请获取 Azure 订阅的列表。If you have more than one subscription, get a list of your Azure subscriptions.


指定要使用的订阅。Specify the subscription that you want to use.

Select-AzSubscription -SubscriptionName "Name of subscription"

配置强制隧道Configure forced tunneling


可能会看到警告“将在未来发布中修改此 cmdlet 的输出对象类型”。You may see warnings saying "The output object type of this cmdlet will be modified in a future release". 这是预期行为,可以放心地忽略这些警告。This is expected behavior and you can safely ignore these warnings.

  1. 创建资源组。Create a resource group.

    New-AzResourceGroup -Name 'ForcedTunneling' -Location 'China North'
  2. 创建虚拟网络并指定子网。Create a virtual network and specify subnets.

    $s1 = New-AzVirtualNetworkSubnetConfig -Name "Frontend" -AddressPrefix ""
    $s2 = New-AzVirtualNetworkSubnetConfig -Name "Midtier" -AddressPrefix ""
    $s3 = New-AzVirtualNetworkSubnetConfig -Name "Backend" -AddressPrefix ""
    $s4 = New-AzVirtualNetworkSubnetConfig -Name "GatewaySubnet" -AddressPrefix ""
    $vnet = New-AzVirtualNetwork -Name "MultiTier-VNet" -Location "China North" -ResourceGroupName "ForcedTunneling" -AddressPrefix "" -Subnet $s1,$s2,$s3,$s4
  3. 创建本地网络网关。Create the local network gateways.

    $lng1 = New-AzLocalNetworkGateway -Name "DefaultSiteHQ" -ResourceGroupName "ForcedTunneling" -Location "China North" -GatewayIpAddress "" -AddressPrefix ""
    $lng2 = New-AzLocalNetworkGateway -Name "Branch1" -ResourceGroupName "ForcedTunneling" -Location "China North" -GatewayIpAddress "" -AddressPrefix ""
    $lng3 = New-AzLocalNetworkGateway -Name "Branch2" -ResourceGroupName "ForcedTunneling" -Location "China North" -GatewayIpAddress "" -AddressPrefix ""
    $lng4 = New-AzLocalNetworkGateway -Name "Branch3" -ResourceGroupName "ForcedTunneling" -Location "China North" -GatewayIpAddress "" -AddressPrefix ""
  4. 创建路由表和路由规则。Create the route table and route rule.

    New-AzRouteTable -Name "MyRouteTable" -ResourceGroupName "ForcedTunneling" -Location "China North"
    $rt = Get-AzRouteTable -Name "MyRouteTable" -ResourceGroupName "ForcedTunneling" 
    Add-AzRouteConfig -Name "DefaultRoute" -AddressPrefix "" -NextHopType VirtualNetworkGateway -RouteTable $rt
    Set-AzRouteTable -RouteTable $rt
  5. 将路由表与“中间层”子网和“后端”子网关联起来。Associate the route table to the Midtier and Backend subnets.

    $vnet = Get-AzVirtualNetwork -Name "MultiTier-Vnet" -ResourceGroupName "ForcedTunneling"
    Set-AzVirtualNetworkSubnetConfig -Name "MidTier" -VirtualNetwork $vnet -AddressPrefix "" -RouteTable $rt
    Set-AzVirtualNetworkSubnetConfig -Name "Backend" -VirtualNetwork $vnet -AddressPrefix "" -RouteTable $rt
    Set-AzVirtualNetwork -VirtualNetwork $vnet
  6. 创建虚拟网络网关。Create the virtual network gateway. 此步骤需要一些时间才能完成,有时需要 45 分钟或更长时间,你需要创建和配置网关。This step takes some time to complete, sometimes 45 minutes or more, because you are creating and configuring the gateway. 如果看到与 GatewaySKU 值相关的 ValidateSet 问题,请验证是否已安装最新版本的 PowerShell cmdletIf you see ValidateSet errors regarding the GatewaySKU value, verify that you have installed the latest version of the PowerShell cmdlets. 最新版本的 PowerShell cmdlet 包含最新网关 SKU 的新验证值。The latest version of the PowerShell cmdlets contains the new validated values for the latest Gateway SKUs.

    $pip = New-AzPublicIpAddress -Name "GatewayIP" -ResourceGroupName "ForcedTunneling" -Location "China North" -AllocationMethod Dynamic
    $gwsubnet = Get-AzVirtualNetworkSubnetConfig -Name "GatewaySubnet" -VirtualNetwork $vnet
    $ipconfig = New-AzVirtualNetworkGatewayIpConfig -Name "gwIpConfig" -SubnetId $gwsubnet.Id -PublicIpAddressId $pip.Id
    New-AzVirtualNetworkGateway -Name "Gateway1" -ResourceGroupName "ForcedTunneling" -Location "China North" -IpConfigurations $ipconfig -GatewayType Vpn -VpnType RouteBased -GatewaySku VpnGw1 -EnableBgp $false
  7. 将默认站点分配到虚拟网络网关。Assign a default site to the virtual network gateway. -GatewayDefaultSite 是允许强制路由配置进行工作的 cmdlet 参数,因此请注意正确配置此设置。The -GatewayDefaultSite is the cmdlet parameter that allows the forced routing configuration to work, so take care to configure this setting properly.

    $LocalGateway = Get-AzLocalNetworkGateway -Name "DefaultSiteHQ" -ResourceGroupName "ForcedTunneling"
    $VirtualGateway = Get-AzVirtualNetworkGateway -Name "Gateway1" -ResourceGroupName "ForcedTunneling"
    Set-AzVirtualNetworkGatewayDefaultSite -GatewayDefaultSite $LocalGateway -VirtualNetworkGateway $VirtualGateway
  8. 建立站点到站点 VPN 连接。Establish the Site-to-Site VPN connections.

    $gateway = Get-AzVirtualNetworkGateway -Name "Gateway1" -ResourceGroupName "ForcedTunneling"
    $lng1 = Get-AzLocalNetworkGateway -Name "DefaultSiteHQ" -ResourceGroupName "ForcedTunneling" 
    $lng2 = Get-AzLocalNetworkGateway -Name "Branch1" -ResourceGroupName "ForcedTunneling" 
    $lng3 = Get-AzLocalNetworkGateway -Name "Branch2" -ResourceGroupName "ForcedTunneling" 
    $lng4 = Get-AzLocalNetworkGateway -Name "Branch3" -ResourceGroupName "ForcedTunneling" 
    New-AzVirtualNetworkGatewayConnection -Name "Connection1" -ResourceGroupName "ForcedTunneling" -Location "China North" -VirtualNetworkGateway1 $gateway -LocalNetworkGateway2 $lng1 -ConnectionType IPsec -SharedKey "preSharedKey"
    New-AzVirtualNetworkGatewayConnection -Name "Connection2" -ResourceGroupName "ForcedTunneling" -Location "China North" -VirtualNetworkGateway1 $gateway -LocalNetworkGateway2 $lng2 -ConnectionType IPsec -SharedKey "preSharedKey"
    New-AzVirtualNetworkGatewayConnection -Name "Connection3" -ResourceGroupName "ForcedTunneling" -Location "China North" -VirtualNetworkGateway1 $gateway -LocalNetworkGateway2 $lng3 -ConnectionType IPsec -SharedKey "preSharedKey"
    New-AzVirtualNetworkGatewayConnection -Name "Connection4" -ResourceGroupName "ForcedTunneling" -Location "China North" -VirtualNetworkGateway1 $gateway -LocalNetworkGateway2 $lng4 -ConnectionType IPsec -SharedKey "preSharedKey"
    Get-AzVirtualNetworkGatewayConnection -Name "Connection1" -ResourceGroupName "ForcedTunneling"