类似于阿里云 ECS 主机的内外网(双网卡不通网段)的结构,最终实现内外网区分隔离。
https://www.aliyun.com/product/ecs/?utm_medium=text&utm_source=baidu&utm_campaign=
brand&utm_content=se_50381
1、各虚拟机添加网卡并配置 IP:
如果已经是双网卡不需要重新添加,网段配置文 192.168.10.20:
#1:在各虚拟机设置界面点击添加:
#2:添加网卡:选择网络适配器然后点下一步:
#3:确认添加: 选仅主机模式然后点完成
#4:最终确认:确认添加正确然后点确定
#5:各虚拟机确认网卡添加成功:
#6:各虚拟机配置 IP:
[root@linux-host2 ~]# cd /etc/sysconfig/network-scripts/
[root@linux-host2 network-scripts]# vim ifcfg-eth1
TYPE=Ethernet
BOOTPROTO=static
ONBOOT=yes
DEVICE=eth1
NAME=eth1
IPADDR=192.168.20.202 #与 192.168.10.x 网段最后一位 IP 相同
NETMASK=255.255.252.0
[root@linux-host3 ~]# cd /etc/sysconfig/network-scripts/
[root@linux-host3 network-scripts]# cat ifcfg-eth1
TYPE=Ethernet
BOOTPROTO=static
ONBOOT=yes
DEVICE=eth1
NAME=eth1
IPADDR=192.168.20.203
NETMASK=255.255.252.0
#7:其他服务器配置与验证:
#按照以上过程添加其他服务器,然验证各服务器第二块网卡之间是否网络互通:
2、控制节点配置:
#1:编辑配置文件 linuxbridge_agent.ini 如下:
[root@linux-host1 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
155 physical_interface_mappings = internal:eth0, external:eth1
#2:编辑配置文件如下 ml2_conf.ini:
[root@linux-host1 ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini
172 flat_networks = internal, external
#3:控制节点当前全部配置:
[root@linux-host1 ~]# grep "^[a-Z]" /etc/neutron/plugins/ml2/linuxbridge_agent.ini
physical_interface_mappings = internal:eth0, external:eth1
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
enable_security_group = true
enable_vxlan = false
[root@linux-host1 ~]# grep "^[a-Z]" /etc/neutron/plugins/ml2/ml2_conf.ini
type_drivers = flat,vlan
tenant_network_types =
mechanism_drivers = linuxbridge
extension_drivers = port_security
flat_networks = internal, external
enable_ipset = true
#4:重启 neutron 服务:
[root@linux-host1 ~]# systemctl restart neutron-linuxbridge-agent
[root@linux-host1 ~]# systemctl restart neutron-server
3、计算节点配置:
#1:编辑配置文件:
[root@linux-host2 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
155 physical_interface_mappings = internal:eth0, external:eth1
[root@linux-host3 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
physical_interface_mappings = internal:eth0,external:eth1
#2:当前全部配置:
[root@linux-host2 ~]# grep "^[a-Z]" /etc/neutron/plugins/ml2/linuxbridge_agent.ini
physical_interface_mappings = internal:eth0, external:eth1
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
enable_security_group = true
enable_vxlan = false
[root@linux-host3 ~]# grep "^[a-Z]" /etc/neutron/plugins/ml2/linuxbridge_agent.ini
physical_interface_mappings = internal:eth0,external:eth1
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
enable_security_group = true
enable_vxlan = false
#3:重启 neutron 服务:
#或重启服务器
[root@linux-host2 ~]# systemctl restart neutron-linuxbridge-agent
[root@linux-host3 ~]# systemctl restart neutron-linuxbridge-agent
4、创建网络并验证:
#1:控制端创建网络:
[root@linux-host1 ~]# neutron net-create --shared --provider:physical_network external --provider:network_type flat external-net
neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.
#2:创建子网:
[root@linux-host1 ~]# neutron subnet-create --name external-subnet --allocation-pool start=192.168.20.100,end=192.168.20.200 --dns-nameserver 223.5.5.5 external-net 192.168.20.0/24
#3:验证子网创建完成:
[root@linux-host1 ~]# neutron net-list
5、创建虚拟机:
#1:在网卡界面添加两个网卡:其他保持不变
#2:创建中:
#3:验证内外网访问: #如果是在虚拟机启动的实例,则实例启动过程会稍微有点慢,下面是计算节点192.168.10.202 上面的实例:
#下面是计算节点 192.168.10.203 上面的实例