IPv4网关

控制台

1. 前往专有网络控制台-IPv4网关页面，在页面上方选择VPC所在的地域后，单击创建IPv4网关。

2. 创建IPv4网关：选择需集中控制公网访问的专有网络。

3. 激活IPv4网关：选择公有交换机绑定的路由表，系统自动添加0.0.0.0/0路由指向IPv4网关，确保公有交换机中的资源绑定公网IP后可访问公网。当路由表中存在目标网段为0.0.0.0/0的路由时，需要单击暂不激活，调整对应路由的下一跳为IPv4网关后再激活。激活后，专有网络访问公网的行为切换为IPv4网关集中控制。

   • 当ECS实例使用公网NAT网关绑定的公网IP访问公网时，需要将ECS实例和公网NAT网关部署在不同的交换机中，为NAT网关所在交换机关联的路由表配置0.0.0.0/0路由指向IPv4网关，为ECS实例所在交换机关联的路由表配置路由指向公有交换机中的NAT网关。

   • 当ECS实例使用固定公网IP、绑定的弹性公网IP访问公网时，为ECS实例配置0.0.0.0/0路由指向IPv4网关即可。

API

• 调用CreateIpv4Gateway创建IPv4网关。

• 调用EnableVpcIpv4Gateway激活IPv4网关，指定RouteTableList为公有交换机绑定的路由表；如未指定，需要调用CreateRouteEntry在对应路由表中自行添加0.0.0.0/0路由指向IPv4网关。

Terraform

与控制台逻辑不同的是，激活IPv4网关时，系统不会自动添加0.0.0.0/0路由指向IPv4网关，需要自行配置路由。

Resource：alicloud_vpc、alicloud_vswitch、alicloud_vpc_ipv4_gateway、alicloud_route_table、alicloud_route_table_attachment、alicloud_vpc_route_entry、alicloud_instance、alicloud_security_group、alicloud_security_group_rule、alicloud_eip_address、alicloud_eip_association、alicloud_nat_gateway、alicloud_snat_entry

Data Sources：alicloud_zones

# 指定创建IPv4网关的地域
provider "alicloud" {
  region = "cn-hangzhou"
}

# 根据数据源自动获取可以创建交换机的可用区列表
data "alicloud_zones" "available_zones" {
  available_resource_creation = "VSwitch" # 查询VPC内可创建的可用区
}

# 创建1个VPC 
resource "alicloud_vpc" "example_vpc" {
  vpc_name   = "example_vpc_name"
  cidr_block = "10.0.0.0/16" # 指定网段 
}

# 定义交换机配置
locals {
  vswitches = {
    vsw1 = {
      name       = "example_vsw1_name"
      cidr_block = "10.0.0.0/24"
      zone_index = 0
    }
    vsw2 = {
      name       = "example_vsw2_name"
      cidr_block = "10.0.1.0/24"
      zone_index = 1
    }
    vsw3 = {
      name       = "example_vsw3_name"
      cidr_block = "10.0.2.0/24"
      zone_index = 0
    }
    vsw4 = {
      name       = "example_vsw4_name"
      cidr_block = "10.0.3.0/24"
      zone_index = 0
    }
  }

  # 定义路由表配置
  route_tables = {
    rt1 = {
      name        = "example_rt1_name"
      vswitch_key = "vsw1"
    }
    rt2 = {
      name        = "example_rt2_name"
      vswitch_key = "vsw2"
    }
    rt3 = {
      name        = "example_rt3_name"
      vswitch_key = "vsw3"
    }
    rt4 = {
      name        = "example_rt4_name"
      vswitch_key = "vsw4"
    }
  }

  # 定义实例配置
  instances = {
    instance1 = {
      name        = "example_instance1_name"
      vswitch_key = "vsw1"
    }
    instance2 = {
      name        = "example_instance2_name"
      vswitch_key = "vsw3"
    }
    instance3 = {
      name        = "example_instance3_name"
      vswitch_key = "vsw4"
    }
  }

  # 定义EIP配置
  eips = {
    eip1 = {
      name = "example_eip1_name"
    }
    eip2 = {
      name = "example_eip2_name"
    }
  }

  # 定义SNAT条目配置
  snat_entries = {
    snat1 = {
      instance_key = "instance2"
    }
    snat2 = {
      instance_key = "instance3"
    }
  }
}

# 创建多个交换机
resource "alicloud_vswitch" "example_vsw" {
  for_each = local.vswitches

  vswitch_name = each.value.name
  cidr_block   = each.value.cidr_block
  vpc_id       = alicloud_vpc.example_vpc.id
  zone_id      = data.alicloud_zones.available_zones.zones[each.value.zone_index].id
}

# 创建多个自定义路由表
resource "alicloud_route_table" "example_route_table" {
  for_each = local.route_tables

  route_table_name = each.value.name
  vpc_id           = alicloud_vpc.example_vpc.id
}

# 将路由表与交换机绑定
resource "alicloud_route_table_attachment" "example_route_table_attachment" {
  for_each = local.route_tables

  vswitch_id     = alicloud_vswitch.example_vsw[each.value.vswitch_key].id
  route_table_id = alicloud_route_table.example_route_table[each.key].id
}

# 指定实例规格
variable "instance_type" {
  default = "ecs.e-c1m1.large"
}

# 指定镜像ID
variable "image_id" {
  default = "aliyun_3_x64_20G_alibase_20221102.vhd"
}

# 创建安全组
resource "alicloud_security_group" "example_security_group" {
  security_group_name = "example_security_group_name"
  vpc_id              = alicloud_vpc.example_vpc.id
}

# 创建安全组规则,需按实际访问流量修改协议与端口号
resource "alicloud_security_group_rule" "allow_internet" {
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.example_security_group.id
  cidr_ip           = "0.0.0.0/0"
}

# 创建多个服务器
resource "alicloud_instance" "example_instance" {
  for_each = local.instances

  instance_name        = each.value.name
  vswitch_id           = alicloud_vswitch.example_vsw[each.value.vswitch_key].id
  instance_type        = var.instance_type
  image_id             = var.image_id
  system_disk_category = "cloud_essd"
  security_groups      = [alicloud_security_group.example_security_group.id]
  instance_charge_type = "PostPaid"           # 指定付费类型为按量付费
  spot_strategy        = "SpotWithPriceLimit" # 设置上限价格的抢占式实例
}

# 创建多个EIP
resource "alicloud_eip_address" "example_eip" {
  for_each = local.eips

  address_name = each.value.name
  isp          = "BGP"
  netmode      = "public"
  bandwidth    = "1"
  payment_type = "PayAsYouGo"
}

# 绑定ECS和EIP
resource "alicloud_eip_association" "example_eip_ecs_association" {
  allocation_id = alicloud_eip_address.example_eip["eip1"].id
  instance_type = "EcsInstance"
  instance_id   = alicloud_instance.example_instance["instance1"].id
}

# 创建公网NAT网关
resource "alicloud_nat_gateway" "example_natgw" {
  nat_gateway_name = "example_natgw_name"
  vpc_id           = alicloud_vpc.example_vpc.id
  vswitch_id       = alicloud_vswitch.example_vsw["vsw2"].id
  nat_type         = "Enhanced"
  eip_bind_mode    = "NAT" # 指定EIP绑定模式，必须为NAT模式
  payment_type     = "PayAsYouGo"
}

# 绑定EIP和公网NAT网关
resource "alicloud_eip_association" "example_eip_natgw_association" {
  allocation_id = alicloud_eip_address.example_eip["eip2"].id
  instance_type = "NAT"
  instance_id   = alicloud_nat_gateway.example_natgw.id
}

# 添加路由指向NAT网关
resource "alicloud_route_entry" "example_rt3_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt3"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "NatGateway"
  nexthop_id            = alicloud_nat_gateway.example_natgw.id
}

# 添加路由指向NAT网关
resource "alicloud_route_entry" "example_rt4_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt4"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "NatGateway"
  nexthop_id            = alicloud_nat_gateway.example_natgw.id
}

# 创建SNAT条目
resource "alicloud_snat_entry" "example_snat_entry" {
  for_each = local.snat_entries

  snat_table_id = alicloud_nat_gateway.example_natgw.snat_table_ids
  source_cidr   = alicloud_instance.example_instance[each.value.instance_key].primary_ip_address
  snat_ip       = alicloud_eip_address.example_eip["eip2"].ip_address
}

# 创建IPv4网关
resource "alicloud_vpc_ipv4_gateway" "example_ipv4gw" {
  ipv4_gateway_name = "example_ipv4gw_name"
  vpc_id            = alicloud_vpc.example_vpc.id
  enabled           = true
}

# 添加路由指向IPv4网关
resource "alicloud_route_entry" "example_rt1_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt1"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.example_ipv4gw.id
}

# 添加路由指向IPv4网关
resource "alicloud_route_entry" "example_rt2_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt2"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.example_ipv4gw.id
}

控制台

1. 前往专有网络控制台-IPv4网关页面，在页面上方选择VPC所在的地域后，单击创建IPv4网关。

2. 创建IPv4网关：选择需访问非标准私网网段的专有网络。

3. 激活IPv4网关：选择需访问非标准私网网段的交换机绑定的路由表，系统自动添加0.0.0.0/0路由指向IPv4网关，确保交换机中的资源可以按照更明细的路由访问非标准私网网段。

   • 确保绑定的路由表中，不存在目标网段为0.0.0.0/0的路由。如有，需要单击暂不激活，删除路由后再激活。

   • 激活后，IPv4网关集中控制访问公网的流量，所有流量均按照路由表转发。

API

• 调用CreateIpv4Gateway创建IPv4网关。

• 调用EnableVpcIpv4Gateway激活IPv4网关指，定RouteTableList为公有交换机绑定的路由表；如未指定，需要调用CreateRouteEntry在对应路由表中自行添加0.0.0.0/0路由指向IPv4网关。

Terraform

与控制台逻辑不同的是，激活IPv4网关时，系统不会自动添加0.0.0.0/0路由指向IPv4网关，需要自行配置路由。

Resource：alicloud_vpc、alicloud_vswitch、alicloud_vpc_ipv4_gateway、alicloud_route_table、alicloud_route_table_attachment、alicloud_vpc_route_entry、alicloud_instance、alicloud_security_group、alicloud_security_group_rule、alicloud_eip_address、alicloud_eip_association、alicloud_vpc_peer_connection

Data Sources：alicloud_zones

本示例中，建立对等连接的VPC属于同一账号。创建跨账号对等连接时，还需要创建alicloud_vpc_peer_connection_accepter确保对端账号接受对等连接。

# 指定创建IPv4网关的地域
provider "alicloud" {
  region = "cn-hangzhou"
}

# 根据数据源自动获取可以创建交换机的可用区列表
data "alicloud_zones" "available_zones" {
  available_resource_creation = "VSwitch" # 查询VPC内可创建的可用区
}

# 指定实例规格
variable "instance_type" {
  default = "ecs.e-c1m1.large"
}

# 指定镜像ID
variable "image_id" {
  default = "aliyun_3_x64_20G_alibase_20221102.vhd"
}

# 创建VPC
resource "alicloud_vpc" "example_vpc1" {
  vpc_name   = "example_vpc1_name"
  cidr_block = "10.0.0.0/16" # 指定网段 
}

# 创建VPC
resource "alicloud_vpc" "example_vpc2" {
  vpc_name   = "example_vpc2_name"
  cidr_block = "30.0.0.0/16" # 指定网段 
}

# 创建交换机
resource "alicloud_vswitch" "example_vsw1" {
  vswitch_name = "example_vsw1_name"
  cidr_block   = "10.0.1.0/24"
  vpc_id       = alicloud_vpc.example_vpc1.id
  zone_id      = data.alicloud_zones.available_zones.zones.0.id
}

# 创建交换机
resource "alicloud_vswitch" "example_vsw2" {
  vswitch_name = "example_vsw2_name"
  cidr_block   = "30.0.1.0/24"
  vpc_id       = alicloud_vpc.example_vpc2.id
  zone_id      = data.alicloud_zones.available_zones.zones.1.id
}

# 创建安全组
resource "alicloud_security_group" "example_security_group1" {
  security_group_name = "example_security_group1_name"
  vpc_id              = alicloud_vpc.example_vpc1.id
}

# 创建安全组规则,需按实际访问流量修改协议与端口号
resource "alicloud_security_group_rule" "allow_internet1" {
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.example_security_group1.id
  cidr_ip           = "0.0.0.0/0"
}

# 创建安全组
resource "alicloud_security_group" "example_security_group2" {
  security_group_name = "example_security_group2_name"
  vpc_id              = alicloud_vpc.example_vpc2.id
}

# 创建安全组规则,需按实际访问流量修改协议与端口号
resource "alicloud_security_group_rule" "allow_internet2" {
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.example_security_group2.id
  cidr_ip           = "0.0.0.0/0"
}

# 创建ECS实例
resource "alicloud_instance" "example_instance1" {
  instance_name        = "example_instance1_name"
  vswitch_id           = alicloud_vswitch.example_vsw1.id
  instance_type        = var.instance_type
  image_id             = var.image_id
  system_disk_category = "cloud_essd"
  security_groups      = [alicloud_security_group.example_security_group1.id]
  instance_charge_type = "PostPaid"
  spot_strategy        = "SpotWithPriceLimit"
}

# 创建EIP
resource "alicloud_eip_address" "example_eip" {
  address_name = "example_eip_name"
  isp          = "BGP"
  netmode      = "public"
  bandwidth    = "1"
  payment_type = "PayAsYouGo"
}

# 绑定ECS和EIP
resource "alicloud_eip_association" "example_eip_ecs_association" {
  allocation_id = alicloud_eip_address.example_eip.id
  instance_type = "EcsInstance"
  instance_id   = alicloud_instance.example_instance1.id
}

# 创建ECS实例
resource "alicloud_instance" "example_instance2" {
  instance_name        = "example_instance2_name"
  vswitch_id           = alicloud_vswitch.example_vsw2.id
  instance_type        = var.instance_type
  image_id             = var.image_id
  system_disk_category = "cloud_essd"
  security_groups      = [alicloud_security_group.example_security_group2.id]
  instance_charge_type = "PostPaid"
  spot_strategy        = "SpotWithPriceLimit"
}

# 创建自定义路由表
resource "alicloud_route_table" "example_route_table1" {
  route_table_name = "example_route_table1_name"
  vpc_id           = alicloud_vpc.example_vpc1.id
}

# 将路由表与交换机绑定
resource "alicloud_route_table_attachment" "example_route_table_attachment1" {
  vswitch_id     = alicloud_vswitch.example_vsw1.id
  route_table_id = alicloud_route_table.example_route_table1.id
}

# 创建自定义路由表
resource "alicloud_route_table" "example_route_table2" {
  route_table_name = "example_route_table2_name"
  vpc_id           = alicloud_vpc.example_vpc2.id
}

# 将路由表与交换机绑定
resource "alicloud_route_table_attachment" "example_route_table_attachment2" {
  vswitch_id     = alicloud_vswitch.example_vsw2.id
  route_table_id = alicloud_route_table.example_route_table2.id
}

# 创建VPC对等连接
resource "alicloud_vpc_peer_connection" "example_vpc_peer" {
  peer_connection_name = "example_vpc_peer_name"
  vpc_id               = alicloud_vpc.example_vpc1.id
  accepting_ali_uid    = "1234****" # 对端VPC所属的账号I，本示例创建同账号对等连接。如果创建跨账号对等连接，需创建alicloud_vpc_peer_connection_accepter，确保对端账号接受对等连接。
  accepting_region_id  = "cn-hangzhou"
  accepting_vpc_id     = alicloud_vpc.example_vpc2.id
}

# 配置对等连接的路由
resource "alicloud_route_entry" "example_peer_route1" {
  route_table_id        = alicloud_route_table.example_route_table1.id
  destination_cidrblock = "30.0.0.0/16"
  nexthop_type          = "VpcPeer"
  nexthop_id            = alicloud_vpc_peer_connection.example_vpc_peer.id
}

# 配置对等连接的路由
resource "alicloud_route_entry" "example_peer_route2" {
  route_table_id        = alicloud_route_table.example_route_table2.id
  destination_cidrblock = "10.0.0.0/16"
  nexthop_type          = "VpcPeer"
  nexthop_id            = alicloud_vpc_peer_connection.example_vpc_peer.id
}

# 创建IPv4网关
resource "alicloud_vpc_ipv4_gateway" "example_ipv4gw" {
  ipv4_gateway_name = "example_ipv4gw_name"
  vpc_id            = alicloud_vpc.example_vpc1.id
  enabled           = true
}

# 添加路由指向IPv4网关
resource "alicloud_route_entry" "example_igw_route" {
  route_table_id        = alicloud_route_table.example_route_table1.id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.example_ipv4gw.id
}

控制台

API

• 调用AssociateRouteTableWithGateway绑定网关路由表。

• 调用DissociateRouteTableFromGateway解绑网关路由表。

Terraform

Resource：alicloud_vpc_gateway_route_table_attachment

# 指定IPv4网关所在的地域
provider "alicloud" {
  region = "cn-hangzhou"
}

# 指定IPv4网关的ID
variable "ipv4_gateway_id" {
  default = "ipv4gw-hp3v******" # 修改为IPv4网关的实际ID
}

# 指定网关路由表的ID
variable "route_table_id" {
  default = "vtb-hp3w******" # 修改为网关路由表的实际ID
}

# 绑定网关路由表
resource "alicloud_vpc_gateway_route_table_attachment" "example_attachment" {
  ipv4_gateway_id = var.ipv4_gateway_id
  route_table_id  = var.route_table_id
}