Skip to content

Commit 6d65865

Browse files
author
钟弥
committed
Add NAT service unified public network egress solution
1 parent 9925d26 commit 6d65865

File tree

4 files changed

+271
-0
lines changed

4 files changed

+271
-0
lines changed

‎solution/tech-solution/nat-service/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
## Introduction
2+
3+
<!-- DOCS_DESCRIPTION_CN -->
4+
本示例用于实现解决方案[高效安全：企业统一公网出口](https://www.aliyun.com/solution/tech-solution/nat-service), 涉及到专有网络VPC、虚拟交换机vSwitch、公网 NAT 网关、云服务器ECS等资源的部署。
5+
<!-- DOCS_DESCRIPTION_CN -->
6+
7+
<!-- DOCS_DESCRIPTION_EN -->
8+
This example is used to implement solution [Efficient and Secure: Unified Public Network Egress](https://www.aliyun.com/solution/tech-solution/nat-service), which involves the creation and deployment of resources such as Virtual Private Cloud (VPC), Virtual Switch (vSwitch), Internet NAT Gateway and Elastic Compute Service (ECS).
9+
<!-- DOCS_DESCRIPTION_EN -->
10+
11+
12+
<!-- BEGIN_TF_DOCS -->
13+
## Providers
14+
15+
| Name | Version |
16+
|------|---------|
17+
| <a name="provider_alicloud"></a> [alicloud](#provider\_alicloud) | n/a |
18+
| <a name="provider_random"></a> [random](#provider\_random) | n/a |
19+
20+
## Modules
21+
22+
No modules.
23+
24+
## Resources
25+
26+
| Name | Type |
27+
|------|------|
28+
| [alicloud_eip.eip](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/eip) | resource |
29+
| [alicloud_eip_association.eip_association](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/eip_association) | resource |
30+
| [alicloud_instance.ecs_instance1](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/instance) | resource |
31+
| [alicloud_instance.ecs_instance2](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/instance) | resource |
32+
| [alicloud_nat_gateway.nat_gateway](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/nat_gateway) | resource |
33+
| [alicloud_security_group.security_group](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/security_group) | resource |
34+
| [alicloud_security_group_rule.allow_http](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/security_group_rule) | resource |
35+
| [alicloud_security_group_rule.allow_https](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/security_group_rule) | resource |
36+
| [alicloud_security_group_rule.allow_workbench](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/security_group_rule) | resource |
37+
| [alicloud_snat_entry.snat](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/snat_entry) | resource |
38+
| [alicloud_snat_entry.snat2](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/snat_entry) | resource |
39+
| [alicloud_vpc.vpc](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/vpc) | resource |
40+
| [alicloud_vswitch.vswitch1](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/vswitch) | resource |
41+
| [alicloud_vswitch.vswitch2](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/vswitch) | resource |
42+
| [alicloud_vswitch.vswitch3](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/vswitch) | resource |
43+
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
44+
45+
## Inputs
46+
47+
| Name | Description | Type | Default | Required |
48+
|------|-------------|------|---------|:--------:|
49+
| <a name="input_instance_password"></a> [instance\_password](#input\_instance\_password) | 服务器登录密码,长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ 中的特殊符号）` | `string` | n/a | yes |
50+
| <a name="input_instance_type1"></a> [instance\_type1](#input\_instance\_type1) | ECS1 实例规格 | `string` | `"ecs.e-c1m2.large"` | no |
51+
| <a name="input_instance_type2"></a> [instance\_type2](#input\_instance\_type2) | ECS2 实例规格 | `string` | `"ecs.e-c1m2.large"` | no |
52+
| <a name="input_region"></a> [region](#input\_region) | 地域 | `string` | `"cn-hangzhou"` | no |
53+
| <a name="input_region_zone_id1"></a> [region\_zone\_id1](#input\_region\_zone\_id1) | 可用区1 | `string` | `"cn-hangzhou-j"` | no |
54+
| <a name="input_region_zone_id2"></a> [region\_zone\_id2](#input\_region\_zone\_id2) | 可用区2 | `string` | `"cn-hangzhou-k"` | no |
55+
<!-- END_TF_DOCS -->

‎solution/tech-solution/nat-service/main.tf‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
# ------------------------------------------------------------------------------
2+
# 核心资源定义 (Main Resource Definitions)
3+
#
4+
# 本文件包含了模块的核心基础设施资源。
5+
# 这里的代码负责根据输入变量来创建和配置所有云资源。
6+
# ------------------------------------------------------------------------------
7+
8+
# 配置阿里云提供商 (Provider)
9+
provider "alicloud" {
10+
# 资源部署地域
11+
region = "cn-hangzhou"
12+
}
13+
14+
# 生成随机ID后缀
15+
resource "random_id" "suffix" {
16+
byte_length = 8
17+
}
18+
19+
# 定义本地变量
20+
locals {
21+
common_name = random_id.suffix.id
22+
}
23+
24+
# 创建VPC
25+
resource "alicloud_vpc" "vpc" {
26+
cidr_block = "192.168.0.0/16"
27+
vpc_name = "${local.common_name}-vpc"
28+
}
29+
30+
# 创建交换机
31+
resource "alicloud_vswitch" "vswitch1" {
32+
vpc_id = alicloud_vpc.vpc.id
33+
cidr_block = "192.168.1.0/24"
34+
zone_id = var.region_zone_id1
35+
vswitch_name = "${local.common_name}-app1-vsw"
36+
}
37+
38+
# 创建交换机
39+
resource "alicloud_vswitch" "vswitch2" {
40+
vpc_id = alicloud_vpc.vpc.id
41+
cidr_block = "192.168.2.0/24"
42+
zone_id = var.region_zone_id2
43+
vswitch_name = "${local.common_name}-app2-vsw"
44+
}
45+
46+
# 创建交换机（NAT网关）
47+
resource "alicloud_vswitch" "vswitch3" {
48+
vpc_id = alicloud_vpc.vpc.id
49+
cidr_block = "192.168.3.0/24"
50+
zone_id = var.region_zone_id1
51+
vswitch_name = "${local.common_name}-pub-vsw"
52+
}
53+
54+
# 创建安全组
55+
resource "alicloud_security_group" "security_group" {
56+
vpc_id = alicloud_vpc.vpc.id
57+
security_group_name = "${local.common_name}-sg"
58+
}
59+
60+
# 安全组规则：允许HTTPS
61+
resource "alicloud_security_group_rule" "allow_https" {
62+
type = "ingress"
63+
ip_protocol = "tcp"
64+
port_range = "443/443"
65+
cidr_ip = "0.0.0.0/0"
66+
security_group_id = alicloud_security_group.security_group.id
67+
}
68+
69+
# 安全组规则：允许HTTP
70+
resource "alicloud_security_group_rule" "allow_http" {
71+
type = "ingress"
72+
ip_protocol = "tcp"
73+
port_range = "80/80"
74+
cidr_ip = "0.0.0.0/0"
75+
security_group_id = alicloud_security_group.security_group.id
76+
}
77+
78+
# 安全组规则：允许SSH
79+
resource "alicloud_security_group_rule" "allow_workbench" {
80+
type = "ingress"
81+
ip_protocol = "tcp"
82+
port_range = "22/22"
83+
cidr_ip = "100.104.0.0/16"
84+
security_group_id = alicloud_security_group.security_group.id
85+
}
86+
87+
# 创建ECS1
88+
resource "alicloud_instance" "ecs_instance1" {
89+
instance_name = "${local.common_name}-ecs-1"
90+
image_id = "aliyun_3_9_x64_20G_alibase_20231219.vhd"
91+
instance_type = var.instance_type1
92+
system_disk_category = "cloud_essd"
93+
vswitch_id = alicloud_vswitch.vswitch1.id
94+
security_groups = [alicloud_security_group.security_group.id]
95+
internet_max_bandwidth_out = 0
96+
password = var.instance_password
97+
}
98+
99+
# 创建ECS2
100+
resource "alicloud_instance" "ecs_instance2" {
101+
instance_name = "${local.common_name}-ecs-2"
102+
image_id = "aliyun_3_9_x64_20G_alibase_20231219.vhd"
103+
instance_type = var.instance_type2
104+
system_disk_category = "cloud_essd"
105+
vswitch_id = alicloud_vswitch.vswitch2.id
106+
security_groups = [alicloud_security_group.security_group.id]
107+
internet_max_bandwidth_out = 0
108+
password = var.instance_password
109+
}
110+
111+
# 创建NAT网关
112+
resource "alicloud_nat_gateway" "nat_gateway" {
113+
vpc_id = alicloud_vpc.vpc.id
114+
vswitch_id = alicloud_vswitch.vswitch3.id
115+
nat_type = "Enhanced"
116+
nat_gateway_name = "${local.common_name}-ngw"
117+
}
118+
119+
# 创建EIP
120+
resource "alicloud_eip" "eip" {
121+
bandwidth = 200
122+
internet_charge_type = "PayByTraffic"
123+
isp = "BGP"
124+
deletion_protection = false
125+
}
126+
127+
# 绑定EIP到NAT网关
128+
resource "alicloud_eip_association" "eip_association" {
129+
instance_id = alicloud_nat_gateway.nat_gateway.id
130+
allocation_id = alicloud_eip.eip.id
131+
}
132+
133+
# 配置SNAT规则（vswitch1）
134+
resource "alicloud_snat_entry" "snat" {
135+
snat_table_id = alicloud_nat_gateway.nat_gateway.snat_table_ids
136+
snat_ip = alicloud_eip.eip.ip_address
137+
source_vswitch_id = alicloud_vswitch.vswitch1.id
138+
snat_entry_name = "${local.common_name}-snat"
139+
depends_on = [alicloud_eip_association.eip_association]
140+
}
141+
142+
# 配置SNAT规则（vswitch2）
143+
resource "alicloud_snat_entry" "snat2" {
144+
snat_table_id = alicloud_nat_gateway.nat_gateway.snat_table_ids
145+
snat_ip = alicloud_eip.eip.ip_address
146+
source_vswitch_id = alicloud_vswitch.vswitch2.id
147+
snat_entry_name = "${local.common_name}-snat2"
148+
depends_on = [alicloud_eip_association.eip_association]
149+
}

‎solution/tech-solution/nat-service/outputs.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# ------------------------------------------------------------------------------
2+
# 模块输出值 (Module Outputs)
3+
#
4+
# 本文件定义了模块执行成功后返回给调用方的值。
5+
# 这些输出可以被其他 Terraform 配置引用，或在 apply 命令结束后显示给用户。
6+
# ------------------------------------------------------------------------------
7+
8+
# ECS1登录地址
9+
output "ecs_login_address1" {
10+
description = "ECS1 登录地址"
11+
value = format("https://ecs-workbench.aliyun.com/?from=EcsConsole&instanceType=ecs&regionId=%s&instanceId=%s", var.region, alicloud_instance.ecs_instance1.id)
12+
}
13+
14+
# ECS2登录地址
15+
output "ecs_login_address2" {
16+
description = "ECS2 登录地址"
17+
value = format("https://ecs-workbench.aliyun.com/?from=EcsConsole&instanceType=ecs&regionId=%s&instanceId=%s", var.region, alicloud_instance.ecs_instance2.id)
18+
}

‎solution/tech-solution/nat-service/variables.tf‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# ------------------------------------------------------------------------------
2+
# 模块输入变量 (Module Input Variables)
3+
#
4+
# 本文件定义了该 Terraform 模块所有可配置的输入变量。
5+
# 每个变量都包含了详细的 'description'，以说明其用途、格式和默认值逻辑。
6+
# 请参考这些描述来正确配置模块。
7+
# ------------------------------------------------------------------------------
8+
9+
# 部署地域
10+
variable "region" {
11+
type = string
12+
description = "地域"
13+
default = "cn-hangzhou"
14+
}
15+
16+
# 可用区1
17+
variable "region_zone_id1" {
18+
type = string
19+
description = "可用区1"
20+
default = "cn-hangzhou-j"
21+
}
22+
23+
# 可用区2
24+
variable "region_zone_id2" {
25+
type = string
26+
description = "可用区2"
27+
default = "cn-hangzhou-k"
28+
}
29+
30+
# ECS1实例规格
31+
variable "instance_type1" {
32+
type = string
33+
description = "ECS1 实例规格"
34+
default = "ecs.e-c1m2.large"
35+
}
36+
37+
# ECS2实例规格
38+
variable "instance_type2" {
39+
type = string
40+
description = "ECS2 实例规格"
41+
default = "ecs.e-c1m2.large"
42+
}
43+
44+
# ECS登录密码
45+
variable "instance_password" {
46+
type = string
47+
sensitive = true
48+
description = "服务器登录密码,长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ 中的特殊符号）"
49+
}

0 commit comments

Comments
 (0)