未从负载均衡器后面的 Azure VM 规模集中的节点获取任何外部出站流量

Question

我在从 VM 规模集中配置的节点 (RHEL) 访问外部资源时遇到困难。

为了描绘我试图使用 Azure 资源管理器模板描述的环境，我希望创建：

1 个通用虚拟网络
1 个前端 VM（运行 RHEL，并且按预期工作）
1 个集群 (vmss) 运行 2 个节点 (RHEL)
- 节点在与前端 VM 相同的私有子网中产生
- 1 负载均衡器应该作为 NAT 网关工作（但它不是这样工作的）
  - 负载均衡器有外部IP，inboundNatPool（有效），backendAddressPool（节点注册成功）
- 网络安全组管理对端口的访问（设置为允许所有出站连接）

作为脚注，我很乐意在 YAML 中编写 AWS cloudformation 文件，因此我以类似的方式处理 Azure 资源管理器模板，以提高可读性和在我的模板中添加评论的附加功能.

我的 vmss 配置示例（简短片段）

... #(yaml-template is first converted to json and than deployed using the azure cli)
#   Cluster
#   -------
#     Scale Set
#     ---------
#       | VM Scale Set can not connect to external sources
#       |
- type: Microsoft.Compute/virtualMachineScaleSets
  name: '[variables(''vmssName'')]'
  location: '[resourceGroup().location]'
  apiVersion: '2017-12-01'
  dependsOn:
  - '[variables(''vnetName'')]'
  - '[variables(''loadBalancerName'')]'
  - '[variables(''networkSecurityGroupName'')]'
  sku:
    capacity: '[variables(''instanceCount'')]' # Amount of nodes to be spawned
    name: Standard_A2_v2
    tier: Standard
  # zones: # If zone is specified, no sku can be chosen
  # - '1'
  properties:
    overprovision: 'true'
    upgradePolicy:
      mode: Manual
    virtualMachineProfile:
      networkProfile:
        networkInterfaceConfigurations:
        - name: '[variables(''vmssNicName'')]'
          properties:
            ipConfigurations:
            - name: '[variables(''ipConfigName'')]'
              properties:
                loadBalancerBackendAddressPools:
                - id: '[variables(''lbBackendAddressPoolsId'')]'
                loadBalancerInboundNatPools:
                - id: '[variables(''lbInboundNatPoolsId'')]'
                subnet:
                  id: '[variables(''subnetId'')]'
            primary: true
            networkSecurityGroup:
              id: '[variables(''networkSecurityGroupId'')]'
      osProfile:
        computerNamePrefix: '[variables(''vmssName'')]'
        adminUsername: '[parameters(''sshUserName'')]'
        # adminPassword: '[parameters(''adminPassword'')]'
        linuxConfiguration:
          disablePasswordAuthentication: True
          ssh:
            publicKeys:
            - keyData: '[parameters(''sshPublicKey'')]'
              path: '[concat(''/home/'',parameters(''sshUserName''),''/.ssh/authorized_keys'')]'
      storageProfile:
        imageReference: '[variables(''clusterImageReference'')]'
        osDisk:
          caching: ReadWrite
          createOption: FromImage
...

上面模板中引用的网络安全组是：

#     NetworkSecurityGroup
#     --------------------
- type: Microsoft.Network/networkSecurityGroups
  name: '[variables(''networkSecurityGroupName'')]'
  apiVersion: '2017-10-01'
  location: '[resourceGroup().location]'
  properties:
    securityRules:
    - name: remoteConnection
      properties:
        priority: 101
        access: Allow
        direction: Inbound
        protocol: Tcp
        description: Allow SSH traffic
        sourceAddressPrefix: '*'
        sourcePortRange: '*'
        destinationAddressPrefix: '*'
        destinationPortRange: '22'
    - name: allow_outbound_connections
      properties:
        description: This rule allows outbound connections
        priority: 200
        access: Allow
        direction: Outbound
        protocol: '*'
        sourceAddressPrefix: 'VirtualNetwork'
        sourcePortRange: '*'
        destinationAddressPrefix: '*'
        destinationPortRange: '*'

而负载均衡器，我认为应该是错误的，被描述为：

#   Loadbalancer as NatGateway
#   --------------------------
- type: Microsoft.Network/loadBalancers
  name: '[variables(''loadBalancerName'')]'
  apiVersion: '2017-10-01'
  location: '[resourceGroup().location]'
  sku:
    name: Standard
  dependsOn:
  - '[variables(''natIPAddressName'')]'
  properties:
    backendAddressPools:
    - name: '[variables(''lbBackendPoolName'')]'
    frontendIPConfigurations:
    - name: LoadBalancerFrontEnd
      properties:
        publicIPAddress:
          id: '[variables(''natIPAddressId'')]'
    inboundNatPools:
    - name: '[variables(''lbNatPoolName'')]'
      properties:
        backendPort: '22'
        frontendIPConfiguration:
          id: '[variables(''frontEndIPConfigID'')]'
        frontendPortRangeStart: '50000'
        frontendPortRangeEnd: '50099'
        protocol: tcp

我一直在阅读有关使用端口伪装配置 SNAT 的文章，但我缺少此类设置的相关示例。

非常感谢任何帮助。

Answer 1

进行了大量搜索，但 article from Azure about Azure Load Balancer outbound Connections (Scenario #2) 指出 SNAT 运行需要负载平衡规则（和互补的 Health Probe）。

负载均衡器的新代码变为：

...
- type: Microsoft.Network/loadBalancers
  name: '[variables(''loadBalancerName'')]'
  apiVersion: '2017-10-01'
  location: '[resourceGroup().location]'
  sku:
    name: Standard
  dependsOn:
  - '[variables(''natIPAddressName'')]'
  properties:
    backendAddressPools:
    - name: '[variables(''lbBackendPoolName'')]'
    frontendIPConfigurations:
    - name: LoadBalancerFrontEnd
      properties:
        publicIPAddress:
          id: '[variables(''natIPAddressId'')]'
    probes:  # Needed for loadBalancingRule to work
    - name: '[variables(''lbProbeName'')]'
      properties:
        protocol: Tcp
        port: 22
        intervalInSeconds: 5
        numberOfProbes: 2
    loadBalancingRules:  # Needed for SNAT to work
    - name: '[concat(variables(''loadBalancerName''),''NatRule'')]'
      properties:
        disableOutboundSnat: false
        frontendIPConfiguration:
          id: '[variables(''frontEndIPConfigID'')]'
        backendAddressPool:
          id: '[variables(''lbBackendAddressPoolsId'')]'
        probe:
          id: '[variables(''lbProbeId'')]'
        protocol: tcp
        frontendPort: 80
        backendPort: 80
...

未从负载均衡器后面的 Azure VM 规模集中的节点获取任何外部出站流量

Not getting any external outbound traffic from nodes in a Azure VM Scale Set behind a loadbalancer

rhel

nat

azure

outbound

azure-resource-manager