Virtual Private Cloud：IPv4網關

控制台

1. 前往專用網路控制台-IPv4網關頁面，在頁面上方選擇VPC所在的地區後，單擊建立IPv4網關。

2. 建立IPv4網關：選擇需集中控制公網訪問的專用網路。

3. 啟用IPv4網關：選擇公有交換器綁定的路由表，系統自動添加0.0.0.0/0路由指向IPv4網關，確保公有交換器中的資源綁定公網IP後可訪問公網。當路由表中存在目標網段為0.0.0.0/0的路由時，需要單擊暫不啟用，調整對應路由的下一跳為IPv4網關後再啟用。啟用後，專用網路訪問公網的行為切換為IPv4網關集中控制。

   • 當ECS執行個體使用公網NAT Gateway綁定的公網IP訪問公網時，需要將ECS執行個體和公網NAT Gateway部署在不同的交換器中，為NAT Gateway所在交換器關聯的路由表配置0.0.0.0/0路由指向IPv4網關，為ECS執行個體所在交換器關聯的路由表配置路由指向公有交換器中的NAT Gateway。

   • 當ECS執行個體使用固定公網IP、綁定的Elastic IP Address訪問公網時，為ECS執行個體配置0.0.0.0/0路由指向IPv4網關即可。

API

• 調用CreateIpv4Gateway建立IPv4網關。

• 調用EnableVpcIpv4Gateway啟用IPv4網關，指定RouteTableList為公有交換器綁定的路由表；如未指定，需要調用CreateRouteEntry在對應路由表中自行添加0.0.0.0/0路由指向IPv4網關。

Terraform

與控制台邏輯不同的是，啟用IPv4網關時，系統不會自動添加0.0.0.0/0路由指向IPv4網關，需要自行配置路由。

Resource：alicloud_vpc、alicloud_vswitch、alicloud_vpc_ipv4_gateway、alicloud_route_table、alicloud_route_table_attachment、alicloud_vpc_route_entry、alicloud_instance、alicloud_security_group、alicloud_security_group_rule、alicloud_eip_address、alicloud_eip_association、alicloud_nat_gateway、alicloud_snat_entry

Data Sources：alicloud_zones

# 指定建立IPv4網關的地區
provider "alicloud" {
  region = "cn-hangzhou"
}

# 根據資料來源自動擷取可以建立交換器的可用性區域列表
data "alicloud_zones" "available_zones" {
  available_resource_creation = "VSwitch" # 查詢VPC內可建立的可用性區域
}

# 建立1個VPC 
resource "alicloud_vpc" "example_vpc" {
  vpc_name   = "example_vpc_name"
  cidr_block = "10.0.0.0/16" # 指定網段 
}

# 定義交換器配置
locals {
  vswitches = {
    vsw1 = {
      name       = "example_vsw1_name"
      cidr_block = "10.0.0.0/24"
      zone_index = 0
    }
    vsw2 = {
      name       = "example_vsw2_name"
      cidr_block = "10.0.1.0/24"
      zone_index = 1
    }
    vsw3 = {
      name       = "example_vsw3_name"
      cidr_block = "10.0.2.0/24"
      zone_index = 0
    }
    vsw4 = {
      name       = "example_vsw4_name"
      cidr_block = "10.0.3.0/24"
      zone_index = 0
    }
  }

  # 定義路由表配置
  route_tables = {
    rt1 = {
      name        = "example_rt1_name"
      vswitch_key = "vsw1"
    }
    rt2 = {
      name        = "example_rt2_name"
      vswitch_key = "vsw2"
    }
    rt3 = {
      name        = "example_rt3_name"
      vswitch_key = "vsw3"
    }
    rt4 = {
      name        = "example_rt4_name"
      vswitch_key = "vsw4"
    }
  }

  # 定義執行個體配置
  instances = {
    instance1 = {
      name        = "example_instance1_name"
      vswitch_key = "vsw1"
    }
    instance2 = {
      name        = "example_instance2_name"
      vswitch_key = "vsw3"
    }
    instance3 = {
      name        = "example_instance3_name"
      vswitch_key = "vsw4"
    }
  }

  # 定義EIP配置
  eips = {
    eip1 = {
      name = "example_eip1_name"
    }
    eip2 = {
      name = "example_eip2_name"
    }
  }

  # 定義SNAT條目配置
  snat_entries = {
    snat1 = {
      instance_key = "instance2"
    }
    snat2 = {
      instance_key = "instance3"
    }
  }
}

# 建立多個交換器
resource "alicloud_vswitch" "example_vsw" {
  for_each = local.vswitches

  vswitch_name = each.value.name
  cidr_block   = each.value.cidr_block
  vpc_id       = alicloud_vpc.example_vpc.id
  zone_id      = data.alicloud_zones.available_zones.zones[each.value.zone_index].id
}

# 建立多個自訂路由表
resource "alicloud_route_table" "example_route_table" {
  for_each = local.route_tables

  route_table_name = each.value.name
  vpc_id           = alicloud_vpc.example_vpc.id
}

# 將路由表與交換器綁定
resource "alicloud_route_table_attachment" "example_route_table_attachment" {
  for_each = local.route_tables

  vswitch_id     = alicloud_vswitch.example_vsw[each.value.vswitch_key].id
  route_table_id = alicloud_route_table.example_route_table[each.key].id
}

# 指定執行個體規格
variable "instance_type" {
  default = "ecs.e-c1m1.large"
}

# 指定鏡像ID
variable "image_id" {
  default = "aliyun_3_x64_20G_alibase_20221102.vhd"
}

# 建立安全性群組
resource "alicloud_security_group" "example_security_group" {
  security_group_name = "example_security_group_name"
  vpc_id              = alicloud_vpc.example_vpc.id
}

# 建立安全性群組規則,需按實際訪問流量修改協議與連接埠號碼
resource "alicloud_security_group_rule" "allow_internet" {
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.example_security_group.id
  cidr_ip           = "0.0.0.0/0"
}

# 建立多個伺服器
resource "alicloud_instance" "example_instance" {
  for_each = local.instances

  instance_name        = each.value.name
  vswitch_id           = alicloud_vswitch.example_vsw[each.value.vswitch_key].id
  instance_type        = var.instance_type
  image_id             = var.image_id
  system_disk_category = "cloud_essd"
  security_groups      = [alicloud_security_group.example_security_group.id]
  instance_charge_type = "PostPaid"           # 指定付費類型為隨用隨付
  spot_strategy        = "SpotWithPriceLimit" # 設定上限價格的搶佔式執行個體
}

# 建立多個EIP
resource "alicloud_eip_address" "example_eip" {
  for_each = local.eips

  address_name = each.value.name
  isp          = "BGP"
  netmode      = "public"
  bandwidth    = "1"
  payment_type = "PayAsYouGo"
}

# 綁定ECS和EIP
resource "alicloud_eip_association" "example_eip_ecs_association" {
  allocation_id = alicloud_eip_address.example_eip["eip1"].id
  instance_type = "EcsInstance"
  instance_id   = alicloud_instance.example_instance["instance1"].id
}

# 建立公網NAT Gateway
resource "alicloud_nat_gateway" "example_natgw" {
  nat_gateway_name = "example_natgw_name"
  vpc_id           = alicloud_vpc.example_vpc.id
  vswitch_id       = alicloud_vswitch.example_vsw["vsw2"].id
  nat_type         = "Enhanced"
  eip_bind_mode    = "NAT" # 指定EIP繫結模式，必須為NAT模式
  payment_type     = "PayAsYouGo"
}

# 綁定EIP和公網NAT Gateway
resource "alicloud_eip_association" "example_eip_natgw_association" {
  allocation_id = alicloud_eip_address.example_eip["eip2"].id
  instance_type = "NAT"
  instance_id   = alicloud_nat_gateway.example_natgw.id
}

# 添加路由指向NAT Gateway
resource "alicloud_route_entry" "example_rt3_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt3"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "NatGateway"
  nexthop_id            = alicloud_nat_gateway.example_natgw.id
}

# 添加路由指向NAT Gateway
resource "alicloud_route_entry" "example_rt4_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt4"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "NatGateway"
  nexthop_id            = alicloud_nat_gateway.example_natgw.id
}

# 建立SNAT條目
resource "alicloud_snat_entry" "example_snat_entry" {
  for_each = local.snat_entries

  snat_table_id = alicloud_nat_gateway.example_natgw.snat_table_ids
  source_cidr   = alicloud_instance.example_instance[each.value.instance_key].primary_ip_address
  snat_ip       = alicloud_eip_address.example_eip["eip2"].ip_address
}

# 建立IPv4網關
resource "alicloud_vpc_ipv4_gateway" "example_ipv4gw" {
  ipv4_gateway_name = "example_ipv4gw_name"
  vpc_id            = alicloud_vpc.example_vpc.id
  enabled           = true
}

# 添加路由指向IPv4網關
resource "alicloud_route_entry" "example_rt1_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt1"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.example_ipv4gw.id
}

# 添加路由指向IPv4網關
resource "alicloud_route_entry" "example_rt2_route" {
  route_table_id        = alicloud_route_table.example_route_table["rt2"].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.example_ipv4gw.id
}

控制台

1. 前往專用網路控制台-IPv4網關頁面，在頁面上方選擇VPC所在的地區後，單擊建立IPv4網關。

2. 建立IPv4網關：選擇需訪問非標準私網網段的專用網路。

3. 啟用IPv4網關：選擇需訪問非標準私網網段的交換器綁定的路由表，系統自動添加0.0.0.0/0路由指向IPv4網關，確保交換器中的資源可以按照更明細的路由訪問非標準私網網段。

   • 確保綁定的路由表中，不存在目標網段為0.0.0.0/0的路由。如有，需要單擊暫不啟用，刪除路由後再啟用。

   • 啟用後，IPv4網關集中控制訪問公網的流量，所有流量均按照路由錶轉發。

API

• 調用CreateIpv4Gateway建立IPv4網關。

• 調用EnableVpcIpv4Gateway啟用IPv4網關指，定RouteTableList為公有交換器綁定的路由表；如未指定，需要調用CreateRouteEntry在對應路由表中自行添加0.0.0.0/0路由指向IPv4網關。

Terraform

與控制台邏輯不同的是，啟用IPv4網關時，系統不會自動添加0.0.0.0/0路由指向IPv4網關，需要自行配置路由。

Resource：alicloud_vpc、alicloud_vswitch、alicloud_vpc_ipv4_gateway、alicloud_route_table、alicloud_route_table_attachment、alicloud_vpc_route_entry、alicloud_instance、alicloud_security_group、alicloud_security_group_rule、alicloud_eip_address、alicloud_eip_association、alicloud_vpc_peer_connection

Data Sources：alicloud_zones

本樣本中，建立對等串連的VPC屬於同一帳號。建立跨帳號對等串連時，還需要建立alicloud_vpc_peer_connection_accepter確保對端帳號接受對等串連。

# 指定建立IPv4網關的地區
provider "alicloud" {
  region = "cn-hangzhou"
}

# 根據資料來源自動擷取可以建立交換器的可用性區域列表
data "alicloud_zones" "available_zones" {
  available_resource_creation = "VSwitch" # 查詢VPC內可建立的可用性區域
}

# 指定執行個體規格
variable "instance_type" {
  default = "ecs.e-c1m1.large"
}

# 指定鏡像ID
variable "image_id" {
  default = "aliyun_3_x64_20G_alibase_20221102.vhd"
}

# 建立VPC
resource "alicloud_vpc" "example_vpc1" {
  vpc_name   = "example_vpc1_name"
  cidr_block = "10.0.0.0/16" # 指定網段 
}

# 建立VPC
resource "alicloud_vpc" "example_vpc2" {
  vpc_name   = "example_vpc2_name"
  cidr_block = "30.0.0.0/16" # 指定網段 
}

# 建立交換器
resource "alicloud_vswitch" "example_vsw1" {
  vswitch_name = "example_vsw1_name"
  cidr_block   = "10.0.1.0/24"
  vpc_id       = alicloud_vpc.example_vpc1.id
  zone_id      = data.alicloud_zones.available_zones.zones.0.id
}

# 建立交換器
resource "alicloud_vswitch" "example_vsw2" {
  vswitch_name = "example_vsw2_name"
  cidr_block   = "30.0.1.0/24"
  vpc_id       = alicloud_vpc.example_vpc2.id
  zone_id      = data.alicloud_zones.available_zones.zones.1.id
}

# 建立安全性群組
resource "alicloud_security_group" "example_security_group1" {
  security_group_name = "example_security_group1_name"
  vpc_id              = alicloud_vpc.example_vpc1.id
}

# 建立安全性群組規則,需按實際訪問流量修改協議與連接埠號碼
resource "alicloud_security_group_rule" "allow_internet1" {
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.example_security_group1.id
  cidr_ip           = "0.0.0.0/0"
}

# 建立安全性群組
resource "alicloud_security_group" "example_security_group2" {
  security_group_name = "example_security_group2_name"
  vpc_id              = alicloud_vpc.example_vpc2.id
}

# 建立安全性群組規則,需按實際訪問流量修改協議與連接埠號碼
resource "alicloud_security_group_rule" "allow_internet2" {
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.example_security_group2.id
  cidr_ip           = "0.0.0.0/0"
}

# 建立ECS執行個體
resource "alicloud_instance" "example_instance1" {
  instance_name        = "example_instance1_name"
  vswitch_id           = alicloud_vswitch.example_vsw1.id
  instance_type        = var.instance_type
  image_id             = var.image_id
  system_disk_category = "cloud_essd"
  security_groups      = [alicloud_security_group.example_security_group1.id]
  instance_charge_type = "PostPaid"
  spot_strategy        = "SpotWithPriceLimit"
}

# 建立EIP
resource "alicloud_eip_address" "example_eip" {
  address_name = "example_eip_name"
  isp          = "BGP"
  netmode      = "public"
  bandwidth    = "1"
  payment_type = "PayAsYouGo"
}

# 綁定ECS和EIP
resource "alicloud_eip_association" "example_eip_ecs_association" {
  allocation_id = alicloud_eip_address.example_eip.id
  instance_type = "EcsInstance"
  instance_id   = alicloud_instance.example_instance1.id
}

# 建立ECS執行個體
resource "alicloud_instance" "example_instance2" {
  instance_name        = "example_instance2_name"
  vswitch_id           = alicloud_vswitch.example_vsw2.id
  instance_type        = var.instance_type
  image_id             = var.image_id
  system_disk_category = "cloud_essd"
  security_groups      = [alicloud_security_group.example_security_group2.id]
  instance_charge_type = "PostPaid"
  spot_strategy        = "SpotWithPriceLimit"
}

# 建立自訂路由表
resource "alicloud_route_table" "example_route_table1" {
  route_table_name = "example_route_table1_name"
  vpc_id           = alicloud_vpc.example_vpc1.id
}

# 將路由表與交換器綁定
resource "alicloud_route_table_attachment" "example_route_table_attachment1" {
  vswitch_id     = alicloud_vswitch.example_vsw1.id
  route_table_id = alicloud_route_table.example_route_table1.id
}

# 建立自訂路由表
resource "alicloud_route_table" "example_route_table2" {
  route_table_name = "example_route_table2_name"
  vpc_id           = alicloud_vpc.example_vpc2.id
}

# 將路由表與交換器綁定
resource "alicloud_route_table_attachment" "example_route_table_attachment2" {
  vswitch_id     = alicloud_vswitch.example_vsw2.id
  route_table_id = alicloud_route_table.example_route_table2.id
}

# 建立VPC對等串連
resource "alicloud_vpc_peer_connection" "example_vpc_peer" {
  peer_connection_name = "example_vpc_peer_name"
  vpc_id               = alicloud_vpc.example_vpc1.id
  accepting_ali_uid    = "1234****" # 對端VPC所屬的帳號I，本樣本建立同帳號對等串連。如果建立跨帳號對等串連，需建立alicloud_vpc_peer_connection_accepter，確保對端帳號接受對等串連。
  accepting_region_id  = "cn-hangzhou"
  accepting_vpc_id     = alicloud_vpc.example_vpc2.id
}

# 配置對等串連的路由
resource "alicloud_route_entry" "example_peer_route1" {
  route_table_id        = alicloud_route_table.example_route_table1.id
  destination_cidrblock = "30.0.0.0/16"
  nexthop_type          = "VpcPeer"
  nexthop_id            = alicloud_vpc_peer_connection.example_vpc_peer.id
}

# 配置對等串連的路由
resource "alicloud_route_entry" "example_peer_route2" {
  route_table_id        = alicloud_route_table.example_route_table2.id
  destination_cidrblock = "10.0.0.0/16"
  nexthop_type          = "VpcPeer"
  nexthop_id            = alicloud_vpc_peer_connection.example_vpc_peer.id
}

# 建立IPv4網關
resource "alicloud_vpc_ipv4_gateway" "example_ipv4gw" {
  ipv4_gateway_name = "example_ipv4gw_name"
  vpc_id            = alicloud_vpc.example_vpc1.id
  enabled           = true
}

# 添加路由指向IPv4網關
resource "alicloud_route_entry" "example_igw_route" {
  route_table_id        = alicloud_route_table.example_route_table1.id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.example_ipv4gw.id
}

控制台

API

• 調用AssociateRouteTableWithGateway綁定網關路由表。

• 調用DissociateRouteTableFromGateway解除綁定網關路由表。

Terraform

Resource：alicloud_vpc_gateway_route_table_attachment

# 指定IPv4網關所在的地區
provider "alicloud" {
  region = "cn-hangzhou"
}

# 指定IPv4網關的ID
variable "ipv4_gateway_id" {
  default = "ipv4gw-hp3v******" # 修改為IPv4網關的實際ID
}

# 指定網關路由表的ID
variable "route_table_id" {
  default = "vtb-hp3w******" # 修改為網關路由表的實際ID
}

# 綁定網關路由表
resource "alicloud_vpc_gateway_route_table_attachment" "example_attachment" {
  ipv4_gateway_id = var.ipv4_gateway_id
  route_table_id  = var.route_table_id
}