在AWS中創建NAT節點

NAT, Network Address Translation,即網絡地址轉換。當內部網絡的主機想要訪問外網，但是又不想直接暴露給公網，可以通過NAT節點來訪問外網。這樣做有兩個好處，第一是內網的主機無需擁有公網IP就可訪問網絡（NAT節點需要公網IP），節約了公網IP；第二是內網的主機由於沒有公網IP，所以公網的電腦無法訪問到它，這樣就可以隱藏自己。一個很經典的示例是假如你有一台數據庫服務器放置在內網中，為在同一個內網中的web服務器提供數據服務，為了安全性考慮你不會把它直接暴露在公網中。但是數據庫服務器有時候自己是需要訪問公網的，比如需要升級數據庫服務器中的某些軟件等。采用NAT方案可以很好的解決這個問題。

下圖是NAT節點的功能示意圖。

一些路由器或者裝有特定軟件的主機都可以作為NAT節點。在AWS中如果你想創建一個NAT節點的話那是非常的方便，因為AWS直接提供了預裝了NAT軟件的AMI，你只需直接使用該AMI在你的公共子網中實例化一台機器，並進行相應的配置即可。

下面的圖展示了在AWS中的一個經典的VPC架構。該VPC里面建立了兩個子網，一個是公共子網，通過Intenet Geteway和公網連接；一個是私有子網，無法直接訪問公網。然后在公共子網中建立了一個EC2機器，使用的是AWS提供的具有NAT功能的AMI，並為它分配了一個彈性IP，這樣該EC2就是一個NAT節點。在私有子網的所有機器都具有了通過該NAT節點訪問外網的能力。

為了創建這樣一套網絡及機器，最簡便的方式當然是使用AWS提供的CloudFormation了。如果不了解CloudFormation，可以看我以前寫過的一篇文章《亞馬遜雲服務之CloudFormation》。下面展示的是創建該整個VPC的CloudFormation腳本。

 
                {  "AWSTemplateFormatVersion": "2010-09-09",  "Description": "Setup a vpc, which contains two subnets and one NAT machine",  "Parameters": {  "KeyName": {  "Description": "Name of and existing EC2 KeyPair to enable SSH access to the instance",  "Type": "String"  },  "VpcCidr": {  "Description": "CIDR address for the VPC to be created.",  "Type": "String",  "Default": "10.2.0.0/16"  },  "AnyCidr": {  "Description": "CIDR address for Any Where.",  "Type": "String",  "Default": "0.0.0.0/0"  },  "AvailabilityZone1": {  "Description": "First AZ.",  "Type": "String",  "Default": "cn-north-1a"  },  "PublicSubnetCidr": {  "Description": "Address range for a public subnet to be created in AZ1.",  "Type": "String",  "Default": "10.2.1.0/24"  },  "PrivateSubnetCidr": {  "Description": "Address range for private subnet.",  "Type": "String",  "Default": "10.2.2.0/24"  },  "NATInstanceType": {  "Description": "Instance type for NAT",  "Type": "String",  "Default": "t1.micro"  }  },  "Mappings": {  "AWSNATAMI": {  "cn-north-1": {  "AMI": "ami-eab220d3"  }  }  },  "Resources": {  "VPC": {  "Type": "AWS::EC2::VPC",  "Properties": {  "CidrBlock": {  "Ref": "VpcCidr"  },  "Tags": [  {  "Key": "Name",  "Value": "VPC"  }  ]  }  },  "InternetGateWay": {  "Type": "AWS::EC2::InternetGateway",  "Properties": {  "Tags": [  {  "Key": "Name",  "Value": "INTERNET_GATEWAY"  }  ]  }  },  "GatewayToInternet": {  "Type": "AWS::EC2::VPCGatewayAttachment",  "Properties": {  "InternetGatewayId": {  "Ref": "InternetGateWay"  },  "VpcId": {  "Ref": "VPC"  }  }  },  "PublicSubnet": {  "Type": "AWS::EC2::Subnet",  "Properties": {  "CidrBlock": {  "Ref": "PublicSubnetCidr"  },  "AvailabilityZone": {  "Ref": "AvailabilityZone1"  },  "Tags": [  {  "Key": "Name",  "Value": "PUBLIC_SUBNET"  }  ],  "VpcId": {  "Ref": "VPC"  }  }  },  "PrivateSubnet": {  "Type": "AWS::EC2::Subnet",  "Properties": {  "CidrBlock": {  "Ref": "PrivateSubnetCidr"  },  "AvailabilityZone": {  "Ref": "AvailabilityZone1"  },  "Tags": [  {  "Key": "Name",  "Value": "PRIVATE_SUBNET"  }  ],  "VpcId": {  "Ref": "VPC"  }  }  },  "DefaultSecurityGroup": {  "Type": "AWS::EC2::SecurityGroup",  "Properties": {  "GroupDescription": "Default Instance SecurityGroup",  "SecurityGroupIngress": [  {  "IpProtocol": "-1",  "CidrIp": {  "Ref": "VpcCidr"  }  }  ],  "Tags": [  {  "Key": "Name",  "Value": "DEFAULT_SECURITY_GROUP"  }  ],  "VpcId": {  "Ref": "VPC"  }  }  },  "PublicRouteTable": {  "Type": "AWS::EC2::RouteTable",  "Properties": {  "VpcId": {  "Ref": "VPC"  },  "Tags": [  {  "Key": "Name",  "Value": "PUBLIC_ROUTE_TABLE"  }  ]  }  },  "PublicRoute": {  "Type": "AWS::EC2::Route",  "Properties": {  "DestinationCidrBlock": {  "Ref": "AnyCidr"  },  "GatewayId": {  "Ref": "InternetGateWay"  },  "RouteTableId": {  "Ref": "PublicRouteTable"  }  }  },  "PublicSubnetRouteTableAssociation": {  "Type": "AWS::EC2::SubnetRouteTableAssociation",  "Properties": {  "RouteTableId": {  "Ref": "PublicRouteTable"  },  "SubnetId": {  "Ref": "PublicSubnet"  }  }  },  "NATEIP": {  "Type": "AWS::EC2::EIP",  "Properties": {  "InstanceId": {  "Ref": "NATInstance"  }  }  },  "NATInstance": {  "Type": "AWS::EC2::Instance",  "Properties": {  "InstanceType": {  "Ref": "NATInstanceType"  },  "KeyName": {  "Ref": "KeyName"  },  "SubnetId": {  "Ref": "PublicSubnet"  },  "SourceDestCheck": false,  "ImageId": {  "Fn::FindInMap": [  "AWSNATAMI",  {  "Ref": "AWS::Region"  },  "AMI"  ]  },  "Tags": [  {  "Key": "Name",  "Value": "NAT"  }  ],  "SecurityGroupIds": [  {  "Ref": "NATSecurityGroup"  }  ]  }  },  "PrivateSubnetRouteTable": {  "Type": "AWS::EC2::RouteTable",  "Properties": {  "VpcId": {  "Ref": "VPC"  },  "Tags": [  {  "Key": "Name",  "Value": "PRIVATE_SUBNET_ROUTE_TABLE"  }  ]  }  },  "PrivateSubnetRoute": {  "Type": "AWS::EC2::Route",  "Properties": {  "DestinationCidrBlock": {  "Ref": "AnyCidr"  },  "InstanceId": {  "Ref": "NATInstance"  },  "RouteTableId": {  "Ref": "PrivateSubnetRouteTable"  }  }  },  "PrivateSubnetRouteTableAssociation": {  "Type": "AWS::EC2::SubnetRouteTableAssociation",  "Properties": {  "RouteTableId": {  "Ref": "PrivateSubnetRouteTable"  },  "SubnetId": {  "Ref": "PrivateSubnet"  }  }  },  "NATSecurityGroup": {  "Type": "AWS::EC2::SecurityGroup",  "Properties": {  "GroupDescription": "NAT Instance SecurityGroup",  "SecurityGroupIngress": [  {  "IpProtocol": "-1",  "CidrIp": {  "Ref": "VpcCidr"  }  }  ],  "Tags": [  {  "Key": "Name",  "Value": "NAT_SECURITY_GROUP"  }  ],  "VpcId": {  "Ref": "VPC"  }  }  }  },  "Outputs": {  "VPCId": {  "Description": "VPC id",  "Value": {  "Ref": "VPC"  }  },  "PublicSubnetId": {  "Description": "public subnet id",  "Value": {  "Ref": "PublicSubnet"  }  },  "PrivateSubnetId": {  "Description": "private subnet id",  "Value": {  "Ref": "PrivateSubnet"  }  },  "NATSecurityGroupId": {  "Description": "NAT SG id",  "Value": {  "Ref": "NATSecurityGroup"  }  },  "NATEIP": {  "Description": "NAT Server EIP.",  "Value": {  "Ref": "NATEIP"  }  }  } }

你可以通過AWS提供的圖形化界面AWS Management Console來使用該CloudFormation腳本，也可以通過AWS CLI來使用。使用以上的CloudFormation腳本創建的VPC可以一鍵創建你AWS中的基礎網絡架構。從此再也不用為配置網絡發愁了。

在AWS中創建NAT節點

免責聲明！