进城务工人员小梅GCP上的机器多网卡、多公网IP时，第二块网卡的公网IP默认入访和出访都不通，以如下实例为例：
GCP多网卡实例
默认网络配置：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 |
[jumper@instance-3 ~]$ ifconfig eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1460 inet 10.140.0.4 netmask 255.255.255.255 broadcast 0.0.0.0 inet6 fe80::7e0:7f5:3fac:d869 prefixlen 64 scopeid 0x20<link> ether 42:01:0a:8c:00:04 txqueuelen 1000 (Ethernet) RX packets 81210 bytes 55164267 (52.6 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 77576 bytes 8497158 (8.1 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1460 inet 192.168.1.4 netmask 255.255.255.255 broadcast 0.0.0.0 inet6 fe80::359f:8fc5:4abb:e0ee prefixlen 64 scopeid 0x20<link> ether 42:01:c0:a8:01:04 txqueuelen 1000 (Ethernet) RX packets 33943 bytes 2933013 (2.7 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 2848 bytes 496832 (485.1 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 1000 (Local Loopback) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 [jumper@instance-3 ~]$ route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default _gateway 0.0.0.0 UG 100 0 0 eth0 10.140.0.0 _gateway 255.255.240.0 UG 100 0 0 eth0 _gateway 0.0.0.0 255.255.255.255 UH 100 0 0 eth0 192.168.1.0 192.168.1.1 255.255.255.0 UG 0 0 0 eth1 192.168.1.0 192.168.1.1 255.255.255.0 UG 101 0 0 eth1 192.168.1.1 0.0.0.0 255.255.255.255 UH 0 0 0 eth1 192.168.1.1 0.0.0.0 255.255.255.255 UH 101 0 0 eth1 |
我们可以使用wget，指定网卡作为出口进行测试：
|
1 |
wget http://pv.sohu.com/cityjson --bind-address=192.168.1.4 |
可以看到第二块网卡是不通的：
GCP多网卡实例默认第二块网卡入访出访都不通
首先要增加防火墙配置：
GCP自定义VPC防火墙
但是即使增加了防火墙配置，在GCP后台测试能够出访时，依然不能在虚拟机上出访：
GCP自定义VPC的防火墙策略
在ServerFault上有一个类似的问题（参考资料1），其中的两个回答指向了GCP官网的文档：
ServerFault类似问题
在官网上我们可以看到：
GCP Configuring Policy Route
增加策略路由后：
|
1 2 3 4 5 6 |
sudo ifconfig eth1 192.168.1.4 netmask 255.255.255.255 broadcast 192.168.1.4 mtu 1430 echo "1 rt1" | sudo tee -a /etc/iproute2/rt_tables sudo ip route add 192.168.1.1 src 192.168.1.4 dev eth1 table rt1 sudo ip route add default via 192.168.1.1 dev eth1 table rt1 sudo ip rule add from 192.168.1.4/32 table rt1 sudo ip rule add to 192.168.1.4/32 table rt1 |
入访和出访就都可以了：
GCP配置策略路由后实现多网卡出入访
参考资料：
1、https://serverfault.com/questions/930207/centos-7-with-2-nics-on-google-cloud
2、https://cloud.google.com/vpc/docs/create-use-multiple-interfaces
转载时请保留出处，违法转载追究到底：进城务工人员小梅 » GCP机器多网卡、多公网IP配置