[管理篇]VMWare搭建Openstack——将FlatDHCP网络转化为GRE网络——实例化网络
我们已经将我们的网络模式更改为GRE网络，前面也讲到了GRE网络的表现形式，下面就实际操作一下，来感受一下GRE网络到底是一个什么样子的状态。
![[管理篇]VMWare搭建Openstack——将FlatDHCP网络转化为GRE网络——实例化网络_第1张图片](http://img.e-com-net.com/image/info8/f37ce089043943de863f4c4fa2698223.jpg)
通过上图我们可以看到，我们的外部网络是在网络节点的eth2，我们需要创建一个外部网络，来保证通过外部网络可以访问虚拟机。
首先通过admin租户权限来创建外部网络
source admin-openrc.sh1、创建外部网络
neutron net-create ext-net --shared --router:external=True2、创建子网络
neutron subnet-create ext-net --name ext-subnet \
--allocation-pool start=203.0.113.101,end=203.0.113.200 \
--disable-dhcp --gateway 203.0.113.1 203.0.113.0/24创建一个子网络，该子网络的起始IP为203.0.113.101到203.0.113.200，分给我们了100个外部IP，所以该信息实际上是通过网络管理员来获知的。
由于我的外部网络已经提前创建完毕，我就不讲具体生成信息进行显示了。
接下来我们创建一个租户，来看一下怎么在租户内创建内部网络，怎么通过外部网络来访问租户的虚拟机。
1、创建一个租户，创建租户通过admin用户来创建，所以需要获得admin的环境变量，我们创建了一个租户TenantC，我们可以假设创建了一个部门。
sm@controller:~$ source admin-openrc.sh
sm@controller:~$ keystone tenant-create --name TenantC
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | |
| enabled | True |
| id | 7a9a86dfd657482a859688fb97e2375f |
| name | TenantC |
+-------------+----------------------------------+
sm@controller:~$ keystone user-create --name=UserC --pass=password --tenant-id TenantC [email protected]
+----------+----------------------------------+
| Property | Value |
+----------+----------------------------------+
| email | [email protected] |
| enabled | True |
| id | 5bcdce96f7e749fbb157842c9eaf7765 |
| name | UserC |
| tenantId | 7a9a86dfd657482a859688fb97e2375f |
| username | UserC |
+----------+----------------------------------+
sm@controller:~$ keystone role-list
+----------------------------------+----------+
| id | name |
+----------------------------------+----------+
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |
| f23b1fadeda94747ac6f3b612afc6e69 | admin |
+----------------------------------+----------+
sm@controller:~$ keystone user-role-add --tenant TenantC --user UserC --role _member_
4、为租户C创建一个网络
sm@controller:~$ neutron --os-tenant-name TenantC --os-username UserC --os-password password --os-auth-url=http://localhost:5000/v2.0 net-create tenantC-Net
Created a new network:
+----------------+--------------------------------------+
| Field | Value |
+----------------+--------------------------------------+
| admin_state_up | True |
| id | e0b02bcc-0696-4099-9b02-18b98ada3fff |
| name | tenantC-Net |
| shared | False |
| status | ACTIVE |
| subnets | |
| tenant_id | 7a9a86dfd657482a859688fb97e2375f |
+----------------+--------------------------------------+
5、为租户C创建一个子网
sm@controller:~$ neutron --os-tenant-name TenantC --os-username UserC --os-password password --os-auth-url=http://localhost:5000/v2.0 subnet-create tenantC-Net 12.0.0.0/24
Created a new subnet:
+------------------+--------------------------------------------+
| Field | Value |
+------------------+--------------------------------------------+
| allocation_pools | {"start": "12.0.0.2", "end": "12.0.0.254"} |
| cidr | 12.0.0.0/24 |
| dns_nameservers | |
| enable_dhcp | True |
| gateway_ip | 12.0.0.1 |
| host_routes | |
| id | d3faf871-3def-47e4-b269-1226736be50c |
| ip_version | 4 |
| name | |
| network_id | e0b02bcc-0696-4099-9b02-18b98ada3fff |
| tenant_id | 7a9a86dfd657482a859688fb97e2375f |
+------------------+--------------------------------------------+
sm@controller:~$ neutron --os-tenant-name TenantC --os-username UserC --os-password password --os-auth-url=http://localhost:5000/v2.0 router-create tenant-R-C
Created a new router:
+-----------------------+--------------------------------------+
| Field | Value |
+-----------------------+--------------------------------------+
| admin_state_up | True |
| external_gateway_info | |
| id | 40ea7752-64a5-4e14-9db1-8bf4dadea3de |
| name | tenant-R-C |
| status | ACTIVE |
| tenant_id | 7a9a86dfd657482a859688fb97e2375f |
+-----------------------+--------------------------------------+
sm@controller:~$ neutron --os-tenant-name TenantC --os-username UserC --os-password password --os-auth-url=http://localhost:5000/v2.0 router-interface-add tenant-R-C d3faf871-3def-47e4-b269-1226736be50c
Added interface 987fa9d6-fec7-4b85-a808-1c90128eb217 to router tenant-R-C.
8、为租户C路由增加网关，直接连接外部网络
sm@controller:~$ neutron router-gateway-set tenant-R-C Ext-Net
Set gateway for router tenant-R-C
接下来设置安全组
对于安全组，我们既可以在Horizon界面进行设置也可以使用命令行设置，设置的目的就是为租户的访问安全进行保障，例如我们是否可以ping通租户的VM，是否可以开启租户虚拟机的设定端口等。
获得租户C默认的安全规则
sm@controller:~$ neutron --os-tenant-name TenantC --os-username UserC --os-password password --os-auth-url=http://localhost:5000/v2.0 security-group-list
+--------------------------------------+---------+-------------+
| id | name | description |
+--------------------------------------+---------+-------------+
| 809da267-56a9-4287-abcc-c54b753cb075 | default | default |
+--------------------------------------+---------+-------------+
添加相关的安全规则，以下设置为最大的安全设置，可以任意进行ping，也可以对所有TCP和UDP接口进行访问，但是生产环境下，建议实行严格的安全机制
sm@controller:~$ neutron --os-tenant-name TenantC --os-username UserC --os-password password --os-auth-url=http://localhost:5000/v2.0 security-group-list
+--------------------------------------+---------+-------------+
| id | name | description |
+--------------------------------------+---------+-------------+
| 809da267-56a9-4287-abcc-c54b753cb075 | default | default |
+--------------------------------------+---------+-------------+
sm@controller:~$
sm@controller:~$ nova --os-tenant-name TenantC --os-username UserC --os-password password --os-auth-url=http://localhost:5000/v2.0 secgroup-add-rule default tcp 1 65535 0.0.0.0/0
+-------------+-----------+---------+-----------+--------------+
| IP Protocol | From Port | To Port | IP Range | Source Group |
+-------------+-----------+---------+-----------+--------------+
| tcp | 1 | 65535 | 0.0.0.0/0 | |
+-------------+-----------+---------+-----------+--------------+
sm@controller:~$ nova --os-tenant-name TenantC --os-username UserC --os-password password --os-auth-url=http://localhost:5000/v2.0 secgroup-add-rule default udp 1 65535 0.0.0.0/0
+-------------+-----------+---------+-----------+--------------+
| IP Protocol | From Port | To Port | IP Range | Source Group |
+-------------+-----------+---------+-----------+--------------+
| udp | 1 | 65535 | 0.0.0.0/0 | |
+-------------+-----------+---------+-----------+--------------+
sm@controller:~$ nova --os-tenant-name TenantC --os-username UserC --os-password password --os-auth-url=http://localhost:5000/v2.0 secgroup-add-rule default icmp -1 -1 0.0.0.0/0
+-------------+-----------+---------+-----------+--------------+
| IP Protocol | From Port | To Port | IP Range | Source Group |
+-------------+-----------+---------+-----------+--------------+
| icmp | -1 | -1 | 0.0.0.0/0 | |
+-------------+-----------+---------+-----------+--------------+
密钥对访问，创建密钥对，设定固定机器的访问
sm@controller:~$ source userC-openrc.sh
sm@controller:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/sm/.ssh/id_rsa):
Created directory '/home/sm/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/sm/.ssh/id_rsa.
Your public key has been saved in /home/sm/.ssh/id_rsa.pub.
The key fingerprint is:
27:ba:56:33:8e:64:18:83:f7:8a:3c:5c:65:13:61:cc sm@controller
The key's randomart image is:
+--[ RSA 2048]----+
| oo. |
| .E |
| . . |
| . + + |
| . B .S . |
| o +.+o |
| o o +.+ o |
| = . o.. |
| . .. |
+-----------------+
sm@controller:~$ nova keypair-add --pub-key ~/.ssh/id_rsa.pub c-key
sm@controller:~$ nova keypair-list
+-----------+-------------------------------------------------+
| Name | Fingerprint |
+-----------+-------------------------------------------------+
| c-key | 27:ba:56:33:8e:64:18:83:f7:8a:3c:5c:65:13:61:cc |
+-----------+-------------------------------------------------+
接下来就现在Horizon界面查看相关信息，我们可以创建虚拟机，虚拟机可以分配IP，但是外部网络还无法访问，我们需要设置浮动IP才能访问，下面我们就介绍如何实现。