地址范围

地址范围基于子网池构建。虽然子网池提供了一种控制地址分配给子网的机制，但地址范围显示了地址可以在哪些网络之间路由，从而防止在任何两个子网中使用重叠的地址。由于在地址范围内分配的所有地址不重叠，Neutron 路由器不会在您的项目网络和外部网络之间进行 NAT。只要地址范围内的地址匹配，Networking 服务就会在网络之间执行简单的路由。

访问地址范围

任何具有访问 Networking 服务的权限的用户都可以创建自己的地址范围。但是，网络管理员可以创建共享地址范围，允许其他项目在该地址范围内创建网络。

通过子网池管理范围内的地址访问。子网池可以创建在地址范围内，也可以更新以属于地址范围。

使用子网池，地址范围内的所有正在使用的地址从地址范围所有者的角度来看都是唯一的。因此，如果池具有不同的所有者，请将多个子网池添加到地址范围，从而可以委派地址范围的一部分。委派可以防止整个范围内的地址重叠。否则，如果两个池具有相同的地址范围，您将收到错误消息。

每个路由器接口都通过查看连接到网络的子网与地址范围相关联。当路由器连接到具有匹配地址范围的外部网络时，网络流量将在没有网络地址转换 (NAT) 的情况下路由。路由器会将源自每个接口的所有流量连接标记为相应的地址范围。如果流量从错误的范围内的接口发出，路由器将阻止该流量。

向后兼容性

在 Mitaka 版本之前创建的网络不包含显式命名的地址范围，除非网络包含属于已创建或更新的地址范围的子网池。Networking 服务通过特殊的地址范围属性保留与 Mitaka 之前的网络的向后兼容性，以便这些网络可以执行高级路由

1. 允许无限的地址重叠。

2. Neutron 路由器默认情况下会对从内部网络到外部网络的流量进行 NAT。

3. Mitaka 之前的地址范围无法通过 API 查看。您无法列出地址范围或显示详细信息。范围隐式地存在，作为未显式作用域的地址的兜底方案。

以管理员用户身份创建共享地址范围

本节介绍如何设置共享地址范围，以便为具有相同子网池的项目网络提供简单的路由。

注意

为了简洁起见，已从这些命令的输出中删除了不相关的字段。

1. 创建 IPv6 和 IPv4 地址范围

   $ openstack address scope create --share --ip-version 6 address-scope-ip6
   
   +------------+--------------------------------------+
   | Field      | Value                                |
   +------------+--------------------------------------+
   | headers    |                                      |
   | id         | 28424dfc-9abd-481b-afa3-1da97a8fead7 |
   | ip_version | 6                                    |
   | name       | address-scope-ip6                    |
   | project_id | 098429d072d34d3596c88b7dbf7e91b6     |
   | shared     | True                                 |
   +------------+--------------------------------------+
   

   $ openstack address scope create --share --ip-version 4 address-scope-ip4
   
   +------------+--------------------------------------+
   | Field      | Value                                |
   +------------+--------------------------------------+
   | headers    |                                      |
   | id         | 3193bd62-11b5-44dc-acf8-53180f21e9f2 |
   | ip_version | 4                                    |
   | name       | address-scope-ip4                    |
   | project_id | 098429d072d34d3596c88b7dbf7e91b6     |
   | shared     | True                                 |
   +------------+--------------------------------------+
   

2. 创建指定子网池所属的地址范围的名称（或 UUID）的子网池。如果您已经有子网池，请使用 openstack subnet pool set 命令将其放入新的地址范围

   $ openstack subnet pool create --address-scope address-scope-ip6 \
   --share --pool-prefix 2001:db8:a583::/48 --default-prefix-length 64 \
   subnet-pool-ip6
   +-------------------+--------------------------------------+
   | Field             | Value                                |
   +-------------------+--------------------------------------+
   | address_scope_id  | 28424dfc-9abd-481b-afa3-1da97a8fead7 |
   | created_at        | 2016-12-13T22:53:30Z                 |
   | default_prefixlen | 64                                   |
   | default_quota     | None                                 |
   | description       |                                      |
   | id                | a59ff52b-0367-41ff-9781-6318b927dd0e |
   | ip_version        | 6                                    |
   | is_default        | False                                |
   | max_prefixlen     | 128                                  |
   | min_prefixlen     | 64                                   |
   | name              | subnet-pool-ip6                      |
   | prefixes          | 2001:db8:a583::/48                   |
   | project_id        | 098429d072d34d3596c88b7dbf7e91b6     |
   | revision_number   | 1                                    |
   | shared            | True                                 |
   | tags              | []                                   |
   | updated_at        | 2016-12-13T22:53:30Z                 |
   +-------------------+--------------------------------------+
   

   $ openstack subnet pool create --address-scope address-scope-ip4 \
   --share --pool-prefix 203.0.113.0/24 --default-prefix-length 26 \
   subnet-pool-ip4
   +-------------------+--------------------------------------+
   | Field             | Value                                |
   +-------------------+--------------------------------------+
   | address_scope_id  | 3193bd62-11b5-44dc-acf8-53180f21e9f2 |
   | created_at        | 2016-12-13T22:55:09Z                 |
   | default_prefixlen | 26                                   |
   | default_quota     | None                                 |
   | description       |                                      |
   | id                | d02af70b-d622-426f-8e60-ed9df2a8301f |
   | ip_version        | 4                                    |
   | is_default        | False                                |
   | max_prefixlen     | 32                                   |
   | min_prefixlen     | 8                                    |
   | name              | subnet-pool-ip4                      |
   | prefixes          | 203.0.113.0/24                       |
   | project_id        | 098429d072d34d3596c88b7dbf7e91b6     |
   | revision_number   | 1                                    |
   | shared            | True                                 |
   | tags              | []                                   |
   | updated_at        | 2016-12-13T22:55:09Z                 |
   +-------------------+--------------------------------------+
   

3. 确保外部网络上的子网是从上述子网池创建的

   $ openstack subnet show ipv6-public-subnet
   +-------------------+------------------------------------------+
   | Field             | Value                                    |
   +-------------------+------------------------------------------+
   | allocation_pools  | 2001:db8:a583::2-2001:db8:a583:0:ffff:ff |
   |                   | ff:ffff:ffff                             |
   | cidr              | 2001:db8:a583::/64                       |
   | created_at        | 2016-12-10T21:36:04Z                     |
   | description       |                                          |
   | dns_nameservers   |                                          |
   | enable_dhcp       | False                                    |
   | gateway_ip        | 2001:db8:a583::1                         |
   | host_routes       |                                          |
   | id                | b333bf5a-758c-4b3f-97ec-5f12d9bfceb7     |
   | ip_version        | 6                                        |
   | ipv6_address_mode | None                                     |
   | ipv6_ra_mode      | None                                     |
   | name              | ipv6-public-subnet                       |
   | network_id        | 05a8d31e-330b-4d96-a3fa-884b04abfa4c     |
   | project_id        | 098429d072d34d3596c88b7dbf7e91b6         |
   | revision_number   | 2                                        |
   | segment_id        | None                                     |
   | service_types     |                                          |
   | subnetpool_id     | a59ff52b-0367-41ff-9781-6318b927dd0e     |
   | tags              | []                                       |
   | updated_at        | 2016-12-10T21:36:04Z                     |
   +-------------------+------------------------------------------+
   

   $ openstack subnet show public-subnet
   +-------------------+--------------------------------------+
   | Field             | Value                                |
   +-------------------+--------------------------------------+
   | allocation_pools  | 203.0.113.2-203.0.113.62             |
   | cidr              | 203.0.113.0/26                       |
   | created_at        | 2016-12-10T21:35:52Z                 |
   | description       |                                      |
   | dns_nameservers   |                                      |
   | enable_dhcp       | False                                |
   | gateway_ip        | 203.0.113.1                          |
   | host_routes       |                                      |
   | id                | 7fd48240-3acc-4724-bc82-16c62857edec |
   | ip_version        | 4                                    |
   | ipv6_address_mode | None                                 |
   | ipv6_ra_mode      | None                                 |
   | name              | public-subnet                        |
   | network_id        | 05a8d31e-330b-4d96-a3fa-884b04abfa4c |
   | project_id        | 098429d072d34d3596c88b7dbf7e91b6     |
   | revision_number   | 2                                    |
   | segment_id        | None                                 |
   | service_types     |                                      |
   | subnetpool_id     | d02af70b-d622-426f-8e60-ed9df2a8301f |
   | tags              | []                                   |
   | updated_at        | 2016-12-10T21:35:52Z                 |
   +-------------------+--------------------------------------+
   

非特权用户使用地址范围进行路由

本节介绍非特权用户如何使用地址范围直接路由到外部网络，而无需 NAT。

1. 创建几个网络来托管子网

   $ openstack network create network1
   +---------------------------+--------------------------------------+
   | Field                     | Value                                |
   +---------------------------+--------------------------------------+
   | admin_state_up            | UP                                   |
   | availability_zone_hints   |                                      |
   | availability_zones        |                                      |
   | created_at                | 2016-12-13T23:21:01Z                 |
   | description               |                                      |
   | headers                   |                                      |
   | id                        | 1bcf3fe9-a0cb-4d88-a067-a4d7f8e635f0 |
   | ipv4_address_scope        | None                                 |
   | ipv6_address_scope        | None                                 |
   | mtu                       | 1450                                 |
   | name                      | network1                             |
   | port_security_enabled     | True                                 |
   | project_id                | 098429d072d34d3596c88b7dbf7e91b6     |
   | provider:network_type     | vxlan                                |
   | provider:physical_network | None                                 |
   | provider:segmentation_id  | 94                                   |
   | revision_number           | 3                                    |
   | router:external           | Internal                             |
   | shared                    | False                                |
   | status                    | ACTIVE                               |
   | subnets                   |                                      |
   | tags                      | []                                   |
   | updated_at                | 2016-12-13T23:21:01Z                 |
   +---------------------------+--------------------------------------+
   

   $ openstack network create network2
   +---------------------------+--------------------------------------+
   | Field                     | Value                                |
   +---------------------------+--------------------------------------+
   | admin_state_up            | UP                                   |
   | availability_zone_hints   |                                      |
   | availability_zones        |                                      |
   | created_at                | 2016-12-13T23:21:45Z                 |
   | description               |                                      |
   | headers                   |                                      |
   | id                        | 6c583603-c097-4141-9c5c-288b0e49c59f |
   | ipv4_address_scope        | None                                 |
   | ipv6_address_scope        | None                                 |
   | mtu                       | 1450                                 |
   | name                      | network2                             |
   | port_security_enabled     | True                                 |
   | project_id                | 098429d072d34d3596c88b7dbf7e91b6     |
   | provider:network_type     | vxlan                                |
   | provider:physical_network | None                                 |
   | provider:segmentation_id  | 81                                   |
   | revision_number           | 3                                    |
   | router:external           | Internal                             |
   | shared                    | False                                |
   | status                    | ACTIVE                               |
   | subnets                   |                                      |
   | tags                      | []                                   |
   | updated_at                | 2016-12-13T23:21:45Z                 |
   +---------------------------+--------------------------------------+
   

2. 创建一个未与子网池或地址范围关联的子网

   $ openstack subnet create --network network1 --subnet-range \
   198.51.100.0/26 subnet-ip4-1
   +-------------------+--------------------------------------+
   | Field             | Value                                |
   +-------------------+--------------------------------------+
   | allocation_pools  | 198.51.100.2-198.51.100.62           |
   | cidr              | 198.51.100.0/26                      |
   | created_at        | 2016-12-13T23:24:16Z                 |
   | description       |                                      |
   | dns_nameservers   |                                      |
   | enable_dhcp       | True                                 |
   | gateway_ip        | 198.51.100.1                         |
   | headers           |                                      |
   | host_routes       |                                      |
   | id                | 66874039-d31b-4a27-85d7-14c89341bbb7 |
   | ip_version        | 4                                    |
   | ipv6_address_mode | None                                 |
   | ipv6_ra_mode      | None                                 |
   | name              | subnet-ip4-1                         |
   | network_id        | 1bcf3fe9-a0cb-4d88-a067-a4d7f8e635f0 |
   | project_id        | 098429d072d34d3596c88b7dbf7e91b6     |
   | revision_number   | 2                                    |
   | service_types     |                                      |
   | subnetpool_id     | None                                 |
   | tags              | []                                   |
   | updated_at        | 2016-12-13T23:24:16Z                 |
   +-------------------+--------------------------------------+
   

   $ openstack subnet create --network network1 --ipv6-ra-mode slaac \
   --ipv6-address-mode slaac --ip-version 6 --subnet-range \
   2001:db8:80d2:c4d3::/64 subnet-ip6-1
   +-------------------+-----------------------------------------+
   | Field             | Value                                   |
   +-------------------+-----------------------------------------+
   | allocation_pools  | 2001:db8:80d2:c4d3::2-2001:db8:80d2:c4d |
   |                   | 3:ffff:ffff:ffff:ffff                   |
   | cidr              | 2001:db8:80d2:c4d3::/64                 |
   | created_at        | 2016-12-13T23:28:28Z                    |
   | description       |                                         |
   | dns_nameservers   |                                         |
   | enable_dhcp       | True                                    |
   | gateway_ip        | 2001:db8:80d2:c4d3::1                   |
   | headers           |                                         |
   | host_routes       |                                         |
   | id                | a7551b23-2271-4a88-9c41-c84b048e0722    |
   | ip_version        | 6                                       |
   | ipv6_address_mode | slaac                                   |
   | ipv6_ra_mode      | slaac                                   |
   | name              | subnet-ip6-1                            |
   | network_id        | 1bcf3fe9-a0cb-4d88-a067-a4d7f8e635f0    |
   | project_id        | 098429d072d34d3596c88b7dbf7e91b6        |
   | revision_number   | 2                                       |
   | service_types     |                                         |
   | subnetpool_id     | None                                    |
   | tags              | []                                      |
   | updated_at        | 2016-12-13T23:28:28Z                    |
   +-------------------+-----------------------------------------+
   

3. 使用与外部网络地址范围关联的子网池创建子网

   $ openstack subnet create --subnet-pool subnet-pool-ip4 \
   --network network2 subnet-ip4-2
   +-------------------+--------------------------------------+
   | Field             | Value                                |
   +-------------------+--------------------------------------+
   | allocation_pools  | 203.0.113.2-203.0.113.62             |
   | cidr              | 203.0.113.0/26                       |
   | created_at        | 2016-12-13T23:32:12Z                 |
   | description       |                                      |
   | dns_nameservers   |                                      |
   | enable_dhcp       | True                                 |
   | gateway_ip        | 203.0.113.1                          |
   | headers           |                                      |
   | host_routes       |                                      |
   | id                | 12be8e8f-5871-4091-9e9e-4e0651b9677e |
   | ip_version        | 4                                    |
   | ipv6_address_mode | None                                 |
   | ipv6_ra_mode      | None                                 |
   | name              | subnet-ip4-2                         |
   | network_id        | 6c583603-c097-4141-9c5c-288b0e49c59f |
   | project_id        | 098429d072d34d3596c88b7dbf7e91b6     |
   | revision_number   | 2                                    |
   | service_types     |                                      |
   | subnetpool_id     | d02af70b-d622-426f-8e60-ed9df2a8301f |
   | tags              | []                                   |
   | updated_at        | 2016-12-13T23:32:12Z                 |
   +-------------------+--------------------------------------+
   

   $ openstack subnet create --ip-version 6 --ipv6-ra-mode slaac \
   --ipv6-address-mode slaac --subnet-pool subnet-pool-ip6 \
   --network network2 subnet-ip6-2
   +-------------------+--------------------------------------+
   | Field             | Value                                |
   +-------------------+--------------------------------------+
   | allocation_pools  | 2001:db8:a583::2-2001:db8:a583:0:fff |
   |                   | f:ffff:ffff:ffff                     |
   | cidr              | 2001:db8:a583::/64                   |
   | created_at        | 2016-12-13T23:31:17Z                 |
   | description       |                                      |
   | dns_nameservers   |                                      |
   | enable_dhcp       | True                                 |
   | gateway_ip        | 2001:db8:a583::1                     |
   | headers           |                                      |
   | host_routes       |                                      |
   | id                | b599c2be-e3cd-449c-ba39-3cfcc744c4be |
   | ip_version        | 6                                    |
   | ipv6_address_mode | slaac                                |
   | ipv6_ra_mode      | slaac                                |
   | name              | subnet-ip6-2                         |
   | network_id        | 6c583603-c097-4141-9c5c-288b0e49c59f |
   | project_id        | 098429d072d34d3596c88b7dbf7e91b6     |
   | revision_number   | 2                                    |
   | service_types     |                                      |
   | subnetpool_id     | a59ff52b-0367-41ff-9781-6318b927dd0e |
   | tags              | []                                   |
   | updated_at        | 2016-12-13T23:31:17Z                 |
   +-------------------+--------------------------------------+
   

   通过从作用域内的子网池创建子网，网络与地址范围相关联。

   $ openstack network show network2
   +---------------------------+------------------------------+
   | Field                     | Value                        |
   +---------------------------+------------------------------+
   | admin_state_up            | UP                           |
   | availability_zone_hints   |                              |
   | availability_zones        | nova                         |
   | created_at                | 2016-12-13T23:21:45Z         |
   | description               |                              |
   | id                        | 6c583603-c097-4141-9c5c-     |
   |                           | 288b0e49c59f                 |
   | ipv4_address_scope        | 3193bd62-11b5-44dc-          |
   |                           | acf8-53180f21e9f2            |
   | ipv6_address_scope        | 28424dfc-9abd-481b-          |
   |                           | afa3-1da97a8fead7            |
   | mtu                       | 1450                         |
   | name                      | network2                     |
   | port_security_enabled     | True                         |
   | project_id                | 098429d072d34d3596c88b7dbf7e |
   |                           | 91b6                         |
   | provider:network_type     | vxlan                        |
   | provider:physical_network | None                         |
   | provider:segmentation_id  | 81                           |
   | revision_number           | 10                           |
   | router:external           | Internal                     |
   | shared                    | False                        |
   | status                    | ACTIVE                       |
   | subnets                   | 12be8e8f-5871-4091-9e9e-     |
   |                           | 4e0651b9677e, b599c2be-e3cd- |
   |                           | 449c-ba39-3cfcc744c4be       |
   | tags                      | []                           |
   | updated_at                | 2016-12-13T23:32:12Z         |
   +---------------------------+------------------------------+
   

4. 将路由器连接到每个已创建的项目子网，例如，使用名为 router1 的路由器

   $ openstack router add subnet router1 subnet-ip4-1
   $ openstack router add subnet router1 subnet-ip4-2
   $ openstack router add subnet router1 subnet-ip6-1
   $ openstack router add subnet router1 subnet-ip6-2
   

检查连接性

本示例演示如何检查具有地址范围的网络之间的连接性。

1. 启动两个实例，instance1 在 network1 上，instance2 在 network2 上。将浮动 IP 地址关联到两个实例。

2. 调整安全组以允许 ping 和 SSH（IPv4 和 IPv6）。

   $ openstack server list
   +--------------+-----------+---------------------------------------------------------------------------+--------+----------+
   | ID           | Name      | Networks                                                                  | Image  | Flavor   |
   +--------------+-----------+---------------------------------------------------------------------------+--------+----------+
   | 97e49c8e-... | instance1 | network1=2001:db8:80d2:c4d3:f816:3eff:fe52:b69f, 198.51.100.3, 203.0.113.3| cirros | m1.tiny  |
   | ceba9638-... | instance2 | network2=203.0.113.3, 2001:db8:a583:0:f816:3eff:fe42:1eeb, 203.0.113.4    | centos | m1.small |
   +--------------+-----------+---------------------------------------------------------------------------+--------+----------+
   

无论地址范围如何，都可以从外部网络 ping 浮动 IP。

$ ping -c 1 203.0.113.3
1 packets transmitted, 1 received, 0% packet loss, time 0ms
$ ping -c 1 203.0.113.4
1 packets transmitted, 1 received, 0% packet loss, time 0ms

现在您可以直接 ping instance2，因为 instance2 与外部网络共享相同的地址范围

注意

可以使用 BGP 路由自动为您的实例设置静态路由。

# ip route add 203.0.113.0/26 via 203.0.113.2
$ ping -c 1 203.0.113.3
1 packets transmitted, 1 received, 0% packet loss, time 0ms

# ip route add 2001:db8:a583::/64 via 2001:db8::1
$ ping6 -c 1 2001:db8:a583:0:f816:3eff:fe42:1eeb
1 packets transmitted, 1 received, 0% packet loss, time 0ms

由于地址范围不匹配，因此无法直接 ping instance1

# ip route add 198.51.100.0/26 via 203.0.113.2
$ ping -c 1 198.51.100.3
1 packets transmitted, 0 received, 100% packet loss, time 0ms

# ip route add 2001:db8:80d2:c4d3::/64 via 2001:db8::1
$ ping6 -c 1 2001:db8:80d2:c4d3:f816:3eff:fe52:b69f
1 packets transmitted, 0 received, 100% packet loss, time 0ms

如果网络之间的地址范围匹配，则 ping 和其他流量将直接路由。如果网络之间的范围不匹配，路由器将丢弃流量或应用 NAT 以跨越范围边界。