CN118784565A - A communication method and device between cloud platform virtual private networks - Google Patents

Abstract

The present invention provides a method and device for communicating between virtual private networks of a cloud platform, which can improve the convenience of connectivity between different virtual private networks. The method for communicating between virtual private networks of a cloud platform includes: binding network cards of non-business network segments of multiple virtual private networks to a virtual routing gateway; configuring static routes of multiple virtual private networks in the same virtual routing gateway to achieve communication between multiple virtual private networks on the same cloud platform; establishing a general routing encapsulation tunnel between virtual routing gateways of a first target cloud platform and a second target cloud platform based on an elastic public network IP address and a general routing encapsulation tunnel protocol to connect the first target cloud platform and the second target cloud platform; after the first target cloud platform and the second target cloud platform are connected, the virtual private network of the first target cloud platform and the virtual private network of the second target cloud platform communicate through the general routing encapsulation tunnel.

Description

A communication method and device between cloud platform virtual private networks

Technical Field

The present invention relates to the field of Internet cloud network technology, and in particular to communication between virtual private networks on a cloud platform.

Background Art

In cloud environments, virtual private networks (VPCs) are widely used as an important isolation and security mechanism to build proprietary virtual network environments to simulate the network effects of physical isolation. However, in actual applications, the virtual private networks provided by current cloud platform network technologies are isolated from each other, and virtual machines in different virtual private networks cannot directly communicate using intranet addresses. When using a peer-to-peer connection solution, it is necessary to create peer-to-peer connections between different virtual private networks. When the number of virtual private networks increases, the number of peer-to-peer connections will also increase exponentially. In addition, virtual private networks between different cloud platforms cannot communicate using intranet addresses allocated by virtual private networks.

Summary of the invention

In order to solve the above technical problems, the present invention is proposed. The embodiments of the present invention provide a method and device for communication between virtual private networks on a cloud platform, which can improve the convenience of connectivity between different virtual private networks.

According to one aspect of the present invention, a method for communication between virtual private networks of a cloud platform is provided, comprising: binding network cards of non-business network segments of multiple virtual private networks to a virtual routing gateway; configuring static routes of multiple virtual private networks in the same virtual routing gateway to realize communication between multiple virtual private networks in the same cloud platform; establishing a general routing encapsulation tunnel between virtual routing gateways of a first target cloud platform and a second target cloud platform based on an elastic public network IP address and a general routing encapsulation tunnel protocol to connect the first target cloud platform and the second target cloud platform; wherein the first target cloud platform and the second target cloud platform each include at least one virtual private network; after the first target cloud platform and the second target cloud platform are connected, the virtual private network of the first target cloud platform and the virtual private network of the second target cloud platform communicate through the general routing encapsulation tunnel.

In one embodiment, before binding network cards of non-business network segments of multiple virtual private networks to a virtual routing gateway, a communication method between virtual private networks of a cloud platform includes: creating a virtual routing gateway; wherein the virtual routing gateway is used to perform traffic routing management between multiple virtual private networks; wherein binding network cards of non-business network segments of multiple virtual private networks to the virtual routing gateway includes: establishing a subnet of a non-business network segment in a target virtual private network; the target virtual private network is any one of the multiple virtual private networks; in the subnet of the non-business network segment, creating a network card instance, and binding the network card instance to the virtual routing gateway.

In one embodiment, after the network cards of the non-business network segments of the first virtual private network and the second virtual private network are bound to the virtual routing gateway, static routes of multiple virtual private networks in the same virtual routing gateway are configured, including: in the virtual router of the first virtual private network, static routes are configured, the destination network segment is the connected network segment of the second virtual private network, and the next hop is the non-business network segment network card of the first virtual private network; in the virtual router of the second virtual private network, static routes are configured, the destination network segment is the connected network segment of the first virtual private network, and the next hop is the non-business network segment network card of the second virtual private network; wherein, the first virtual private network and the second virtual private network are any two virtual private networks in the same cloud platform that have communication needs.

In one embodiment, before establishing a general routing encapsulation tunnel between virtual routing gateways of a first target cloud platform and a second target cloud platform based on an elastic public IP address and a general routing encapsulation tunnel protocol, a communication method between cloud platform virtual private networks includes: creating non-user virtual private networks on the first target cloud platform and the second target cloud platform, respectively; creating network card instances in the non-user virtual private networks on the first target cloud platform and the second target cloud platform, respectively; and associating the network card instances to the corresponding virtual routing gateways of the first target cloud platform and the second target cloud platform, respectively.

In one embodiment, after the network card instance is respectively associated with the corresponding virtual routing gateway of the first target cloud platform and the virtual routing gateway of the second target cloud platform, the communication method between cloud platform virtual private networks also includes: applying for elastic public IP addresses for the virtual routing gateway of the first target cloud platform and the virtual routing gateway of the second target cloud platform respectively; wherein, based on the elastic public IP address and the universal routing encapsulation tunnel protocol, a universal routing encapsulation tunnel is established between the virtual routing gateways of the first target cloud platform and the second target cloud platform, including: associating the elastic public IP address of the first target cloud platform with the network card instance of the first target cloud platform as the first endpoint of the universal routing encapsulation tunnel; associating the elastic public IP address of the second target cloud platform with the network card instance of the second target cloud platform as the second endpoint of the universal routing encapsulation tunnel.

In one embodiment, based on an elastic public network IP address and a universal routing encapsulation tunnel protocol, a universal routing encapsulation tunnel is established between virtual routing gateways of a first target cloud platform and a second target cloud platform, and further includes: based on a preset system command, loading a kernel component of the universal routing encapsulation in the virtual routing gateway of the first target cloud platform and the virtual routing gateway of the second target cloud platform respectively; wherein the kernel component is used for performing subsequent universal routing encapsulation tunnel creation configuration; based on preset instructions, creating a first tunnel port device in the virtual routing gateway of the first target cloud platform, and creating a second tunnel port device in the virtual routing gateway of the second target cloud platform; mapping the first tunnel port device and the second tunnel port device into a universal routing encapsulation tunnel.

In one embodiment, the first tunnel port device and the second tunnel port device are mapped into a general routing encapsulation tunnel, including: configuring a static route in the virtual routing gateway of the first target cloud platform, the destination address is the network segment of the second target cloud platform, and the next hop points to the first tunnel port device of the first target cloud platform; and configuring a static route in the virtual routing gateway of the second target cloud platform, the destination address is the network segment of the first target cloud platform, and the next hop points to the second tunnel port device of the second target cloud platform.

In one embodiment, based on preset instructions, a first tunnel port device is created in the virtual routing gateway of the first target cloud platform, and a second tunnel port device is created in the virtual routing gateway of the second target cloud platform, including: configuring the elastic public IP address of the first target cloud platform to the first tunnel port device; configuring the elastic public IP address of the second target cloud platform to the second tunnel port device; wherein the elastic public IP address of the first target cloud platform is symmetrical with the elastic public IP address of the second target cloud platform.

In one embodiment, the static route is added according to demand, and the static route includes a destination network segment, a next hop address, and a destination network card device name; wherein, when setting the static route, it is checked whether there is an address conflict between the static routes; when there is an address conflict between the static routes, a conflict prompt is issued.

According to another aspect of the present invention, a communication device between virtual private networks of cloud platforms is provided, comprising: a binding module, which binds network cards of non-business network segments of multiple virtual private networks to a virtual routing gateway; a configuration module, which configures static routes of multiple virtual private networks in the same virtual routing gateway to achieve communication between multiple virtual private networks in the same cloud platform; an establishment module, which establishes a general routing encapsulation tunnel between virtual routing gateways of a first target cloud platform and a second target cloud platform based on an elastic public network IP address and a general routing encapsulation tunnel protocol to connect the first target cloud platform and the second target cloud platform; wherein the first target cloud platform and the second target cloud platform each include at least one virtual private network; a communication module, after the first target cloud platform and the second target cloud platform are connected, the virtual private network of the first target cloud platform and the virtual private network of the second target cloud platform communicate through the general routing encapsulation tunnel.

The communication method and device between virtual private networks of cloud platforms provided by the present invention, compared with the peer-to-peer connection which requires configuration of each pair of virtual private networks, the communication between virtual private networks using a virtual routing gateway only requires one connection configuration for each peer connection, and the virtual private network communication between multiple cloud platforms can use one tunnel. Compared with each pair of multi-cloud virtual private networks which requires a cross-regional peer-to-peer connection, it saves more public network IP address resources and is simpler to configure.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other purposes, features and advantages of the present invention will become more apparent by describing the embodiments of the present invention in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

FIG1 is a flow chart of a method for communicating between virtual private networks on a cloud platform provided by an exemplary embodiment of the present invention.

FIG2 is a schematic diagram of the structure of a communication device between cloud platform virtual private networks provided by an exemplary embodiment of the present invention.

DETAILED DESCRIPTION

Below, the exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments of the present invention, and it should be understood that the present invention is not limited to the exemplary embodiments described here.

In cloud environments, Virtual Private Cloud (VPC) is an important isolation and security mechanism that is widely used to build a dedicated virtual network environment to simulate the network effect of physical isolation. VPC allows users to customize network topology, routing policies, and security rules to achieve isolation and secure access between resources. However, in a complex multi-cloud environment, different VPCs may overlap private network address segments due to improper planning or changes in business needs, and thus cannot communicate directly, becoming a bottleneck that restricts the efficient use of cloud resources and secure communication.

On the existing cloud platform, when the private network address segments of two VPCs overlap, the communication between the two VPCs will be blocked due to routing conflicts and restrictions. This not only limits the flexible configuration of cloud resources, but also affects the continuity and scalability of the business. Therefore, in order to solve this problem, the present application provides a method and device for communication between virtual private networks on a cloud platform, using a virtual routing gateway to bind network cards of non-business network segments of multiple virtual private networks, and automatically configure static routes of multiple virtual private networks by communicating with the management network to achieve the purpose of intranet address communication, and rely on the elastic public IP resources of the cloud platform and the GRE tunnel protocol to achieve intranet IP address communication between virtual private networks of multiple cloud platforms, complete the connection of virtual private networks (VPC) in different regions, and achieve intranet address communication. Therefore, virtual private network communication between multiple clouds can use one tunnel, which saves multiple elastic public IPs compared to each pair of multi-cloud virtual private networks that require a cross-region peer connection.

FIG. 1 is a flow chart of a method for communicating between virtual private networks on a cloud platform provided by an exemplary embodiment of the present invention. As shown in FIG. 1 , the method for communicating between virtual private networks on a cloud platform includes:

S100: Bind network cards of non-business network segments of multiple virtual private networks to a virtual routing gateway.

Add the user's virtual private network to the virtual routing gateway. The intranet IP address communication solution between multiple virtual private networks in the cloud platform involves two types of resources, the user's virtual private network and the virtual routing gateway. When the user adds the virtual private network to the virtual routing gateway and provides a local network segment that can communicate with other virtual private networks, the network segment addresses of other virtual private networks added to the virtual routing gateway can communicate with the network segment address of the user's virtual private network. Therefore, binding the network cards of the non-business network segments of multiple virtual private networks to the virtual routing gateway can achieve the purpose of intercommunication between multiple virtual private networks through the virtual routing gateway, and occupy less resources.

S200: Configure static routes of multiple virtual private networks in the same virtual routing gateway to achieve communication between multiple virtual private networks on the same cloud platform.

Static routes can be added manually by users according to their needs. Static routes are mainly composed of the destination network segment, the next hop address, and the destination network card device name. After the static route is added, it can automatically configure the static routes of multiple virtual private networks by communicating with the management network, so as to achieve the purpose of intranet address communication. During the configuration process, just ensure that there is no address conflict in the static route in the virtual routing gateway.

S300: Based on the elastic public IP address and the general routing encapsulation tunnel protocol, a general routing encapsulation tunnel is established between the virtual routing gateways of the first target cloud platform and the second target cloud platform to connect the first target cloud platform and the second target cloud platform.

Wherein, the first target cloud platform and the second target cloud platform each include at least one virtual private network.

Based on the elastic public IP address and the general routing encapsulation tunnel protocol, a cross-region general routing encapsulation tunnel is established to realize communication between virtual private networks of different cloud platforms. The GRE (General Routing Encapsulation) protocol encapsulates certain network layer protocol data packets so that these encapsulated data packets can be transmitted in another network layer protocol (such as IPv4). GRE provides a mechanism to encapsulate a message of one protocol in a message of another protocol. It is a three-layer tunnel encapsulation technology that enables messages to be transparently transmitted through the GRE tunnel. GRE is a method for establishing direct point-to-point connections on the network, with the aim of simplifying the connection between separate networks. In addition, its implementation mechanism is simple and has a small burden on the devices at both ends of the tunnel, which is suitable for the purpose of connecting the VPCs in two regions in this solution. In order to establish a cross-region GRE tunnel, the elastic public IP resources provided by the cloud platform are required. The elastic public IP resources of the cloud platform provide a connection exit with the public network, providing the ability for cloud resources to access the external network.

S400: After the first target cloud platform and the second target cloud platform are connected, the virtual private network of the first target cloud platform and the virtual private network of the second target cloud platform communicate through a general routing encapsulation tunnel.

The first target cloud platform and the second target cloud platform can be any two cloud platforms. It is understandable that the virtual private networks between any two cloud platforms can communicate through the general routing encapsulation tunnel, and multiple cloud platforms can use one tunnel. Compared with each pair of multi-cloud virtual private networks requiring a cross-region peer connection, multiple elastic public IP resources are saved. In addition, since the configuration of multi-virtual private network communication is mainly concentrated in the virtual routing gateway, it is easy to manage.

In one embodiment, before S100 (binding network cards of non-business network segments of multiple virtual private networks to a virtual routing gateway), a communication method between virtual private networks on a cloud platform may include: creating a virtual routing gateway; wherein the virtual routing gateway is used to perform traffic routing management between multiple virtual private networks; wherein S100 (binding network cards of non-business network segments of multiple virtual private networks to the virtual routing gateway) includes: establishing a subnet of a non-business network segment in a target virtual private network; the target virtual private network is any one of the multiple virtual private networks; in the subnet of the non-business network segment, creating a network card instance, and binding the network card instance to the virtual routing gateway.

A subnet is a network segment that is further divided within a larger network, used to divide the network into smaller logical networks. Subnets allow network administrators to divide a large IP address range into multiple smaller subnetworks, thereby managing IP address allocation and network communications more efficiently. A network card instance can refer to a logical interface or virtual interface configured for a specific network card, used for network communications with the host or other virtual machines.

The process of a user's virtual private network joining a virtual routing gateway is as follows: Create a virtual routing gateway to manage traffic routing between multiple virtual private networks. In the user's business virtual private network A (target virtual private network), establish a subnet of a non-business network segment. The purpose of establishing this network segment is to allow it to be in the same virtual router as virtual private network A without occupying the user's network segment resources. In the subnet of the non-business network segment, create a network card instance a and bind it to the virtual routing gateway. According to the user configuration, configure the routing rules in the virtual routing gateway, the destination network segment is the connected network segment of virtual private network A, and the next hop is network card instance a. The target virtual private network can be any virtual private network in the cloud platform.

In one embodiment, after the network cards of the non-business network segments of the first virtual private network and the second virtual private network are bound to the virtual routing gateway, S200 (configuring static routes of multiple virtual private networks in the same virtual routing gateway) may include: in the virtual router of the first virtual private network, configuring a static route, the destination network segment is the connected network segment of the second virtual private network, and the next hop is the non-business network segment network card of the first virtual private network; in the virtual router of the second virtual private network, configuring a static route, the destination network segment is the connected network segment of the first virtual private network, and the next hop is the non-business network segment network card of the second virtual private network; wherein the first virtual private network and the second virtual private network are any two virtual private networks in the same cloud platform that have communication needs.

For example, in the same cloud platform, after adding virtual private network A (the first virtual private network) and virtual private network B (the second virtual private network) to the virtual routing gateway, virtual private network A and virtual private network B want to communicate. In the virtual router of virtual private network A, static routing is configured, the destination network segment is the connected network segment of virtual private network B, and the next hop is the non-business network segment network card a of virtual private network A. In the virtual router of virtual private network B, static routing is configured, the destination network segment is the connected network segment of virtual private network A, and the next hop is the non-business network segment network card b of virtual private network B. After completing the above steps, virtual private networks A and B can communicate with the connected network segments configured. When virtual private network C is added, repeat the above steps to complete the communication between the connected network segment of virtual private network C and A and B. That is, the communication requirements of the intranet IP addresses of multiple virtual private networks in the cloud platform are realized.

In one embodiment, before S300 (establishing a general routing encapsulation tunnel between the virtual routing gateways of the first target cloud platform and the second target cloud platform based on the elastic public IP address and the general routing encapsulation tunnel protocol), the communication method between cloud platform virtual private networks includes: creating non-user virtual private networks on the first target cloud platform and the second target cloud platform respectively; creating network card instances in the non-user virtual private networks on the first target cloud platform and the second target cloud platform respectively; and associating the network card instances to the corresponding virtual routing gateways of the first target cloud platform and the second target cloud platform respectively.

Create a non-user virtual private network on the cloud platform for communication, create a network card instance in it, and associate it with the virtual routing gateway of the cloud platform. In addition, perform this step on other cloud platforms that need to establish communication.

In one embodiment, after the network card instances are respectively associated with the corresponding virtual routing gateways of the first target cloud platform and the second target cloud platform, the communication method between cloud platform virtual private networks may also include: applying for elastic public IP addresses for the virtual routing gateways of the first target cloud platform and the second target cloud platform respectively; wherein S300 (establishing a general routing encapsulation tunnel between the virtual routing gateways of the first target cloud platform and the second target cloud platform based on the elastic public IP address and the general routing encapsulation tunnel protocol) may include: associating the elastic public IP address of the first target cloud platform with the network card instance of the first target cloud platform as the first endpoint of the general routing encapsulation tunnel; associating the elastic public IP address of the second target cloud platform with the network card instance of the second target cloud platform as the second endpoint of the general routing encapsulation tunnel.

When the virtual private networks between two cloud platforms need to communicate, it is necessary to use elastic public IP to establish a GRE tunnel between the virtual routing gateways of the two cloud platforms to communicate between the virtual private networks of multiple cloud platforms. First, create a non-user virtual private network in one of the cloud platforms that needs to communicate, create a network card instance in it, and associate it with the virtual routing gateway, apply for an elastic public IP address, and associate the public IP with the created network card instance as a tunnel endpoint. Then, create a non-user virtual private network in the other cloud platform that needs to communicate, create a network card instance in it, and associate it with the virtual routing gateway, apply for an elastic public IP address, and associate the public IP with the created network card instance as another tunnel endpoint. This completes the preliminary preparation for establishing a tunnel.

In one embodiment, S300 (establishing a universal routing encapsulation tunnel between the virtual routing gateways of the first target cloud platform and the second target cloud platform based on the elastic public network IP address and the universal routing encapsulation tunnel protocol) may also include: based on a preset system command, loading the kernel component of the universal routing encapsulation in the virtual routing gateway of the first target cloud platform and the virtual routing gateway of the second target cloud platform respectively; wherein the kernel component is used to perform subsequent universal routing encapsulation tunnel creation configuration; based on preset instructions, creating a first tunnel port device in the virtual routing gateway of the first target cloud platform, and creating a second tunnel port device in the virtual routing gateway of the second target cloud platform; mapping the first tunnel port device and the second tunnel port device to a universal routing encapsulation tunnel.

Taking the first target cloud platform as an example, use the system command "modprobeip_gre" to load the kernel component of GRE in the virtual routing gateway for subsequent GRE tunnel creation configuration, and use the "ip tunnel" command to create the first tunnel port device in the virtual routing gateway. And according to the plan, configure the local IP and the other end IP information of the tunnel to the port device, configure the static route in the virtual routing gateway, the destination address is the network segment of the other end cloud center (the second target cloud platform), and the next hop points to the created first tunnel port device to complete the creation of one end of the GRE tunnel. In another cloud center that needs to communicate (such as the second target cloud platform), perform the same steps to complete the creation of the other end of the GRE tunnel. 2. Virtual private network communication between multiple clouds can use one tunnel to save network resources.

For example, associate the elastic public IP (EIP1) with the service network card of virtual routing gateway A (the virtual routing gateway of the first target cloud platform), and create a tunnel port device gre tunnel1 (the first tunnel port device) through the ip tunnel command. Associate the elastic public IP (EIP2) with the service network card of virtual routing gateway B (the virtual routing gateway of the second target cloud platform), and create a tunnel port device gre tunnel2 (the second tunnel port device) through the ip tunnel command. The first tunnel port device and the second tunnel port device are mapped to a GRE tunnel.

In one embodiment, the first tunnel port device and the second tunnel port device are mapped to a general routing encapsulation tunnel, including: configuring a static route in the virtual routing gateway of the first target cloud platform, the destination address is the network segment of the second target cloud platform, and the next hop points to the first tunnel port device of the first target cloud platform; and configuring a static route in the virtual routing gateway of the second target cloud platform, the destination address is the network segment of the first target cloud platform, and the next hop points to the second tunnel port device of the second target cloud platform.

Configure static routing in the virtual routing gateway. The destination address is the network segment of the peer cloud center, and the next hop points to the created tunnel port device. For example, if you need to implement communication between the virtual private network in the first target cloud platform and the second target cloud platform, set the destination address of the first target cloud platform to the network segment of the second target cloud platform, and the next hop points to the first tunnel port device. Set the destination address of the second target cloud platform to the network segment of the first target cloud platform, and the next hop points to the second tunnel port device. A network segment refers to a set of IP addresses with the same network address (same high bits).

In one embodiment, based on preset instructions, a first tunnel port device is created in the virtual routing gateway of the first target cloud platform, and a second tunnel port device is created in the virtual routing gateway of the second target cloud platform, including: configuring the elastic public IP address of the first target cloud platform to the first tunnel port device; configuring the elastic public IP address of the second target cloud platform to the second tunnel port device; wherein the elastic public IP address of the first target cloud platform is symmetrical with the elastic public IP address of the second target cloud platform.

Associate the service network card of the virtual routing gateway of the first target cloud platform with an elastic public IP, associate the service network card of the virtual routing gateway of the second target cloud platform with another elastic public IP, and configure the elastic public IP address of the first target cloud platform to the first tunnel port device, and configure the elastic public IP address of the second target cloud platform to the second tunnel port device. The IP address of the local end (the first target cloud platform) and the IP address of the opposite end (the second target cloud platform) need to be symmetrical.

In one embodiment, a static route is added according to demand, and the static route includes a destination network segment, a next hop address, and a destination network card device name; wherein, when setting a static route, it is checked whether there is an address conflict between static routes; when there is an address conflict between static routes, a conflict prompt is issued.

Static routing is a routing method. Static routing refers to the manual configuration of routing table entries in the router by the network administrator according to the network topology and business needs to determine the forwarding path of the data packet in the network. When the data packet is transmitted in the network, the router will determine the forwarding path of the data packet based on the entries in the routing table. For static routing, each entry in the routing table is manually configured by the network administrator. When the router receives a data packet, it will search for a matching entry in the routing table based on the destination IP address of the data packet. If a matching entry is found, the router will forward the data packet according to the next hop address or outbound interface specified in the entry.

Taking cloud platform A and cloud platform B as examples, there are two virtual private networks in cloud center A: VPC1 (subnet segment 192.168.0.0/24) and VPC2 (subnet segment 192.168.1.0/24), and there are two virtual private networks in cloud center B: VPC3 (subnet segment 192.168.3.0/24) and VPC4 (subnet segment 192.168.4.0/24). The resources of the above four VPCs need to use intranet addresses for communication. CIDR is the abbreviation of "Classless Inter-Domain Routing", which is a method for creating and assigning IP addresses on the Internet.

The steps to establish communication between cloud platform A and cloud platform B include:

1. Create virtual routing gateway A in cloud center A. Create non-business network segments in VPC1 and VPC2 respectively, create ports eth1 (11.0.103.100) and eth2 (11.0.103.101), and associate the network card with virtual routing gateway A.

2. Create virtual routing gateway B in cloud center B. Create non-business network segments in VPC3 and VPC4 respectively, create ports eth3 (11.0.103.100) and eth4 (11.0.103.101), and associate the network card with virtual routing gateway B.

3. Associate the elastic public IP (EIP1) with the service network card of virtual routing gateway A, and create the tunnel port device GRE tunnel1 through the ip tunnel command.

4. Associate the elastic public IP (EIP2) with the service network card of virtual routing gateway B, and create a tunnel port device GRE tunnel2 through the ip tunnel command. Map it to a GRE tunnel with the tunnel port created in step ③.

5. Configure static routes in the routing tables of the four VPCs. The destination network segments are the other three interconnected subnet segments, and the next hop is the non-business network segment network card (11.0.103.X) of your own VPC.

For example, the subnet address of VPC1 is (192.168.0.0/24), which includes ECS (192.168.0.10) and ECS (192.168.0.11), and the subnet address of VPC2 is (192.168.1.0/24), which includes ECS (192.168.1.10) and ECS (192.168.1.11). ), the subnet address of VPC3 is (192.168.3.0/24), which includes ECS (192.168.3.10) and ECS (192.168.3.11), and the subnet address of VPC4 is (192.168.4.0/24), which includes ECS (192.168.4.10) and ECS (192.168.4.11).

Configure static routes in the routing table of VPC1, set the destination network segment to VPC2 (subnet network segment 192.168.1.0/24), VPC3 (subnet network segment 192.168.3.0/24), VPC4 (subnet network segment 192.168.4.0/24), and the next hop address to eth1. Configure static routes in the routing table of VPC2, set the destination network segment to VPC1 (192.168.0.0/24), VPC3 (subnet network segment 192.168.3.0/24), VPC4 (subnet network segment 192.168.4.0/24), and the next hop address to eth2. Configure static routes in the routing table of VPC3, set the destination network segment to VPC1 (192.168.0.0/24), VPC2 (subnet network segment 192.168.1.0/24), VPC4 (subnet network segment 192.168.4.0/24), and the next hop address to eth3. Configure static routes in the routing table of VPC4, set the destination network segment to VPC1 (192.168.0.0/24), VPC2 (subnet network segment 192.168.1.0/24), VPC3 (subnet network segment 192.168.3.0/24), and the next hop address to eth4.

6. Configure routing in virtual routing gateway A and virtual routing gateway B respectively to direct the traffic of the destination network segment to the corresponding VPC port or GRE tunnel port.

In cloud center A, configure the next hop address of VPC1 (subnet segment 192.168.0.0/24) as eth1, configure the next hop address of VPC2 (subnet segment 192.168.1.0/24) as eth2, and configure the next hop address of VPC3 (subnet segment 192.168.3.0/24) and VPC4 (subnet segment 192.168.4.0/24) as GRE Tunnel 1. In cloud center B, configure the next hop address of VPC3 (subnet segment 192.168.3.0/24) as eth3, configure the next hop address of VPC4 (subnet segment 192.168.4.0/24) as eth4, and configure the next hop address of VPC1 (subnet segment 192.168.0.0/24) and VPC2 (subnet segment 192.168.1.0/24) as GRE Tunnel 2.

After completing the above steps, the intranet communication solution between multi-cloud center virtual private networks is configured.

After the configuration is completed, take the example of transmitting data from VPC1 of cloud center A to VPC3 of cloud center B. First, the data is sent from the virtual machine to the subnet gateway (192.168.0.0/24) where the virtual machine is located. After being sent to the subnet gateway (192.168.0.0/24), it is forwarded to virtual routing gateway A through routing (11.0.103.100). Virtual routing gateway A checks the routing table and finds that the network segment to be accessed needs to be sent through the GRE tunnel, so it sends the data packet to the GRE tunnel. After being sent to the GRE tunnel, GRE Tunnel2 of cloud center B can receive the packet. After GRE unpacks the packet, it matches the route. Since it needs to be sent to VPC3, it is forwarded to the route of eth3 (11.0.103.100), and then sent to the router where VPC3 is located, and finally finds the corresponding virtual machine to be accessed.

2 is a schematic diagram of the structure of a communication device between virtual private networks of cloud platforms provided by an exemplary embodiment of the present invention. As shown in FIG2 , the communication device 5 between virtual private networks of cloud platforms includes: a binding module 51, which binds the network cards of non-business network segments of multiple virtual private networks to a virtual routing gateway; a configuration module 52, which configures static routes of multiple virtual private networks in the same virtual routing gateway to achieve communication between multiple virtual private networks in the same cloud platform; an establishment module 53, which establishes a general routing encapsulation tunnel between the virtual routing gateways of the first target cloud platform and the second target cloud platform based on an elastic public network IP address and a general routing encapsulation tunnel protocol to connect the first target cloud platform and the second target cloud platform; wherein the first target cloud platform and the second target cloud platform each include at least one virtual private network; a communication module 54, after the first target cloud platform and the second target cloud platform are connected, the virtual private network of the first target cloud platform and the virtual private network of the second target cloud platform communicate through the general routing encapsulation tunnel.

The communication device between virtual private networks of cloud platforms provided by the present invention, compared with the peer-to-peer connection which requires configuration of each pair of virtual private networks, only requires one connection configuration for each peer-to-peer connection for communication between virtual private networks using a virtual routing gateway. Virtual private network communication between multiple cloud platforms can use one tunnel. Compared with each pair of multi-cloud virtual private networks which requires a cross-regional peer-to-peer connection, it saves more public IP address resources and is simpler to configure.

In one embodiment, the communication device 5 between cloud platform virtual private networks includes: creating a virtual routing gateway; wherein the virtual routing gateway is used to perform traffic routing management between multiple virtual private networks; wherein the binding module 51 can be configured as: establishing a subnet of a non-business network segment in the target virtual private network; the target virtual private network is any one of the multiple virtual private networks; in the subnet of the non-business network segment, creating a network card instance, and binding the network card instance to the virtual routing gateway.

In one embodiment, after the network cards of the non-business network segments of the first virtual private network and the second virtual private network are bound to the virtual routing gateway, the configuration module 52 can be configured as follows: in the virtual router of the first virtual private network, a static route is configured, the destination network segment is the connected network segment of the second virtual private network, and the next hop is the non-business network segment network card of the first virtual private network; in the virtual router of the second virtual private network, a static route is configured, the destination network segment is the connected network segment of the first virtual private network, and the next hop is the non-business network segment network card of the second virtual private network; wherein the first virtual private network and the second virtual private network are any two virtual private networks in the same cloud platform that have communication needs.

In one embodiment, the communication device 5 between cloud platform virtual private networks includes: creating non-user virtual private networks on the first target cloud platform and the second target cloud platform respectively; creating network card instances in the non-user virtual private networks on the first target cloud platform and the second target cloud platform respectively; and associating the network card instances to the corresponding virtual routing gateways of the first target cloud platform and the second target cloud platform respectively.

In one embodiment, the communication device 5 between cloud platform virtual private networks may also include: applying for elastic public IP addresses for the virtual routing gateway of the first target cloud platform and the virtual routing gateway of the second target cloud platform respectively; wherein the establishment module 53 can be configured to: associate the elastic public IP address of the first target cloud platform with the network card instance of the first target cloud platform as the first endpoint of the general routing encapsulation tunnel; associate the elastic public IP address of the second target cloud platform with the network card instance of the second target cloud platform as the second endpoint of the general routing encapsulation tunnel.

In one embodiment, the establishment module 53 can also be configured as: based on a preset system command, loading the kernel component of the general routing encapsulation in the virtual routing gateway of the first target cloud platform and the virtual routing gateway of the second target cloud platform respectively; wherein the kernel component is used to perform subsequent general routing encapsulation tunnel creation configuration; based on preset instructions, creating a first tunnel port device in the virtual routing gateway of the first target cloud platform, and creating a second tunnel port device in the virtual routing gateway of the second target cloud platform; mapping the first tunnel port device and the second tunnel port device into a general routing encapsulation tunnel.

In one embodiment, mapping the first tunnel port device and the second tunnel port device to a universal routing encapsulation tunnel may include: configuring a static route in the virtual routing gateway of the first target cloud platform, with the destination address being the network segment of the second target cloud platform, and the next hop pointing to the first tunnel port device of the first target cloud platform; and configuring a static route in the virtual routing gateway of the second target cloud platform, with the destination address being the network segment of the first target cloud platform, and the next hop pointing to the second tunnel port device of the second target cloud platform.

In one embodiment, based on preset instructions, creating a first tunnel port device in the virtual routing gateway of the first target cloud platform and creating a second tunnel port device in the virtual routing gateway of the second target cloud platform can include: configuring the elastic public IP address of the first target cloud platform to the first tunnel port device; configuring the elastic public IP address of the second target cloud platform to the second tunnel port device; wherein the elastic public IP address of the first target cloud platform is symmetrical with the elastic public IP address of the second target cloud platform.

In one embodiment, a static route is added according to demand, and the static route includes a destination network segment, a next hop address, and a destination network card device name; wherein, when setting a static route, it is checked whether there is an address conflict between static routes; when there is an address conflict between static routes, a conflict prompt is issued.

An embodiment of the present invention provides a communication device between virtual private networks of a cloud platform. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From a hardware perspective, in addition to the CPU, memory, network interface, and non-volatile memory, the device in the embodiment where the device is located can generally include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, as a device in a logical sense, it is formed by the CPU of the device where it is located reading the corresponding computer program instructions in the non-volatile memory into the memory for execution.

According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the storage medium stores a computer program for executing the communication method between virtual private networks of a cloud platform according to any of the above embodiments.

In addition to the above-mentioned methods and devices, an embodiment of the present invention may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the communication method between cloud platform virtual private networks according to various embodiments of the present invention described in the above "Exemplary Method" section of this specification.

According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: a processor; a memory for storing instructions executable by the processor; and a processor for executing the communication method between cloud platform virtual private networks of any of the above embodiments.

In addition, an embodiment of the present invention may also be a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor executes the steps of the communication method between cloud platform virtual private networks according to various embodiments of the present invention described in the above "Exemplary Method" section of this specification.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims (10)

1. A communication method between virtual private networks of a cloud platform, characterized by comprising: Bind the network cards of non-business network segments of multiple virtual private networks to the virtual routing gateway; Configure static routes for multiple virtual private networks in the same virtual routing gateway to enable communication between multiple virtual private networks on the same cloud platform; Based on the elastic public IP address and the universal routing encapsulation tunnel protocol, a universal routing encapsulation tunnel is established between the virtual routing gateways of the first target cloud platform and the second target cloud platform to connect the first target cloud platform and the second target cloud platform; wherein the first target cloud platform and the second target cloud platform each include at least one virtual private network; After the first target cloud platform and the second target cloud platform are connected, the virtual private network of the first target cloud platform and the virtual private network of the second target cloud platform communicate through a general routing encapsulation tunnel. 2. The method for communicating between virtual private networks on a cloud platform according to claim 1, characterized in that before binding the network cards of the non-service network segments of the plurality of virtual private networks to the virtual routing gateway, the method for communicating between virtual private networks on the cloud platform comprises: Creating a virtual routing gateway; wherein the virtual routing gateway is used to manage traffic routing between multiple virtual private networks; Among them, the network cards of non-business network segments of multiple virtual private networks are bound to the virtual routing gateway, including: Establishing a subnet of a non-business network segment in a target virtual private network; the target virtual private network is any one of the multiple virtual private networks; In a subnet of a non-business network segment, a network card instance is created, and the network card instance is bound to a virtual routing gateway. 3. The communication method between virtual private networks of a cloud platform according to claim 1 is characterized in that after the network cards of the non-service network segments of the first virtual private network and the second virtual private network are bound to the virtual routing gateway, static routes of multiple virtual private networks in the same virtual routing gateway are configured, including: In the virtual router of the first virtual private network, a static route is configured, the destination network segment is the connected network segment of the second virtual private network, and the next hop is the non-service network segment network card of the first virtual private network; In the virtual router of the second virtual private network, configure a static route, the destination network segment is the connected network segment of the first virtual private network, and the next hop is the non-service network segment network card of the second virtual private network; The first virtual private network and the second virtual private network are any two virtual private networks in the same cloud platform that have communication needs. 4. The method for communicating between virtual private networks of cloud platforms according to claim 1, characterized in that before establishing a general routing encapsulation tunnel between virtual routing gateways of the first target cloud platform and the second target cloud platform based on the elastic public network IP address and the general routing encapsulation tunnel protocol, the method for communicating between virtual private networks of cloud platforms comprises: Creating non-user virtual private networks on the first target cloud platform and the second target cloud platform respectively; Create network card instances in non-user virtual private networks on the first target cloud platform and the second target cloud platform respectively; The network card instance is associated with the corresponding virtual routing gateway of the first target cloud platform and the virtual routing gateway of the second target cloud platform respectively. 5. The method for communicating between cloud platform virtual private networks according to claim 4, characterized in that after the network card instance is associated with the corresponding virtual routing gateway of the first target cloud platform and the virtual routing gateway of the second target cloud platform, the method for communicating between cloud platform virtual private networks further comprises: Apply for elastic public IP addresses for the virtual routing gateway of the first target cloud platform and the virtual routing gateway of the second target cloud platform respectively; Wherein, based on the elastic public network IP address and the universal routing encapsulation tunnel protocol, a universal routing encapsulation tunnel is established between the virtual routing gateways of the first target cloud platform and the second target cloud platform, including: Associating the elastic public IP address of the first target cloud platform with the network card instance of the first target cloud platform as the first endpoint of the general routing encapsulation tunnel; The elastic public IP address of the second target cloud platform is associated with the network card instance of the second target cloud platform as the second endpoint of the universal routing encapsulation tunnel. 6. The communication method between cloud platform virtual private networks according to claim 5 is characterized in that, based on the elastic public network IP address and the general routing encapsulation tunnel protocol, a general routing encapsulation tunnel is established between the virtual routing gateways of the first target cloud platform and the second target cloud platform, and further includes: Based on the preset system command, the kernel component of the general routing encapsulation is loaded in the virtual routing gateway of the first target cloud platform and the virtual routing gateway of the second target cloud platform respectively; wherein the kernel component is used for performing subsequent general routing encapsulation tunnel creation configuration; Based on the preset instructions, create a first tunnel port device in the virtual routing gateway of the first target cloud platform, and create a second tunnel port device in the virtual routing gateway of the second target cloud platform; The first tunnel port device and the second tunnel port device are mapped into a general routing encapsulation tunnel. 7. The communication method between cloud platform virtual private networks according to claim 6, characterized in that the first tunnel port device and the second tunnel port device are mapped into a general routing encapsulation tunnel, comprising: Configure a static route in the virtual routing gateway of the first target cloud platform, the destination address is the network segment of the second target cloud platform, and the next hop points to the first tunnel port device of the first target cloud platform; and Configure a static route in the virtual routing gateway of the second target cloud platform, with the destination address being the network segment of the first target cloud platform and the next hop pointing to the second tunnel port device of the second target cloud platform. 8. The method for communication between cloud platform virtual private networks according to claim 6, characterized in that, based on a preset instruction, a first tunnel port device is created in a virtual routing gateway of a first target cloud platform, and a second tunnel port device is created in a virtual routing gateway of a second target cloud platform, comprising: Configure the elastic public IP address of the first target cloud platform to the first tunnel port device; Configure the elastic public IP address of the second target cloud platform to the second tunnel port device; The elastic public IP address of the first target cloud platform is symmetrical to the elastic public IP address of the second target cloud platform. 9. The communication method between cloud platform virtual private networks according to any one of claims 1 to 8, characterized in that the static route is added according to demand, and the static route includes a destination network segment, a next hop address and a destination network card device name; Wherein, when setting the static routes, checking whether there is an address conflict between the static routes; When there is an address conflict between the static routes, a conflict prompt is issued. 10. A communication device between virtual private networks of a cloud platform, characterized by comprising: A binding module binds the network cards of non-business network segments of multiple virtual private networks to the virtual routing gateway; A configuration module, which configures static routes of multiple virtual private networks in the same virtual routing gateway to achieve communication between multiple virtual private networks on the same cloud platform; Establish a module, based on the elastic public network IP address and the universal routing encapsulation tunnel protocol, to establish a universal routing encapsulation tunnel between the virtual routing gateways of the first target cloud platform and the second target cloud platform to connect the first target cloud platform and the second target cloud platform; wherein the first target cloud platform and the second target cloud platform each include at least one virtual private network; Communication module, after the first target cloud platform and the second target cloud platform are connected, the virtual private network of the first target cloud platform and the virtual private network of the second target cloud platform communicate through a general routing encapsulation tunnel.