WO2021136311A1 - Method and device for communication between vpcs - Google Patents

Abstract

Provided are a method and device for communication between VPCs. The method comprises: a bridge virtual machine comprising a first network card bound to a first VPC and a second network card bound to a second VPC; and the bridge virtual machine receiving, on the basis of the first network card, a first message sent by a first virtual machine in the first VPC to a second virtual machine in the second VPC, performing network function processing on the message, and sending, on the basis of the second network card, the first message which has been subjected to network function processing to the second VPC. The communication between VPCs by means of the establishment of a virtual private network or a dedicated line is prevented. Provided is a new and more convenient communication method. Furthermore, network functions can further be configured on the bridge virtual machine. The method is different from the method of simply forwarding data via a virtual private network or a dedicated line. On the basis of the realization of communication between VPCs, the present application further improves a data processing function, and has a wider range of application scenarios and a strong applicability.

Description

A communication method and device between VPCs

Cross-references to related applications

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on December 30, 2019, the application number is 201911399727.0, and the application name is "a communication method and device between VPCs", the entire contents of which are incorporated by reference In this application.

Technical field

This application relates to the field of communication technology, and in particular to a communication method and device between VPCs.

Background technique

Cloud computing is a network application model. It is the development of distributed processing, parallel processing and grid computing. It automatically splits a huge computing processing program into countless smaller sub-programs through the network, and then hands them to multiple parts. The huge system composed of servers will return the processing results to the users after calculation and analysis.

With the popularity of data centers, the hardware resources of data centers can provide cloud services for enterprises in the form of virtualized equipment. Enterprises do not need to purchase equipment to deploy their own IT centers. They can apply for a set of IT resources in the data center. The company provides cloud computing services. The software and hardware facilities that the enterprise applies to create in the data center constitute a virtual private cloud (Virtual Private Cloud). A virtual private cloud refers to a comprehensive name that is built separately for an enterprise and a series of resources such as hardware, software, and network are unified. .

An enterprise can apply for public cloud resources belonging to the enterprise on the public cloud platform, and create one or more virtual private clouds belonging to the enterprise in the public cloud resources to allocate to different parts or groups. Each virtual machine private cloud is an isolated and private virtual network.

At present, different virtual machines in the same VPC can be connected (or communicated) with each other. When communicating between virtual machines in different virtual private clouds, it is necessary to establish a virtual private network (VPN) or leased line. The way to communicate, the current way to achieve communication between VPCs is single.

Summary of the invention

This application provides a communication method and device between VPCs, so as to provide a new way of implementing communication between VPCs.

In the first aspect, the present application provides a communication method between VPCs. The method is applied to a bridged virtual machine. The bridged virtual machine includes a first network card bound to a first VPC and a second network card bound to a second VPC. , The method includes:

The bridged virtual machine receives the first message sent by the first virtual machine in the first VPC to the second virtual machine of the second VPC based on the first network card, and performs network function processing on the message. The first packet after the function processing is sent to the second VPC.

Based on the above solution, a new communication method between VPCs is realized, which avoids the current communication between VPCs only through the establishment of a virtual private network or a dedicated line, and simplifies the communication process between different VPCs. Further, various network functions can also be set on the bridged virtual machine. Those skilled in the art will know that the network function can be address translation, routing, firewall filtering, etc. Therefore, the bridged virtual machine in the embodiment of the present application is implementing a bridge In addition to data transmission between VPCs, it can also process multiple network functions for data. When simplifying the communication between VPCs, the data processing functions are also more complete and applicable to a wider range of scenarios. Further, if you bridge virtual machines When firewall filtering is set, the security of communication between VPCs can also be improved.

In a possible implementation manner, the first network card is provided with a first private network address of a first VPC, and the second network card is provided with a second private network address of a second VPC;

When the bridged virtual machine receives a first packet sent from the first virtual machine in the first VPC to the second virtual machine in the second VPC from the first network card, the source IP of the first packet The address is the private network address of the first virtual machine in the first VPC, and the destination IP address is the first private network address;

When the bridge virtual machine performs network function processing on the first message, and sends the first message processed by the network function to the second VPC through the second network card, it includes:

The bridging virtual machine modifies the source IP address of the first message to the second private network address, and modifies the destination IP address of the first message to the second virtual machine in the second private network address. The private network address in the VPC, and the modified first message is sent to the second VPC through the second network card.

Based on the above solution, address translation rules can be set on the bridge virtual machine. When the address translation rules are set, the bridge virtual machine can perform address translation on the first message from the first virtual machine and send it to the second VPC. In this manner, when the first virtual machine sends a message to the second virtual machine, it can be directly sent to the bridged virtual machine without forwarding through a router, which shortens the transmission delay of the message and saves resource overhead.

In a possible implementation, the source IP address of the bridged virtual machine receiving the first packet from the first network card is the private network address of the first virtual machine in the first VPC, The destination IP address is the private network address of the second virtual machine in the second VPC;

The bridge virtual machine performs network function processing on the first message, and sends the first message processed by the network function to the second VPC through the second network card, including:

The bridged virtual machine selects a second network card according to the destination IP address of the first message, and sends the first message to the second VPC through the second network card.

Based on the above solution, a routing function can be set on the bridging virtual machine. In this application, a communication path between VPCs can be set by a custom route, which simplifies the communication process and has high flexibility.

In a possible implementation manner, the bridge virtual machine performs network function processing on the first packet, and sends the first packet processed by the network function to the second network card through the second network card. VPC, including:

The bridged virtual machine judges whether the first packet meets the preset firewall rules, and if so, sends the first packet processed by the network function to the second VPC through the second network card, if it does not meet , The first message is not sent.

Based on the above solution, it avoids the problem that when the current communication between VPCs is realized through the establishment of a virtual private network or a dedicated line, only pure data transmission can be realized, and security rules cannot be configured on the path. This application not only simplifies different VPCs The communication method between virtual machines in the virtual machine can also improve the security of communication between VPCs based on the firewall filtering function deployed on the bridge virtual machine.

In a second aspect, this application provides a method for setting up communication between VPCs, including creating a bridged virtual machine, the bridged virtual machine is provided with a first network card and a second network card; setting the first network card and the first network card VPC binding, the second network card is bound to the second VPC, wherein the bridge virtual machine is used to perform network function processing on the packets sent from the first VPC to the second VPC via the first network card , And used to perform network function processing on the message sent by the second VPC to the first VPC via the second network card.

In a possible implementation manner, the network function processing includes one or any combination of network address translation NAT, routing, and firewall filtering.

In a third aspect, the present application also provides a communication system, including a first virtual machine in a first VPC, a second virtual machine in a second VPC, and a bridge virtual machine;

The first virtual machine is used to send a first message;

The bridged virtual machine is configured to receive, from the first network card, a first message sent by a first virtual machine in the first VPC to a second virtual machine in a second VPC, and to respond to the first message Perform network function processing, and send the first packet processed by the network function to the second VPC through the second network card.

The second virtual machine is configured to receive the first message processed by the network function from the bridge virtual machine.

In a possible implementation manner, the first network card of the bridge virtual machine is set with a first private network address of the first VPC, and the second network card is set with a second private network address of the second VPC;

When the bridged virtual machine receives the first message sent from the first virtual machine in the first VPC to the second virtual machine in the second VPC from the first network card, it is specifically used for: the bridged virtual machine The first message is received from the first network card, the source IP address of the first message is the private network address of the first virtual machine in the first VPC, and the destination IP address is the first VPC A private network address;

When the bridge virtual machine performs network function processing on the first message, and sends the first message processed by the network function to the second VPC through the second network card, it is specifically used for: The bridging virtual machine modifies the source IP address of the first message to the second private network address, and modifies the destination IP address of the first message to that the second virtual machine is in the second VPC And send the modified first message to the second VPC through the second network card.

In a possible implementation manner, when the bridged virtual machine receives from the first network card a first packet sent by the first virtual machine in the first VPC to the second virtual machine in the second VPC, Specifically, the bridged virtual machine receives the first message from the first network card, and the source IP address of the first message is the private network of the first virtual machine in the first VPC Address, the destination IP address is the private network address of the second virtual machine in the second VPC;

When the bridge virtual machine performs network function processing on the first message, and sends the first message processed by the network function to the second VPC through the second network card, it is specifically used for: The bridging virtual machine selects a second network card according to the destination IP address of the first message, and sends the first message to the second VPC through the second network card.

In a possible implementation manner, the bridge virtual machine performs network function processing on the first packet, and sends the first packet processed by the network function to the second network card through the second network card. In the case of VPC, it is specifically used for: the bridged virtual machine determines whether the first message meets the preset firewall rules, and if so, sends the first message processed by the network function to the The second VPC.

In a fourth aspect, the present application provides a communication device suitable for a first computing node or a chip in the first computing node, and includes a unit or means for executing each step of the above first aspect or second aspect.

In a fifth aspect, the present application provides a communication device suitable for terminal equipment or a chip in the terminal equipment, including at least one processing element and at least one storage element, wherein the at least one storage element is used to store programs and data, the At least one processing element is used to execute the method provided in the first aspect or the second aspect of the present application.

In a sixth aspect, the present application provides a communication device including at least one processing element (or chip) for executing the method of the above first aspect or second aspect.

In a seventh aspect, the present application provides a computer program product, the computer program product includes a computer program, and when the computer program is executed by a computer, the computer is caused to execute the method in any of the above aspects.

In an eighth aspect, the present application provides a computer-readable storage medium that stores a computer program, and when the computer program is executed by a computer, the computer executes the method in any of the above aspects.

Description of the drawings

Figure 1 is one of the schematic diagrams of a communication system provided by this application;

Figure 2 is a second schematic diagram of a communication system provided by this application;

Figure 3 is the third schematic diagram of a communication system provided by this application;

Figure 4 is a fourth schematic diagram of a communication system provided by this application;

FIG. 5 is the fifth schematic diagram of a communication system provided by this application;

Fig. 6 is a sixth schematic diagram of a communication system provided by this application;

FIG. 7 is a specific example of a communication system provided by this application;

FIG. 8 is a flowchart of a method for creating a bridged virtual machine provided by the present application;

FIG. 9 is a flowchart of a communication method between VPCs provided by the present application;

FIG. 10 is a schematic diagram of a device for bridging virtual machines according to an embodiment of the application;

FIG. 11 is a schematic diagram of a configuration device provided by an embodiment of the application.

Detailed ways

The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

Figure 1 shows a communication system 100 deployed in a cloud data center to which this application may be applicable. The communication system 100 includes a controller, a virtual private cloud VPC1 and a virtual private cloud VPC2, where the controller is used to configure the virtual machine private cloud VPC1 And virtual private cloud VPC2. The virtual private cloud VPC1 includes at least two virtual machines, VM1 and VM2, respectively, and the virtual private cloud VPC2 includes at least two virtual machines, VM4 and VM5, respectively.

The communication system also includes at least one bridging virtual machine VM3, which can be created in the virtual private cloud VPC1 or in the virtual private cloud VPC2.

It should be understood that users can deploy virtual private clouds from the user world provided by the SDN controller. In this virtual private cloud, users can customize network segments, divide subnets, and create various virtual devices, such as virtual machines and virtual routers. , Interactive machines and other virtual devices, and assign IP addresses to each virtual device.

In the communication system shown in Figure 1, the URL of the virtual private cloud VPC1 is 192.168.0.0/16, and the virtual private cloud VPC1 includes router 1 and subnet 1. Subnet 1 has the same network segment as the virtual private cloud VPC1, and subnet 1 It contains VM1, VM2 and switch 1, and the network cards of VM1 and VM2 are connected to switch 1. Among them, the IP address of VM1 is 192.168.0.2, the IP address of VM2 is 192.168.0.3, and the IP address of switch 1 is 192.168.0.13.

The URL of virtual private cloud VPC2 is 10.0.0.0/16. Virtual private cloud VPC2 includes subnet 2 and router 2. Subnet 2 has the same network segment as virtual private cloud VPC2. Subnet 2 contains VM4, VM5, and switch 2. The network cards of VM4 and VM5 are connected to switch 2. Among them, the IP address of VM4 is 10.0.0.2, the IP address of VM5 is 10.0.0.3, and the IP address of switch 2 is 10.0.0.13. The number under each virtual machine icon represents the network card identifier of the virtual machine. For example, the network card identifier of VM1 is 9, the network card identifier of VM2 is 8, and so on.

Assume that the bridge virtual machine VM3 is created in the virtual private cloud VPC1. The VM3 has two network cards, for example, it can be named network card 1 and network card 2. Assume that network card 1 is connected to switch 1, network card 2 is connected to switch 2, and network card 1 is assigned The IP address is 192.168.0.4, and the assigned IP address of NIC 2 is 10.0.0.4.

Among them, routers (including router 1 and router 2) are used to implement data transmission between subnets of different network segments. For example, router 1 is used to forward packets from VM1 of subnet 1 to VM4 of subnet 2 to Router 2, the premise is that a tunnel or dedicated line needs to be established between router 1 and router 2 (such as the cross-VPC communication method introduced in the background art of this article), and the cross-VPC proposed in this application is implemented in the communication system shown in Figure 1 When communicating, data can be forwarded by the bridge virtual machine VM3 without going through the router. The following describes how the bridge virtual machine VM3 implements the communication between VPC1 and VPC2:

It should be understood that the network card 1 of VM3 can be bound to any virtual machine in VPC1 or VP2. After the network card 1 of VM3 receives a message, the received message can be forwarded to the virtual machine bound to the network card 1 . Similarly, NIC 2 of VM3 can also be bound to any virtual machine in VPC1 or VP2. When NIC 2 of VM3 receives a message, it can forward the received message to the virtual machine bound to NIC 2 on.

Exemplarily, suppose that the address translation function is deployed on VM3, and the address mapping rule set on VM3 is one-to-one mapping between the IP address of network card 1 and the IP address of VM4, and the IP address of network card 2 is one-to-one mapping with the IP address of VM2. The rule set by the virtual machine in VPC1 is that when the destination of the message is a virtual machine in VPC2, the message is sent to NIC 1 of VM3, that is, the destination IP address of the message is the IP of NIC 1 address.

The following takes VM1 to send a message to the virtual machine in VPC2 as an example to introduce the entire data transmission process:

1. VM1 sends the message to NIC 1 of VM3;

It should be understood that when VM1 wants to send a message to the virtual machine in VPC2, it will send the message to the network card 1 of VM3 as a specific rule configured by the user, and the rule can be configured by the SDN controller. Among them, the SDN controller can also configure other rules in response to user operation instructions. For example, when a virtual machine in VPC2 sends a message to a virtual machine in VPC1, the message is sent to network card 2 of VM3, and network card 2 will The received message is sent to VM2 bound to network card 2.

2. The network card 1 of VM3 receives the message from VM1;

3. VM3 processes the message, and sends the processed message to VM4 through the network card 2.

4. VM4 receives the message from the network card 2.

Optionally, VM4 can also send the message to any virtual machine in VPC2. For example, VM4 sends the message from network card 1 to other virtual machines in VPC2, and for example, forwards it to the same subnet. The virtual machine, or all virtual machines in VPC2, may not be forwarded to any virtual machine.

Specifically, the message sent by the virtual machine 1 may include two parts, namely a header part and a data part. Among them, the header part can include the source IP address and the destination IP address.

Correspondingly, during the transmission of the aforementioned data message, the entire data processing flow may include:

1. VM1 sends the message to NIC 1 of VM3;

The source IP address of message 1 is the IP address of VM1 (the IP address in VPC1), that is, 192.168.0.2, and the destination IP address is the IP address of VM3's network card 1, that is, 192.168.0.4.

2. The network card 1 of VM3 receives the message from VM1;

3. VM3 performs network function processing on the message, and sends the processed message to VM4 through the network card 2.

Specifically, when processing the message, VM3 modifies the source IP address of the received message to the IP address of network card 2, namely 10.10.0.4, and modifies the destination IP address to the IP address of VM4 (the IP address in VPC2). ), which is 10.10.0.2.

The above-mentioned network function is processed as address translation NAT. The address translation of the data sending process can be called DNAT. Correspondingly, the address translation of the data receiving process can be called SNAT. The virtual machine in VPC2 sends to the virtual machine in VPC1. When sending a message, for example, VM4 wants to send a message to VM2. Based on the rules set by the user, VM4 first sends the message to the network card 2 of VM3 (the source IP address of the message is the IP address of VM4, and the destination IP address is The IP address of NIC 2). After VM3 receives the message through NIC 2, VM3 can also perform the backhaul address translation of the message. For example, modify the source IP address of the message to the IP address of NIC 1. The destination Change the IP address to the IP address of VM2. Taking the one-to-one mapping between the IP address of NIC 2 and the IP address of VM2 as an example, the following describes the data transmission process of sending packets from VM4 in VPC2 to VM2 in VPC1:

1. VM4 sends message 1 to network card 2 of VM3;

Specifically, the source IP address of the message sent by VM4 is the IP address of VM4 (10.0.0.2), and the destination IP address is the IP address (10.0.0.4) of the network card 2 of VM3.

2. VM3 receives the message from VM4 based on the network card 2, and processes the message based on the address mapping rules to obtain message 2, and sends the processed message 2 to VM2 through the network card 1.

Among them, the specific processing process is that since the IP address of the network card 2 is mapped to the IP address of VM2, VM3 can modify the destination IP address of the received message 1 (the IP address of the network card 2) to the network card 2. Corresponding to the IP address of VM2, message 2 is obtained, that is, the destination IP address of message 2 is the IP address of VM2 (192.168.0.3).

3. VM2 receives message 2 sent by network card 1.

The above is an introduction to DNAT and SNAT through the data processing process. When DNAT and SNAT are set on VM3 at the same time, it can also be called FULLNAT. It should be understood that only DNAT or SNAT can be set on VM3.

Through the above method, by bridging the NIC 1 and NIC 2 of the virtual machine VM3, the message interaction between the virtual machines between VPC1 and VPC2 is realized, and the cross-VPC is avoided by establishing a tunnel or a dedicated line on the router between the two VPCs. Communication, this application provides a new way of cross-VPC communication.

The cross-VPC communication provided by this application can also be implemented in conjunction with routers. As shown in FIG. 2, another communication system 200 deployed in a cloud data center provided by this application, the communication system 200 and the virtual devices included in the communication system 100, and each The IP addresses of the virtual machine devices are the same. For other configurations of the communication system 200 that are the same as those of the communication system 100, please refer to the above description of the communication system 100, which will not be repeated here. The difference is that in the communication system 200, the network card 1 of the bridging virtual machine VM3 is not connected to the switch 1, but is connected to the router 1, and the network card 2 of the VM3 is connected to the router 2.

Exemplarily, assuming that the address translation function is not set in VM3, the destination IP address of the message sent by the virtual machine in VPC1 is the IP address of the destination end of the message. Similarly, the following describes the entire data processing process when VM1 sends a message to virtual machine VM4 in VPC2:

1. VM1 sends the message to switch 1;

The source IP address of the message sent by VM1 is the IP address of VM1, and the destination IP address is the IP address of VM4.

2. Switch 1 sends the received message from VM1 to router 1;

Specifically, the source IP address of the message sent by VM1 can be the IP address of VM1 (192.168.0.2), and the destination IP address can be the IP address of VM4 (10.0.0.2), because the source and destination IP addresses are not the same Network segment, and routers can implement data forwarding between different network segments. Therefore, after switch 1 receives the message, it sends the message to router 1. It should be understood that the switch 1 and the router 1 can calculate that the source IP address and the destination IP address are not in the same network segment. When router 1 receives that router 1 determines that the destination IP address of the message is the IP address of the virtual machine in VPC2, it sends the message to network card 1 of VM3.

Among them, a routing rule can be configured in router 1. If the destination IP address of the message is the private network address of VPC2 (for example, 10.0.0.2), router 1 sends the message to network card 1 of VM3.

Correspondingly, a routing rule for the backhaul can also be configured in router 1. For example, when the destination IP address of the packet received by router 1 is 192.168.0.0/24, it is forwarded to subnet 1.

3. Router 1 sends the message to the network card 1 of the bridge virtual machine VM3;

4. VM3 sends the message from router 1 to router 2 through network card 2;

Specifically, based on the network card 1 receiving the message from the router 1, the VM3 can directly send the message to the router 2 through the network card 2 according to the destination IP address (10.0.0.2) of the message.

Optionally, VM3 can also perform network function processing on packets, for example, the address translation described above, and firewall filtering can also be performed. For details, please refer to the description of firewalls below.

5. The router 2 receives the message from the network card 2 of the VM3, and forwards the message to some or all of the virtual machines connected under the switch 2.

The foregoing is the data forwarding of the bridged virtual machine based on the router level, that is, the routing function that can be implemented by the bridged virtual machine of this application.

It should be noted that the setting of two network cards in the bridged virtual machine described above is only an example, and the bridged virtual machine in the embodiment of this application can also be set with more than two network cards to implement multiple VPCs (more than 2). Data transfer between two VPCs.

Next, the deployment method and the corresponding communication method when more than 2 network cards are set on the bridge virtual machine are introduced:

Exemplarily, suppose that 4 network cards are provided on the bridge virtual machine, as shown in the communication system 300 shown in FIG. 3. The communication system adds virtual private clouds VPC3 and VPC4 on the basis of the communication system 100, and bridges the virtual machine VM3. There are 4 network cards, for example, including the first network card, the second network card, the third network card, and the fourth network card. The first network card is bound to VPC1, the second network card is bound to VPC2, and the third network card is bound to VPC3. , The fourth network card is bound to VPC4.

Assume that the IP address of the first network card is mapped to the IP address of VM4 in VPC2, the IP address of the second network card is mapped to the IP address of VM2 in VPC1, and the IP address of the third network card is mapped to that of VM7 in VPC4. The IP addresses are mapped one by one, and the IP address of the fourth network card is mapped one by one with the IP address of VM6 in VPC3.

In the communication system 300, the network card 1 and the network card 2 that can bridge the virtual machine VM3 can realize the data transmission between the VPC1 and the VPC2, and the network card 3 and the network card 4 based on the VM3 can realize the data transmission between the VPC3 and the VPC4.

As another example, in some scenarios, routing rules can also be deployed in the bridge virtual machine. For example, for router 1 of VPC1, when sending packets of VPC1 to VPC2, the corresponding routing rule can be The packet whose destination IP address is the private network address of VPC2 is sent to network card 1 of VM3. If you want to send the message of VPC1 to VPC3, the corresponding routing rule can be that the message whose destination IP address is the private network address of VPC3 is also sent to the network card 1 of VM3. That is, the message received by the NIC 1 of VM3 may be sent to VPC2, or it may be sent to VPC3, then the routing rule set on VM3 can be: the message whose destination IP address is the private network address of VPC2 is sent by The network card 2 sends a message with the destination IP address of the private network address of VPC3 being sent by the network card 3.

The communication system 400 shown in FIG. 4 is based on the communication system 200 and adds a virtual private cloud VPC3. The bridging virtual machine VM3 is provided with 3 network cards, for example, including a first network card, a second network card, and The third network card, wherein the first network card is bound to VPC1, the second network card is bound to VPC2, and the third network card is bound to VPC3.

Each router is configured with routing rules. Similarly, the bridging virtual machine VM3 is also configured with routing rules. The following takes router 1 and the bridging virtual machine VM3 as an example to describe the routing rules configured on router 1 and the corresponding VM3 :

For router 1 of VPC1, when sending packets of VPC1 to VPC2, the corresponding routing rule may be to send packets whose destination IP address is the private network address of VPC2 to network card 1 of VM3. If you want to send the message of VPC1 to VPC3, the corresponding routing rule can be that the message whose destination IP address is the private network address of VPC3 is also sent to the network card 1 of VM3. That is, the message received by the NIC 1 of VM3 may be sent to VPC2, or it may be sent to VPC3, then the routing rule set on VM3 can be: the message whose destination IP address is the private network address of VPC2 is sent by The network card 2 sends a message with the destination IP address of the private network address of VPC3 being sent by the network card 3.

Similarly, for router 2 in VPC2 and router 3 in VPC3, you can refer to the routing rules configured for router 1 and VM3 for configuration, which will not be repeated here.

Based on the above routing rules, in the communication system 300, network card 1 and network card 2 based on bridging virtual machine VM3 can implement data transmission between VPC1 and VPC2, and network card 1 and network card 3 based on VM3 can implement data between VPC1 and VPC3 Transmission, VM3-based network card 2 and network card 3 can realize data transmission between VPC2 and VPC3.

As an optional implementation manner, a firewall may also be deployed in the bridge virtual machine VM3 to implement any function of the firewall. For example, a security policy is set through a firewall. The security policy means that the firewall checks whether the data flow can pass through the basic security control mechanism of the firewall according to certain filtering rules. Illustratively, the firewall sends a filtering rule that VPC1 can access any of VPC2. Virtual device, or can only access the virtual device with the specified IP address in the specified VPC2, etc.

Exemplarily, after the firewall is deployed, after the network card 1 of VM3 receives a message from VPC1, it can determine whether the message meets the preset firewall rules, if so, the message is sent to VPC2 through the network card 2, otherwise , Do not send the message. Correspondingly, after the network card 2 of VM3 receives the message from VPC2, it can also determine whether the message meets the preset firewall rules. If so, the message is sent to VPC1 through the network card 1, otherwise, the message is not sent Text.

In the embodiment of this application, the bridged virtual machine deployed with a firewall can realize the security filtering of the data to be transmitted, thereby improving the security of cross-VPC communication, and can also realize other functions of the firewall. You can refer to the implementation based on the existing firewall mechanism. Ways, I won’t repeat them here.

As an optimization solution, in order to improve the reliability of cross-VPC communication through bridged virtual machines, the bridged virtual machines can also be configured in redundant mode. The configuration can be based on the VRRP protocol or the HA protocol. There is a redundant configuration mechanism, the specific configuration method will not be repeated. The communication system 500 shown in Figure 5 is based on Figure 1. Two bridged virtual machines are deployed between VPC1 and VPC2 at the same time. It should be understood that only one of the two bridged virtual machines is used at the same time. In actual data transmission, the bridged virtual machine actually used for data transmission is the main bridged virtual machine, and the other is used as the standby bridged virtual machine. In short, the redundancy mode can be understood as a master-standby mode. When the main bridged virtual machine occurs In the event of a failure, the standby bridged virtual machine can be switched to the main bridged virtual machine to ensure the normal operation of the communication system.

Therefore, the configuration of the standby bridged virtual machine must be exactly the same as the configuration of the main bridged virtual machine to achieve seamless switching, that is, the main bridged virtual machine and the standby bridged virtual machine have the same hardware configuration and network configuration, for example, the same The number of network cards, the same IP address, the same address mapping rules, the same routing rules, etc. The difference is that the mac address of the primary bridge virtual machine is different from the mac address of the standby bridge virtual machine.

After the primary bridge virtual machine fails, the standby bridge virtual machine automatically switches to the primary bridge virtual machine. For example, it can be assumed that the bridge virtual machine is in a redundant configuration. The current primary bridge virtual machine is VM3, and the standby bridge virtual machine is VM3. '. When VM3 is running, it can periodically broadcast messages to notify VM3' that the status of the master bridge virtual machine is normal. When VM3 fails, it will no longer broadcast the message. VM3' has not detected the master within the preset time. After the message broadcasted by the bridge virtual machine is switched, it is switched to the main bridge virtual machine, that is, at this time, VM3' runs as the main bridge virtual machine.

It should be noted that for two bridged virtual machines in redundant configuration, the IP addresses of the two bridged virtual machines are virtual IP (VIP) without real IP. The virtual IP is relative to the real IP. It means that when the same IP address in the same VPC only corresponds to the same virtual device, the IP is the real IP of the host. The virtual IP means that two hosts have the same IP address in the redundant mode, and the IP address is the virtual IP of the two virtual machine devices that are jointly owned. Therefore, when the embodiment of the application implements the redundant configuration of the bridged virtual machine, the virtual device in the embodiment of the application also has the function of obtaining the MAC address of the bridged virtual machine VIP to ensure that the message is sent according to the obtained mac address To the main bridge virtual machine.

The above is the solution of implementing cross-VPC communication in this application by deploying different network functions on the bridge virtual machine. In a possible scenario, the embodiment of this application can realize the user's offline IDC and cloud on the basis of cross-VPC communication. The communication between VPCs, as shown in FIG. 6, is another communication system 600 provided for this application. The communication system 600 includes offline IDC, VPC1 and VPC2. The offline IDC includes at least one terminal device 10 and a router 11. The terminal device may be a computer, a computer, a mobile phone, and so on. VPC2 includes at least one virtual gateway 20. The router 11 in the offline IDC establishes a connection with the virtual gateway 20 of VPC2. For example, the connection can be a VPN connection or a tunnel is established to achieve a connection. VPC2 and VPC1 are bridged through virtual machines to achieve cross-VPC connection. Specifically, the offline IDC router establishes a connection with the virtual gateway (VPN) of VPC2 through a dedicated line. For the specific internal structure of VPC2 and VPC1, please refer to the description of Figure 1, Figure 2, Figure 3, Figure 4, Figure 5 or Figure 6. I won't repeat them here.

In the pass-through system 500, the offline IDC can communicate with the virtual machine in VPC1, and can also communicate with the virtual machine in VPC2. The following describes the communication process between the offline IDC and the virtual machine in VPC2 in detail:

1. The offline IDC terminal device 10 sends a message to the router 11;

The source IP address of the message sent by the terminal device 10 is the IP address assigned by the offline IDC to the terminal device 10, assuming it is 10.0.0.2. The destination IP address is the IP address 192.168.0.3 of VM2 in VPC1.

2. The router 11 performs address conversion on the message and sends it to the virtual gateway in VPC2;

Routing rules can be set in the router 11, and if the destination IP address of the message is the private network address of VPC1 or VPC2, the message is sent to the virtual gateway of VPC2.

Further, when the router 11 has a VPN function, it can also perform encryption processing on the IP message to be forwarded. For example, the router 11 encrypts the IP message based on a preset algorithm and adds a VPN header to the encrypted IP message. The source IP address of the VPN packet header is the public network address of router 11, and the destination IP address is the public network address of the virtual gateway in VPC2 to obtain the processed VPN message, and send the processed VPN message to VPC2 through the dedicated line Virtual gateway.

It should be understood that communication based on dedicated lines or VPNs requires data transmission based on the public network addresses of the devices at both ends.

3. The virtual gateway of VPC2 receives VPN packets from the offline IDC router;

Assume that the virtual gateway of VPC2 is a VPN gateway. After the VPN gateway receives a VPN message from an offline IDC, it decapsulates the VPN message, removes the header of the VPN message, and obtains the encrypted IP message part, and The IP packet is decrypted based on the preset decryption algorithm corresponding to the preset encryption algorithm in the router 11.

4. Based on the destination IP address of the decrypted message, the virtual gateway of VPC2 sends the message to the network card 2 of the bridge virtual machine VM3;

5. VM3 sends the message to VM2 in VPC1 based on network card 1.

It should be noted that the communication between the offline IDC and the virtual private cloud described above is only an example, and this application can implement communication between various offline and on-cloud networks, and this application is not limited to the communication between the IDC and the virtual private cloud.

The above method can realize the encrypted transmission of the network under the cloud and on the cloud, which improves the security of data transmission. At the same time, since VPC1 is not directly connected to the public network, the risk of VPC1 being invaded can also be reduced to a certain extent. For example, in In a possible scenario, users can store data with high confidentiality requirements, such as R&D data, in VPC1, and deploy data interaction with the public network in VPC2 to realize the Gree of public network data and R&D data. This reduces the risk of intrusion that may be caused when public network data and R&D data are simultaneously transmitted in the same VPC.

As shown in FIG. 7, a specific example of a connection mode between virtual devices in a communication system is provided for this application. The communication system includes VPC1 and VPC2. VPC1 includes VM1 and VM2, and VPC2 includes VM3 and VM4. Among them, VM1, VM2, and VM4 all have a network card, the network cards of VM1 and VM2 are connected to the logical bridge VNI ₁ , and the network cards of VM3 and VM4 are connected to the logical bridge VNI ₂ . VM3 has two network cards, one of which is connected to the logical bridge VNI ₁ , and the other is connected to the logical bridge VNI ₂ .

Among them, the configuration of the aforementioned virtual devices (for example, the virtual machines of VPC1 and VPC2 in FIG. 1) can be implemented by a controller (or called a configuration device). For example, the controller is an SDN controller, and the SDN controller can correspond to The controller in Figure 1. Assume that there are two VPC networks created by the SDN controller, namely VPC1 and VPC2.

Next, please refer to FIG. 8, which is a flowchart of a configuration method for implementing communication between VPCs through a controller in an embodiment of this application, including the following steps:

S800: Create a bridge virtual machine, set the first network card and the second network card for the bridge virtual machine; specifically, for example, create a bridge virtual machine in VPC1 or VPC2, and configure the number of network cards of the bridge virtual machine, for example, it can be 2 network cards , Namely the first network card and the second network card;

S801: Set the first network card to be bound to VPC1, and the second network card to be bound to VPC2. The bridged virtual machine is used to perform network function processing on the packets sent from VPC1 to VPC2 via network card 1 and to send VPC2 to VPC2 via network card 2. The packets of VPC1 are processed by the network function.

It should be noted that if the two VPCs do not belong to the same tenant, the SDN controller may also provide a VPC authorization mechanism, and the communication between the VPCs can be realized only after authorization. For example, the user belonging to VPC1 can authorize the permissions (such as access permissions) of VPC1 to VPC2 through the authorization interface provided by the SDN controller, and the user of VPC2 can authorize the permissions of VPC2 through the authorization interface of the same function provided by the SDN controller After VPC1 is authorized, the communication between the two VPCs can be realized based on the setting of the above-mentioned bridged virtual machine.

Next, please refer to FIG. 9, which is an interaction flowchart of a method for communication between virtual machines in an embodiment of this application. The first virtual machine, the bridged virtual machine, and the second virtual machine in this process can be any virtual machine or bridged virtual machine in VPC1 in Figure 1, Figure 2, Figure 3, Figure 4, Figure 5, or Figure 6, respectively. Any virtual machine in VM3 and VPC2, or the first virtual machine can also be any virtual machine in VPC2 in Figure 1, Figure 2, Figure 3, Figure 4, Figure 5, or Figure 6, then the second virtual machine The machine is any virtual machine in VPC1. As shown in Figure 9, the method includes:

S900. The first virtual machine sends the first message;

S901. The bridged virtual machine receives the first message based on the first network card, and performs network function processing on the first message to obtain a second message;

S902: The bridged virtual machine sends the second message to the second virtual machine based on the second network card.

S903. The second virtual machine receives the second packet sent by the bridging virtual machine.

Regarding the processing process of the bridged virtual machine's network function on the data, please refer to the above record, which will not be described here.

Similar to the above-mentioned concept, as shown in FIG. 10, the present application provides an apparatus 1000, which can be applied to the bridge virtual machine in the process shown in FIG. 9 above.

The communication device 1000 may include a processor 1001 and a memory 1002. Further, the device may further include a first communication interface 1004 and a second communication interface 1005, and the communication interface may be a transceiver. Further, the device may also include a bus system 1003.

The processor 1001, the memory 1002, the first communication interface 1004 and the second communication interface 1005 can be connected via a bus system 1003, the memory 1002 can store computer programs, and the processor 1001 can be used to execute the computer programs stored in the memory 1002. In order to control the first communication interface 1004 and the second communication interface 1005 to receive or send signals, the steps of bridging virtual machines as the main body in the method shown in FIG. 9 are completed.

The memory 1002 may be integrated in the processor 1001, or may be a different physical entity from the processor 1001.

As an implementation manner, the functions of the first communication interface 1004 and the second communication interface 1005 may be implemented by a transceiver circuit or a dedicated chip for transceiver. The processor 1001 may be implemented by a dedicated processing chip, a processing circuit, a processor, or a general-purpose chip.

As another implementation manner, a computer may be considered to implement the functions of the first computing node or the first computing node provided in the embodiments of the present application. The program codes for realizing the functions of the processor 1001, the first communication interface 1004, and the second communication interface 1005 are stored in the memory 1002. The general-purpose processor can implement the processor 1001, the first communication interface 1004, and the first communication interface 1004 by executing the codes in the memory. Second, the function of the communication interface 1005.

For the concepts, explanations, detailed descriptions, and other steps related to the technical solutions provided by the present application related to the communication device 1000, please refer to the descriptions of these contents in the foregoing method or other embodiments, which are not repeated here.

In an example of the present application, the communication device 1000 can be used to execute the steps in the process shown in FIG. 9 described above with the bridged virtual machine as the execution subject. For example, the first communication interface 1004 can receive the message sent by the first virtual machine in the first VPC bound to the first communication interface 1004; the processor 1001 can transmit the messages received by the first communication interface 1004 and the second communication interface 1005 The message is processed by the network function; the second communication interface 1005 can send the message of the second virtual machine in the second VPC bound by the first virtual machine to the second communication interface 1005.

For the introduction of the processor 1001, the first communication interface 1004, and the second communication interface 1005, refer to the introduction of the process shown in FIG. 9 above, which is not repeated here.

Similar to the above-mentioned concept, as shown in FIG. 11, the present application provides a configuration device 1100, which can be applied to the controller in the process shown in FIG. 8 above.

The configuration device 1100 may include a processor 1101 and a memory 1102. Further, the device may further include a communication interface 1104, and the communication interface may be a transceiver. Further, the device may also include a bus system 1103.

The processor 1101, the memory 1102, and the communication interface 1104 can be connected via a bus system 1103. The memory 1102 can store a computer program. The processor 1101 can be used to execute the computer program stored in the memory 1102 to control the communication interface 1104 to receive or send Signal to complete the steps with the controller as the main body in the method shown in Figure 8 above.

The memory 1102 may be integrated in the processor 1101, or may be a different physical entity from the processor 1101.

As an implementation manner, the function of the communication interface 1104 may be implemented by a transceiver circuit or a dedicated chip for transceiver. The processor 1101 may be implemented by a dedicated processing chip, a processing circuit, a processor, or a general-purpose chip.

As another implementation manner, a computer may be considered to implement the functions of the first computing node or the first computing node provided in the embodiments of the present application. The program code for realizing the functions of the processor 1101 and the communication interface 1104 is stored in the memory 1102, and the general-purpose processor can realize the functions of the processor 1101 and the communication interface 1104 by executing the codes in the memory.

For the concepts, explanations, detailed descriptions, and other steps related to the technical solutions provided by the present application related to the communication device 1100, please refer to the descriptions of these contents in the foregoing method or other embodiments, which will not be repeated here.

In an example of the present application, the communication device 1100 can be used to execute the steps in the process shown in FIG. 8 with the controller as the execution subject. For example, the processor 1101 may create a bridge virtual machine, set a first network card and a second network card for the bridge virtual machine, and set the first network card to be bound to the first VPC, and the second network card to be bound to the second VPC. set,;

For the introduction of the processor 1101 and the communication interface 1104, reference may be made to the introduction of the process shown in FIG. 8, which will not be repeated here.

Based on the above embodiments, the embodiments of the present application also provide a computer storage medium, the storage medium stores a software program, and the software program can implement any one or more of the above when read and executed by one or more processors. The method provided by the embodiment. The computer storage medium may include: U disk, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk and other media that can store program codes.

Based on the above embodiments, the embodiments of the present application also provide a computer program product. The computer program product includes a computer program. When the computer program is executed by a computer, the computer executes any one or more of the above implementations. The method provided by the example.

Based on the above embodiments, the embodiments of the present application also provide a chip, which includes a processor, which is used to implement the functions involved in any one or more of the above embodiments, such as acquiring or processing the information involved in the above methods or news. Optionally, the chip further includes a memory for storing programs and data executed by the processor. The chip may also include chips and other discrete devices.

It should be understood that in the embodiments of the present application, the processor may be a central processing unit (central processing unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (digital signal processors, DSP), and dedicated integration Circuit (application-specific integrated circuit, ASIC), ready-made programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

The memory may include a read-only memory and a random access memory, and provides instructions and data to the processor. A part of the memory may also include a non-volatile random access memory.

In addition to the data bus, the bus system may also include a power bus, a control bus, and a status signal bus. However, for the sake of clear description, various buses are marked as bus systems in the figure. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or instructions in the form of software. The steps of the method disclosed in combination with the embodiments of the present application may be directly embodied as execution and completion by a hardware processor, or execution and completion by a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.

In the various embodiments of this application, if there are no special instructions and logical conflicts, the terms and/or descriptions between different embodiments are consistent and can be mutually cited. The technical features in different embodiments are based on their inherent Logical relationships can be combined to form new embodiments.

It can be understood that the various numerical numbers involved in the embodiments of the present application are only for easy distinction for description, and are not used to limit the scope of the embodiments of the present application. The size of the sequence number of the above-mentioned processes does not mean the order of execution, the order of execution of the processes should be determined by their functions and internal logic.

In some possible implementation manners, the various aspects of the information synchronization method provided in the embodiments of the present application can also be implemented in the form of a program product, which includes program code, and when the program code runs on a computer device, The program code is used to make the computer device execute the steps in the method for bridging a virtual machine or an SDN controller according to various exemplary embodiments of the present application described in this specification.

The program product can use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable Type programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

The program product for configuring parameters according to the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may run on a server device. However, the program product of this application is not limited to this. In this document, the readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or in combination with information transmission, devices, or devices.

The readable signal medium may include a data signal propagated in baseband or as a part of a carrier wave, and readable program code is carried therein. This propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. The readable signal medium may also be any readable medium other than a readable storage medium, and the readable medium may send, propagate, or transmit a program for use by or in combination with a periodic network action system, apparatus, or device.

The program code contained on the readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

The program code used to perform the operations of this application can be written in any combination of one or more programming languages. The programming languages include object-oriented programming languages, such as Java, C++, etc., as well as conventional procedural programming languages. Programming language, such as "C" language or similar programming language. The program code can be executed entirely on the user's computing device, partly on the user's device, executed as an independent software package, partly on the user's computing device and partly executed on the remote computing device, or entirely on the remote computing device or server Executed on. In the case of a remote computing device, the remote computing device may be connected to a user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device.

The embodiment of the present application also provides a computing device readable storage medium for the information synchronization method, that is, the content is not lost after a power failure. The storage medium stores a software program, including program code. When the program code runs on a computing device, the software program can implement any of the above embodiments of the present application when it is read and executed by one or more processors. Information synchronization scheme.

The foregoing describes the present application with reference to block diagrams and/or flowcharts illustrating methods, devices (systems) and/or computer program products according to embodiments of the present application. It should be understood that one block of the block diagram and/or flowchart diagram and a combination of the blocks in the block diagram and/or flowchart diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, and/or other programmable data processing devices to produce a machine, so that the instructions executed via the computer processor and/or other programmable data processing device are created for A method of implementing the functions/actions specified in the block diagrams and/or flowchart blocks.

Correspondingly, hardware and/or software (including firmware, resident software, microcode, etc.) can also be used to implement this application. Furthermore, this application may take the form of a computer program product on a computer-usable or computer-readable storage medium, which has a computer-usable or computer-readable program code implemented in the medium to be used or used by the instruction execution system. Used in conjunction with the instruction execution system. In the context of this application, a computer-usable or computer-readable medium can be any medium that can contain, store, communicate, transmit, or transmit a program for use by an instruction execution system, apparatus, or device, or in combination with an instruction execution system, Device or equipment use.

Although the application has been described in combination with specific features and embodiments, it is obvious that various modifications and combinations can be made without departing from the spirit and scope of the application. Accordingly, the specification and drawings are merely exemplary descriptions of the application as defined by the appended claims, and are deemed to cover any and all modifications, changes, combinations or equivalents within the scope of the application. Obviously, those skilled in the art can make various changes and modifications to the application without departing from the scope of the application. In this way, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalent technologies, this application is also intended to include these modifications and variations.

Claims (12)

A communication method between virtual private cloud VPCs, characterized in that the method is applied to a bridged virtual machine, and the bridged virtual machine includes a first network card bound to a first VPC and a second network card bound to a second VPC. Second network card, the method includes: Receiving, by the bridged virtual machine from the first network card, a first message sent by the first virtual machine in the first VPC to the second virtual machine in the second VPC; The bridge virtual machine performs network function processing on the first message, and sends the first message processed by the network function to the second VPC through the second network card. The method according to claim 1, wherein the first network card is provided with a first private network address of a first VPC, and the second network card is provided with a second private network address of a second VPC, The receiving, by the bridged virtual machine from the first network card, the first message sent by the first virtual machine in the first VPC to the second virtual machine in the second VPC includes: The bridged virtual machine receives the first message from the first network card, and the source IP address of the first message is the private network address of the first virtual machine in the first VPC, and the destination network The protocol IP address is the first private network address; The bridge virtual machine performs network function processing on the first message, and sends the first message processed by the network function to the second VPC through the second network card, including: The bridging virtual machine modifies the source IP address of the first message to the second private network address, and modifies the destination IP address of the first message to the second virtual machine in the second private network address. The private network address in the VPC; The bridged virtual machine sends the modified first message to the second VPC through the second network card. The method of claim 1, wherein: The receiving, by the bridged virtual machine from the first network card, the first message sent by the first virtual machine in the first VPC to the second virtual machine in the second VPC includes: The bridged virtual machine receives the first message from the first network card, and the source IP address of the first message is the private network address of the first virtual machine in the first VPC, and the destination IP The address is the private network address of the second virtual machine in the second VPC; The bridge virtual machine performs network function processing on the first message, and sends the first message processed by the network function to the second VPC through the second network card, including: The bridged virtual machine selects a second network card according to the destination IP address of the first message, and sends the first message to the second VPC through the second network card. The method according to any one of claims 1 to 3, wherein the bridging virtual machine performs network function processing on the first message, and uses the second network card to process the first message processed by the network function. A message sent to the second VPC includes: The bridged virtual machine judges whether the first message conforms to a preset firewall rule, and if so, sends the first message processed by the network function to the second VPC through the second network card. A method for setting communication between VPCs, which is applied to a controller, and is characterized in that it includes: Creating a bridged virtual machine, where the bridged virtual machine is provided with a first network card and a second network card; Set the first network card to be bound to the first VPC, and the second network card to be bound to the second VPC, wherein the bridge virtual machine is used to send the first VPC to the first VPC via the first network card. The message of the second VPC performs network function processing, and is used to perform network function processing on the message sent by the second VPC to the first VPC via the second network card. The method according to claim 5, wherein the network function processing includes one or any combination of network address translation (NAT), routing, and firewall filtering. A communication system, characterized by comprising a first virtual machine in a first VPC, a second virtual machine in a second VPC, and a bridge virtual machine; The first virtual machine is used to send a first message; The bridged virtual machine is configured to receive, from the first network card, a first message sent by a first virtual machine in the first VPC to a second virtual machine in a second VPC, and to respond to the first message Perform network function processing, and send the first packet processed by the network function to the second VPC through the second network card; The second virtual machine is configured to receive the first message processed by the network function from the bridge virtual machine. The system according to claim 7, wherein the first network card of the bridge virtual machine is set with a first private network address of the first VPC, and the second network card is set with a second private network address of the second VPC ； When the bridged virtual machine receives the first message sent from the first virtual machine in the first VPC to the second virtual machine in the second VPC from the first network card, it is specifically used to: The bridged virtual machine receives the first message from the first network card, and the source IP address of the first message is the private network address of the first virtual machine in the first VPC, and the destination IP The address is the first private network address; When the bridge virtual machine performs network function processing on the first message, and sends the first message processed by the network function to the second VPC through the second network card, it is specifically used for: The bridging virtual machine modifies the source IP address of the first message to the second private network address, and modifies the destination IP address of the first message to the second virtual machine in the second private network address. The private network address in the VPC sends the modified first message to the second VPC through the second network card. The system according to claim 7, wherein: When the bridged virtual machine receives the first message sent from the first virtual machine in the first VPC to the second virtual machine in the second VPC from the first network card, it is specifically used to: The bridged virtual machine receives the first message from the first network card, and the source IP address of the first message is the private network address of the first virtual machine in the first VPC, and the destination IP The address is the private network address of the second virtual machine in the second VPC; When the bridge virtual machine performs network function processing on the first message, and sends the first message processed by the network function to the second VPC through the second network card, it is specifically used for: The bridged virtual machine selects a second network card according to the destination IP address of the first message, and sends the first message to the second VPC through the second network card. The system according to any one of claims 7-9, wherein the bridge virtual machine performs network function processing on the first message, and uses the second network card to process the network function processed second message When a message is sent to the second VPC, it is specifically used for: The bridged virtual machine judges whether the first message conforms to a preset firewall rule, and if so, sends the first message processed by the network function to the second VPC through the second network card. A communication device, characterized in that it comprises a processor and a memory; The memory stores a computer program; The processor is configured to execute the computer program stored in the memory, so that the communication device implements the method according to any one of claims 1-4. A configuration device, characterized in that it comprises a processor and a memory; The memory stores a computer program; The processor is configured to execute the computer program stored in the memory, so that the configuration device implements the method according to any one of claims 5-6.

Images