配置 Networking服务目录配置 Networking服务1. 配置控制节点2. 控制节点配置公有网络3. 配置元数据代理4. 配置计算节点5. 验证操作在共有网络启动一台云主机1. 创建共有网络在网络上创建一个子网2. 创建只需要64 MB的m1.nano规格的主机3. 添加一个公共密钥到计算服务4. 添加安全组5. 启动云主机6. 排错步骤7. 验证云主机是否成功登录总结Networking 服务即 Neutron是 OpenStack 中负责网络资源管理的核心组件为云平台提供网络、子网、路由、安全组等虚拟网络能力。本节将演示如何在控制节点和计算节点上完成 Neutron 服务的安装与配置并验证各网络代理是否正常运行。1. 配置控制节点在控制节点上首先需要为 Neutron 创建数据库、服务账号、服务实体以及访问端点。以下命令依次完成这些基础准备工作。[rootcontroller ~]# mysql -p001003 Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 29 Server version: 10.1.20-MariaDB MariaDB Server Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others. Type help; or \h for help. Type \c to clear the current input statement. MariaDB [(none)] CREATE DATABASE neutron; Query OK, 1 row affected (0.00 sec) MariaDB [(none)] GRANT ALL PRIVILEGES ON neutron.* TO neutronlocalhost - IDENTIFIED BY neutron; Query OK, 0 rows affected (0.00 sec) MariaDB [(none)] GRANT ALL PRIVILEGES ON neutron.* TO neutron% - IDENTIFIED BY neutron; Query OK, 0 rows affected (0.00 sec) MariaDB [(none)] ^DBye数据库创建完成后接着创建 Neutron 服务账号并将其加入 service 项目下的 admin 角色以便后续管理操作具备相应权限。[rootcontroller ~]# source admin-openrc [rootcontroller ~]# openstack user create --domain default --password neutron neutron --------------------------------------------- | Field | Value | --------------------------------------------- | domain_id | 30e46230611e4fb7b152e1adf37f3200 | | enabled | True | | id | fb1cd7c10c684958a6991219ed2c109e | | name | neutron | --------------------------------------------- [rootcontroller ~]# openstack role add --project service --user neutron admin随后在 Keystone 中注册 Neutron 服务实体类型为 network用于标识网络服务。[rootcontroller ~]# openstack service create --name neutron \ --description OpenStack Networking network ----------------------------------------------- | Field | Value | ----------------------------------------------- | description | OpenStack Networking | | enabled | True | | id | 6bbf3bd2831d4994844f6165c01773bb | | name | neutron | | type | network | -----------------------------------------------最后为 Neutron 服务创建 public、internal、admin 三种类型的访问端点统一指向控制节点的 9696 端口。[rootcontroller ~]# openstack endpoint create --region RegionOne \ network public http://controller:9696 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | be559a5c3fb34826ae38e40fb77b7e39 | | interface | public | | region | RegionOne | | region_id | RegionOne | | service_id | 6bbf3bd2831d4994844f6165c01773bb | | service_name | neutron | | service_type | network | | url | http://controller:9696 | ------------------------------------------------ [rootcontroller ~]# openstack endpoint create --region RegionOne \ network internal http://controller:9696 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | 0f05ad05a2f942f9b75ee64d464de6ba | | interface | internal | | region | RegionOne | | region_id | RegionOne | | service_id | 6bbf3bd2831d4994844f6165c01773bb | | service_name | neutron | | service_type | network | | url | http://controller:9696 | ------------------------------------------------ [rootcontroller ~]# openstack endpoint create --region RegionOne \ network admin http://controller:9696 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | 722b112503c641e19840975654a6fbe4 | | interface | admin | | region | RegionOne | | region_id | RegionOne | | service_id | 6bbf3bd2831d4994844f6165c01773bb | | service_name | neutron | | service_type | network | | url | http://controller:9696 | ------------------------------------------------2. 控制节点配置公有网络完成基础准备后开始安装 Neutron 相关组件并配置核心服务、ML2 插件、Linux Bridge 代理以及 DHCP 代理。首先安装所需软件包。[rootcontroller ~]# yum install openstack-neutron openstack-neutron-ml2 \ openstack-neutron-linuxbridge ebtables [rootcontroller ~]# vim /etc/neutron/neutron.conf [DEFAULT] core_plugin ml2 service_plugins rpc_backend rabbit auth_strategy keystone notify_nova_on_port_status_changes True notify_nova_on_port_data_changes True [database] connection mysqlpymysql://neutron:neutroncontroller/neutron [keystone_authtoken] auth_uri http://controller:5000 auth_url http://controller:35357 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username neutron password neutron [nova] auth_url http://controller:35357 auth_type password project_domain_name default user_domain_name default region_name RegionOne project_name service username nova password nova [oslo_concurrency] lock_path /var/lib/neutron/tmp [oslo_messaging_rabbit] rabbit_host controller rabbit_userid openstack rabbit_password openstack接着配置 ML2 插件指定使用 flat 和 vlan 两种网络类型并启用 Linux Bridge 作为机制驱动。[rootcontroller ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini [ml2] type_drivers flat,vlan tenant_network_types mechanism_drivers linuxbridge extension_drivers port_security [ml2_type_flat] flat_networks provider [securitygroup] enable_ipset True配置 Linux Bridge 代理将物理网卡 eth1 映射到 provider 网络并关闭 VXLAN 隧道。[rootcontroller ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini [linux_bridge] physical_interface_mappings provider:eth1 [securitygroup] enable_security_group True firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver [vxlan] enable_vxlan False配置 DHCP 代理指定使用 Linux Bridge 接口驱动和 Dnsmasq 作为 DHCP 驱动。[rootcontroller ~]# vim /etc/neutron/dhcp_agent.ini [DEFAULT] interface_driver neutron.agent.linux.interface.BridgeInterfaceDriver dhcp_driver neutron.agent.linux.dhcp.Dnsmasq enable_isolated_metadata True3. 配置元数据代理元数据代理用于向云主机提供实例元数据服务。首先配置 metadata_agent指定 Nova 元数据服务地址和共享密钥。[rootcontroller ~]# vim /etc/neutron/metadata_agent.ini [DEFAULT] nova_metadata_ip controller metadata_proxy_shared_secret 001003然后在 Nova 配置中启用元数据代理并设置相同的共享密钥确保 Neutron 与 Nova 之间能够正常通信。[rootcontroller ~]# vim /etc/nova/nova.conf [neutron] url http://controller:9696 auth_url http://controller:35357 auth_type password project_domain_name default user_domain_name default region_name RegionOne project_name service username neutron password neutron service_metadata_proxy True metadata_proxy_shared_secret 001003配置完成后创建插件软链接并初始化 Neutron 数据库。[rootcontroller ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini [rootcontroller ~]# su -s /bin/sh -c neutron-db-manage --config-file /etc/neutron/neutron.conf \ --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head neutron ··· INFO [alembic.runtime.migration] Running upgrade 5ffceebfada - 4ffceebfcdc, standard_desc OK最后重启 Nova API 服务并启动 Neutron 的各个代理服务使其随系统开机自启。[rootcontroller ~]# systemctl restart openstack-nova-api.service [rootcontroller ~]# systemctl enable neutron-server.service \ neutron-linuxbridge-agent.service neutron-dhcp-agent.service \ neutron-metadata-agent.service [rootcontroller ~]# systemctl start neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service4. 配置计算节点在计算节点上需要安装 Linux Bridge 代理并配置 Neutron 与 Nova 的对接参数。首先安装所需软件包。[rootcomputer1 ~]# yum install openstack-neutron-linuxbridge ebtables ipset [rootcomputer1 ~]# vim /etc/neutron/neutron.conf [DEFAULT] rpc_backend rabbit [oslo_messaging_rabbit] rabbit_host controller rabbit_userid openstack rabbit_password openstack [DEFAULT] auth_strategy keystone [keystone_authtoken] auth_uri http://controller:5000 auth_url http://controller:35357 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username neutron password neutron [oslo_concurrency] lock_path /var/lib/neutron/tmp配置计算节点上的 Linux Bridge 代理同样将 eth1 映射到 provider 网络并关闭 VXLAN。[rootcomputer1 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini [linux_bridge] physical_interface_mappings provider:eth1 [vxlan] enable_vxlan False [securitygroup] enable_security_group True firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver在 Nova 配置中指定 Neutron 服务地址和认证信息使计算节点能够调用网络服务。[rootcomputer1 ~]# vim /etc/nova/nova.conf [neutron] url http://controller:9696 auth_url http://controller:35357 auth_type password project_domain_name default user_domain_name default region_name RegionOne project_name service username neutron password neutron重启 Nova Compute 服务并启动 Linux Bridge 代理。[rootcomputer1 ~]# systemctl restart openstack-nova-compute.service [rootcomputer1 ~]# systemctl enable neutron-linuxbridge-agent.service Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-linuxbridge-agent.service to /usr/lib/systemd/system/neu tron-linuxbridge-agent.service. [rootcomputer1 ~]# systemctl start neutron-linuxbridge-agent.service5. 验证操作配置完成后在控制节点上执行以下命令验证 Neutron 服务是否正常运行。首先查看已加载的扩展列表。[rootcontroller ~]# source admin-openrc [rootcontroller ~]# neutron ext-list -------------------------------------------------------------------------- | alias | name | -------------------------------------------------------------------------- | default-subnetpools | Default Subnetpools | | availability_zone | Availability Zone | | network_availability_zone | Network Availability Zone | | auto-allocated-topology | Auto Allocated Topology Services | | binding | Port Binding | | agent | agent | | subnet_allocation | Subnet Allocation | | dhcp_agent_scheduler | DHCP Agent Scheduler | | tag | Tag support | | external-net | Neutron external network | | net-mtu | Network MTU | | network-ip-availability | Network IP Availability | | quotas | Quota management support | | provider | Provider Network | | multi-provider | Multi Provider Network | | address-scope | Address scope | | timestamp_core | Time Stamp Fields addition for core resources | | extra_dhcp_opt | Neutron Extra DHCP opts | | security-group | security-group | | rbac-policies | RBAC Policies | | standard-attr-description | standard-attr-description | | port-security | Port Security | | allowed-address-pairs | Allowed Address Pairs | --------------------------------------------------------------------------接着查看各代理的运行状态确认 Linux Bridge、DHCP 和 Metadata 代理均已正常启动。[rootcontroller ~]# neutron agent-list ---------------------------------------------------------------------------------------------------------------------- | id | agent_type | host | availability_zone | alive | admin_state_up | binary | ---------------------------------------------------------------------------------------------------------------------- | 09523f56-6fe6-46ca- | Linux bridge agent | computer1 | | :-) | True | neutron-linuxbridge- | | 8c33-b2ed66e342d1 | | | | | | agent | | 92389b8c-7ca0-4d8e- | Linux bridge agent | controller | | :-) | True | neutron-linuxbridge- | | b7e8-ef2887696de5 | | | | | | agent | | b1f2f575-ff37-4eac- | DHCP agent | controller | nova | :-) | True | neutron-dhcp-agent | | b49e-05c71843460b | | | | | | | | d6a76c39-1482-47a5 | Metadata agent | controller | | :-) | True | neutron-metadata- | | -93ab-31fbb1228693 | | | | | | agent | ----------------------------------------------------------------------------------------------------------------------在共有网络启动一台云主机完成 Neutron 服务的安装与验证后本节将演示如何在共有网络provider 网络上启动一台云主机。整个过程包括创建网络、创建子网、定义规格、添加密钥、配置安全组以及最终启动实例下面按步骤逐一展开。1. 创建共有网络首先在控制节点上加载管理员环境变量然后创建一个名为 provider 的共有网络。这里使用 flat 网络类型并将物理网络映射为 provider同时设置 --shared 参数使该网络对所有项目可见。[rootcontroller ~]# source admin-openrc [rootcontroller ~]# neutron net-create --shared --provider:physical_network provider \ --provider:network_type flat provider Created a new network: ----------------------------------------------------------------- | Field | Value | ----------------------------------------------------------------- | admin_state_up | True | | availability_zone_hints | | | availability_zones | | | created_at | 2026-08-26T01:10:24 | | description | | | id | e27be31a-52cd-49cc-a701-a617e404fbe9 | | ipv4_address_scope | | | ipv6_address_scope | | | mtu | 1500 | | name | provider | | port_security_enabled | True | | provider:network_type | flat | | provider:physical_network | provider | | provider:segmentation_id | | | router:external | False | | shared | True | | status | ACTIVE | | subnets | | | tags | | | tenant_id | ec476ad6630045538f632b5b8c3f39fc | | updated_at | 2026-08-26T01:10:24 | -----------------------------------------------------------------网络创建成功后记录下返回的网络 IDe27be31a-52cd-49cc-a701-a617e404fbe9后续创建子网和启动云主机时都会用到。在网络上创建一个子网接下来为刚创建的 provider 网络添加一个子网。这里使用 192.168.223.0/24 网段分配地址池为 192.168.223.100 到 192.168.223.150指定网关为 192.168.223.2并配置 DNS 服务器为 114.114.114.114。[rootcontroller ~]# neutron subnet-create --name provider \ --allocation-pool start192.168.223.100,end192.168.223.150 \ --dns-nameserver 114.114.114.114 --gateway 192.168.223.2 \ provider 192.168.223.0/24 Created a new subnet: --------------------------------------------------------------------------- | Field | Value | --------------------------------------------------------------------------- | allocation_pools | {start: 192.168.223.100, end: 192.168.223.150} | | cidr | 192.168.223.0/24 | | created_at | 2026-08-26T01:13:04 | | description | | | dns_nameservers | 114.114.114.114 | | enable_dhcp | True | | gateway_ip | 192.168.223.2 | | host_routes | | | id | 743b7ce0-ae6a-413c-a273-c9c2a4839c36 | | ip_version | 4 | | ipv6_address_mode | | | ipv6_ra_mode | | | name | provider | | network_id | e27be31a-52cd-49cc-a701-a617e404fbe9 | | subnetpool_id | | | tenant_id | ec476ad6630045538f632b5b8c3f39fc | | updated_at | 2026-08-26T01:13:04 | ---------------------------------------------------------------------------子网创建完成后云主机即可通过 DHCP 从该地址池中自动获取 IP 地址。2. 创建只需要64 MB的m1.nano规格的主机由于测试环境资源有限这里创建一个名为 m1.nano 的最小规格分配 1 个 vCPU、64 MB 内存和 1 GB 磁盘足以运行轻量级的 Cirros 镜像。[rootcontroller ~]# openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano ------------------------------------- | Field | Value | ------------------------------------- | OS-FLV-DISABLED:disabled | False | | OS-FLV-EXT-DATA:ephemeral | 0 | | disk | 1 | | id | 0 | | name | m1.nano | | os-flavor-access:is_public | True | | ram | 64 | | rxtx_factor | 1.0 | | swap | | | vcpus | 1 | -------------------------------------规格创建成功后后续启动云主机时即可直接通过 --flavor m1.nano 引用该规格。3. 添加一个公共密钥到计算服务为了能够通过 SSH 免密登录云主机需要先生成一对密钥并将公钥上传到计算服务。这里切换到 demo 项目环境使用 ssh-keygen 生成密钥对然后通过 openstack keypair create 将公钥注册为 mykey。[rootcontroller ~]# source demo-openrc [rootcontroller ~]# ssh-keygen -q -N Enter file in which to save the key (/root/.ssh/id_rsa): [rootcontroller ~]# ls .ssh/ id_rsa id_rsa.pub known_hosts [rootcontroller ~]# openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey -------------------------------------------------------------- | Field | Value | -------------------------------------------------------------- | fingerprint | fb:63:fe:5a:ab:8a:b0:84:98:a8:3e:9f:dc:3d:1e:62 | | name | mykey | | user_id | 095770ae8de1491aa1d822bc3c302769 | -------------------------------------------------------------- 验证 [rootcontroller ~]# openstack keypair list -------------------------------------------------------- | Name | Fingerprint | -------------------------------------------------------- | mykey | fb:63:fe:5a:ab:8a:b0:84:98:a8:3e:9f:dc:3d:1e:62 | --------------------------------------------------------密钥添加成功后通过 keypair list 可以确认 mykey 已注册到计算服务中。4. 添加安全组安全组用于控制云主机的网络访问。这里为 default 安全组添加两条规则一条允许 ICMP 协议用于 ping 测试另一条允许 TCP 22 端口用于 SSH 登录。[rootcontroller ~]# openstack security group rule create --proto icmp default ------------------------------------------------------------- | Field | Value | ------------------------------------------------------------- | id | 65ee0069-78f4-4bcc-9e97-e21f9c884e63 | | ip_protocol | icmp | | ip_range | 0.0.0.0/0 | | parent_group_id | edf6e5ba-c550-4178-9a5a-872e2ce1081d | | port_range | | | remote_security_group | | -------------------------------------------------------------[rootcontroller ~]# openstack security group rule create --proto tcp --dst-port 22 default ------------------------------------------------------------- | Field | Value | ------------------------------------------------------------- | id | b8c0151d-b027-4cdc-8270-3d2dd7cbf132 | | ip_protocol | tcp | | ip_range | 0.0.0.0/0 | | parent_group_id | edf6e5ba-c550-4178-9a5a-872e2ce1081d | | port_range | 22:22 | | remote_security_group | | -------------------------------------------------------------两条规则添加完成后云主机即可响应 ICMP 请求并接受 SSH 连接。5. 启动云主机所有前置资源准备就绪后即可启动云主机。这里使用 m1.nano 规格、cirros 镜像指定网络 ID 为 e27be31a-52cd-49cc-a701-a617e404fbe9绑定 default 安全组和 mykey 密钥实例命名为 provider-instance。[rootcontroller ~]# openstack server create --flavor m1.nano --image cirros \ --nic net-ide27be31a-52cd-49cc-a701-a617e404fbe9 --security-group default --key-name mykey provider-instance ------------------------------------------------------------------------------------- | Field | Value | ------------------------------------------------------------------------------------- | OS-DCF:diskConfig | MANUAL | | OS-EXT-AZ:availability_zone | | | OS-EXT-STS:power_state | 0 | | OS-EXT-STS:task_state | scheduling | | OS-EXT-STS:vm_state | building | | OS-SRV-USG:launched_at | None | | OS-SRV-USG:terminated_at | None | | accessIPv4 | | | accessIPv6 | | | addresses | | | adminPass | KE2wqGR6ucnj | | config_drive | | | created | 2026-08-26T01:21:28Z | | flavor | m1.nano (0) | | hostId | | | id | 0a24d25e-df3e-4f5e-be37-c917768c4c3b | | image | cirros (d3dff337-1999-4c58-b07d-c899afb415c5) | | key_name | mykey | | name | provider-instance | | os-extended-volumes:volumes_attached | [] | | progress | 0 | | project_id | 6cb4b07252954ae48eeb6dea47df7acc | | properties | | | security_groups | [{uname: udefault}] | | status | BUILD | | updated | 2026-08-26T01:21:28Z | | user_id | 095770ae8de1491aa1d822bc3c302769 | ------------------------------------------------------------------------------------- [rootcontroller ~]# openstack server list ------------------------------------------------------------------------------------------- | ID | Name | Status | Networks | ------------------------------------------------------------------------------------------- | 0a24d25e-df3e-4f5e-be37-c917768c4c3b | provider-instance | ACTIVE | provider192.168.223.101 | ------------------------------------------------------------------------------------------- [rootcontroller ~]# openstack console url show provider-instance ---------------------------------------------------------------------------------------- | Field | Value | ---------------------------------------------------------------------------------------- | type | novnc | | url | http://controller:6080/vnc_auto.html?tokendaa76245-1c7d-41ef-a3cd-7061686c86c9 | ----------------------------------------------------------------------------------------实例创建成功后通过 server list 可以看到 provider-instance 状态为 ACTIVE并已从地址池中分配到 IP 192.168.223.101。随后通过 console url show 获取 VNC 控制台访问地址用于后续登录验证。报错由于使用的镜像是cirros-0.6.0-x86_64-disk.img版本所以云平台一直连接不上需要更换低版本的镜像具体步骤如下6. 排错步骤遇到上述报错时需要删除当前实例并更换为低版本的 Cirros 镜像。首先删除 provider-instance然后以管理员身份删除旧镜像并重新上传 cirros-0.3.4 版本。[rootcontroller ~]# openstack server delete provider-instance [rootcontroller ~]# openstack server list [rootcontroller ~]# source admin-openrc [rootcontroller ~]# openstack image list ------------------------------------------------------ | ID | Name | Status | ------------------------------------------------------ | d3dff337-1999-4c58-b07d-c899afb415c5 | cirros | active | ------------------------------------------------------ [rootcontroller ~]# openstack image delete cirros [rootcontroller ~]# rm -f cirros-0.6.0-x86_64-disk.img [rootcontroller ~]# ls admin-openrc anaconda-ks.cfg cirros-0.3.4-x86_64-disk.img demo-openrc mitaka mitaka.tar [rootcontroller ~]# openstack image create cirros --file cirros-0.3.4-x86_64-disk.img --disk-format qcow2 --container-format bare --public ------------------------------------------------------------------------ | Field | Value | ------------------------------------------------------------------------ | checksum | ee1eca47dc88f4879d8a229cc70a07c6 | | container_format | bare | | created_at | 2026-08-26T01:35:02Z | | disk_format | qcow2 | | file | /v2/images/c10a39be-0c16-4763-b3b3-167609a52be4/file | | id | c10a39be-0c16-4763-b3b3-167609a52be4 | | min_disk | 0 | | min_ram | 0 | | name | cirros | | owner | ec476ad6630045538f632b5b8c3f39fc | | protected | False | | schema | /v2/schemas/image | | size | 13287936 | | status | active | | tags | | | updated_at | 2026-08-26T01:35:02Z | | virtual_size | None | | visibility | public | ------------------------------------------------------------------------ [rootcontroller ~]# openstack image list ------------------------------------------------------ | ID | Name | Status | ------------------------------------------------------ | c10a39be-0c16-4763-b3b3-167609a52be4 | cirros | active | ------------------------------------------------------ [rootcontroller ~]# source demo-openrc [rootcontroller ~]# openstack server create --flavor m1.nano --image cirros --nic net-ide27be31a-52cd-49cc-a701-a617e404fbe9 --security-group default --key-name mykey provider-instance ------------------------------------------------------------------------------------- | Field | Value | ------------------------------------------------------------------------------------- | OS-DCF:diskConfig | MANUAL | | OS-EXT-AZ:availability_zone | | | OS-EXT-STS:power_state | 0 | | OS-EXT-STS:task_state | scheduling | | OS-EXT-STS:vm_state | building | | OS-SRV-USG:launched_at | None | | OS-SRV-USG:terminated_at | None | | accessIPv4 | | | accessIPv6 | | | addresses | | | adminPass | weqazJhHG6c5 | | config_drive | | | created | 2026-08-26T01:36:18Z | | flavor | m1.nano (0) | | hostId | | | id | 997c3206-a28c-4c02-bb2d-e8b3ecca9600 | | image | cirros (c10a39be-0c16-4763-b3b3-167609a52be4) | | key_name | mykey | | name | provider-instance | | os-extended-volumes:volumes_attached | [] | | progress | 0 | | project_id | 6cb4b07252954ae48eeb6dea47df7acc | | properties | | | security_groups | [{uname: udefault}] | | status | BUILD | | updated | 2026-08-26T01:36:18Z | | user_id | 095770ae8de1491aa1d822bc3c302769 | ------------------------------------------------------------------------------------- [rootcontroller ~]# openstack server list ------------------------------------------------------------------------------------------- | ID | Name | Status | Networks | ------------------------------------------------------------------------------------------- | 997c3206-a28c-4c02-bb2d-e8b3ecca9600 | provider-instance | ACTIVE | provider192.168.223.102 | ------------------------------------------------------------------------------------------- [rootcontroller ~]# openstack console url show provider-instance ---------------------------------------------------------------------------------------- | Field | Value | ---------------------------------------------------------------------------------------- | type | novnc | | url | http://controller:6080/vnc_auto.html?token89fc3182-a11e-4d5c-b65d-6d4227d0c8c5 | ----------------------------------------------------------------------------------------更换镜像后再次访问控制台输出的 URL 地址。由于该地址中的 controller 无法被解析需要将其替换为控制节点的 IP 地址后再访问。登录成功后使用页面提示的用户名和密码即可完成登录。7. 验证云主机是否成功登录通过 VNC 控制台成功登录云主机后还可以在控制节点上使用 SSH 直接连接云主机进行验证。由于之前已添加 mykey 密钥这里使用 cirros 用户登录 192.168.223.102。[rootcontroller ~]# ssh cirros192.168.223.102 The authenticity of host 192.168.223.102 (192.168.223.102) cant be established. RSA key fingerprint is SHA256:uVlyzsN4cSrzGiTtMUhLwqzxXWFUm4P2WsdnEfSQ. RSA key fingerprint is MD5:d5:41:29:29:ff:a9:dc:84:77:26:e7:90:55:db:7e:d2. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 192.168.223.102 (RSA) to the list of known hosts. $ ip a 1: lo: LOOPBACK,UP,LOWER_UP mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: BROADCAST,MULTICAST,UP,LOWER_UP mtu 1500 qdisc pfifo_fast qlen 1000 link/ether fa:16:3e:01:e1:78 brd ff:ff:ff:ff:ff:ff inet 192.168.223.102/24 brd 192.168.223.255 scope global eth0 inet6 fe80::f816:3eff:fe01:e178/64 scope link valid_lft forever preferred_lft forever $ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.223.2 0.0.0.0 UG 0 0 0 eth0 169.254.169.254 192.168.223.100 255.255.255.255 UGH 0 0 0 eth0 192.168.223.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0SSH 登录成功后通过 ip a 可以看到云主机已正确获取到 IP 地址 192.168.223.102通过 route -n 可以看到默认网关为 192.168.223.2说明网络配置正常云主机已成功接入共有网络。总结本文完整演示了 OpenStack 中 Neutron 网络服务的配置过程以及在共有网络上启动云主机的完整流程。在配置 Networking 服务部分依次完成了控制节点的数据库、服务账号、服务实体与访问端点创建随后配置了 ML2 插件、Linux Bridge 代理、DHCP 代理和元数据代理并在计算节点上完成对接配置最后通过扩展列表和代理状态验证了服务的正常运行。在共有网络启动云主机部分通过创建共有网络、添加子网、定义 m1.nano 规格、上传密钥、配置安全组等前置准备成功启动了 provider-instance 实例。针对镜像版本导致的连接问题通过更换为低版本 Cirros 镜像完成了排错并最终通过 VNC 控制台和 SSH 两种方式验证了云主机的正常登录与网络连通性。整体来看Neutron 服务的正确配置是云主机网络连通的基础而合理的镜像选择、密钥配置和安全组规则则是实例顺利启动与访问的关键保障。掌握上述流程后即可在 OpenStack 环境中灵活部署和管理基于公有网络的云主机实例。 OpenStack Neutron 网络服务配置与云主机启动实战
配置 Networking服务目录配置 Networking服务1. 配置控制节点2. 控制节点配置公有网络3. 配置元数据代理4. 配置计算节点5. 验证操作在共有网络启动一台云主机1. 创建共有网络在网络上创建一个子网2. 创建只需要64 MB的m1.nano规格的主机3. 添加一个公共密钥到计算服务4. 添加安全组5. 启动云主机6. 排错步骤7. 验证云主机是否成功登录总结Networking 服务即 Neutron是 OpenStack 中负责网络资源管理的核心组件为云平台提供网络、子网、路由、安全组等虚拟网络能力。本节将演示如何在控制节点和计算节点上完成 Neutron 服务的安装与配置并验证各网络代理是否正常运行。1. 配置控制节点在控制节点上首先需要为 Neutron 创建数据库、服务账号、服务实体以及访问端点。以下命令依次完成这些基础准备工作。[rootcontroller ~]# mysql -p001003 Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 29 Server version: 10.1.20-MariaDB MariaDB Server Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others. Type help; or \h for help. Type \c to clear the current input statement. MariaDB [(none)] CREATE DATABASE neutron; Query OK, 1 row affected (0.00 sec) MariaDB [(none)] GRANT ALL PRIVILEGES ON neutron.* TO neutronlocalhost - IDENTIFIED BY neutron; Query OK, 0 rows affected (0.00 sec) MariaDB [(none)] GRANT ALL PRIVILEGES ON neutron.* TO neutron% - IDENTIFIED BY neutron; Query OK, 0 rows affected (0.00 sec) MariaDB [(none)] ^DBye数据库创建完成后接着创建 Neutron 服务账号并将其加入 service 项目下的 admin 角色以便后续管理操作具备相应权限。[rootcontroller ~]# source admin-openrc [rootcontroller ~]# openstack user create --domain default --password neutron neutron --------------------------------------------- | Field | Value | --------------------------------------------- | domain_id | 30e46230611e4fb7b152e1adf37f3200 | | enabled | True | | id | fb1cd7c10c684958a6991219ed2c109e | | name | neutron | --------------------------------------------- [rootcontroller ~]# openstack role add --project service --user neutron admin随后在 Keystone 中注册 Neutron 服务实体类型为 network用于标识网络服务。[rootcontroller ~]# openstack service create --name neutron \ --description OpenStack Networking network ----------------------------------------------- | Field | Value | ----------------------------------------------- | description | OpenStack Networking | | enabled | True | | id | 6bbf3bd2831d4994844f6165c01773bb | | name | neutron | | type | network | -----------------------------------------------最后为 Neutron 服务创建 public、internal、admin 三种类型的访问端点统一指向控制节点的 9696 端口。[rootcontroller ~]# openstack endpoint create --region RegionOne \ network public http://controller:9696 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | be559a5c3fb34826ae38e40fb77b7e39 | | interface | public | | region | RegionOne | | region_id | RegionOne | | service_id | 6bbf3bd2831d4994844f6165c01773bb | | service_name | neutron | | service_type | network | | url | http://controller:9696 | ------------------------------------------------ [rootcontroller ~]# openstack endpoint create --region RegionOne \ network internal http://controller:9696 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | 0f05ad05a2f942f9b75ee64d464de6ba | | interface | internal | | region | RegionOne | | region_id | RegionOne | | service_id | 6bbf3bd2831d4994844f6165c01773bb | | service_name | neutron | | service_type | network | | url | http://controller:9696 | ------------------------------------------------ [rootcontroller ~]# openstack endpoint create --region RegionOne \ network admin http://controller:9696 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | 722b112503c641e19840975654a6fbe4 | | interface | admin | | region | RegionOne | | region_id | RegionOne | | service_id | 6bbf3bd2831d4994844f6165c01773bb | | service_name | neutron | | service_type | network | | url | http://controller:9696 | ------------------------------------------------2. 控制节点配置公有网络完成基础准备后开始安装 Neutron 相关组件并配置核心服务、ML2 插件、Linux Bridge 代理以及 DHCP 代理。首先安装所需软件包。[rootcontroller ~]# yum install openstack-neutron openstack-neutron-ml2 \ openstack-neutron-linuxbridge ebtables [rootcontroller ~]# vim /etc/neutron/neutron.conf [DEFAULT] core_plugin ml2 service_plugins rpc_backend rabbit auth_strategy keystone notify_nova_on_port_status_changes True notify_nova_on_port_data_changes True [database] connection mysqlpymysql://neutron:neutroncontroller/neutron [keystone_authtoken] auth_uri http://controller:5000 auth_url http://controller:35357 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username neutron password neutron [nova] auth_url http://controller:35357 auth_type password project_domain_name default user_domain_name default region_name RegionOne project_name service username nova password nova [oslo_concurrency] lock_path /var/lib/neutron/tmp [oslo_messaging_rabbit] rabbit_host controller rabbit_userid openstack rabbit_password openstack接着配置 ML2 插件指定使用 flat 和 vlan 两种网络类型并启用 Linux Bridge 作为机制驱动。[rootcontroller ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini [ml2] type_drivers flat,vlan tenant_network_types mechanism_drivers linuxbridge extension_drivers port_security [ml2_type_flat] flat_networks provider [securitygroup] enable_ipset True配置 Linux Bridge 代理将物理网卡 eth1 映射到 provider 网络并关闭 VXLAN 隧道。[rootcontroller ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini [linux_bridge] physical_interface_mappings provider:eth1 [securitygroup] enable_security_group True firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver [vxlan] enable_vxlan False配置 DHCP 代理指定使用 Linux Bridge 接口驱动和 Dnsmasq 作为 DHCP 驱动。[rootcontroller ~]# vim /etc/neutron/dhcp_agent.ini [DEFAULT] interface_driver neutron.agent.linux.interface.BridgeInterfaceDriver dhcp_driver neutron.agent.linux.dhcp.Dnsmasq enable_isolated_metadata True3. 配置元数据代理元数据代理用于向云主机提供实例元数据服务。首先配置 metadata_agent指定 Nova 元数据服务地址和共享密钥。[rootcontroller ~]# vim /etc/neutron/metadata_agent.ini [DEFAULT] nova_metadata_ip controller metadata_proxy_shared_secret 001003然后在 Nova 配置中启用元数据代理并设置相同的共享密钥确保 Neutron 与 Nova 之间能够正常通信。[rootcontroller ~]# vim /etc/nova/nova.conf [neutron] url http://controller:9696 auth_url http://controller:35357 auth_type password project_domain_name default user_domain_name default region_name RegionOne project_name service username neutron password neutron service_metadata_proxy True metadata_proxy_shared_secret 001003配置完成后创建插件软链接并初始化 Neutron 数据库。[rootcontroller ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini [rootcontroller ~]# su -s /bin/sh -c neutron-db-manage --config-file /etc/neutron/neutron.conf \ --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head neutron ··· INFO [alembic.runtime.migration] Running upgrade 5ffceebfada - 4ffceebfcdc, standard_desc OK最后重启 Nova API 服务并启动 Neutron 的各个代理服务使其随系统开机自启。[rootcontroller ~]# systemctl restart openstack-nova-api.service [rootcontroller ~]# systemctl enable neutron-server.service \ neutron-linuxbridge-agent.service neutron-dhcp-agent.service \ neutron-metadata-agent.service [rootcontroller ~]# systemctl start neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service4. 配置计算节点在计算节点上需要安装 Linux Bridge 代理并配置 Neutron 与 Nova 的对接参数。首先安装所需软件包。[rootcomputer1 ~]# yum install openstack-neutron-linuxbridge ebtables ipset [rootcomputer1 ~]# vim /etc/neutron/neutron.conf [DEFAULT] rpc_backend rabbit [oslo_messaging_rabbit] rabbit_host controller rabbit_userid openstack rabbit_password openstack [DEFAULT] auth_strategy keystone [keystone_authtoken] auth_uri http://controller:5000 auth_url http://controller:35357 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username neutron password neutron [oslo_concurrency] lock_path /var/lib/neutron/tmp配置计算节点上的 Linux Bridge 代理同样将 eth1 映射到 provider 网络并关闭 VXLAN。[rootcomputer1 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini [linux_bridge] physical_interface_mappings provider:eth1 [vxlan] enable_vxlan False [securitygroup] enable_security_group True firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver在 Nova 配置中指定 Neutron 服务地址和认证信息使计算节点能够调用网络服务。[rootcomputer1 ~]# vim /etc/nova/nova.conf [neutron] url http://controller:9696 auth_url http://controller:35357 auth_type password project_domain_name default user_domain_name default region_name RegionOne project_name service username neutron password neutron重启 Nova Compute 服务并启动 Linux Bridge 代理。[rootcomputer1 ~]# systemctl restart openstack-nova-compute.service [rootcomputer1 ~]# systemctl enable neutron-linuxbridge-agent.service Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-linuxbridge-agent.service to /usr/lib/systemd/system/neu tron-linuxbridge-agent.service. [rootcomputer1 ~]# systemctl start neutron-linuxbridge-agent.service5. 验证操作配置完成后在控制节点上执行以下命令验证 Neutron 服务是否正常运行。首先查看已加载的扩展列表。[rootcontroller ~]# source admin-openrc [rootcontroller ~]# neutron ext-list -------------------------------------------------------------------------- | alias | name | -------------------------------------------------------------------------- | default-subnetpools | Default Subnetpools | | availability_zone | Availability Zone | | network_availability_zone | Network Availability Zone | | auto-allocated-topology | Auto Allocated Topology Services | | binding | Port Binding | | agent | agent | | subnet_allocation | Subnet Allocation | | dhcp_agent_scheduler | DHCP Agent Scheduler | | tag | Tag support | | external-net | Neutron external network | | net-mtu | Network MTU | | network-ip-availability | Network IP Availability | | quotas | Quota management support | | provider | Provider Network | | multi-provider | Multi Provider Network | | address-scope | Address scope | | timestamp_core | Time Stamp Fields addition for core resources | | extra_dhcp_opt | Neutron Extra DHCP opts | | security-group | security-group | | rbac-policies | RBAC Policies | | standard-attr-description | standard-attr-description | | port-security | Port Security | | allowed-address-pairs | Allowed Address Pairs | --------------------------------------------------------------------------接着查看各代理的运行状态确认 Linux Bridge、DHCP 和 Metadata 代理均已正常启动。[rootcontroller ~]# neutron agent-list ---------------------------------------------------------------------------------------------------------------------- | id | agent_type | host | availability_zone | alive | admin_state_up | binary | ---------------------------------------------------------------------------------------------------------------------- | 09523f56-6fe6-46ca- | Linux bridge agent | computer1 | | :-) | True | neutron-linuxbridge- | | 8c33-b2ed66e342d1 | | | | | | agent | | 92389b8c-7ca0-4d8e- | Linux bridge agent | controller | | :-) | True | neutron-linuxbridge- | | b7e8-ef2887696de5 | | | | | | agent | | b1f2f575-ff37-4eac- | DHCP agent | controller | nova | :-) | True | neutron-dhcp-agent | | b49e-05c71843460b | | | | | | | | d6a76c39-1482-47a5 | Metadata agent | controller | | :-) | True | neutron-metadata- | | -93ab-31fbb1228693 | | | | | | agent | ----------------------------------------------------------------------------------------------------------------------在共有网络启动一台云主机完成 Neutron 服务的安装与验证后本节将演示如何在共有网络provider 网络上启动一台云主机。整个过程包括创建网络、创建子网、定义规格、添加密钥、配置安全组以及最终启动实例下面按步骤逐一展开。1. 创建共有网络首先在控制节点上加载管理员环境变量然后创建一个名为 provider 的共有网络。这里使用 flat 网络类型并将物理网络映射为 provider同时设置 --shared 参数使该网络对所有项目可见。[rootcontroller ~]# source admin-openrc [rootcontroller ~]# neutron net-create --shared --provider:physical_network provider \ --provider:network_type flat provider Created a new network: ----------------------------------------------------------------- | Field | Value | ----------------------------------------------------------------- | admin_state_up | True | | availability_zone_hints | | | availability_zones | | | created_at | 2026-08-26T01:10:24 | | description | | | id | e27be31a-52cd-49cc-a701-a617e404fbe9 | | ipv4_address_scope | | | ipv6_address_scope | | | mtu | 1500 | | name | provider | | port_security_enabled | True | | provider:network_type | flat | | provider:physical_network | provider | | provider:segmentation_id | | | router:external | False | | shared | True | | status | ACTIVE | | subnets | | | tags | | | tenant_id | ec476ad6630045538f632b5b8c3f39fc | | updated_at | 2026-08-26T01:10:24 | -----------------------------------------------------------------网络创建成功后记录下返回的网络 IDe27be31a-52cd-49cc-a701-a617e404fbe9后续创建子网和启动云主机时都会用到。在网络上创建一个子网接下来为刚创建的 provider 网络添加一个子网。这里使用 192.168.223.0/24 网段分配地址池为 192.168.223.100 到 192.168.223.150指定网关为 192.168.223.2并配置 DNS 服务器为 114.114.114.114。[rootcontroller ~]# neutron subnet-create --name provider \ --allocation-pool start192.168.223.100,end192.168.223.150 \ --dns-nameserver 114.114.114.114 --gateway 192.168.223.2 \ provider 192.168.223.0/24 Created a new subnet: --------------------------------------------------------------------------- | Field | Value | --------------------------------------------------------------------------- | allocation_pools | {start: 192.168.223.100, end: 192.168.223.150} | | cidr | 192.168.223.0/24 | | created_at | 2026-08-26T01:13:04 | | description | | | dns_nameservers | 114.114.114.114 | | enable_dhcp | True | | gateway_ip | 192.168.223.2 | | host_routes | | | id | 743b7ce0-ae6a-413c-a273-c9c2a4839c36 | | ip_version | 4 | | ipv6_address_mode | | | ipv6_ra_mode | | | name | provider | | network_id | e27be31a-52cd-49cc-a701-a617e404fbe9 | | subnetpool_id | | | tenant_id | ec476ad6630045538f632b5b8c3f39fc | | updated_at | 2026-08-26T01:13:04 | ---------------------------------------------------------------------------子网创建完成后云主机即可通过 DHCP 从该地址池中自动获取 IP 地址。2. 创建只需要64 MB的m1.nano规格的主机由于测试环境资源有限这里创建一个名为 m1.nano 的最小规格分配 1 个 vCPU、64 MB 内存和 1 GB 磁盘足以运行轻量级的 Cirros 镜像。[rootcontroller ~]# openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano ------------------------------------- | Field | Value | ------------------------------------- | OS-FLV-DISABLED:disabled | False | | OS-FLV-EXT-DATA:ephemeral | 0 | | disk | 1 | | id | 0 | | name | m1.nano | | os-flavor-access:is_public | True | | ram | 64 | | rxtx_factor | 1.0 | | swap | | | vcpus | 1 | -------------------------------------规格创建成功后后续启动云主机时即可直接通过 --flavor m1.nano 引用该规格。3. 添加一个公共密钥到计算服务为了能够通过 SSH 免密登录云主机需要先生成一对密钥并将公钥上传到计算服务。这里切换到 demo 项目环境使用 ssh-keygen 生成密钥对然后通过 openstack keypair create 将公钥注册为 mykey。[rootcontroller ~]# source demo-openrc [rootcontroller ~]# ssh-keygen -q -N Enter file in which to save the key (/root/.ssh/id_rsa): [rootcontroller ~]# ls .ssh/ id_rsa id_rsa.pub known_hosts [rootcontroller ~]# openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey -------------------------------------------------------------- | Field | Value | -------------------------------------------------------------- | fingerprint | fb:63:fe:5a:ab:8a:b0:84:98:a8:3e:9f:dc:3d:1e:62 | | name | mykey | | user_id | 095770ae8de1491aa1d822bc3c302769 | -------------------------------------------------------------- 验证 [rootcontroller ~]# openstack keypair list -------------------------------------------------------- | Name | Fingerprint | -------------------------------------------------------- | mykey | fb:63:fe:5a:ab:8a:b0:84:98:a8:3e:9f:dc:3d:1e:62 | --------------------------------------------------------密钥添加成功后通过 keypair list 可以确认 mykey 已注册到计算服务中。4. 添加安全组安全组用于控制云主机的网络访问。这里为 default 安全组添加两条规则一条允许 ICMP 协议用于 ping 测试另一条允许 TCP 22 端口用于 SSH 登录。[rootcontroller ~]# openstack security group rule create --proto icmp default ------------------------------------------------------------- | Field | Value | ------------------------------------------------------------- | id | 65ee0069-78f4-4bcc-9e97-e21f9c884e63 | | ip_protocol | icmp | | ip_range | 0.0.0.0/0 | | parent_group_id | edf6e5ba-c550-4178-9a5a-872e2ce1081d | | port_range | | | remote_security_group | | -------------------------------------------------------------[rootcontroller ~]# openstack security group rule create --proto tcp --dst-port 22 default ------------------------------------------------------------- | Field | Value | ------------------------------------------------------------- | id | b8c0151d-b027-4cdc-8270-3d2dd7cbf132 | | ip_protocol | tcp | | ip_range | 0.0.0.0/0 | | parent_group_id | edf6e5ba-c550-4178-9a5a-872e2ce1081d | | port_range | 22:22 | | remote_security_group | | -------------------------------------------------------------两条规则添加完成后云主机即可响应 ICMP 请求并接受 SSH 连接。5. 启动云主机所有前置资源准备就绪后即可启动云主机。这里使用 m1.nano 规格、cirros 镜像指定网络 ID 为 e27be31a-52cd-49cc-a701-a617e404fbe9绑定 default 安全组和 mykey 密钥实例命名为 provider-instance。[rootcontroller ~]# openstack server create --flavor m1.nano --image cirros \ --nic net-ide27be31a-52cd-49cc-a701-a617e404fbe9 --security-group default --key-name mykey provider-instance ------------------------------------------------------------------------------------- | Field | Value | ------------------------------------------------------------------------------------- | OS-DCF:diskConfig | MANUAL | | OS-EXT-AZ:availability_zone | | | OS-EXT-STS:power_state | 0 | | OS-EXT-STS:task_state | scheduling | | OS-EXT-STS:vm_state | building | | OS-SRV-USG:launched_at | None | | OS-SRV-USG:terminated_at | None | | accessIPv4 | | | accessIPv6 | | | addresses | | | adminPass | KE2wqGR6ucnj | | config_drive | | | created | 2026-08-26T01:21:28Z | | flavor | m1.nano (0) | | hostId | | | id | 0a24d25e-df3e-4f5e-be37-c917768c4c3b | | image | cirros (d3dff337-1999-4c58-b07d-c899afb415c5) | | key_name | mykey | | name | provider-instance | | os-extended-volumes:volumes_attached | [] | | progress | 0 | | project_id | 6cb4b07252954ae48eeb6dea47df7acc | | properties | | | security_groups | [{uname: udefault}] | | status | BUILD | | updated | 2026-08-26T01:21:28Z | | user_id | 095770ae8de1491aa1d822bc3c302769 | ------------------------------------------------------------------------------------- [rootcontroller ~]# openstack server list ------------------------------------------------------------------------------------------- | ID | Name | Status | Networks | ------------------------------------------------------------------------------------------- | 0a24d25e-df3e-4f5e-be37-c917768c4c3b | provider-instance | ACTIVE | provider192.168.223.101 | ------------------------------------------------------------------------------------------- [rootcontroller ~]# openstack console url show provider-instance ---------------------------------------------------------------------------------------- | Field | Value | ---------------------------------------------------------------------------------------- | type | novnc | | url | http://controller:6080/vnc_auto.html?tokendaa76245-1c7d-41ef-a3cd-7061686c86c9 | ----------------------------------------------------------------------------------------实例创建成功后通过 server list 可以看到 provider-instance 状态为 ACTIVE并已从地址池中分配到 IP 192.168.223.101。随后通过 console url show 获取 VNC 控制台访问地址用于后续登录验证。报错由于使用的镜像是cirros-0.6.0-x86_64-disk.img版本所以云平台一直连接不上需要更换低版本的镜像具体步骤如下6. 排错步骤遇到上述报错时需要删除当前实例并更换为低版本的 Cirros 镜像。首先删除 provider-instance然后以管理员身份删除旧镜像并重新上传 cirros-0.3.4 版本。[rootcontroller ~]# openstack server delete provider-instance [rootcontroller ~]# openstack server list [rootcontroller ~]# source admin-openrc [rootcontroller ~]# openstack image list ------------------------------------------------------ | ID | Name | Status | ------------------------------------------------------ | d3dff337-1999-4c58-b07d-c899afb415c5 | cirros | active | ------------------------------------------------------ [rootcontroller ~]# openstack image delete cirros [rootcontroller ~]# rm -f cirros-0.6.0-x86_64-disk.img [rootcontroller ~]# ls admin-openrc anaconda-ks.cfg cirros-0.3.4-x86_64-disk.img demo-openrc mitaka mitaka.tar [rootcontroller ~]# openstack image create cirros --file cirros-0.3.4-x86_64-disk.img --disk-format qcow2 --container-format bare --public ------------------------------------------------------------------------ | Field | Value | ------------------------------------------------------------------------ | checksum | ee1eca47dc88f4879d8a229cc70a07c6 | | container_format | bare | | created_at | 2026-08-26T01:35:02Z | | disk_format | qcow2 | | file | /v2/images/c10a39be-0c16-4763-b3b3-167609a52be4/file | | id | c10a39be-0c16-4763-b3b3-167609a52be4 | | min_disk | 0 | | min_ram | 0 | | name | cirros | | owner | ec476ad6630045538f632b5b8c3f39fc | | protected | False | | schema | /v2/schemas/image | | size | 13287936 | | status | active | | tags | | | updated_at | 2026-08-26T01:35:02Z | | virtual_size | None | | visibility | public | ------------------------------------------------------------------------ [rootcontroller ~]# openstack image list ------------------------------------------------------ | ID | Name | Status | ------------------------------------------------------ | c10a39be-0c16-4763-b3b3-167609a52be4 | cirros | active | ------------------------------------------------------ [rootcontroller ~]# source demo-openrc [rootcontroller ~]# openstack server create --flavor m1.nano --image cirros --nic net-ide27be31a-52cd-49cc-a701-a617e404fbe9 --security-group default --key-name mykey provider-instance ------------------------------------------------------------------------------------- | Field | Value | ------------------------------------------------------------------------------------- | OS-DCF:diskConfig | MANUAL | | OS-EXT-AZ:availability_zone | | | OS-EXT-STS:power_state | 0 | | OS-EXT-STS:task_state | scheduling | | OS-EXT-STS:vm_state | building | | OS-SRV-USG:launched_at | None | | OS-SRV-USG:terminated_at | None | | accessIPv4 | | | accessIPv6 | | | addresses | | | adminPass | weqazJhHG6c5 | | config_drive | | | created | 2026-08-26T01:36:18Z | | flavor | m1.nano (0) | | hostId | | | id | 997c3206-a28c-4c02-bb2d-e8b3ecca9600 | | image | cirros (c10a39be-0c16-4763-b3b3-167609a52be4) | | key_name | mykey | | name | provider-instance | | os-extended-volumes:volumes_attached | [] | | progress | 0 | | project_id | 6cb4b07252954ae48eeb6dea47df7acc | | properties | | | security_groups | [{uname: udefault}] | | status | BUILD | | updated | 2026-08-26T01:36:18Z | | user_id | 095770ae8de1491aa1d822bc3c302769 | ------------------------------------------------------------------------------------- [rootcontroller ~]# openstack server list ------------------------------------------------------------------------------------------- | ID | Name | Status | Networks | ------------------------------------------------------------------------------------------- | 997c3206-a28c-4c02-bb2d-e8b3ecca9600 | provider-instance | ACTIVE | provider192.168.223.102 | ------------------------------------------------------------------------------------------- [rootcontroller ~]# openstack console url show provider-instance ---------------------------------------------------------------------------------------- | Field | Value | ---------------------------------------------------------------------------------------- | type | novnc | | url | http://controller:6080/vnc_auto.html?token89fc3182-a11e-4d5c-b65d-6d4227d0c8c5 | ----------------------------------------------------------------------------------------更换镜像后再次访问控制台输出的 URL 地址。由于该地址中的 controller 无法被解析需要将其替换为控制节点的 IP 地址后再访问。登录成功后使用页面提示的用户名和密码即可完成登录。7. 验证云主机是否成功登录通过 VNC 控制台成功登录云主机后还可以在控制节点上使用 SSH 直接连接云主机进行验证。由于之前已添加 mykey 密钥这里使用 cirros 用户登录 192.168.223.102。[rootcontroller ~]# ssh cirros192.168.223.102 The authenticity of host 192.168.223.102 (192.168.223.102) cant be established. RSA key fingerprint is SHA256:uVlyzsN4cSrzGiTtMUhLwqzxXWFUm4P2WsdnEfSQ. RSA key fingerprint is MD5:d5:41:29:29:ff:a9:dc:84:77:26:e7:90:55:db:7e:d2. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 192.168.223.102 (RSA) to the list of known hosts. $ ip a 1: lo: LOOPBACK,UP,LOWER_UP mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: BROADCAST,MULTICAST,UP,LOWER_UP mtu 1500 qdisc pfifo_fast qlen 1000 link/ether fa:16:3e:01:e1:78 brd ff:ff:ff:ff:ff:ff inet 192.168.223.102/24 brd 192.168.223.255 scope global eth0 inet6 fe80::f816:3eff:fe01:e178/64 scope link valid_lft forever preferred_lft forever $ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.223.2 0.0.0.0 UG 0 0 0 eth0 169.254.169.254 192.168.223.100 255.255.255.255 UGH 0 0 0 eth0 192.168.223.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0SSH 登录成功后通过 ip a 可以看到云主机已正确获取到 IP 地址 192.168.223.102通过 route -n 可以看到默认网关为 192.168.223.2说明网络配置正常云主机已成功接入共有网络。总结本文完整演示了 OpenStack 中 Neutron 网络服务的配置过程以及在共有网络上启动云主机的完整流程。在配置 Networking 服务部分依次完成了控制节点的数据库、服务账号、服务实体与访问端点创建随后配置了 ML2 插件、Linux Bridge 代理、DHCP 代理和元数据代理并在计算节点上完成对接配置最后通过扩展列表和代理状态验证了服务的正常运行。在共有网络启动云主机部分通过创建共有网络、添加子网、定义 m1.nano 规格、上传密钥、配置安全组等前置准备成功启动了 provider-instance 实例。针对镜像版本导致的连接问题通过更换为低版本 Cirros 镜像完成了排错并最终通过 VNC 控制台和 SSH 两种方式验证了云主机的正常登录与网络连通性。整体来看Neutron 服务的正确配置是云主机网络连通的基础而合理的镜像选择、密钥配置和安全组规则则是实例顺利启动与访问的关键保障。掌握上述流程后即可在 OpenStack 环境中灵活部署和管理基于公有网络的云主机实例。