1 Networking 服务配置1.1 控制节点配置1.1.1 创建数据库、服务凭证和API端点创建neutron数据库授予合适的访问权限[rootcontroller ~]# mysql -p123456# 用数据库连接客户端以 root 用户连接到数据库服务器MariaDB[(none)]CREATE DATABASE neutron;# 创建数据库MariaDB[(none)]GRANT ALL PRIVILEGES ON neutron.* TOneutronlocalhostIDENTIFIED BYneutron;# 对数据库授予访问权限设置密码与用户名相同MariaDB[(none)]GRANT ALL PRIVILEGES ON neutron.* TOneutron%IDENTIFIED BYneutron;# 允许所有主机远程访问 neutron 库设置密码与用户名相同MariaDB[(none)]quit创建neutron用户[rootcontroller ~]# openstack user create --domain default --password neutron neutron添加admin角色到neutron用户[rootcontroller ~]# openstack role add --project service --user neutron admin创建neutron服务实体[rootcontroller ~]# openstack service create --name neutron --description OpenStack Networking network创建网络服务 API 端点[rootcontroller ~]# openstack endpoint create --region RegionOne network public http://controller:9696[rootcontroller ~]# openstack endpoint create --region RegionOne network internal http://controller:9696[rootcontroller ~]# openstack endpoint create --region RegionOne network admin http://controller:96961.1.2 配置公共网络安装网络组件[rootcontroller ~]# yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables配置服务组件[rootcontroller ~]# vim /etc/neutron/neutron.conf[database] ... connection mysqlpymysql://neutron:neutroncontroller/neutron [DEFAULT] ... core_plugin ml2 service_plugins rpc_backend rabbit auth_strategy keystone notify_nova_on_port_status_changes True notify_nova_on_port_data_changes True [oslo_messaging_rabbit] ... rabbit_host controller rabbit_userid openstack rabbit_password openstack [keystone_authtoken] ... auth_uri http://controller:5000 auth_url http://controller:35357 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username neutron password neutron [nova] ... auth_url http://controller:35357 auth_type password project_domain_name default user_domain_name default region_name RegionOne project_name service username nova password nova [oslo_concurrency] ... lock_path /var/lib/neutron/tmp配置 Modular Layer 2 (ML2) 插件[rootcontroller ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini[ml2] ... type_drivers flat,vlan tenant_network_types mechanism_drivers linuxbridge extension_drivers port_security [ml2_type_flat] ... flat_networks provider [securitygroup] ... enable_ipset True配置 Linuxbridge 代理[rootcontroller ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini[linux_bridge] physical_interface_mappings provider:eth1 [vxlan] enable_vxlan False [securitygroup] ... enable_security_group True firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver配置 DHCP 代理[rootcontroller ~]# vim /etc/neutron/dhcp_agent.ini[DEFAULT] ... interface_driver neutron.agent.linux.interface.BridgeInterfaceDriver dhcp_driver neutron.agent.linux.dhcp.Dnsmasq enable_isolated_metadata True1.1.3 配置元数据代理[rootcontroller ~]# vim /etc/neutron/metadata_agent.ini[DEFAULT] ... nova_metadata_ip controller metadata_proxy_shared_secret westos # 此密码为自定义稍后部署会用到1.1.4 为计算节点配置网络服务[rootcontroller ~]# vim /etc/nova/nova.conf[neutron] ... url http://controller:9696 auth_url http://controller:35357 auth_type password project_domain_name default user_domain_name default region_name RegionOne project_name service username neutron password neutron service_metadata_proxy True metadata_proxy_shared_secret westos # 此密码是在上一步中自定义的密码网络服务初始化脚本需要一个超链接/etc/neutron/plugin.ini指向ML2插件配置文件/etc/neutron/plugins/ml2/ml2_conf.ini[rootcontroller ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini同步数据库[rootcontroller ~]# su -s /bin/sh -c neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head neutron重启服务[rootcontroller ~]# systemctl restart openstack-nova-api.service[rootcontroller ~]# systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service[rootcontroller ~]# systemctl start neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service验证[rootcontroller ~]# neutron ext-list[rootcontroller ~]# neutron agent-list1.2 计算节点配置1.2.1 安装并配置通用组件[rootcompute1 ~]# yum install openstack-neutron-linuxbridge ebtables ipset[rootcompute1 ~]# vim /etc/neutron/neutron.conf[DEFAULT] ... rpc_backend rabbit auth_strategy keystone [oslo_messaging_rabbit] ... rabbit_host controller rabbit_userid openstack rabbit_password openstack [keystone_authtoken] ... auth_uri http://controller:5000 auth_url http://controller:35357 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username neutron password neutron [oslo_concurrency] ... lock_path /var/lib/neutron/tmp1.2.2 配置公共网络配置 Linuxbridge 代理[rootcompute1 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini[linux_bridge] physical_interface_mappings provider:eth1 [vxlan] enable_vxlan False [securitygroup] ... enable_security_group True firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver1.2.3 为计算节点配置网络服务[rootcompute1 ~]# vim /etc/nova/nova.conf[neutron] ... url http://controller:9696 auth_url http://controller:35357 auth_type password project_domain_name default user_domain_name default region_name RegionOne project_name service username neutron password neutron重启计算服务启动 Linuxbridge 代理并配置它开机自启动[rootcompute1 ~]# systemctl restart openstack-nova-compute.service[rootcompute1 ~]# systemctl enable neutron-linuxbridge-agent.service[rootcompute1 ~]# systemctl start neutron-linuxbridge-agent.service2 启动一个实例2.1 创建虚拟网络创建提供者网络[rootcontroller ~]# neutron net-create --shared --provider:physical_network provider --provider:network_type flat provider在网络上创建一个子网[rootcontroller ~]# neutron subnet-create --name provider \--allocation-poolstart192.168.40.100,end192.168.40.150\--dns-nameserver114.114.114.114--gateway192.168.40.2\provider192.168.40.0/242.2 创建 m1.nano 规格的主机[rootcontroller ~]# openstack flavor list[rootcontroller ~]# openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano2.3 生成一个键值对导入租户demo的凭证生成和添加秘钥对[rootcontroller ~]# . demo-openrc[rootcontroller ~]# ssh-keygen -q -N [rootcontroller ~]# openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey验证公钥的添加[rootcontroller ~]# openstack keypair list2.4 增加安全组规则[rootcontroller ~]# openstack security group rule create --proto icmp default[rootcontroller ~]# openstack security group rule create --proto tcp --dst-port 22 default2.5 创建实例确定实例选项[rootcontroller ~]# . demo-openrc[rootcontroller ~]# openstack flavor list[rootcontroller ~]# openstack image list[rootcontroller ~]# openstack network list[rootcontroller ~]# openstack security group list创建并启动实例[rootcontroller ~]# openstack server create --flavor m1.nano --image cirros --nic net-id3b8fe504-9c01-4f54-a60e-0fda4e80f7a8 --security-group default --key-name mykey provider-instance查看实例状态[rootcontroller ~]# openstack server list获取实例的 Virtual Network Computing (VNC) 会话URL并从web浏览器访问它[rootcontroller ~]# openstack console url show provider-instance访问网址http://controller:6080/vnc_auto.html?tokenea8b8a4f-066c-4f1c-a951-3af0243eb8a6其中的 controller 替换为IP地址用指定的用户名和密码登录即可测试远程登录[rootcontroller ~]# ssh cirros192.168.40.1013 Dashboard3.1 安装并配置组件[rootcontroller ~]# yum install openstack-dashboard[rootcontroller ~]# vim /etc/openstack-dashboard/local_settingsOPENSTACK_HOST controller ALLOWED_HOSTS [*, ] SESSION_ENGINE django.contrib.sessions.backends.cache CACHES { default: { BACKEND: django.core.cache.backends.memcached.MemcachedCache, LOCATION: controller:11211, } } OPENSTACK_KEYSTONE_URL http://%s:5000/v3 % OPENSTACK_HOST OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT True OPENSTACK_API_VERSIONS { identity: 3, image: 2, volume: 2, } OPENSTACK_KEYSTONE_DEFAULT_DOMAIN default OPENSTACK_KEYSTONE_DEFAULT_ROLE user OPENSTACK_NEUTRON_NETWORK { ... enable_router: False, enable_quotas: False, enable_distributed_router: False, enable_ha_router: False, enable_lb: False, enable_firewall: False, enable_vpn: False, enable_fip_topology_check: False, } TIME_ZONE Asia/Shanghai重启 web 服务器以及会话存储服务[rootcontroller ~]# systemctl restart httpd.service memcached.service3.2 前端页面操作访问http://192.168.40.161/dashboard管理员身份登录用户名和密码都是 admin可以看到各类信息登录普通用户 demo用户名与密码相同管理员创建的共享网络普通用户云主机占用必须要删除云主机才能删除网络删除云主机登录 admin记住供应商的信息删除子网删除网络重新创建网络信息与供应商信息保持一致创建成功后点进 provider创建子网创建成功除此之外云主机类型和镜像等都可以自行创建登录demo批量创建云主机启动实例验证远程连接也没问题 
长河君 · 2026/8/28 6:30:05 · 阅读 1.2k OpenStack 私有云实战 3—— Neutron 网络服务与 Dashboard 控制台部署
1 Networking 服务配置1.1 控制节点配置1.1.1 创建数据库、服务凭证和API端点创建neutron数据库授予合适的访问权限[rootcontroller ~]# mysql -p123456# 用数据库连接客户端以 root 用户连接到数据库服务器MariaDB[(none)]CREATE DATABASE neutron;# 创建数据库MariaDB[(none)]GRANT ALL PRIVILEGES ON neutron.* TOneutronlocalhostIDENTIFIED BYneutron;# 对数据库授予访问权限设置密码与用户名相同MariaDB[(none)]GRANT ALL PRIVILEGES ON neutron.* TOneutron%IDENTIFIED BYneutron;# 允许所有主机远程访问 neutron 库设置密码与用户名相同MariaDB[(none)]quit创建neutron用户[rootcontroller ~]# openstack user create --domain default --password neutron neutron添加admin角色到neutron用户[rootcontroller ~]# openstack role add --project service --user neutron admin创建neutron服务实体[rootcontroller ~]# openstack service create --name neutron --description OpenStack Networking network创建网络服务 API 端点[rootcontroller ~]# openstack endpoint create --region RegionOne network public http://controller:9696[rootcontroller ~]# openstack endpoint create --region RegionOne network internal http://controller:9696[rootcontroller ~]# openstack endpoint create --region RegionOne network admin http://controller:96961.1.2 配置公共网络安装网络组件[rootcontroller ~]# yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables配置服务组件[rootcontroller ~]# vim /etc/neutron/neutron.conf[database] ... connection mysqlpymysql://neutron:neutroncontroller/neutron [DEFAULT] ... core_plugin ml2 service_plugins rpc_backend rabbit auth_strategy keystone notify_nova_on_port_status_changes True notify_nova_on_port_data_changes True [oslo_messaging_rabbit] ... rabbit_host controller rabbit_userid openstack rabbit_password openstack [keystone_authtoken] ... auth_uri http://controller:5000 auth_url http://controller:35357 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username neutron password neutron [nova] ... auth_url http://controller:35357 auth_type password project_domain_name default user_domain_name default region_name RegionOne project_name service username nova password nova [oslo_concurrency] ... lock_path /var/lib/neutron/tmp配置 Modular Layer 2 (ML2) 插件[rootcontroller ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini[ml2] ... type_drivers flat,vlan tenant_network_types mechanism_drivers linuxbridge extension_drivers port_security [ml2_type_flat] ... flat_networks provider [securitygroup] ... enable_ipset True配置 Linuxbridge 代理[rootcontroller ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini[linux_bridge] physical_interface_mappings provider:eth1 [vxlan] enable_vxlan False [securitygroup] ... enable_security_group True firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver配置 DHCP 代理[rootcontroller ~]# vim /etc/neutron/dhcp_agent.ini[DEFAULT] ... interface_driver neutron.agent.linux.interface.BridgeInterfaceDriver dhcp_driver neutron.agent.linux.dhcp.Dnsmasq enable_isolated_metadata True1.1.3 配置元数据代理[rootcontroller ~]# vim /etc/neutron/metadata_agent.ini[DEFAULT] ... nova_metadata_ip controller metadata_proxy_shared_secret westos # 此密码为自定义稍后部署会用到1.1.4 为计算节点配置网络服务[rootcontroller ~]# vim /etc/nova/nova.conf[neutron] ... url http://controller:9696 auth_url http://controller:35357 auth_type password project_domain_name default user_domain_name default region_name RegionOne project_name service username neutron password neutron service_metadata_proxy True metadata_proxy_shared_secret westos # 此密码是在上一步中自定义的密码网络服务初始化脚本需要一个超链接/etc/neutron/plugin.ini指向ML2插件配置文件/etc/neutron/plugins/ml2/ml2_conf.ini[rootcontroller ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini同步数据库[rootcontroller ~]# su -s /bin/sh -c neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head neutron重启服务[rootcontroller ~]# systemctl restart openstack-nova-api.service[rootcontroller ~]# systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service[rootcontroller ~]# systemctl start neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service验证[rootcontroller ~]# neutron ext-list[rootcontroller ~]# neutron agent-list1.2 计算节点配置1.2.1 安装并配置通用组件[rootcompute1 ~]# yum install openstack-neutron-linuxbridge ebtables ipset[rootcompute1 ~]# vim /etc/neutron/neutron.conf[DEFAULT] ... rpc_backend rabbit auth_strategy keystone [oslo_messaging_rabbit] ... rabbit_host controller rabbit_userid openstack rabbit_password openstack [keystone_authtoken] ... auth_uri http://controller:5000 auth_url http://controller:35357 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username neutron password neutron [oslo_concurrency] ... lock_path /var/lib/neutron/tmp1.2.2 配置公共网络配置 Linuxbridge 代理[rootcompute1 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini[linux_bridge] physical_interface_mappings provider:eth1 [vxlan] enable_vxlan False [securitygroup] ... enable_security_group True firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver1.2.3 为计算节点配置网络服务[rootcompute1 ~]# vim /etc/nova/nova.conf[neutron] ... url http://controller:9696 auth_url http://controller:35357 auth_type password project_domain_name default user_domain_name default region_name RegionOne project_name service username neutron password neutron重启计算服务启动 Linuxbridge 代理并配置它开机自启动[rootcompute1 ~]# systemctl restart openstack-nova-compute.service[rootcompute1 ~]# systemctl enable neutron-linuxbridge-agent.service[rootcompute1 ~]# systemctl start neutron-linuxbridge-agent.service2 启动一个实例2.1 创建虚拟网络创建提供者网络[rootcontroller ~]# neutron net-create --shared --provider:physical_network provider --provider:network_type flat provider在网络上创建一个子网[rootcontroller ~]# neutron subnet-create --name provider \--allocation-poolstart192.168.40.100,end192.168.40.150\--dns-nameserver114.114.114.114--gateway192.168.40.2\provider192.168.40.0/242.2 创建 m1.nano 规格的主机[rootcontroller ~]# openstack flavor list[rootcontroller ~]# openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano2.3 生成一个键值对导入租户demo的凭证生成和添加秘钥对[rootcontroller ~]# . demo-openrc[rootcontroller ~]# ssh-keygen -q -N [rootcontroller ~]# openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey验证公钥的添加[rootcontroller ~]# openstack keypair list2.4 增加安全组规则[rootcontroller ~]# openstack security group rule create --proto icmp default[rootcontroller ~]# openstack security group rule create --proto tcp --dst-port 22 default2.5 创建实例确定实例选项[rootcontroller ~]# . demo-openrc[rootcontroller ~]# openstack flavor list[rootcontroller ~]# openstack image list[rootcontroller ~]# openstack network list[rootcontroller ~]# openstack security group list创建并启动实例[rootcontroller ~]# openstack server create --flavor m1.nano --image cirros --nic net-id3b8fe504-9c01-4f54-a60e-0fda4e80f7a8 --security-group default --key-name mykey provider-instance查看实例状态[rootcontroller ~]# openstack server list获取实例的 Virtual Network Computing (VNC) 会话URL并从web浏览器访问它[rootcontroller ~]# openstack console url show provider-instance访问网址http://controller:6080/vnc_auto.html?tokenea8b8a4f-066c-4f1c-a951-3af0243eb8a6其中的 controller 替换为IP地址用指定的用户名和密码登录即可测试远程登录[rootcontroller ~]# ssh cirros192.168.40.1013 Dashboard3.1 安装并配置组件[rootcontroller ~]# yum install openstack-dashboard[rootcontroller ~]# vim /etc/openstack-dashboard/local_settingsOPENSTACK_HOST controller ALLOWED_HOSTS [*, ] SESSION_ENGINE django.contrib.sessions.backends.cache CACHES { default: { BACKEND: django.core.cache.backends.memcached.MemcachedCache, LOCATION: controller:11211, } } OPENSTACK_KEYSTONE_URL http://%s:5000/v3 % OPENSTACK_HOST OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT True OPENSTACK_API_VERSIONS { identity: 3, image: 2, volume: 2, } OPENSTACK_KEYSTONE_DEFAULT_DOMAIN default OPENSTACK_KEYSTONE_DEFAULT_ROLE user OPENSTACK_NEUTRON_NETWORK { ... enable_router: False, enable_quotas: False, enable_distributed_router: False, enable_ha_router: False, enable_lb: False, enable_firewall: False, enable_vpn: False, enable_fip_topology_check: False, } TIME_ZONE Asia/Shanghai重启 web 服务器以及会话存储服务[rootcontroller ~]# systemctl restart httpd.service memcached.service3.2 前端页面操作访问http://192.168.40.161/dashboard管理员身份登录用户名和密码都是 admin可以看到各类信息登录普通用户 demo用户名与密码相同管理员创建的共享网络普通用户云主机占用必须要删除云主机才能删除网络删除云主机登录 admin记住供应商的信息删除子网删除网络重新创建网络信息与供应商信息保持一致创建成功后点进 provider创建子网创建成功除此之外云主机类型和镜像等都可以自行创建登录demo批量创建云主机启动实例验证远程连接也没问题