MyVPC -10.2.0.0/16，公共子网10.2.20.0/27 子网A -10.2.2.0/27和子网B -10.2.4.0/27，每个子网都有一组实例。 我希望他们使用自定义LB端口访问（RDP），例如AWS-LB：33801
如果我在路由表中添加NAT网关，则无法从指定的前缀列表访问这些实例（IP）。如果我从路由表中删除nat-gw（server_route_table/desktop_route_table），那么我可以从前缀列表访问实例，但是未连接到Internet的实例provider "aws" {
region = var.region
}
# VPC
resource "aws_vpc" "main" {
cidr_block = "10.2.0.0/16"
enable_dns_support = true
enable_dns_hostnames = true
tags = {
Name = "test-vpc"
}
}
# Internet Gateway
resource "aws_internet_gateway" "main" {
vpc_id = aws_vpc.main.id
tags = {
Name = "test-internet-ateway"
}
}
# Subnets
resource "aws_subnet" "subnet_public" {
vpc_id = aws_vpc.main.id
cidr_block = "10.2.20.0/27"
availability_zone = "us-west-2a"
tags = {
Name = "test-public-subnet"
}
}
resource "aws_subnet" "subnet_servers" {
vpc_id = aws_vpc.main.id
cidr_block = "10.2.2.0/27"
availability_zone = "us-west-2a"
tags = {
Name = "test-server-subnet"
}
}
resource "aws_subnet" "subnet_desktops" {
vpc_id = aws_vpc.main.id
cidr_block = "10.2.4.0/27"
availability_zone = "us-west-2b"
tags = {
Name = "test-desktop-subnet"
}
}
# Route Table
resource "aws_route_table" "public_route_table" {
vpc_id = aws_vpc.main.id
route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.main.id
}
tags = {
Name = "test Main Route Table"
}
}
#elastic ip for NAT gateway
resource "aws_eip" "server_nat_eip" {
vpc = true
}
#NAT gateway
resource "aws_nat_gateway" "server_nat_gw" {
allocation_id = aws_eip.server_nat_eip.id
subnet_id = aws_subnet.subnet_public.id
tags = {
Name = "test-server-ngw"
}
}
resource "aws_eip" "desktop_nat_eip" {
vpc = true
}
resource "aws_nat_gateway" "desktop_nat_gw" {
allocation_id = aws_eip.desktop_nat_eip.id
subnet_id = aws_subnet.subnet_public.id
tags = {
Name = "test-desktop-ngw"
}
}
# Data block to reference the existing prefix list
data "aws_ec2_managed_prefix_list" "existing_prefix_list" {
id = "pl-xyz123"
}
# Route Table for Nat Gateway
resource "aws_route_table" "server_route_table" {
vpc_id = aws_vpc.main.id
route {
destination_prefix_list_id = data.aws_ec2_managed_prefix_list.existing_prefix_list.id
gateway_id = aws_internet_gateway.main.id
}
route {
cidr_block = "0.0.0.0/0"
nat_gateway_id= aws_nat_gateway.server_nat_gw.id
}
tags = {
Name = "test-server-internet-route"
}
}
resource "aws_route_table" "desktop_route_table" {
vpc_id = aws_vpc.main.id
route {
destination_prefix_list_id = data.aws_ec2_managed_prefix_list.existing_prefix_list.id
gateway_id = aws_internet_gateway.main.id
}
route {
cidr_block = "0.0.0.0/0"
nat_gateway_id= aws_nat_gateway.desktop_nat_gw.id
}
tags = {
Name = "test-desktop-internet-route"
}
}
# Route Table Associations for Servers and Desktops
resource "aws_route_table_association" "subnet_servers_association" {
subnet_id = aws_subnet.subnet_servers.id
route_table_id = aws_route_table.server_route_table.id
}
resource "aws_route_table_association" "subnet_desktops_association" {
subnet_id = aws_subnet.subnet_desktops.id
route_table_id = aws_route_table.desktop_route_table.id
}
resource "aws_route_table_association" "subnet_public_association" {
subnet_id = aws_subnet.subnet_public.id
route_table_id = aws_route_table.public_route_table.id
}
# Security Groups
resource "aws_security_group" "server-sg" {
name = "test-server-sg"
description = "Allow all traffic from server and desktop subnet"
vpc_id = aws_vpc.main.id
ingress {
description = "Allow all traffic from desktop and server subnet"
from_port = 0
to_port = 0
protocol = "-1" # -1 means all protocols
cidr_blocks = ["10.2.2.0/27", "10.2.4.0/27"]
}
# Allow RDP access from the load balancer or your IP
ingress {
description = "Allow RDP from Load Balancer"
from_port = 3389
to_port = 3389
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"] # Replace with your IP for security
}
# Allow traffic from NAT Gateway
ingress {
description = "Allow traffic from NAT Gateway"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["10.2.0.0/16"]
}
egress {
description = "Allow all outbound traffic"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = {
Name = "test-server-sg"
}
}
resource "aws_security_group" "desktop-sg" {
name = "test-desktop-sg"
description = "Allow all traffic from server and desktop subnet"
vpc_id = aws_vpc.main.id
ingress {
description = "Allow all traffic from desktop and server subnet"
from_port = 0
to_port = 0
protocol = "-1" # -1 means all protocols
cidr_blocks = ["10.2.2.0/27", "10.2.4.0/27"]
}
# Allow RDP access from the load balancer or your IP
ingress {
description = "Allow RDP from Load Balancer"
from_port = 3389
to_port = 3389
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"] # Restrict to trusted IPs.
}
# Allow traffic from NAT Gateway
ingress {
description = "Allow traffic from NAT Gateway"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["10.2.0.0/16"]
}
egress {
description = "Allow all outbound traffic"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = {
Name = "test-desktop-sg"
}
}
resource "aws_security_group" "lb_security_group" {
name = "test_lb_security_group"
description = "Allow RDP traffic for load balancer"
vpc_id = aws_vpc.main.id
# Allow custom RDP ports for Windows instances
ingress {
from_port = 33801
to_port = 33805
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
# Egress rule to allow all outbound traffic
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = {
Name = "test_lb_security_group"
}
}
# Load Balancer
resource "aws_lb" "rdp_lb" {
name = "test-rdp-lowin-balancer"
internal = false
lowin_balancer_type = "network"
security_groups = [aws_security_group.lb_security_group.id]
subnets = [aws_subnet.subnet_servers.id, aws_subnet.subnet_desktops.id]
enable_deletion_protection = false
tags = {
Name = "test RDP Load Balancer"
}
}
# Target Groups
resource "aws_lb_target_group" "rdp_tg_win_server" {
name = "win-server-tg"
port = 3389
protocol = "TCP"
vpc_id = aws_vpc.main.id
target_type = "instance"
tags = {
Name = "win-server-tg"
}
}
resource "aws_lb_target_group" "rdp_tg_win11_client" {
name = "win11-client-tg"
port = 3389
protocol = "TCP"
vpc_id = aws_vpc.main.id
target_type = "instance"
tags = {
Name = "win11-client-tg"
}
}
# Target Group Attachments
resource "aws_lb_target_group_attachment" "win_server_attachment" {
target_group_arn = aws_lb_target_group.rdp_tg_win_server.arn
target_id = aws_instance.win_server.id
port = 3389
}
resource "aws_lb_target_group_attachment" "win11_client_attachment" {
target_group_arn = aws_lb_target_group.rdp_tg_win11_client.arn
target_id = aws_instance.win11_client.id
port = 3389
}
# Listeners
resource "aws_lb_listener" "listener_33801" {
lowin_balancer_arn = aws_lb.rdp_lb.arn
port = 33801
protocol = "TCP"
default_action {
type = "forward"
target_group_arn = aws_lb_target_group.rdp_tg_win_server.arn
}
}
resource "aws_lb_listener" "listener_33803" {
lowin_balancer_arn = aws_lb.rdp_lb.arn
port = 33803
protocol = "TCP"
default_action {
type = "forward"
target_group_arn = aws_lb_target_group.rdp_tg_win11_client.arn
}
}
# Instances
resource "aws_instance" "win_server" {
ami = var.windows_server_ami
instance_type = var.instance_type
subnet_id = aws_subnet.subnet_servers.id
private_ip = "10.2.2.10"
vpc_security_group_ids = [aws_security_group.server-sg.id]
key_name = var.key_pair
tags = {
Name = "win-server"
Role = "Win Server"
}
}
resource "aws_instance" "win11_client" {
ami = var.windows_desktop_ami
instance_type = var.instance_type
subnet_id = aws_subnet.subnet_desktops.id
private_ip = "10.2.4.4"
vpc_security_group_ids = [aws_security_group.desktop-sg.id]
key_name = var.key_pair
tags = {
Name = "win11-client"
Role = "Windows 11 Client"
}
}
server_route_table通过Internet网关处理互联网流量的出口。 您需要删除路由到Internet网关的
desktop_route_tablepublic_route_tableserver_route_tabledesktop_route_table