Google VM无法通过REST API接收响应的网络问题求助

问题 #

我有一台Google VM，运行以下Python代码调用REST API时出错，浏览器访问该URL提示问题在我方。

代码：

import requests
# response = requests.get("http://palmetto.aksw.org/palmetto-webapp/service/cp?words=cake%20apple%20banana%20cherry%20chocolate")
response = requests.get("http://palmetto.aksw.org/palmetto-webapp/service/calculate?coherence=cp&words=cake%20apple%20banana%20cherry%20chocolate")

报错信息：

---------------------------------------------------------------------------
OSError                                   Traceback (most recent call last)
File /usr/local/lib/python3.8/site-packages/urllib3/connection.py:174, in HTTPConnection._new_conn(self)
    173 try:
--> 174     conn = connection.create_connection(
    175         (self._dns_host, self.port), self.timeout, **extra_kw
    176     )
    178 except SocketTimeout:

File /usr/local/lib/python3.8/site-packages/urllib3/util/connection.py:95, in create_connection(address, timeout, source_address, socket_options)
     94 if err is not None:
---> 95     raise err
     97 raise socket.error("getaddrinfo returns an empty list")

File /usr/local/lib/python3.8/site-packages/urllib3/util/connection.py:85, in create_connection(address, timeout, source_address, socket_options)
     84     sock.bind(source_address)
---> 85 sock.connect(sa)
     86 return sock

OSError: [Errno 101] Network is unreachable

During handling of the above exception, another exception occurred:

NewConnectionError                        Traceback (most recent call last)
File /usr/local/lib/python3.8/site-packages/urllib3/connectionpool.py:703, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, **response_kw)
    702 # Make the request on the httplib connection object.
--> 703 httplib_response = self._make_request(
    704     conn,
    705     method,
    706     url,
    707     timeout=timeout_obj,
    708     body=body,
    709     headers=headers,
    710     chunked=chunked,
    711 )
    713 # If we're going to release the connection in ``finally:``, then
    714 # the response doesn't need to know about the connection. Otherwise
    715 # it will also try to release it and we'll have a double-release
    716 # mess.

File /usr/local/lib/python3.8/site-packages/urllib3/connectionpool.py:398, in HTTPConnectionPool._make_request(self, conn, method, url, timeout, chunked, **httplib_request_kw)
    397     else:
--> 398         conn.request(method, url, **httplib_request_kw)
    400 # We are swallowing BrokenPipeError (errno.EPIPE) since the server is
    401 # legitimately able to close the connection after sending a valid response.
    402 # With this behaviour, the received response is still readable.

File /usr/local/lib/python3.8/site-packages/urllib3/connection.py:239, in HTTPConnection.request(self, method, url, body, headers)
    238     headers["User-Agent"] = _get_default_user_agent()
--> 239 super(HTTPConnection, self).request(method, url, body=body, headers=headers)

File /usr/local/lib/python3.8/http/client.py:1240, in HTTPConnection.request(self, method, url, body, headers, encode_chunked)
   1239 """Send a complete request to the server."""
-> 1240 self._send_request(method, url, body, headers, encode_chunked)

File /usr/local/lib/python3.8/http/client.py:1286, in HTTPConnection._send_request(self, method, url, body, headers, encode_chunked)
   1285     body = _encode(body, 'body')
-> 1286 self.endheaders(body, encode_chunked=encode_chunked)

File /usr/local/lib/python3.8/http/client.py:1235, in HTTPConnection.endheaders(self, message_body, encode_chunked)
   1234     raise CannotSendHeader()
-> 1235 self._send_output(message_body, encode_chunked=encode_chunked)

File /usr/local/lib/python3.8/http/client.py:1006, in HTTPConnection._send_output(self, message_body, encode_chunked)
   1005 del self._buffer[:]
-> 1006 self.send(msg)
   1008 if message_body is not None:
   1009 
   1010     # create a consistent interface to message_body

File /usr/local/lib/python3.8/http/client.py:946, in HTTPConnection.send(self, data)
    945 if self.auto_open:
-> 946     self.connect()
    947 else:

File /usr/local/lib/python3.8/site-packages/urllib3/connection.py:205, in HTTPConnection.connect(self)
    204 def connect(self):
-> 205     conn = self._new_conn()
    206     self._prepare_conn(conn)

File /usr/local/lib/python3.8/site-packages/urllib3/connection.py:186, in HTTPConnection._new_conn(self)
    185 except SocketError as e:
--> 186     raise NewConnectionError(
    187         self, "Failed to establish a new connection: %s" % e
    188     )
    190 return conn

NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f847d936190>: Failed to establish a new connection: [Errno 101] Network is unreachable

During handling of the above exception, another exception occurred:

MaxRetryError                             Traceback (most recent call last)
File /usr/local/lib/python3.8/site-packages/requests/adapters.py:489, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies)
    488 if not chunked:
--> 489     resp = conn.urlopen(
    490         method=request.method,
    491         url=url,
    492         body=request.body,
    493         headers=request.headers,
    494         redirect=False,
    495         assert_same_host=False,
    496         preload_content=False,
    497         decode_content=False,
    498         retries=self.max_retries,
    499         timeout=timeout,
    500     )
    502 # Send the request.
    503 else:

File /usr/local/lib/python3.8/site-packages/urllib3/connectionpool.py:787, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, **response_kw)
    785     e = ProtocolError("Connection aborted.", e)
--> 787 retries = retries.increment(
    788     method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]
    789 )
    790 retries.sleep()

File /usr/local/lib/python3.8/site-packages/urllib3/util/retry.py:592, in Retry.increment(self, method, url, response, error, _pool, _stacktrace)
    591 if new_retry.is_exhausted():
--> 592     raise MaxRetryError(_pool, url, error or ResponseError(cause))
    594 log.debug("Incremented Retry for (url='%s'): %r", url, new_retry)

MaxRetryError: HTTPConnectionPool(host='palmetto.aksw.org', port=80): Max retries exceeded with url: /palmetto-webapp/service/calculate?coherence=cp&words=cake%20apple%20banana%20cherry%20chocolate (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f847d936190>: Failed to establish a new connection: [Errno 101] Network is unreachable'))

During handling of the above exception, another exception occurred:

ConnectionError                           Traceback (most recent call last)
Cell In [7], line 3
      1 import requests
      2 # response = requests.get("http://palmetto.aksw.org/palmetto-webapp/service/cp?words=cake%20apple%20banana%20cherry%20chocolate")
----> 3 response = requests.get("http://palmetto.aksw.org/palmetto-webapp/service/calculate?coherence=cp&words=cake%20apple%20banana%20cherry%20chocolate")
      4 print(response.text)

File /usr/local/lib/python3.8/site-packages/requests/api.py:73, in get(url, params, **kwargs)
     62 def get(url, params=None, **kwargs):
     63     r"""Sends a GET request.
     64 
     65     :param url: URL for the new :class:`Request` object.
   (...)
     70     :rtype: requests.Response
     71     """
--> 73     return request("get", url, params=params, **kwargs)

File /usr/local/lib/python3.8/site-packages/requests/api.py:59, in request(method, url, **kwargs)
     55 # By using the 'with' statement we are sure the session is closed, thus we
     56 # avoid leaving sockets open which can trigger a ResourceWarning in some
     57 # cases, and look like a memory leak in others.
     58 with sessions.Session() as session:
--> 59     return session.request(method=method, url=url, **kwargs)

File /usr/local/lib/python3.8/site-packages/requests/sessions.py:587, in Session.request(self, method, url, params, data, headers, cookies, files, auth, timeout, allow_redirects, proxies, hooks, stream, verify, cert, json)
    582 send_kwargs = {
    583     "timeout": timeout,
    584     "allow_redirects": allow_redirects,
    585 }
    586 send_kwargs.update(settings)
--> 587 resp = self.send(prep, **send_kwargs)
    589 return resp

File /usr/local/lib/python3.8/site-packages/requests/sessions.py:701, in Session.send(self, request, **kwargs)
    698 start = preferred_clock()
    700 # Send the request
--> 701 r = adapter.send(request, **kwargs)
    703 # Total elapsed time of the request (approximately)
    704 elapsed = preferred_clock() - start

File /usr/local/lib/python3.8/site-packages/requests/adapters.py:565, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies)
    561     if isinstance(e.reason, _SSLError):
    562         # This branch is for urllib3 v1.22 and later.
    563         raise SSLError(e, request=request)
--> 565     raise ConnectionError(e, request=request)
    567 except ClosedPoolError as e:
    568     raise ConnectionError(e, request=request)

ConnectionError: HTTPConnectionPool(host='palmetto.aksw.org', port=80): Max retries exceeded with url: /palmetto-webapp/service/calculate?coherence=cp&words=cake%20apple%20banana%20cherry%20chocolate (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f847d936190>: Failed to establish a new connection: [Errno 101] Network is unreachable'))

已确认VM设置中允许HTTP和HTTPS访问，推测需要调整VM网络相关设置，但不清楚具体应修改哪些内容。

解决方案 #

根据报错Network is unreachable，结合Google VM的网络逻辑，按以下步骤排查调整：

1. 检查VM的外部IP配置 #

• 确认VM是否分配了外部静态IP：如果VM只有内部IP，无法直接访问公网资源。进入Google Cloud控制台的VM实例页面，查看该实例的"外部IP"列，若显示"无"，则需要为其分配一个外部IP。
• 若使用临时外部IP，重启VM可能会导致IP变更，但不影响公网访问能力，可忽略此点除非IP变更后出现问题。

2. 验证VPC网络的路由规则 #

• 进入VPC网络的"路由"页面，检查是否存在指向互联网的默认路由（目标为0.0.0.0/0，下一跳为default-internet-gateway）。如果没有该路由，VM无法访问公网。
• 若缺少默认路由，手动创建一条：目标范围设为0.0.0.0/0，下一跳选择"互联网网关"，所属网络与VM一致。

3. 检查防火墙规则的出站方向 #

• 虽然你已允许HTTP/HTTPS入站，但出站规则同样重要。进入VPC网络的"防火墙"页面，确认存在允许所有出站流量（或至少允许目标端口80/443的出站流量）的规则。
• 若没有合适的出站规则，创建一条：方向设为"出站"，目标标签选择VM的标签（或设为all），协议和端口选择"tcp:80,443"或"全部"，动作设为"允许"。

4. 测试VM内部的网络连通性 #

• 在VM终端执行ping palmetto.aksw.org，检查是否能解析域名并收到响应。如果ping不通，先执行nslookup palmetto.aksw.org确认DNS解析是否正常。
• 若DNS解析失败，检查VM的DNS配置：Google VM默认使用内部DNS，若自定义了DNS服务器，确保其能正常解析公网域名。
• 执行telnet palmetto.aksw.org 80，测试是否能建立TCP连接。若连接失败，说明网络层面存在阻断，回到前面的路由和防火墙规则排查。

5. 检查是否启用了VPC私有访问 #

• 如果VM所在的VPC启用了"私有访问"且未配置云NAT，VM无法通过内部IP访问公网。此时需要配置云NAT网关，让VM通过NAT访问互联网。

内容的提问来源于stack exchange，提问作者NFStudio