Help Center> Virtual Private Cloud> Best Practices> Using Third-Party Firewalls When Connecting VPCs
View PDF

Using Third-Party Firewalls When Connecting VPCs

Scenarios

VPC allows you to configure and manage virtual networks. You can use security groups and network ACLs in a VPC to control network access. You can also use your existing third-party firewalls to ensure the security of cloud services.

This section describes how to use a third party firewall when connecting multiple VPCs in the same region.

Solution Advantages

  • You can use third-party firewalls.
  • You can define security rules as required.

Typical Topology

Assume that your services are deployed in VPC 1, VPC 2, VPC 3, and VPC X, and you need to use a third-party virtual firewall on the cloud. You can configure the virtual firewall on ECS X in VPC X and use VPC peering connections and configure routes to enable communication between the VPCs. The ECS X with the firewall deployed in VPC X filters incoming and outgoing data based on the firewall rules.

The deployment diagram is as follows:

Figure 1 Deployment diagram

Prerequisites

  • The subnet of the ECS with the third-party virtual firewall deployed has been associated with a route table. Ensure that the region you selected allows you to visit the route table module directly from the navigation pane on the left of the network console.
  • The subnet CIDR block of VPC X does not overlap with these of VPC 1, VPC 2, and VPC 3. Otherwise, traffic cannot go through firewall on the ECS.

Procedure

  1. Create VPCs.

    Create VPC 1, VPC 2, VPC 3, and VPC X.

    For details, see Creating a VPC.

    The CIDR blocks of VPC 1, VPC 2, VPC 3, and VPC X cannot overlap with each other. For example, the CIDR block of VPC 1 is 10.1.0.0/24, VPC 2 is 10.2.0.0/24, VPC 3 is 10.3.0.0/24, and VPC X is 192.168.0.0/16.

  2. Create ECSs.

    1. Create ECS 1, ECS 2, ECS 3, and ECS X that belong to VPC 1, VPC 2, VPC 3, and VPC X, respectively.

      For details, see Purchasing an ECS.

      Disable the source/destination check for the ECS X NIC. For details, see Disabling Source and Destination Check.

    1. Deploy a third-party virtual firewall on the ECS X.

  3. Create VPC peering connections.

    Create VPC peering connections between VPC 1 and VPC X, VPC 2 and VPC X, and VPC 3 and VPC X to enable communications between them.

    When creating a VPC peering connection, do not configure routes for the local and peer ends. Configure routes in step 6.

    For details about creating VPC peering connections, see Creating a VPC Peering Connection with Another VPC in Your Account.

  4. Create a route table for a subnet.

    Create a custom route table and associate it with the VPC X subnet to control the outbound traffic.

    For details, see Creating a Custom Route Table.

  5. (Optional) Assign a virtual IP address and bind it to the ECS X.

    You can create two ECSs in VPC X and bind them to the same virtual IP address so that they can work in the active and standby mode. If the active ECS is faulty and cannot provide services, the virtual IP address will be dynamically switched to the standby ECS to continue providing services. Skip this step if the ECS where the firewall is deployed does not need to work in the active/standby mode.

    1. Assign a virtual IP address in the VPC X subnet.

      For details, see Assigning a Virtual IP Address.

    2. Bind the virtual IP address to ECS X.

      For details, see Binding a Virtual IP Address to an EIP or ECS.

  6. Configure routes.

    You can configure routes to forward traffic to a next hop and finally to a destination.
    1. Add the following routes to the default route table of VPC 1:
      1. Add a route to forward traffic from VPC 1 to VPC X, set the destination of the route to the CIDR block of VPC X, and the next hop of the route to the VPC peering connection between VPC 1 and VPC X.
      2. Add a route to forward traffic from VPC 1 to VPC 2, set the destination of the route to the CIDR block of VPC 2, and the next hop of the route to the VPC peering connection between VPC 1 and VPC X.
      3. Add a route to forward traffic from VPC 1 to VPC 3, set the destination of the route to the CIDR block of VPC 3, and the next hop of the route to the VPC peering connection between VPC 1 and VPC X.

        Figure 2 is for reference.

        Figure 2 Routes in the default route table of VPC 1
    2. Add the following routes to the default route table of VPC 2:
      1. Add a route to forward traffic from VPC 2 to VPC X, set the destination of the route to the CIDR block of VPC X, and the next hop of the route to the VPC peering connection between VPC 2 and VPC X.
      2. Add a route to forward traffic from VPC 2 to VPC 1, set the destination of the route to the CIDR block of VPC 1, and the next hop of the route to the VPC peering connection between VPC 2 and VPC X.
      3. Add a route to forward traffic from VPC 2 to VPC 3, set the destination of the route to the CIDR block of VPC 3, and the next hop of the route to the VPC peering connection between VPC 2 and VPC X.

        Figure 3 is for reference.

        Figure 3 Routes in the default route table of VPC 2
    3. Add the following routes to the default route table of VPC 3:
      1. Add a route to forward traffic from VPC 3 to VPC X, set the destination of the route to the CIDR block of VPC X, and the next hop of the route to the VPC peering connection between VPC 3 and VPC X.
      2. Add a route to forward traffic from VPC 3 to VPC 2, set the destination of the route to the CIDR block of VPC 2, and the next hop of the route to the VPC peering connection between VPC 3 and VPC X.
      3. Add a route to forward traffic from VPC 3 to VPC 1, set the destination of the route to the CIDR block of VPC 1, and the next hop of the route to the VPC peering connection between VPC 3 and VPC X.

        Figure 4 is for reference.

        Figure 4 Routes in the default route table of VPC 3
    4. Add the following route to the default route table of VPC X:
      1. Set the destination of the route to 0.0.0.0/0, and the next hop of the route to ECS X.

        If there are two ECSs that use the same virtual IP address to work in the active and standby mode, the next hop should be the virtual IP address.

        Figure 5 is for reference.

        Figure 5 Routes in the default route table of VPC X
    5. Add the following routes to the route table of VPC X subnet:
      1. Add a route to forward traffic from VPC X to VPC 1, set the destination of the route to the CIDR block of VPC 1, and the next hop of the route to the VPC peering connection between VPC 1 and VPC X.
      2. Add a route to forward traffic from VPC X to VPC 2, set the destination of the route to the CIDR block of VPC 2, and the next hop of the route to the VPC peering connection between VPC 2 and VPC X.
      3. Add a route to forward traffic from VPC X to VPC 3, set the destination of the route to the CIDR block of VPC 3, and the next hop of the route to the VPC peering connection between VPC 3 and VPC X.

        Figure 6 is for reference.

        Figure 6 Routes in the route table of VPC X subnet

Verification

Log in to ECS 1 and then access ECS 2 from ECS 1. Check whether ECS X can receive packets that are sent from ECS 1 to ECS 2. Check whether the packets pass through and are filtered by the firewall on ECS X.