Using a Public NAT Gateway and Direct Connect to Accelerate Internet Access

Scenarios

You need to connect your on-premises data center to Huawei Cloud using Direct Connect and then add SNAT rules to enable your on-premises servers to access the Internet through a public NAT gateway in a secure, reliable, and high-speed way, or add DNAT rules to enable your on-premises servers to provide services accessible from the Internet. This practice can be used in similar scenarios like Internet, games, e-commerce, and finance.

Solution Advantages

With Direct Connect, you can access a VPC on a cloud platform over high-performance, low-latency, and secure networks. A Direct Connect connection supports a maximum of 10 Gbit/s bandwidth, meeting various bandwidth requirements.

With SNAT and DNAT of the public NAT gateway, your servers can share an EIP for Internet access, saving costs on EIPs. You can change the public NAT gateway types and EIPs bound to it at any time. The configuration is simple and will take effect immediately.

Typical Topology

The network of your on-premises data center is 172.18.0.0/24.

The subnet of the VPC your on-premises data center will access is 172.16.0.0/24.

Implementation methods:

1. A Direct Connect connection is used to connect your on-premises data center to the VPC.
2. A public NAT gateway is created in the VPC, enabling Internet connectivity for your on-premises servers.
   Figure 1 Network topology
   

Prerequisites

• The default route of your on-premises data center is available for configuring Direct Connect.
• The CIDR block of your on-premises data center does not overlap with the subnet CIDR block of the VPC. Otherwise, the communications between your on-premises data center and the VPC will fail.

Procedure

1. Create a VPC.

   For detailed operations, see Creating a VPC.

2. Configure a Direct Connect connection.
   Create a direct connection between your on-premises data center and the transit VPC (in the specified region). For details, see Overview.

   

   After the Direct Connect connection is created, configure routes in your on-premises data center as follows:

   • Static: Add the default route with 0.0.0.0/0 as the destination and set the next hop to the connection.
   • BGP: The on-premises network can learn the default route using BGP.

3. Assign an EIP and configure a public NAT gateway.
   1. Buy an EIP in the specified region. For details, see Assigning an EIP.
   2. Create a public NAT gateway. For details, see Creating a Public NAT Gateway.
   3. Add an SNAT rule by setting the CIDR block to that of the Direct Connect connection. For more details, see Adding an SNAT Rule.

      Set CIDR Block to 172.18.0.0/24 and select the EIP assigned in 1.

   4. Add a DNAT rule. For details, see Adding a DNAT Rule.

      Configure the protocol and port type. Set Private IP Address to 172.18.0.100 and select an EIP.

      

      SNAT and DNAT are used for different services. If an SNAT rule and a DNAT rule use the same EIP, there may be service conflicts. An SNAT rule cannot share an EIP with a DNAT rule with Port Type set to All ports.

Verification

After the configuration is complete, test the network connectivity.

Ping an external IP address, for example, 114.114.114.114, from a server in your on-premises data center.