Using a Public NAT Gateway and Direct Connect to Accelerate Internet Access

Scenarios

You need to connect your on-premises data center to Huawei Cloud using Direct Connect and then add SNAT rules to enable your on-premises servers to access the Internet through a public NAT gateway in a secure, reliable, and high-speed way, or add DNAT rules to enable your on-premises servers to provide services accessible from the Internet. This practice can be used in similar scenarios like Internet, gaming, e-commerce, and finance.

Solution Advantages

With Direct Connect, you can access a VPC on Huawei Cloud over high-performance, low-latency, and secure networks. A Direct Connect connection supports up to 10 Gbit/s bandwidth, meeting your service requirements.

With SNAT and DNAT of the public NAT gateway, your servers can share an EIP for Internet access, saving costs on EIPs. You can change the public NAT gateway types and EIPs bound to it at any time. The configuration is simple and will take effect immediately.

Typical Topology

The CIDR block of your on-premises data center is 172.18.0.0/24, which will access the VPC deployed in the CN-Hong Kong region. The CIDR block of the accessed VPC is 172.16.0.0/24.

Implementation methods:

1. A Direct Connect connection is used to connect your on-premises data center to the VPC.
2. A public NAT gateway is created in the VPC, enabling Internet connectivity for your on-premises servers.
   Figure 1 Network topology
   

Prerequisites

• The default route of your on-premises data center is available for configuring Direct Connect.
• The CIDR block of your on-premises data center does not overlap with the subnet CIDR block of the VPC. Otherwise, the communications between your on-premises data center and the VPC will fail.

Procedure

1. Create a VPC.

   For detailed operations, see Creating a VPC.

2. Configure a Direct Connect connection.
   Create a Direct Connect connection between your on-premises data center and the transit VPC (in the CN-Hong Kong region). For details, see Overview.

   

   After the Direct Connect connection is created, configure routes in your on-premises data center as follows:

   • Static: Add the default route with 0.0.0.0/0 as the destination and set the next hop to the Direct Connect connection.
   • BGP: The on-premises network can learn the default route using BGP.

3. Buy an EIP and configure a public NAT gateway.
   1. Buy an EIP in the CN-Hong Kong region. For details, see Assigning an EIP.
   2. Buy a public NAT gateway. For details about how to configure other parameters, see Buying a Public NAT Gateway.
   3. Add an SNAT rule by setting the CIDR block to that of the Direct Connect connection. For more details, see Adding an SNAT Rule.

      Set CIDR Block to 172.18.0.0/24 and select the EIP assigned in 1.

      Figure 2 Add SNAT Rule
      
   4. Add a DNAT rule. For details, see Adding a DNAT Rule.

      Configure the protocol and port type. All ports is used as an example. Set Private IP Address to 172.18.0.100 and select an EIP.

      Figure 3 Add DNAT Rule
      
      

      SNAT and DNAT are used for different services. If an SNAT rule and a DNAT rule use the same EIP, there may be service conflicts. An SNAT rule cannot share an EIP with a DNAT rule with Port Type set to All ports.

Verification

After the configuration is complete, test the network connectivity.

Ping an external IP address, for example, 114.114.114.114, from a server in your on-premises data center.