Viewing the Traffic from ECSs to the Internet Through a NAT Gateway

Solution Architecture

In this example, multiple ECSs are deployed in the same VPC subnet and use an SNAT rule of a public NAT gateway to access the Internet. When the traffic from the NAT gateway to the Internet increases sharply, O&M engineers need to identify the ECSs generating high traffic. To do this, they need to create a flow log to collect flow logs of the subnet for analysis and fault locating.

Figure 1 Viewing the traffic from ECSs to the Internet through a NAT gateway

Constraints

For details about the restrictions on flow logs, see Constraints.

Resource Planning

In this example, the VPC, subnet, ECSs, EIP, NAT gateway, and VPC flow log must be in the same region but can be in different AZs.

The following resource details are only for your reference. You can modify them if needed.

Table 1 Resource planning

Resource	Quantity	Description
VPC and subnet	VPC: 1 Subnet: 1	VPC name: Set it as needed. In this example, VPC-A is used. VPC IPv4 CIDR block: Set it as needed. In this example, 192.168.0.0/16 is used. Subnet name: Set it as needed. In this example, Subnet-A01 is used. Subnet IPv4 CIDR block: Set it as needed. In this example, 192.168.0.0/24 is used.
ECS	3	Configure the three ECSs as follows: ECS Name: Set it as needed. In this example, the ECSs are named ECS-01, ECS-02, and ECS-03. ECS flavor: In this example, flow logs of the subnet of the three ECSs are collected. Select the ECS flavor that supports flow logs. For details, see Constraints. Image: Set it as needed. In this example, public image Huawei Cloud EulerOS 2.0 Standard 64 bit is used. System Disk: In this example, a general-purpose SSD disk of 40 GiB is used. Data Disk: Set it as needed. In this example, no data disk is used. Network VPC: Select a VPC. In this example, VPC-A is used. Subnet: Select a subnet. In this example, Subnet-A01 is used. Security Group: In this example, the three ECSs are associated with the same security group (Sg-X). Ensure that all rules in Table 2 are added. EIP: Select Not required. Private IP address: Use 192.168.0.102 for ECS-01, 192.168.0.60 for ECS-02, and 192.168.0.42 for ECS-03.
EIP	1	In this example, one EIP (121.XX.XX.73) is required. Configure parameters such as EIP type and bandwidth as required.
Public NAT gateway	1	Configure the public NAT gateway as follows: Name: In this example, NAT-A is used. Specifications: In this example, select Small. VPC: In this example, select VPC-A. Subnet: In this example, select Subnet-A01. Add an SNAT rule to the public NAT gateway. Configure the SNAT rule as follows: Scenario: Select VPC. CIDR Block: Select Existing and select Subnet-A01. Public IP Address Type: Select the EIP assigned in this example.
VPC flow log	1	Name: Set it as needed. In this example, flowlog-A is used. Version: Select v1 in this example. Resource Type: Select Subnet in this example. Resource: Select a resource as needed. In this example, select Subnet-A01. Filter: Select All traffic in this example. Log Group: Select an existing or create a log group. The log group of this example is as follows: Log Group Name: Set it as needed. In this example, lts-group-A is used. Log Retention (Days): Set it as needed. In this example, 30 is used. Log Stream: Select an existing or create a log stream. The log stream of this example is as follows: Log Group Name: In this example, the log group name is lts-group-A. Log Stream Name: Set it as needed. In this example, lts-topic-A is used. Log Storage: You are advised to enable this function for log search and analysis. Log Retention (Days): Set it as needed. In this example, 30 is used.

Table 2 Security group Sg-X rules

Direction	Action	Type	Protocol & Port	Source/Destination	Description
Inbound	Allow	IPv4	TCP: 22	Source: 0.0.0.0/0	Allows remote logins to Linux ECSs over SSH port 22.
Inbound	Allow	IPv4	TCP: 3389	Source: 0.0.0.0/0	Allows remote logins to Windows ECSs over RDP port 3389.
Inbound	Allow	IPv4	All	Source: current security group (Sg-X)	Allows the ECSs in Sg-X to communicate with each other using IPv4 addresses.
Inbound	Allow	IPv6	All	Source: current security group (Sg-X)	Allows the ECSs in Sg-X to communicate with each other using IPv6 addresses.
Outbound	Allow	IPv4	All	Destination: 0.0.0.0/0	Allows ECSs in Sg-X to access the external networks using IPv4 addresses.
Outbound	Allow	IPv6	All	Destination: ::/0	Allows ECSs in Sg-X to access the external networks using IPv6 addresses.

If the source of an inbound rule is set to 0.0.0.0/0, all external IP addresses are allowed to remotely log in to your instances. Exposing port 22 or 3389 to the public network will leave your instances vulnerable to network risks. To address this issue, set the source to a trusted IP address, for example, the IP address of your local PC.

Procedure

Figure 2 shows the process for viewing the traffic from ECSs to the Internet through a NAT gateway.

Figure 2 Viewing the traffic from ECSs to the Internet through a NAT gateway

Step 1: Create Cloud Resources

1. Create a VPC with a subnet.

   For details, see Creating a VPC with a Subnet.

2. Create ECSs.

   For details, see Purchasing an ECS in Custom Config Mode.

3. Assign an EIP.

   For details, see Assigning an EIP.

4. Create a public NAT gateway.

   For details, see Buying a Public NAT Gateway.

5. Configure an SNAT rule for the public NAT gateway.

   For details, see Adding an SNAT Rule.

Step 2: Create a VPC Flow Log

1. Create a log group and log stream on the LTS console.

   For details about how to create a log group, see Creating a Log Group.

   For details about how to create a log stream, see Creating a Log Stream.

2. Create a VPC flow log.

   For details, see Creating a VPC Flow Log.

Step 3: View the VPC Flow Log

In this example, the flow log of Subnet-A01 is collected. You can ping a public IP address from ECS-03 to generate traffic for observation. Flow logs are collected at the subnet level. Traffic generated by any ECS in the subnet is reported, allowing you to identify ECSs with abnormal traffic.

1. Remotely log in to ECS-03.

   For details, see How Do I Log In to My ECS?

2. Ping an IP address on the Internet from ECS-03 and collect logs:

   ping <IP-address-on-the-Internet>

   Example command:

   ping 117.XX.XX.122

   Information similar to the following is displayed. You can view the flow log records in about 10 minutes. Do not stop the ping command during flow log collection.

   [root@ecs-03 ~]# ping 117.XX.XX.122
   PING 117.XX.XX.122 (117.XX.XX.122) 56(84) bytes of data.
   64 bytes from 117.XX.XX.122: icmp_seq=1 ttl=49 time=26.5 ms
   64 bytes from 117.XX.XX.122: icmp_seq=2 ttl=49 time=26.3 ms
   64 bytes from 117.XX.XX.122: icmp_seq=3 ttl=49 time=26.2 ms
   ...

3. Wait for about 10 minutes and view the VPC flow log information by referring to Viewing a VPC Flow Log.

   You can enter the IP address (117.XX.XX.122) in the search box to quickly filter the logs of the communication between an ECS in the subnet and the Internet.

   Figure 3 Viewing logs
   
   The flow log record is in the following format:

   <version> <project-id> <interface-id> <srcaddr> <dstaddr> <srcport> <dstport> <protocol> <packets> <bytes> <start> <end> <action> <log-status>

   • Example log: 1 1XX89aca74e640d9848a37dea0315d99 ff3fcb8c-25b5-4fe4-9da6-b8857a6150e2 117.XX.XX.122 192.168.0.42 0 0 1 599 58702 1782959031 1782959631 ACCEPT OK
   • Log description: The VPC flow log version is 1. During the 10 minutes from 10:23:51 to 10:33:51 on July 2, 2026, the network interface (ff3fcb8c-25b5-4fe4-9da6-b8857a6150e2) accepted the following packets. A total of 599 echo request (type=8,code=0) packets were sent from the source IP address (192.168.0.42) to the destination IP address (117.XX.XX.122) using ICMP (protocol=1). The total size of all packets was 58,702 bytes.

     For details about flow log data, see VPC Flow Log Data.

Step 4: Configure Cloud Structuring Parsing and Analyze Visualized Logs for the VPC Flow Log