Using the SNAT Rule of a Private NAT Gateway and Direct Connect to Enable Cloud Servers to Access an On-premises Data Center

Scenarios

When an ECS in a VPC needs to communicate with an on-premises data center through a Direct Connect connection, the private IP address of the ECS needs to be translated into a private IP address trusted by the on-premises data center.

Solution Architecture

1. A Direct Connect connection connects an on-premises data center to a transit VPC.
2. A private NAT gateway translates the private IP address of the ECS in the service VPC into a transit IP address (private IP address trusted by the on-premises data center) in the transit VPC.
   Figure 1 Networking diagram
   

Solution Advantages

In a hybrid cloud network, the private IP addresses of ECSs in the VPC need to be mapped to those trusted by the on-premises data center to meet security compliance requirements.

Constraints

• The CIDR block of your on-premises data center cannot overlap with those of the transit VPC and the service VPC; otherwise, your on-premises data center will be unable to communicate with the service VPC.
• You need to define a CIDR block in the transit VPC to map private IP addresses from the service VPC. Generally, you use a private CIDR block or private IP addresses trusted by your on-premises data center.

Resource Planning

• In this practice, the private IP address (192.168.0.10) of the ECS is mapped to the private IP address (10.1.0.10) trusted by the on-premises data center through the private NAT gateway.
• The VPC, NAT gateway, Direct Connect connection, and ECS must be in the same region.

Procedure

1. Create a service VPC and a transit VPC.
2. Configure a Direct Connect connection.
3. Buy a private NAT gateway.

Implementation Procedure

1. Create a service VPC and a transit VPC.

   For details, see Creating a VPC with a Subnet.

2. Configure a Direct Connect connection.

   Create a Direct Connect connection between the on-premises data center and the transit VPC. For details, see Using Direct Connect to Connect an On-Premises Data Center to the Cloud.

3. Buy a private NAT gateway.
   1. Buy a private NAT gateway in the specified region and select a service VPC.
   2. Assign a transit IP address. Set Transit VPC to VPC-Test02. Select Manual for Transit IP Address, and set IP Address to 10.1.0.10.
   3. On the SNAT Rules tab of the private NAT gateway, click Add SNAT Rule and set Subnet to 192.168.0.0/24, the service subnet with the IP addresses that need to access the on-premises data center. Set Transit IP Address to the address configured in the previous step.
   4. Add a route pointing to the private NAT gateway to the route table of the service VPC. Set Destination to 10.0.0.0/24.
      Figure 2 Adding a route
      
   5. Add an inbound security group rule to allow traffic to the destination CIDR block that contains the IP address (10.0.0.62) of the on-premises server.

Verification

Test the network connectivity.

Log in to ECS-Test in the service VPC and ping the private IP address (10.0.0.62) of an on-premises server to verify the network connectivity.