Help Center/ VPC Endpoint/ Getting Started/ Configuring a VPC Endpoint for Accessing the Private IP Address of OBS/ Step 3: Access OBS Using a VPN or Direct Connect Connection
Updated on 2024-12-13 GMT+08:00
View PDF
Share

Step 3: Access OBS Using a VPN or Direct Connect Connection

Scenarios

This section describes how to access OBS using a VPN or Direct Connect connection.

Prerequisites

Your on-premises data center has been connected to your VPC using a VPN or Direct Connect connection.
  • The VPC subnet that needs to communicate with the VPN gateway must include the OBS CIDR block. For details about how to obtain the OBS CIDR block, submit a service ticket or contact the OBS customer manager.

    For details about how to create a VPN connection, see Creating a VPN Gateway.

  • The VPC subnet that needs to communicate with the Direct Connect virtual gateway must include the OBS CIDR block. For details about how to obtain the OBS CIDR block, submit a service ticket or contact the OBS customer manager.

    For details on how to enable Direct Connect, see Enabling Direct Connect.

Procedure

  1. In the VPC endpoint list, locate the VPC endpoint and click the ID of the endpoint to view its private IP address.
  2. Add DNS records on the DNS server at your on-premises data center to forward requests for resolving OBS domain names to the VPC endpoint for accessing DNS.

    The methods of configuring DNS forwarding rules vary depending on OSs. For details, see the DNS software operation guides.

    This step uses Bind, a common DNS software, as an example to configure forwarding rules in the UNIX.

    Method 1: In file /etc/named.conf, add the DNS forwarder configuration and set forwarders to the private IP address of the VPC endpoint for accessing DNS.

    options {
forward only;
forwarders{ xx.xx.xx.xx;};
};

    Method 2: In file /etc/named.rfc1912.zones, add the following content, and set forwarders to the private IP address of the VPC endpoint for accessing DNS.

    The following uses the OBS endpoint and cluster address of an OBS bucket in the LA-Mexico City1 region as an example:

    zone "obs.na-mexico-1.myhuaweicloud.com" {
type forward;
forward only;
forwarders{ xx.xx.xx.xx;};
};
zone "obs.lz01.na-mexico-1.myhuaweicloud.com" {
type forward;
forward only;
forwarders{ xx.xx.xx.xx;};
};
    • If no DNS server is available at your on-premises data center, add the private IP address of the VPC endpoint in file /etc/resolv.conf.
    • obs.na-mexico-1.myhuaweicloud.com indicates the OBS endpoint in the LA-Mexico City1 region.
    • obs.lz01.na-mexico-1.myhuaweicloud.com indicates the address of the lz01 cluster where the OBS bucket is deployed.
    • xx.xx.xx.xx is the VPC endpoint's private IP address obtained in 1.
  3. Add a route destined for DNS over the VPN gateway or Direct Connect virtual gateway.

    To access DNS over a VPN or Direct Connect connection, ensure that traffic from your on-premises data center to DNS is directed to the VPN gateway or Direct Connect gateway.

    Configure a permanent route at your on-premises data center and specify the IP address of the Direct Connect or VPN gateway as the next hop for accessing DNS. The following is the example command for configuring such a route:

    route -p add xx.xx.xx.xx mask 255.255.255.255 xxx.xxx.xxx.xxx
    • xx.xx.xx.xx is the VPC endpoint's private IP address obtained in 1.
    • xxx.xxx.xxx.xxx indicates the IP address of the Direct Connect or VPN gateway created at your on-premises data center.
    • The route command format varies depending on the OS. Use the route command in the actual OS.
  4. Add a route destined for OBS over the VPN gateway or Direct Connect virtual gateway.

    The CIDR block of the VPC endpoint for accessing OBS is 100.125.0.0/16. To access OBS over a VPN or Direct Connect connection, ensure that traffic from your on-premises data center to OBS is directed to the VPN gateway or Direct Connect gateway.

    Configure a permanent route at your on-premises data center and specify the Direct Connect or VPN gateway as the next hop for accessing OBS. The following is the example command for configuring such a route:

    route -p add 100.125.0.0 mask 255.255.0.0 xxx.xxx.xxx.xxx
    • xxx.xxx.xxx.xxx indicates the IP address of the Direct Connect or VPN gateway created at your on-premises data center.
    • The route command format varies depending on the OS. Use the route command format corresponding to the actual OS.
  5. At the on-premises data center, run the following command to verify the connectivity with OBS: 
    telnet bucketname.endpoint Port number

    bucketname.endpoint indicates the domain name of the OBS bucket. You can obtain the domain name by viewing the bucket information on OBS console. For details, see Viewing Basic Information of a Bucket.

    In the command:

    • bucketname: indicates the bucket name.
    • endpoint: indicates the bucket endpoint (domain name) in the region where the bucket is deployed.
    • Port number: indicates the service port number, which can be 80 or 443.

    Example: telnet bucketname.obs.na-mexico-1.myhuaweicloud.com 80 or telnet bucketname.obs.na-mexico-1.myhuaweicloud.com 443

    You can obtain OBS endpoint information at Regions and Endpoints.