How Do I Purchase the NAT and EIP Services to Enable Cloud Applications to Be Accessed Through the Internet?

Scenarios

After the administrator publishes an application, the cloud application is in the VPC subnet by default and cannot access the Internet. The administrator needs to configure the NAT gateway to share an EIP so that users can access and use Workspace Application Streaming using the Internet access address. If a cloud application has multiple service subnets, the Internet function must be enabled for each service subnet.

Workspace Application Streaming and Workspace share the same network. If a desktop exists in the same subnet of the same project and the administrator has enabled Internet access for the desktop, end users can directly access the application. If only cloud applications exist in the subnet of the current project, the administrator needs to access the NAT and EIP pages to purchase the corresponding services and enable the Internet.

Prerequisites

• You have obtained the region, project, VPC, and subnet information of the cloud application that needs to access the Internet.
• You have the permission to perform operations on the NAT and EIP services.
  

  • By default, a Huawei Cloud account has the operation permissions on all Huawei Cloud services. If you use such an account, you do not need to confirm it.
  • To use NAT and EIP, the IAM account created under the Huawei Cloud account must be added to the admin user group or a user group with NAT and EIP operation permissions. Go to the IAM page to check whether the user belongs to the admin user group. If not, grant the IAM account the permission for using NAT and EIP by referring to Creating a User and Granting NAT Gateway Permissions and Creating a User and Granting EIP Permissions.

Procedure

Creating an EIP

1. Log in to the console as an administrator.
2. Click in the upper left corner and select the region and project where the cloud application to access the public network is located.
3. Click and choose Networking > Elastic IP in the service list.
4. On the page displayed, click Buy EIP.
5. Set the parameters by referring to the parameter description in section Assigning an EIP.
   

   Select the region and project of the cloud application that you want to access the public network.

6. Click Next.
7. Confirm the configurations and click Submit.

Buying a public NAT gateway

8. Click and choose Networking > NAT Gateway in the service list.
9. Click Buy Public NAT Gateway. The Buy Public NAT Gateway page is displayed.
10. Set the parameters by referring to the parameter description in section Buy a Public NAT Gateway.
    

    Select the VPC and subnet to which the cloud application that needs to access the Internet belongs.

11. Click Next.
12. Confirm the configurations and click Submit.
13. On the page for adding a rule, click Cancel.

Checking whether the VPC has a route to the NAT gateway

14. Log in to the Workspace Application Streaming console and choose Tenant Configuration.
15. Click the VPC name of the tenant to go to its basic information page.
16. In the Networking Components area on the right of the page, click the number next to Route Tables to go to the route table list page of the VPC.
17. Click the name of the target route table. The basic information list is displayed.
18. Check whether there is a route whose next hop is the NAT gateway in the route list.

    The NAT gateway automatically creates a route 0.0.0.0/0 from the VPC to the NAT gateway to allow traffic from the VPC to the NAT gateway, as shown in Figure 1.

    Figure 1 Route to the NAT gateway
    
    • If the route shown in Figure 1 exists, go to 19.
    • If the route shown in Figure 1 does not exist, add such a route and go to 19.

Adding an SNAT rule

19. Click and choose Networking > NAT Gateway in the service list.
20. On the displayed page, locate the NAT gateway created in 12 and choose Operation > Configure Rules.
21. On the SNAT Rules tab page, click Add SNAT Rule.
22. Set the parameters by referring to the parameter description in section Add an SNAT Rule.
    

    Set Scenario to VPC, Subnet to Existing, and EIP to the EIP purchased in 7.

23. Click OK.

    If the added SNAT rule is in the Running state, the rule is added successfully.

Configuring DNS forwarding

24. Log in to the DNS server as the administrator.
25. On the taskbar in the lower left corner, click .
26. Click on the right of the Start menu.
27. The Server Manager window is displayed.
28. In the left navigation pane, click DNS.
29. In the SERVERS area, right-click a Server name and choose DNS Manager from the shortcut menu.
30. The DNS Manager dialog box is displayed.
31. Expand DNS. Right-click the computer name, and choose Properties from the shortcut menu.
32. On the Advanced tab page, deselect Disable recursion (also disable forwarders) and click Apply.
33. On the Forwarder tab page, click Edit, enter the default DNS server IP address of the cloud application region in the text box, and click OK.
    

    The default DNS server IP address of the Workspace Application Streaming region can be obtained from the private DNS server addresses provided by Huawei Cloud.

Verifying whether Workspace Application Streaming can be accessed using the NAT gateway

34. Log in to Workspace Application Streaming as an end user using the Huawei Cloud Workspace client to check whether the service can be used.