Using a Specified IP Address to Access Hosts Outside a VPC

Scenarios

The existing network architecture of the on-premises data center needs to be migrated to the cloud without any changes. In addition, servers can access external resources with a specified IP address.

In this best practice, department A needs to use a specified IP address (10.1.0.55) to access servers in a regulatory agency to upload required data after migrating its workloads to the cloud.

Solution Architecture

• The regulatory agency allows requests only from specified IP address (10.1.0.55).
• The server (192.168.0.3) in department A uses a private NAT gateway to translate 192.168.0.3 to the specified IP address (10.1.0.55) to periodically access the industry regulatory agency (10.10.0.5).

Figure 1 Logical topology

Solution Advantages

You can flexibly assign a transit IP address. All servers in the VPC can then use the transit IP address to access hosts outside the VPC.

Resource and Cost Planning

Prerequisites

• You have registered a Huawei Cloud account.
• Your Huawei Cloud account is not in arrears and the account balance is sufficient to pay for the resources involved in this best practice.
• A private NAT gateway is available.
  

  • Private NAT gateways are free for a limited time in the following regions: CN East-Shanghai2, CN-Hong Kong, LA-Sao Paulo1, AF-Johannesburg, and LA-Mexico City2.
  • Private NAT gateways are billed in the following regions: CN South-Guangzhou, CN East-Shanghai1, CN North-Beijing4, AP-Bangkok, AP-Singapore, and CN Southwest-Guiyang1.
• You have performed operations in Enabling Mutual Access Between Servers in Overlapping Subnets on the Cloud.

Procedures

1. Creating a VPC
2. Creating a Security Group
3. Creating an ECS
4. Configuring Private NAT Gateways
5. Configuring a VPC Peering Connection
6. Configuring Routes
7. Verifying that Department A Can Access the Regulatory Agency

Creating a VPC

1. Log in to the Huawei Cloud management console and select the CN-Hong Kong region.
2. Under Networking, select Virtual Private Cloud. On the Virtual Private Cloud page displayed, click Create VPC.
3. Configure a VPC for the regulatory agency based on Table 1 and click Create Now.
   • Region: CN-Hong Kong
   • Name: Set it to vpc-regulation.
   • IPv4 CIDR Block: Set it to 10.10.0.0/24.
   • AZ: Select AZ1.
   • Name: Set it to subnet-W.
   • IPv4 CIDR Block: Retain the default value.
   • For parameters not mentioned, retain their default values or configure them as prompted.

Creating a Security Group

1. Under Networking, select Virtual Private Cloud. In the navigation pane on the left, choose Access Control > Security Groups, and click Create Security Group in the upper right corner.
2. Configure the security group parameters and click OK.
   • Name: Set it to sg-regulation.
   • Template: Select General-purpose web server.
   • For parameters not mentioned, retain their default values or configure them as prompted.

   

3. Locate the row that contains sg-regulation, and click Manage Rule in the Operation column. On the sg-regulation details page, click the Inbound Rules tab, and delete all rules displayed.

   

4. Click Add Rule to allow only the IP address 10.1.0.55 to access the regulatory agency. Configure the following parameters and click OK.
   • Priority: Set it to 1.
   • Action: Select Allow.
   • Protocol & Port: Select All.
   • Type: Select IPv4.
   • Source: Enter 10.1.0.55.

   

Creating an ECS

1. Under Compute, select Elastic Cloud Server. On the Elastic Cloud Server page displayed, click Buy ECS.
2. Based on Table 1, configure basic information about the ECS of the regulatory agency and click Next: Configure Network.
   • Billing Mode: Select Pay-per-use.
   • Region: CN-Hong Kong
   • Specifications: You can select ECS specifications based on your project requirements. This example uses c6.large.2 as an example.
   • Image: Select Public image. This example uses a CentOS 8.0 image as an example.
   • For parameters not mentioned, retain their default values or configure them as prompted.

3. Configure the ECS network information and click Next: Configure Advanced Settings.
   • Network: Select VPC vpc-regulation, select Manually specify IP address, and set the IP address to 10.10.0.5 planned in Table 1.
   • Security Group: Select sg-regulation, in which
   • EIP: Select Not required.
   • For parameters not mentioned, retain their default values or configure them as prompted.

4. Set the ECS name and password, and click Next: Confirm.
   • ECS Name: Set it to ecs-regulation.
   • Login Mode: Select Password and enter a password.
   • For parameters not mentioned, retain their default values or configure them as prompted.

5. Confirm the ECS information, read the agreement and select the Agreement option, and click Submit to finish the ECS creation for the regulatory agency.
6. In the ECS list, locate the row that contains the ECS for the regulatory agency, and click Remote Login in the Operation column. In the displayed dialog box, click Log In under Other Login Modes.
7. Log in to the ECS as user root and check whether the private IP address of the ECS is the one you planned:

   ifconfig

   

Configuring Private NAT Gateways

To assign a transit IP address

1. On the management console, under Networking, select NAT Gateway. In the left navigation pane, choose Private NAT Gateways, and click the Transit IP Addresses tab.

   

2. Click Assign Transit IP Address and configure the parameters as follows:
   • Transit VPC: Select vpc-transit1.
   • Transit Subnet: Select ext_sub_T1.
   • Transit IP Address: Select Manual.
   • IP Address: Enter 10.1.0.55.

3. Click the Private NAT Gateways tab and click private-nat-A.
4. On the SNAT Rules tab page, click Add SNAT Rule.
   • Subnet: Select Existing. The system automatically displays the subnet of department A.
   • Transit Subnet: Select ext_sub_T1.
   • Transit IP Address: Enter 10.1.0.55.

   

5. After the SNAT rule parameters are configured, click OK.
6. Go back to Network Console. In the navigation pane on the left, choose Route Tables and click rtb-vpc-departmentA. Confirm that the route from department A to private NAT gateway private-nat A has been added.

   

Configuring a VPC Peering Connection

1. Under Networking, select Virtual Private Cloud. In the navigation pane on the left, choose VPC Peering.
2. Configure the following parameters and click OK.
   • Name: Set it to peering-TtoW.
   • Local VPC: Select vpc-transit1.
   • Peer VPC: Select vpc-regulation.
   • For parameters not mentioned, retain their default values or configure them as prompted.

   

Configuring Routes

1. Choose Networking > Virtual Private Cloud. In the navigation pane on the left, choose Route Tables.
2. Click rtb-vpc-transit1 to delete the existing 0.0.0.0/0 routing rule.
3. Click Add Route, configure required parameters and click OK.
   • Destination: Set it to 0.0.0.0/0.
   • Next Hop Type: Select VPC peering connection.
   • Next Hop: The system automatically displays the VPC peering connection.

   

4. Go back to the Route Tables page, click rtb-vpc-regulation, and click Add Route.
5. Configure route information and click OK.
   • Destination: Set it to 0.0.0.0/0.
   • Next Hop Type: Select VPC peering connection.
   • Next Hop: The system automatically displays the VPC peering connection.

   

Verifying that Department A Can Access the Regulatory Agency

1. Under Computing, select Elastic Cloud Server and use VNC to log in to ecs-departmentA.
2. On ecs-departmentA, verify that it can access the regulatory agency.

   ping 10.10.0.5