NAT Instance Configuration

Transcription

1 NAT Instance Cnfiguratin Enabling Internet Access fr Private Subnets O R A C L E W H I T E P A P E R J A N U A R Y

2 Table f Cntents Intrductin 3 Assumptins 4 Basic NAT Cnfiguratin 4 Architecture 5 Cnfiguratin 6 Terrafrm 10 NAT HA and Advanced Cncepts 11 HA Architecture 11 Required Resurces and Creatin Order 12 HA Cnfiguratin 14 Cnclusin 14 Appendices 15 Appendix 1: Example ntify.sh 15 Appendix 2: Example keepalived.cnf 16 2 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

3 Intrductin Oracle Clud Infrastructure enables yu t create a virtual clud netwrk (VCN) that functins as an extended data center in the clud. The virtual netwrking primitives ffered by the platfrm give yu full flexibility t build a netwrk that meets cmplex enterprise requirements. Yu can use any address range fr yur VCN, segment it int subnets, and cnfigure security lists and rute tables. Yu can cnnect yur VCN t yur n-premises netwrk thrugh a dynamic ruting gateway (DRG), either thrugh IPsec cnnectins ver the internet r thrugh FastCnnect ver private, dedicated cnnectins. One f the mst cmmn netwrk design requirements is t secure private instances s that they are nt accessible frm the internet but are accessible nly frm the n-premises netwrk r bastin hsts in public subnets. Yu can achieve this requirement by launching the instances in a private subnet r by chsing nt t assign a public IP address at launch. Hwever, these backend instances might need access t the internet fr specific purpses, such as sftware updates r CRL verificatin. Yu can chse t rute this traffic t yur n-premises netwrk thrugh yur internet gateway, but that might add unwanted latency r cst. In 1993, the first dcument abut Netwrk Address Translatin (NAT) was published. NAT was cnceived as a way t reuse address space t prevent IP address exhaustin, but was widely adpted as a way fr peple t cnnect their private netwrks t the public internet. Currently, NAT is mst cmmnly used as a frm f IP masquerade, which allws users t hide an entire IP space behind a single external address. In effect, NAT prvide an additinal firewall because n unauthrized traffic can enter the private netwrk. With the recent enhancements t the Oracle Clud Infrastructure virtual netwrking platfrm, yu can nw enable utbund internet access frm private instances by using NAT instances. This white paper describes recmmended steps fr setting up a NAT instance in yur VCN and cnfiguring yur private subnet t rute internet requests thrugh it. 3 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

4 Assumptins This white paper is intended fr users wh want t cnfigure an instance that perates as a NAT gateway fr the private netwrk. T perfrm a deplyment as described in this paper, yu shuld have a slid familiarity with the fllwing items: Linux cmmand line Prvisining clud infrastructure via Terrafrm, a ppular and free lightweight deplyment tl ( Basic understanding f netwrking prtcls Yu shuld als be familiar with the fundamentals f the Oracle Clud Infrastructure. Fr infrmatin, g t If this is the first time that yu have used the platfrm, we recmmend specifically the tutrial at 1.racleclud.cm/Cntent/GSG/Reference/verviewwrkflw.htm. Basic NAT Cnfiguratin The nature f Oracle Clud Infrastructure Netwrking makes it unnecessary t physically separate subnets by using virtual interfaces. Because ruting is dne by underlying sftware-defined netwrking, and because security lists exist between the subnets in mst f the cases, it s enugh t use a single virtual NIC (VNIC). As a result, mst f the examples in this paper use a single interface. If yu re using mre than ne VNIC, ensure that yur ruting tables crrectly pint t the gateway IP address in the subnet yu re cnnected t, r disable reverse path filtering in the Linux kernel. 4 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

5 Architecture The fllwing diagram shws a high-level architecture f the prpsed setup. The diagram shws a VCN (NAT-VCN-1) with tw subnets: public ( /24), with access t internet thrugh an internet gateway. NAT1 is an instance in the frntend subnet that will functin as NAT fr the private subnet. private ( /24), a private subnet with n access t the internet. Backend Hst represents the instances in the private subnet. NOTE: Private subnet plicy frbids public IP address assignment frm the VNIC, which prvides an additinal layer f security against external access. Public Subnet Cnfiguratin The rute table fr the public subnet has a rute rule that cnfigures the internet gateway as the rute target fr all traffic ( /0). Its security list has an egress rule t allw traffic t all destinatins. Ingress rules allw traffic frm the backend subnet (and any ther address ranges in the VCN). 5 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

6 Private Subnet Cnfiguratin The rute table fr the private subnet has a rute rule that cnfigures the NAT1 hst as the rute target fr all traffic ( /0). Its security list has an egress rule t allw traffic t all destinatins. Ingress rules allw nly specific address ranges (such as an n-premises netwrk r any ther backend subnets in the VCN). If cnnectin with n-premises netwrk is used, then the rute tward the enterprise shuld be set t the cnfigured DRG. With this cnfiguratin, when the backend instances initiate utbund internet requests, traffic is ruted t the NAT1 instance. The NAT1 instance frwards the traffic t the internet thrugh the internet gateway (after applying surce NAT). The destinatin n the internet sees the traffic as surced frm the NAT1 public IP address. When the NAT instance receives the respnse frm the internet, it frwards the traffic t the backend instance (after applying destinatin NAT). Cnfiguratin This sectin shws an example f basic steps t create the netwrk and a NAT instance. 1. In the Oracle Clud Infrastructure Cnsle, create a VCN withut any resurces. The VCN will have a default empty rute table, a default security list, and DHCP ptins. In this example, the VCN is called NAT-VCN Open the VCN that yu created. In the Resurces panel, click Security Lists and then pen the default security list. Click Edit All Rules. 3. Create an ingress rule. In the Surce CIDR field, enter /24 (which will be yur private subnet space), and select All Prtcls. Yu can als create a rule allwing SSH prtcl. 4. Create an egress rule that allws /0 fr All Prtcls. 5. Click Save Security List Rules. 6 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

7 6. In the Resurces panel, click Internet Gateways, and then click Create Internet Gateway. 7. Assign it the name InternetGateway, and then click Create Internet Gateway. 8. In the Resurces panel, click Rute Tables, and then pen the default rute table. 9. Create a rule in the default rute table with the fllwing values, and then click Create: Destinatin: /0 Target Type: Internet Gateway Target Cmpartment: Chse a cmpartment. Target Selectin: InternetGateway 10. In the Resurces panel, click Subnets, and then click Create Subnet. 11. Enter the fllwing values, and then click Create: Name: Public Subnet Availability Dmain: Chse frm the list. CIDR Blck: /24 Rute Table: Default Rute Table NAT-VCN-1 Subnet Access: Public Subnet DHCP Optins: Default DHCP Optins fr NAT-VCN-1 Security Lists: Default Security fr NAT-VCN-1 Befre yu create the private subnet, create yur NAT instance. If yu create the NAT instance first, yu can chse the OCID (identifier) f the private IP assigned t yur NAT instance as the rute target in the subnet s rute table. 7 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

8 12. Frm the Cmpute menu, click Instances and then click Launch Instance. Cnfigure the instance as fllws: Name: NAT1 Availability Dmain: Chse an Availability Dmain that yu created yur subnet in. Image: Oracle-Linux r later Shape: VM.Standard1.2 Virtual Clud Netwrk: NAT-VCN-1 Subnet: Public Subnet Private IP Address: Assign public IP address: Select this check bx. SSH Keys: Uplad r paste yur SSH key. Click Shw Advanced Optins, select the Paste Clud-Init Script ptin, and paste the fllwing text. Alternatively, yu can dwnlad the file frm and use the uplad functin. This will cnfigure the server firewall and kernel t prvide NAT and ruting service fr ther hsts n the netwrk. #clud-cnfig write_files: # Create file t be used when enabling ip frwarding - path: /etc/sysctl.d/98-ip-frward.cnf cntent: net.ipv4.ip_frward = 1 runcmd: # Run firewall cmmands t enable masquerading and prt frwarding # Enable ip frwarding by setting sysctl kernel parameter - firewall-ffline-cmd --direct --add-rule ipv4 nat POSTROUTING 0 - ens3 -j MASQUERADE - firewall-ffline-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens3 -j ACCEPT - /bin/systemctl restart firewalld - sysctl -p /etc/sysctl.d/98-ip-frward.cnf 13. Click Launch Instance. 8 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

9 14. Click the name f yur instance, and click Attached VNICs. Then click Edit VNIC. 15. Select Skip Surce/Destinatin Check and then click Update VNIC. Nte: This step is imprtant. Withut it, ther instances can t send traffic thrugh the NAT gateway because f security features enabled by default. Trying t cnfigure the rute target t the VNIC with a Surce/Destinatin Check results in an errr message. At this pint yu have created all required resurces in the public subnet. The next steps guide yu thrugh the prcess f creating the private netwrk. 16. G back t Netwrking > Virtual Clud Netwrks > NAT-VCN In the Resurces panel, click Security Lists, and then click Create Security List. 18. Enter the fllwing values, and then click Create Security List: Fr the name, enter Security List fr Private Subnet. Add an egress rule with /0 as the destinatin and All Prtcls selected. Cnfigure ingress rules accrding t yur needs and security plicies. Be sure t add at least ne rule that allws SSH traffic. 19. In the Resurces panel, click Rute Tables, and then click Create Rute Table. 20. Enter the fllwing values and then click Create Rute Table: Name: Private Rute Destinatin: /0 Target Type: Private IP Target Selectin: In the Resurces panel, click Subnets, and then click Create Subnet. 9 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

10 22. Enter the fllwing values and then click Create: Name: Private Subnet Availability Dmain: Select an Availability Dmain. CIDR Blck: /24 Rute Table: Private Rute Subnet Access: Private subnet DHCP Optins: Default DHCP Optins fr NAT-VCN-1 Security Lists: Security List fr Private Subnet Nw yu can launch the hst instances by using any perating system in the private subnet. They can cnnect t the internet withut a public IP address assigned, and n cnnectins riginated n the internet are pssible directly t yur server. T manage yur private hsts, yu need t use SSH t cnnect t the NAT instance first, r use a CPE VPN cnnectin frm yur wn netwrk. Terrafrm Terrafrm is a tl fr building, changing, and versining infrastructure. It generates an executin plan frm cnfiguratin files, describing what it will d t reach the necessary state, and then executes changes t build an infrastructure. Fr basic infrmatin abut Terrafrm, see the fllwing sites: NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

11 The NAT example cnfiguratin is lcated in the examples flder f the terrafrm-prvider-ci Git repsitry at NAT HA and Advanced Cncepts When a deplyment uses multiple Availability Dmains, yu must maintain sme frm f heartbeat and failver mechanism. In the typical nn-clud deplyment, this can be achieved by using Layer 2 paths and IP failver. because f the nature f the Oracle Clud Infrastructure Netwrking, the best way t achieve redundancy is t maintain rute-table cnfiguratin directly. HA Architecture The fllwing diagram shws three Availability Dmains with NAT instances and hsts in the private subnet. In nrmal cnditins, traffic stays within the Availability Dmain and is translated n the NAT gateway in the public subnet. 11 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

12 In the case f a NAT gateway failure, traffic shuld fail ver t the NAT gateway in the ther Availability Dmain as shwn in the fllwing diagram: Because NAT Instance 1 is nt available, NAT Instance 2 takes ver and mdifies the rute table f the private subnet in AD1. The default gateway is cnfigured fr a private IP f NAT Instance 2 as a rute target, using the unique identifier f the private IP (OCID). This ensures that the private instance can still reach the internet even when an instance fails. Required Resurces and Creatin Order The fllwing table summarizes the resurces needed fr the preceding setup. Yu can use it as a deplyment checklist. VCN Internet Gateway Public Rute Table AD1 Public Rute Table AD2 Public Rute Table AD3 Dependencies Depends n the VCN Depends n the VCN Depends n the VCN Depends n the VCN Private Rute Table AD1 Depends n the VCN Private Rute Table AD2 Depends n the VCN 12 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

13 VCN Dependencies Private Rute Table AD3 Depends n the VCN Public Security List Private Security List Depends n the VCN Depends n the VCN Public Subnet AD1 Depends n the VCN Depends n the Rute Table Public Subnet AD2 Depends n the VCN Depends n the Rute Table Public Subnet AD3 Depends n the VCN Depends n the Rute Table Private Subnet AD1 Depends n the VCN Depends n the Rute Table Private Subnet AD2 Depends n the VCN Depends n the Rute Table Private Subnet AD3 Depends n the VCN Depends n the Rute Table Depends n the Security List Depends n the Security List Depends n the Security List Depends n the Security List Depends n the Security List Depends n the Security List NAT Instance AD1 NAT Instance AD2 NAT Instance AD3 Private Instance AD1 Private Instance AD2 Private Instance AD3 Rute Rules fr Public subnets Rute Rules fr Private subnets Depends n the Subnet Depends n the Subnet Depends n the Subnet Depends n the Subnet Depends n the Subnet Depends n the Subnet Depends n the Internet Gateway NAT Instance Nte that fr rute rule creatin, the NAT instance must be launched first because the rute t the target rule requires an existing private IP bject that is attached t the NAT instance VNIC. 13 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

14 HA Cnfiguratin Fr HA in this example, a keepalived daemn and a custm script that perfrms the failver are used. In additin, NAT instances must have an Oracle Clud Infrastructure CLI, API key, user ID, and relevant plicy t manage virtual-netwrk-family within the cmpartment. Fr example: Allw grup NAT t manage virtual-netwrk-family in cmpartment id aaa.cmpartment.cid Failver Script The failver script prcesses the metadata infrmatin and perfrms rute rule changes in the designated rute table. The active nde within the VRRP grup pints the rute rule t its private IP OCID. See Appendix 1 fr the script example. Keepalived.cnf Fr VRRP cnfiguratin, keepalived needs t be cnfigured fr three different instances. Each f the NAT instances will be the MASTER nde fr the Availability Dmain, and the tw remaining nes will be in the BACKUP state. Ensure that each VRRP instance has a different virtual_ruter_id parameter and that the MASTER nde has a higher pririty. See Appendix 2 fr the cnfiguratin example. Fr each nde, be sure t update the pririty within the crrect Availability Dmain, initial state, and IP addresses f the ndes. Cnclusin A NAT instance can be used t prtect imprtant resurces in yur clud data center and prvide services fr the hsts lcated n the private subnets. Servers lcated in the private subnet are prtected frm being accessible frm utside f yur VCN, but can still reach ut t the internet. 14 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

15 Appendices Appendix 1: Example ntify.sh #!/bin/bash STATUS=$1 AD=$2 RT_TABLE_ID=$3 CURL="/usr/bin/curl -s" OCI=$(/usr/bin/ci) MDS=" INSTANCE_MDS=$MDS"/instance" VNIC_MDS=$MDS"/vnics" PATH="/usr/libexec/keepalived" PUB_SN_ID=$($CURL "$INSTANCE_MDS/metadata/subnet_id") PRIV_SN_ID=$($CURL "$INSTANCE_MDS/metadata/private_subnet_id") VNIC_ID=$($CURL "$VNIC_MDS/0/vnicId") ech $VNIC_MDS ech $VNIC_ID ech $STATUS > $PATH/$AD"_status.txt" $OCI netwrk private-ip list --subnet-id $PUB_SN_ID --vnic-id $VNIC_ID /usr/bin/pythn -c 'imprt sys, jsn; print jsn.lad(sys.stdin)["data"][0]["id"]' > $PATH"/private_ip.cid" case "$STATUS" in "master") ech "master" if [! -z $RT_TABLE_ID ]; then PRIVATE_IP_ID=$(/bin/cat $PATH"/private_ip.cid") $OCI netwrk rute-table update --frce --rt-id $RT_TABLE_ID --rute-rules '[{"cidrblck":" /0","netwrkentityid":"'$private_ip_id'"}]' fi ;; "backup") ech "Backup Status" lgger "Backup Status" exit 0 ;; "stp") ech "Keepalived stpped" lgger "Keepalived stpped" exit 0 ;; "fault") ech "Keepalived fault!" lgger "Keepalived fault!" exit 0 ;; *)exit 1 ;; esac 15 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

16 Appendix 2: Example keepalived.cnf Replace ${variable} with real values. vrrp_instance VI_1 { interface ens3 state MASTER } virtual_ruter_id 51 pririty ${pririty_map_1} unicast_src_ip ${private_ip} unicast_peer { ${peer_ip} ${peer2_ip} } ntify_master "/usr/libexec/keepalived/ntify.sh master ad1 ${ad1_rt_id}" ntify_backup "/usr/libexec/keepalived/ntify.sh backup ad1 ${ad1_rt_id}" ntify_fault "/usr/libexec/keepalived/ntify.sh fault ad1 ${ad1_rt_id}" ntify_stp "/usr/libexec/keepalived/ntify.sh stp ad1 ${ad1_rt_id}" vrrp_instance VI_2 { interface ens3 state BACKUP } virtual_ruter_id 52 pririty ${pririty_map_2} unicast_src_ip ${private_ip} unicast_peer { ${peer_ip} ${peer2_ip} } ntify_master "/usr/libexec/keepalived/ntify.sh master ad2 ${ad2_rt_id}" ntify_backup "/usr/libexec/keepalived/ntify.sh backup ad2 ${ad2_rt_id}" ntify_fault "/usr/libexec/keepalived/ntify.sh fault ad2 ${ad2_rt_id}" ntify_stp "/usr/libexec/keepalived/ntify.sh stp ad2 ${ad2_rt_id}" vrrp_instance VI_3 { interface ens3 state BACKUP } virtual_ruter_id 53 pririty ${pririty_map_3} unicast_src_ip ${private_ip} unicast_peer { ${peer_ip} ${peer2_ip} } ntify_master "/usr/libexec/keepalived/ntify.sh master ad3 ${ad3_rt_id}" ntify_backup "/usr/libexec/keepalived/ntify.sh backup ad3 ${ad3_rt_id}" ntify_fault "/usr/libexec/keepalived/ntify.sh fault ad3 ${ad3_rt_id}" ntify_stp "/usr/libexec/keepalived/ntify.sh stp ad3 ${ad3_rt_id}" 16 NAT INSTANCE CONFIGURATION: ENABLING INTERNET ACCESS FOR PRIVATE SUBNETS

17 Oracle Crpratin, Wrld Headquarters Wrldwide Inquiries 500 Oracle Parkway Phne: Redwd Shres, CA 94065, USA Fax: C O N N E C T W I T H U S blgs.racle.cm/racle facebk.cm/racle twitter.cm/racle racle.cm Cpyright 2018, Oracle and/r its affiliates. All rights reserved. This dcument is prvided fr infrmatin purpses nly, and the cntents heref are subject t change withut ntice. This dcument is nt warranted t be errr-free, nr subject t any ther warranties r cnditins, whether expressed rally r implied in law, including implied warranties and cnditins f merchantability r fitness fr a particular purpse. We specifically disclaim any liability with respect t this dcument, and n cntractual bligatins are frmed either directly r indirectly by this dcument. This dcument may nt be reprduced r transmitted in any frm r by any means, electrnic r mechanical, fr any purpse, withut ur prir written permissin. Oracle and Java are registered trademarks f Oracle and/r its affiliates. Other names may be trademarks f their respective wners. Intel and Intel Xen are trademarks r registered trademarks f Intel Crpratin. All SPARC trademarks are used under license and are trademarks r registered trademarks f SPARC Internatinal, Inc. AMD, Optern, the AMD lg, and the AMD Optern lg are trademarks r registered trademarks f Advanced Micr Devices. UNIX is a registered trademark f The Open Grup NAT Instance Cnfiguratin: Enabling Internet Access fr Private Subnets February 2018