平安云|Ping An Cloud- Building Your Smart Future

Provide Services to the Internet through DNAT

This article describes how ECS instances in the VPC provide external services to the Internet through the DNAT function of the NAT gateway. Prerequisites • You have successfully purchased a VPC, and created a DMZ network domain and subnet. For more information, see <a href="https://yun.pingan.com/ssr/help/network/vpc/quick_start.cvcti" target="_blank">Quick Start</a> of VPC. • You have already purchased a ECS instance in the subnet of the DMZ network domain of the VPC. Limitations • You can apply for a maximum of five public IP addresses for one bandwidth package. • The maximum bandwidth is 200 Mbps. If you want to purchase a bandwidth package with a size of more than 200 Mbps, submit a ticket to apply for it. Step 1: Create a NAT Gateway 1. Log in to the <a href="https://www.pinganyun.com/console/vpc/overview" target="_blank">VPC Console</a>. 2. Click NAT Gateway in the left navigation pane to enter the NAT Gateway page. 3. Click Create in the upper-right corner to enter the Create NAT Gateway page. 4. Create a NAT gateway based on the following information. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20201707142055-1d8fde8b938f.png" style="height:361px; width:830px" /> Configuration Service <table border="1" cellpadding="0" cellspacing="0" style="width:0px"> <tbody> <tr> <td style="background-color:#ededed; width:173px"> Configuration item </td> <td style="background-color:#ededed; vertical-align:top; width:610px"> Description </td> </tr> <tr> <td style="width:173px"> Region </td> <td style="vertical-align:top; width:610px"> Select the region for the VPC that needs to create the NAT gateway. </td> </tr> <tr> <td style="width:173px"> VPC </td> <td style="vertical-align:top; width:610px"> Select the VPC that the NAT gateway belongs to. </td> </tr> <tr> <td style="width:173px"> Specification </td> <td style="vertical-align:top; width:610px"> Select the specification for the NAT gateway. Currently the NAT gateway has small and medium specifications which are priced differently. For more information, see <a href="https://yun.pingan.com/ssr/help/network/NAT_Gateway/Product_Profile.spec" target="_blank">Specifications</a> and <a href="https://yun.pingan.com/ssr/help/network/NAT_Gateway/buy.Price" target="_blank">Billing Overview</a>. </td> </tr> <tr> <td style="width:173px"> Billing method </td> <td style="vertical-align:top; width:610px"> Currently, the NAT gateway is charged by hour. </td> </tr> <tr> <td style="width:173px"> Description </td> <td style="vertical-align:top; width:610px"> Enter the custom descriptive name of the NAT gateway. </td> </tr> </tbody> </table> 5. Click Purchase to enter the Order Confirmation page. 6. Click CONFIRM OPEN to enter the Payment Result page. 7. Click MANAGE CONSOLE to return to the NAT Gateway page. Step 2: Create a Bandwidth Package 1. Click the name of the NAT gateway created in Step 1 to enter the NAT Detail page. 2. Click the Bandwidth tab. 3. On the Bandwidth tab, click Create in the upper-right corner to enter the Create Broadband page. 4. Create a broadband package based on the following information. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20201707142311-15c89d5690d3.png" style="height:382px; width:719px" /> Basic Information <table border="1" cellpadding="0" cellspacing="0" style="width:0px"> <tbody> <tr> <td style="background-color:#ededed; width:182px"> Configuration item </td> <td style="background-color:#ededed; vertical-align:top; width:601px"> Description </td> </tr> <tr> <td style="width:182px"> ISP </td> <td style="vertical-align:top; width:601px"> Select the Internet service provider. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20201707142936-11e74dd39125.png" style="height:21px; margin:1px; width:50px" />: The carrier link of BGP is online on April 29th, 2020. The launch of this function will not affect (such as the use and new purchases of) existing users who have already purchased MAN. For users who do not purchase the bandwidth package of NAT gateway of MAN carrier, only the purchase of the carrier link of BGP is offered. </td> </tr> <tr> <td style="width:182px"> Total bandwidth </td> <td style="vertical-align:top; width:601px"> Select the bandwidth in the range of 1 to 200. The bandwidth package is billed based on the size. </td> </tr> <tr> <td style="width:182px"> Billing method </td> <td style="vertical-align:top; width:601px"> Currently, the bandwidth package is charged by hour. </td> </tr> <tr> <td style="width:182px"> Internet IP amount </td> <td style="vertical-align:top; width:601px"> Select the number of public IP addresses in the range of one to five. </td> </tr> </tbody> </table> 5. Click Purchase to enter the Order Confirmation page. 6. Click CONFIRM OPEN to enter the Payment Result page. 7. Click MANAGE CONSOLE to return to the NAT Gateway page. Step 3: Create a DNAT Rule 1. Click the instance name of the NAT gateway created in Step 1 to enter the NAT Detail page. 2. Click the DNAT Rule tab. 3. On the DNAT Rule tab, click Create in the upper-right corner to enter the Create DNAT Rule page. 4. Create a DNAT rule based on the following information. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20201707142346-1d14e7e2904d.png" style="height:556px; width:663px" /> Basic Information <table border="1" cellpadding="0" cellspacing="0" style="width:0px"> <tbody> <tr> <td style="background-color:#ededed; width:186px"> Configuration item </td> <td style="background-color:#ededed; vertical-align:top; width:597px"> Description </td> </tr> <tr> <td style="width:186px"> Mapping type </td> <td style="vertical-align:top; width:597px"> IP Mapping and Port Mapping can be selected. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20201707142936-11e74dd39125.png" style="height:21px; margin:1px; width:50px" />: • When a service occupies only a few fixed ports to provide services, you can use the port mapping function to maximize the usage of a single public IP. • When a service needs unfixed number or a large number of ports, you can use the IP mapping function, so that one ECS instance only needs to occupy one public IP </td> </tr> <tr> <td style="width:186px"> Internet IP </td> <td style="vertical-align:top; width:597px"> Select one or multiple public IP addresses. If the type of DNAT rule is port mapping, you need to enter the port number. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20201707142936-11e74dd39125.png" style="height:21px; margin:1px; width:50px" />: The public IP selected here is the public IP applied in Step 2. </td> </tr> <tr> <td style="width:186px"> Private IP </td> <td style="vertical-align:top; width:597px"> You can select the ECS instance in the VPC which provides external services to the Internet through one of the two following ways: • Click Select Instance, and perform the following operations: 1. Click Add Instance, and the Add Instance dialog box will open. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20201707142936-11e74dd39125.png" style="height:21px; margin:1px; width:50px" />: The ECS instances listed in the dialog box are in the DMZ network domain of the VPC where the NAT gateway belongs to. 2. Select the ECS instance that needs to provide external services to the Internet, and click Confirm. 3. If the type of the DNAT rule is port mapping, you need to enter the port number. • Click Custom IP address, and perform the following operations: 1. Fill in the IP address of the ECS instance that provides external services. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20201707142936-11e74dd39125.png" style="height:21px; margin:1px; width:50px" />: Please confirm that the IP address is in the subnet of the DMZ network domain of the VPC that the NAT gateway belongs to. 2. If the type of the DNAT rule is port mapping, enter the port number. </td> </tr> <tr> <td style="width:186px"> Protocol type </td> <td style="vertical-align:top; width:597px"> If the type of the DNAT rule is port mapping, you need to select the protocol type. There are two protocol types, including TCP and UDP. You can select one or two protocol types of them. </td> </tr> <tr> <td style="width:186px"> Description </td> <td style="vertical-align:top; width:597px"> Customize the description of the DNAT rule. </td> </tr> </tbody> </table> 5. Click Create to return to the DNAT Rule tab, where you can view the newly created DNAT rule. Step 4: Configure the Security Group 1. Log in to the <a href="https://yun.pingan.com/console/ecs/overview" target="_blank">ECS Console</a>. 2. Click Networks > Security Group in the left navigation pane to enter the Security Group page. 3. Click Create in the upper-right corner, and the Create Security Group dialog box will open. 4. Select the VPC and DMZ network domains which the NAT gateway belongs to, and click Confirm to create a security group. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20201707142450-134f09b9905c.png" style="height:309px; width:767px" /> 5. Click the name of the security group created to enter the Security Group Information page. 6. On the ECS Instance tab, click Add in the upper-right corner, and the Binding dialog box will open. 7. Select the ECS instances that need to provide external services, and click Confirm to add the ECS instances to the security group. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20201707142516-16d59da6987f.png" style="height:328px; width:830px" /> 8. Click the Security Group Rules tab, and click Create in the upper-right corner of the tab. The dialog box of Create Security Group Rules will open. 9. Create a security group based on the following information. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20201707142543-19e4bddc9c7f.png" style="height:557px; width:763px" /> <table border="1" cellpadding="0" cellspacing="0" style="width:0px"> <tbody> <tr> <td style="background-color:#ededed; width:209px"> Configuration item </td> <td style="background-color:#ededed; vertical-align:top; width:574px"> Description </td> </tr> <tr> <td style="width:209px"> Rules direction </td> <td style="vertical-align:top; width:574px"> Select the direction of security group rule as IN: it means that it allows the authorized IP to access the instance in the security group. </td> </tr> <tr> <td style="width:209px"> Protocol type </td> <td style="vertical-align:top; width:574px"> Select the type of network protocol. Currently TCP, UDP, and ICMP are supported. </td> </tr> <tr> <td style="width:209px"> Port range </td> <td style="vertical-align:top; width:574px"> If the protocol type is selected as TCP or UDP, you need to enter the port range. The value range for the port is 1 to 65535. </td> </tr> <tr> <td style="width:209px"> Authorize IP </td> <td style="vertical-align:top; width:574px"> Enter the authorized IP address. </td> </tr> <tr> <td style="width:209px"> Description </td> <td style="vertical-align:top; width:574px"> Customize the description of the security group rule. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20201707142936-11e74dd39125.png" style="height:21px; margin:1px; width:50px" />: A maximum of 50 characters. </td> </tr> </tbody> </table> 10. Click Confirm, and you will see an Operation succeeded message at the bottom of the page.

Did the above content solve your problem? Yes No