平安云|Ping An Cloud- Building Your Smart Future

ECS Internet Access

Cloud services can be accessed only after connecting corresponding services or Elastic Load Balancing (ELB) services to the Internet. Thus, we first need to create an Internet Gateway (IGW). ECS Internet Access (EAST CHINA) Create Internet Gateway Please perform the following steps to create an Internet gateway. 1.     On the Ping An Cloud console, click All Products → Internet Gateway to enter the Overview page of the IGW. 2.     Click IGW to enter the IGW page. 3.     Click Create in the upper right corner to enter the Create IGW page. 4.     Select the corresponding VPC and click PURCHASE to enter the Order Confirmation page. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20191204112408-1f6591aa97f1.png" style="height:367px; width:830px" /> 5.     Check the order information and click CONFIRM OPEN to complete the creation. Note: To view the IGW created, please click IGW to enter the IGW page. For the configuration details of the IGW, please click its name to enter the IGW Information page.   Add an Internet Network Interface Controller (NIC) to an ECS Please perform the following steps to add an Internet NIC to an ECS: 1.     On the IGW Information page, click ECS IP ADDRESSS to enter the ECS IP ADDRESS page. 2.     Click Create to enter the Create ECS IP Address page. 3.     Click ADD INSTANCE and the Add Instance dialog box pops up. 4.     Select the ECS instance to which you want to add a NIC and click Confirm to return to the Create ECS IP Address page. Note: You can only add Internet NICs to ECSs in DMZ. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20191204112504-1dbbeaf3975e.png" style="height:241px; width:830px" /> 5.     Select ISP and Bandwidth and click PURCHASE to enter the Order Confirmation page. 6.     Check the order information and click CONFIRM OPEN to complete the creation. Note: You can view the IP Address of the corresponding ECS on the ECS IP ADDRESS page.   Connect to an ECS via the Internet To connect to an ECS via the Internet, you need to open the ingress port TCP 3389 of the Windows ECS and the port TCP 22 of the Linux ECS, which can be operated on the security policy management page. To connect to an ECS via the Internet, please perform the following steps to create a security policy: 1.     On the ECS IP ADDRESS page, find the ECS to be configured and click Manage under Security Policy to enter the security policy management page. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20191204112534-16e876ca97d5.png" style="height:239px; width:830px" /> 2.     Click Create and the Create Security Policy dialog box pops up. 3.     Refer to the screenshot below, select the Direction and Protocol Type of the security policy, input the Port Range and Authorized IP, and click Confirm to complete the creation. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20191204112600-1afc19439eea.png" style="height:345px; width:830px" /> Note: •     In the above example of the Linux ECS, the ingress port 22 is opened and the authorized IP 0.0.0.0/0 stands for the whole Internet. If needed, you can also specify a network segment to log in. •     If an ECS needs to provide Web services for the Internet, the ports should be 80 and 443.   ECS Accesses Internet If an ECS needs to access the Internet via browsers, egress ports 80 and 443 need to be created. Please perform the following steps to create a security policy: 1.     On the ECS IP ADDRESS page, find the ECS to be configured and click Manage under Security Policy to enter the security policy management page. 2.     Click Create and the Create Security Policy dialog box pops up. 3.     Refer to the screenshot below, select the Direction and Protocol Type of the security policy, input the Port Range and Authorized IP, and click Confirm to complete the creation. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20191204112634-1e5955c19db4.png" style="height:341px; width:830px" /> Note: •         If more than one ports need to be input, please separate them with English commas. •         If the ECS needs to use the DNS service of the Internet, you need to open the egress ports TCP 53 and UDP 53 and configure a DNS server for the ECS. Configure DNS Server For Windows server <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20192702105025-182a900595d1.png" style="height:593px; width:614px" /> After the configuration, you can see the DNS server in the Network Connection Details window of the NIC. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20192702105045-15bef2a497e1.png" style="height:601px; width:442px" /> For Linux server Add a DNS server to an ECS. Enter command vi /etc/resolv.conf to modify the DNS configuration of the ECS, and add the command in the screenshot below. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20181202144400-1182e845922a.png" /> After the modification, save the file and view the DNS status. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20181202144405-15cadddb964a.png" /> Now, the DNS server has been added. By default, there is no need to add DNS server or modify the DNS information manually.   ECS Internet Access (Other Region) Create NAT Gateway Please perform the following steps to create a NAT gateway: 1.     On the Ping An Cloud console, click All Products → Virtual Private Cloud to enter the Overview page of the VPC. 2.     Click NAT Gateway to enter the NAT Gateway page. 3.     Click Create in the upper right corner to enter the Create NAT Gateway page. 4.     Select a VPC and NAT gateway specification and click PURCHASE to enter the Order Confirmation page. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20191204112746-1c9e99f09c05.png" style="height:364px; width:830px" /> 5.     Check the order information and click CONFIRM OPEN to complete the creation. Note: You can view the NAT gateway created on the NAT Gateway page. For further details of the NAT gateway, please click its name to enter the NAT Detail page.   Connect to an ECS via the Internet Destination NAT (DNAT) is used when the Internet accesses the intranet (ELB). It needs to configure security group rules with “IN” direction. Please perform the following steps to connect to an ECS via the Internet: 1.     On the NAT Detail page, click BANDWIDTH to enter the Bandwidth page. 2.     Click Create to enter the Buy Bandwidth Package page. 3.     Select Total Bandwidth and Internet IP Count and Click PURCHASE to enter the Order Confirmation page. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20191204112810-18021d0a9e58.png" style="height:323px; width:830px" /> 4.     Check the order information and click CONFIRM OPEN to complete the creation. 5.     On the NAT Detail page, click DNAT RULE to enter the DNAT Rule page. 6.     Click Create to enter the Create DNAT Rule page. 7.     Select Mapping Type and Internet IP, enter Intranet IP (the IP address of the subnet in the DMZ partition under the VPC where the NAT gateway is located) and port number, and click CREATE to complete the creation. Note: You can view the DNAT rule created on the DNAT Rule page. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20191204112833-1786f26d949e.png" style="height:352px; width:830px" /> 8.     On the console, click All Products → Elastic Compute Service to enter the Overview page of the ECS. 9.     Click Security Group to enter the Security Group page. Select SOUTH CHINA 1 region. 10.   Click Create and the Create Security Group window pops up. 11.   Select a VPC and network and Click Confirm to complete the creation. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20191204112855-17555a699b88.png" style="height:336px; width:830px" /> 12.   On the Security Group page, click the name of the corresponding security group to enter the Security Group Information page. 13.   Click Add Instance and the Add Instance window pops up. 14.   Select an instance and Click Confirm to add it to the security group. 15.   Click Security Group Rules to enter the security group rules management page. 16.   Click Create and the Create Security Group Rules window pops up. 17.   Select Rules Direction, enter Authorize IP and click Confirm to complete the creation. Note: •  The Rules Direction is IN. •  The Authorize IP is the Internet IP scope. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20191204112927-162d5eb597e5.png" style="height:346px; width:830px" />   ECS Accesses Internet Source NAT (SNAT) is used when the intranet accesses the Internet. It needs to configure a security group rule with “OUT” direction. If an ECS needs to access the Internet, Please perform the following steps: 1.     Click All Products → Virtual Private Cloud on the console to enter the Overview page of the VPC. 2.     Click NAT Gateway to enter the NAT Gateway page. 3.     Click the name of the NAT gateway to enter the NAT Detail page. 4.     Click BANDWIDTH to enter the Bandwidth page. 5.     Click Create to enter the Buy Bandwidth Package page. 6.     Select Total Bandwidth and Internet IP Count and Click PURCHASE to enter the Order Confirmation page. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20191204112947-15b0f0079d9c.png" style="height:330px; width:830px" /> 7.     Check the order information and click CONFIRM OPEN to complete the creation. 8.     On the NAT Detail page, click SNAT RULE to enter the SNAT Rule page. 9.     Click Create to enter the Create SNAT Rule page. 10.   Select Source CIDR and Internet IP and click CREATE to complete the creation. Note: You can view the SNAT rule created on the SNAT RULE page. <img src="https://obs-cn-shanghai.yun.pingan.com/pcp-portal/20191204113012-142db11a993e.png" style="height:327px; width:830px" /> 11.   On the console, click All Products → Elastic Compute Service to enter the Overview page of the ECS. 12.   Click Security Group to enter the Security Group page. Select SOUTH CHINA 1 region. 13.   Click the name of the security group created in the previous steps to enter the Security Group Information page. Click Security Group Rules. 14.   Click Create and the Create Security Group Rules window pops up. 15.   Select Rules Direction, enter Authorize IP and click Confirm to complete the creation. Note: •  The Rules Direction is OUT. •  The Authorize IP is the Internet IP scope.

Did the above content solve your problem? Yes No