Setting up a secure network configuration
- Reserve two static public IP addresses
- Create VMs for the service in all availability zones
- Create an IPSec instance for remote access
- Configure VPN routing
- Create and configure security groups
- Assign the security groups to the VMs
- Create a network load balancer
- Test the infrastructure
- Delete the resources you created
Reserve two static public IP addresses
For your internet service to run, you need two static public IP addresses: one to be assigned to the VPN gateway and the other to the network load balancer.
- In the management console
, open Virtual Private Cloud in the folder where you want to reserve the IP addresses. - Open the IP addresses tab. Click Reserve address.
- In the window that opens, select the
ru-central1-b
availability zone. Click ** Reserve**. - Click Reserve address once again.
- In the window that opens, select the
ru-central1-a
availability zone. Click ** Reserve**.
Note
We are gradually deprecating the ru-central1-c
availability zone. For more information about development plans for availability zones and migration options, see this Yandex Cloud blog post.
Create VMs for the service in all availability zones
- In the management console
, open your folder and click Create resource. Select Virtual machine instance. - Enter the VM name:
web-node-a
. - Select the
ru-central1-a
availability zone. - Under Boot disk image, go to the Marketplace tab, click Show all Marketplace products, and select the Drupal image.
- Under Network settings, select
subnet-a
. Under Public IP, selectNo address
. - In the Access field, enter the login and SSH key to access the VM.
- Click Create VM.
- Do the same for the
web-node-b
andweb-node-d
VMs. Create the VMs in theru-central1-b
andru-central1-d
availability zones and connect them tosubnet-b
andsubnet-d
, respectively.
Create an IPSec instance for remote access
To provide secure access to your resources, create an IPSec instance.
- In the management console
, open your folder and click Create resource. Select Virtual machine instance. - Enter the VM name:
vpc
. - Select the
ru-central1-a
availability zone. - Under Boot disk image, go to the Marketplace tab, click Show all Marketplace products, and select the IPSec instance image.
- Under Network settings, select
subnet-a
. Under Public IP, select a reserved IP address from the list. - In the Access field, enter the login and SSH key to access the VM.
- Click Create VM.
Configure VPN routing
Configure routing between the remote network and your IPSec instance. In the example, we will use the 192.168.0.0/24
subnet.
Create a route table
Create a route table and add static routes:
- In the management console
, open the Virtual Private Cloud section in the folder where you want to configure routing. - Select the network to create the route table in.
- In the left-hand panel, select
Routing tables. - Click Create.
- Enter the route table name:
vpn-route
. - Click Add a route.
- In the window that opens, enter the prefix of the remote site destination subnet. In our example, it is
192.168.0.0/24
. - In the Next hop field, enter the internal IP address of the IPSec gateway. Click Add.
- Click Create a routing table.
Link the route table to all subnets
To use static routes, link the route table to a subnet. To do this:
- In the management console
, open Virtual Private Cloud in the folder where you want to configure routing. - Select the network with the subnets to assign the route table to.
- In the row with the subnet you need, click
. - In the menu that opens, select Link routing table.
- In the window that opens, select the created table from the list.
- Click Link.
- Link the route table named
vpn-route
to all the three subnets.
Create and configure security groups
To distribute traffic between network segments, create security groups and set up rules for receiving and sending traffic.
Create a security group for a VPN
For a VPN to work properly, enable receiving and transmitting traffic to UDP ports 500
and 4500
from an external network. This is required for using the IPSec tunnel. You also need to allow traffic between the subnets of your virtual network and the network on the remote site.
- In the management console
, open Virtual Private Cloud in the folder where you want to create a security group. - In the left-hand panel, select
Security groups. - Click Create security group.
- Enter the security group name:
vpn-sg
. - In the Network field, select the network that the security group will refer to.
- Under Rules, create traffic management rules:
- Select the Egress tab.
- Click Add rule.
- In the window that opens, set the port to
500
in the Port range field. - In the Protocol field, select
UDP
. - In the Destination name field, specify the public address of a remote VPN hub with the
32
mask.
- Click Save.
- Click Add rule.
- In the window that opens, set the port to
4500
in the Port range field. - In the Protocol field, select
UDP
. - In the Destination name field, specify the public address of a remote VPN hub with the
32
mask.
- In the window that opens, set the port to
- Click Save.
- Set up rules that allow traffic between the web servers and VMs on the remote site. Click Add rule.
- In the window that opens, click Select the full range in the Port range field.
- In the Protocol field, select
Any
. - In the Destination name field, specify the internal network CIDR:
10.0.0.0/8
. - Click Add CIDR and specify the remote site CIDR:
192.168.0.0/24
.
- Create the same rules for incoming traffic.
Create a security group for the internet service VMs
Create a security group named web-service-sg
and configure traffic rules.
Rules for outgoing traffic
Allow outgoing connections to other VM instances in the security group:
- Protocol:
Any
- Destination name:
Security group
- Security group:
Current
Rules for incoming traffic
Allow the following incoming connections:
- HTTP connections from multiple test dummy IP addresses:
- Protocol:
TCP
- Port range:
80
- CIDR:
1.1.1.1/32
,85.32.45.45/32
- Protocol:
- HTTPS connections from multiple test dummy IP addresses:
- Protocol:
TCP
- Port range:
443
- CIDR:
1.1.1.1/32
,85.32.45.45/32
- Protocol:
- TCP connections for SSH access:
- Protocol:
TCP
- Port range:
22
- CIDR:
0.0.0.0/0
- Protocol:
- Connections from other VM instances in the security group:
- Protocol:
Any
- Destination name:
Security group
- Security group:
Current
- Protocol:
- Health checks from the network load balancer:
- Protocol:
Any
- Port range:
80
- CIDR:
198.18.235.0/24
and198.18.248.0/24
- Protocol:
Assign the security groups to the VMs
For the security group rules to take effect, assign the groups to the VM network interfaces.
- In the management console
, open Compute Cloud. - Select the
vpn
VM. - Under Network, click
and select Edit. - In the window that opens, select the
vpn-sg
security group in the Security groups field. - Click Save.
- Repeat the steps and assign the
web-service-sg
security group to theweb-node-a
,web-node-b
, andweb-node-d
VMs.
Create a network load balancer
The network load balancer will distribute the internet service's incoming traffic across the VMs in the target group.
To create a network load balancer:
- In the management console
, open Network Load Balancer in the folder where you want to create a load balancer. - Click Create a network load balancer.
- Enter the load balancer name:
web-service-lb
. - In the Public address field, select
List
and specify a static public address. - Under Listeners, click Add listener.
- In the window that opens, enter a name for the listener and set the port to
80
in the Port and Target port fields. Click Add. - Under Target groups, click Add target group.
- In the Target group field, click the list and then click
Create target group. - In the window that opens, enter the target group name:
web-tg
. - Select the
web-node-a
,web-node-b
, andweb-node-d
VMs. - Click Create.
- Select the created target group from the list.
- Click Create.
Test the infrastructure
Test the infrastructure and make sure that traffic to the internet service VMs only comes from the addresses allowed by the rules:
- On your computer, run
curl <Network_load_balancer_public_IP_address>
. Make sure you get no response. - Create a security group named
web-service-test-sg
with no rules and assign it to theweb-node-a
,web-node-b
, andweb-node-d
VMs. - In the
web-service-test-sg
security group, create the following rule for incoming traffic:- Protocol:
TCP
- Port range:
80
- CIDR:
<IP_address_of_your_computer>/32
- Protocol:
- On your computer, run
curl <Network_load_balancer_public_IP_address>
once again. Make sure the Drupal homepage HTML code is returned in response. - Delete the test security group.
Delete the resources you created
To stop paying for the deployed resources, delete the VMs and the load balancer you created:
vpn
web-node-a
web-node-b
web-node-d
web-service-lb
Release and delete the static public IP addresses you reserved.