Contact UsGet started

Architecture and protection of a basic internet service

Written by
Updated at October 1, 2024

You will deploy and configure the infrastructure of a basic internet service with multiple VMs. Access to VMs will be restricted using security groups. A network load balancer will distribute the load across web app servers.

To create the infrastructure of an internet service:

  1. Prepare your cloud.
  2. Prepare the network infrastructure.
  3. Reserve two static public IP addresses.
  4. Create VMs for the service in all availability zones.
  5. Create an IPSec instance for remote access.
  6. Configure VPN routing.
  7. Create a route table.
  8. Link the route table to all subnets.
  9. Create and configure security groups.
  10. Assign the security groups to the VMs.
  11. Create a network load balancer.
  12. Test the infrastructure.

If you no longer need the infrastructure, delete the created resources.

Prepare your cloud

Sign up for Yandex Cloud and create a billing account:

  1. Go to the management console and log in to Yandex Cloud or create an account if you do not have one yet.
  2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one.

If you have an active billing account, you can go to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

The cost of internet service support includes:

Prepare the network infrastructure

Before creating a VM:

  1. Go to the Yandex Cloud management console and open the folder where you want to perform the operations.
  2. Select Virtual Private Cloud and create a cloud network with subnets named subnet-a, subnet-b, and subnet-d in the ru-central1-a, ru-central1-b, and ru-central1-d availability zones, respectively.

Reserve two static public IP addresses

For your internet service to run, you need two static public IP addresses: one to be assigned to the VPN gateway and the other to the network load balancer.

  1. In the management console, select Virtual Private Cloud in the folder where you want to reserve the IP addresses.
  2. In the left-hand panel, select IP addresses. Click Reserve address.
  3. In the window that opens, select the ru-central1-b availability zone. Click ** Reserve**.
  4. Click Reserve address once again.
  5. In the window that opens, select the ru-central1-a availability zone. Click ** Reserve**.

Create VMs for the service in all availability zones

  1. In the management console, open your folder and click Create resource in the top-right corner. Select Virtual machine instance.
  2. Enter the VM name: web-node-a.
  3. Select the ru-central1-a availability zone.
  4. Under Boot disk image, go to the Marketplace tab and select the Drupal image.
  5. Under Network settings, select the subnet-a subnet. In the Public IP field, select No address.
  6. In the Access field, enter the login and SSH key to access the VM. You need to create an SSH key pair yourself.
  7. Click Create VM.
  8. Repeat the steps for the VMs named web-node-b and web-node-d. Create them in the ru-central1-b and ru-central1-d availability zones and connect them to subnet-b and subnet-d, respectively.

Create an IPSec instance for remote access

To provide secure access to your resources, create an IPSec instance.

  1. In the management console, open your folder and click Create resource in the top-right corner. Select Virtual machine instance.
  2. Enter the VM name: vpn.
  3. Select the ru-central1-a availability zone.
  4. Under Boot disk image, go to the Marketplace tab and select the IPSec instance image.
  5. Under Network settings, select the subnet-a subnet. In the Public IP field, select List. In the list that opens, select the IP address that you reserved.
  6. In the Access field, enter the login and SSH key to access the VM.
  7. Click Create VM.

Configure VPN routing

Configure routing between the remote network and your IPSec instance. In the example, we will use the 192.168.0.0/24 subnet.

Create a route table

Create a route table and add static routes:

  1. In the management console, select Virtual Private Cloud in the folder where you want to configure routing.
  2. Select the network to create the route table in.
  3. Open the Routing tables tab.
  4. In the top-right corner, click Create.
  5. Enter the route table name: vpn-route.
  6. Under Static routes, click Add a route.
  7. In the window that opens, enter the remote site's destination subnet prefix. In this example, it is 192.168.0.0/24.
  8. In the Next hop field, enter the internal IP address of the IPSec gateway. Click Add.
  9. Click Create a routing table.

Link the route table to all subnets

To use static routes, link the route table to a subnet. To do this:

  1. In the management console, select Virtual Private Cloud in the folder where you want to configure routing.
  2. In the left-hand panel, select Subnets.
  3. In the line of the subnet you need, click and select Link routing table.
  4. In the window that opens, select the created table in the Route table field.
  5. Click Link.
  6. Link the vpn-route route table to all three subnets.

Create and configure security groups

To distribute traffic between network segments, create security groups and set up rules for receiving and sending traffic.

Create a security group for a VPN

For a VPN to work properly, allow traffic to be received and transmitted to UDP ports 500 and 4500 from an external network. This is required for using the IPSec tunnel. You also need to allow traffic between the subnets of your virtual network and the network on the remote site.

  1. In the management console, select Virtual Private Cloud in the folder where you want to create a security group.
  2. In the left-hand panel, select Security groups.
  3. Click Create security group.
  4. Enter the security group name: vpn-sg.
  5. In the Network field, select the network that the security group will refer to.
  6. Under Rules, create rules for outgoing traffic management: To do this, select the Egress tab.
  7. Click Add rule. In the window that opens:
    1. In the Port range field, specify port 500.
    2. In the Protocol field, select UDP.
    3. In the Destination name field, select CIDR.
    4. In the CIDR blocks field, specify the public address of a remote VPN hub with mask 32.
    5. Click Save.
  8. Click Add rule. In the window that opens:
    1. In the Port range field, specify port 4500.
    2. In the Protocol field, select UDP.
    3. In the Destination name field, select CIDR.
    4. In the CIDR blocks field, specify the public address of a remote VPN hub with mask 32.
    5. Click Save.
  9. Set up rules that allow traffic between the web servers and VMs on the remote site. Click Add rule. In the window that opens:
    1. In the Port range field, click Select the full range.
    2. In the Protocol field, select Any.
    3. In the Destination name field, select CIDR.
    4. In the CIDR blocks field, specify the internal network CIDR: 10.0.0.0/8.
    5. Click Add CIDR and specify the remote site CIDR: 192.168.0.0/24.
    6. Click Save.
  10. Select the Ingress tab and create similar rules for incoming traffic.

Create a security group for the internet service VMs

Create a security group named web-service-sg and set up traffic rules.

Rules for outgoing traffic

Allow outgoing connections to other VM instances in the security group:

  • Protocol: Any
  • Destination name: Security group
  • Security group: Current

Rules for incoming traffic

Allow the following incoming connections:

  1. HTTP connections from multiple test dummy IP addresses:
    • Port range: 80
    • Protocol: TCP
    • CIDR blocks: 1.1.1.1/32, 85.32.45.45/32
  2. HTTPS connections from multiple test dummy IP addresses:
    • Port range: 443
    • Protocol: TCP
    • CIDR blocks: 1.1.1.1/32, 85.32.45.45/32
  3. TCP connections for SSH access:
    • Port range: 22
    • Protocol: TCP
    • CIDR blocks: 0.0.0.0/0
  4. Connections from other VM instances in the security group:
    • Protocol: Any
    • Source: Security group
    • Security group: Current
  5. Health checks from the network load balancer:
    • Port range: 80
    • Protocol: TCP
    • Source: Load balancer healthchecks.

Assign the security groups to the VMs

For the security group rules to take effect, assign the groups to the VM network interfaces.

  1. In the management console, select Compute Cloud.
  2. Select the vpn VM.
  3. Under Network, click and select Edit.
  4. In the window that opens, select the vpn-sg security group.
  5. Click Save.
  6. Repeat the steps and assign the web-service-sg security group to the web-node-a, web-node-b, and web-node-d VMs.

Create a network load balancer

The network load balancer will distribute the internet service's incoming traffic across the VMs in the target group.

To create a network load balancer:

  1. In the management console, select Network Load Balancer in the folder to create the load balancer in.
  2. Click Create a network load balancer.
  3. Enter the load balancer name: web-service-lb.
  4. In the Public address field, select List and specify a static public address.
  5. Under Listeners, click Add listener.
  6. In the window that opens, enter a name for the listener and specify port 80 in the Port and Target port fields. Click Add.
  7. Under Target groups, click Add target group.
  8. In the Target group field, click → Create target group. In the window that opens:
    1. Enter the target group name: web-tg.
    2. Select the web-node-a, web-node-b, and web-node-d VMs.
    3. Click Create.
  9. Select the created target group from the list and change the protocol for the load balancer's health checks to TCP in the settings:
    1. Click Configure.
    2. In the Type field of the window that opens, select TCP and click Apply.
  10. Click Save.

Test the infrastructure

Test the infrastructure and make sure that traffic to the internet service VMs only comes from the addresses allowed by the rules:

  1. On your computer, run the command: curl <network_load_balancer_public_IP_address>. Make sure no response is received.
  2. Create a security group named web-service-test-sg with no rules and assign it to the web-node-a, web-node-b, and web-node-d VMs.
  3. In the web-service-test-sg security group, create the following rule for incoming traffic:
    • Port range: 80
    • Protocol: TCP
    • Source: CIDR
    • CIDR blocks: <Your_PC_IP_address>/32
  4. Run the curl <network_load_balancer_public_IP_address> command again on your PC. Make sure the Drupal homepage HTML code is returned in response.
  5. Delete the test security group.

How to delete the resources you created

To shut down the infrastructure and stop paying for the deployed resources, delete the VMs and the load balancer you created:

  • vpn
  • web-node-a
  • web-node-b
  • web-node-d
  • web-service-lb

Release and delete the static public IP addresses you reserved.

Previous
All tutorials
Next
Configuring a fault-tolerant architecture in Yandex Cloud