Public connection

A public connection provides access to Yandex Cloud services. A public connection is set up within a trunk and has its own unique VLAN-ID. A single trunk can host multiple public connections enabling access to various combinations of services.

The maximum IP MTU for a public connection is 1,500 bytes. Yandex Cloud equipment does not support changing the IP MTU.

List of servicesList of services

Each Yandex Cloud service has its own entry point: API Endpoint. You can view the list of entry points for Yandex Cloud services here. Each entry point has its own ID and address that consists of FQDN API Endpoint and the number of the port to which this service gets requests.

Below, you can see the list of Yandex Cloud services you can access through a public connection:

Service name	API Endpoint (FQDN)
Object Storage	storage.yandexcloud.net
Container Registry	container-registry.api.cloud.yandex.net, cr.yandex
Yandex SpeechKit	transcribe.api.cloud.yandex.net tts.api.cloud.yandex.net stt.api.cloud.yandex.net
Yandex Monitoring	monitoring.api.cloud.yandex.net
All-Services	All Yandex Cloud services listed above

Technically, a public connection ensures connectivity between your infrastructure and the IP address to which the respective service's FQDN API Endpoint is converted. FQDN is converted to an IP address through DNS.

For example, if you want to get access from your infrastructure to Object Storage through a service connection, the Yandex Cloud equipment will announce the 213.180.193.243/32 prefix to your router over BGP. This prefix maps to the storage.yandexcloud.net API Endpoint FQDN for Object Storage.

You need to set up traffic routing in your infrastructure so that traffic to Yandex Cloud services goes through the devices handling NAT functions for the public connection.

Point-to-point subnetPoint-to-point subnet

You can set up a point-to-point subnet for public connection using the following methods:

1. Using IPv4 addresses from the Yandex Cloud address pool. With this method, the customer is assigned a /31 point-to-point subnet from the Yandex Cloud address pool. The customer must use a private BGP ASN to set up BGP peering.
2. Using private (RFC-1918) or custom public IPv4 addresses. This method is used if the customer plans to announce their custom public IP prefixes via the point-to-point subnet. In this case, the customer must follow the recommendations for setting up BGP peering listed below.

BGP connectivityBGP connectivity

BGP connectivity is required to exchange routing information, e.g., subnet prefixes, and is configured within each private or public connection between the customer’s and Yandex Cloud point of presence equipment. Once the sides exchange information about their subnets, they can route IPv4 traffic between them.

BGP ASNBGP ASN

To set up BGP connectivity, each side must specify the BGP autonomous system number (ASN) in ASPlain format. The Yandex Cloud BGP ASN is 200350.

You are allowed to use a public BGP ASN (if you have one) on the customer edge equipment. You are allowed to use any value from the following (RFC 6996) private BGP ASN ranges on the customer edge equipment:

• 64512 - 65534: For 2-byte BGP ASNs.
• 4200000000 - 4294967294: For 4-byte BGP ASNs.

You are not allowed to use the following (RFC 5398) BGP ASN ranges on the customer edge equipment:

• 64496 – 64511: For 2-byte BGP ASNs.
• 65536 – 65551: For 4-byte BGP ASNs.

You are not allowed to include any BGP ASN from the above ranges in the BGP AS_Path attribute on the customer edge equipment.

BGP authentication (optional)BGP authentication (optional)

For better BGP connection security, you can use BGP authentication based on BGP MD5 password. We recommend using passwords at least 20 characters long, including letters, numbers, and special characters.

BFD protocolBFD protocol

If you cannot connect your router to the Yandex Cloud equipment directly, you can use intermediate network devices, e.g., switches. The BFD protocol is used to quickly detect faults on the intermediate network devices.

The BFD protocol is always enabled on the Yandex Cloud equipment with the following settings:

• timer: 300ms
• multiplier: 3

These values are fixed and cannot be changed manually.

You can configure the timer setting on your equipment as needed. When establishing a BFD session, these parameters will be aligned between the customer’s and Yandex Cloud equipment.

We do not recommend setting multiplier to anything other than 3, as this may cause BFD performance issues.

BGP timersBGP timers

Below you can see the Yandex Cloud default timer values in seconds:

• minimum-hold-time = 90

Using values less than the specified ones on the customer edge equipment will cause issues with establishing a BGP adjacency.

Setting up BGP peering when announcing custom IP prefixesSetting up BGP peering when announcing custom IP prefixes

If you need to announce your own public IP prefixes for setting up BGP peering for a public connection, follow these rules:

1. Your public IP prefixes must be properly registered. This involves creating the Route Object and Route Origin Authorization objects with the regional registrar.
2. A public BGP ASN can only be used for setting up BGP peering between your equipment and Yandex Cloud equipment. Using private BGP ASNs for such communication is not allowed.
3. Your IP prefixes must be longer than or equal to /24. Yandex Cloud equipment will discard any more specific prefixes, i.e., /25 to /32.

NAT functionsNAT functions

When setting up a public connection (type 1 point-to-point subnet) with IPv4 addresses provided by Yandex Cloud, you need to implement NAT on your equipment to route your traffic correctly across Yandex Cloud services. You can implement NAT in the following ways:

• Running a NAT function on your equipment (router) which establishes the public connection. All public connection traffic originates from the IPv4 address of the router interface in the point-to-point subnet. In this case, your router handling the public connection must announce the point-to-point subnet prefix to the Yandex Cloud equipment over BGP.

• Running a NAT function on your equipment that is not used for the public connection, e.g., on a server or firewall. In this case, Yandex Cloud additionally allocates an auxiliary IPv4 address (/32 prefix), and your router handling the public connection will announce this prefix over BGP to the Yandex Cloud equipment.

When using custom IPv4 addresses (type 2 point-to-point subnet), NAT functions must utilize those IP addresses.

Use casesUse cases

• Creating a public connection
• Deleting a public connection