Architecture and protection of a basic internet service
This scenario describes how the infrastructure of a basic internet service with multiple VMs is built. Access to VMs will be restricted using security groups. A network load balancer will distribute the load across web app servers.
To create the infrastructure of an internet service:
- Reserve two static public IP addresses.
- Create VMs for the service in all availability zones.
- Create an IPSec instance for remote access.
- Configure VPN routing.
- Create a route table.
- Link the route table to all subnets.
- Create and configure security groups.
- Assign the security groups to the VMs.
- Create a network load balancer.
- Test the infrastructure.
If you no longer need the infrastructure, delete the created resources.
Prepare your cloud
Sign up for Yandex Cloud and create a billing account:
- Go to the management console
and log in to Yandex Cloud or create an account if you do not have one yet. - On the Yandex Cloud Billing
page, make sure you have a billing account linked and it has theACTIVE
orTRIAL_ACTIVE
status. If you do not have a billing account, create one.
If you have an active billing account, you can go to the cloud page
Learn more about clouds and folders.
Create a virtual network with subnet-a
, subnet-b
, and subnet-c
in the respective availability zones.
Required paid resources
The cost of internet service support includes:
- A fee for continuously running virtual machines (see Yandex Compute Cloud pricing).
- A fee for using static public IP addresses (see Yandex Virtual Private Cloud pricing).
- A fee for using a network load balancer (see Yandex Network Load Balancer pricing).
Reserve two static public IP addresses
For your internet service to run, you need two static public IP addresses: one to be assigned to the VPN gateway and the other to the network load balancer.
- In the management console
, select Virtual Private Cloud in the folder where you want to reserve the IP addresses. - Go to the IP addresses tab. Click Reserve address.
- In the window that opens, select the
ru-central1-b
availability zone. Click Reserve address. - Click Reserve address once again.
- In the window that opens, select the
ru-central1-a
availability zone. Click Reserve address.
Create VMs for the service in all availability zones
- In the management console
, open your folder and click Create resource. Select Virtual machine. - Enter the VM name:
web-node-a
. - Select an availability zone
ru-central1-a
. - Under Image/boot disk selection, go to the Cloud Marketplace tab and select the Drupal image.
- Under Network settings, select the
subnet-a subnet
. Under Public address, select No address. - In the Access field, enter the login and SSH key to access the VM.
- Click Create VM.
- Repeat the steps for VMs named
web-node-b
andweb-node-c
. Create them in theru-central1-b
andru-central1-c
availability zones and connect them tosubnet-b
andsubnet-c
, respectively.
Create an IPSec instance for remote access
To provide secure access to your resources, create an IPSec instance.
- In the management console
, open your folder and click Create resource. Select Virtual machine. - Enter the VM name:
vpn
. - Select an availability zone
ru-central1-a
. - Under Image/boot disk selection, go to the Cloud Marketplace tab and select an IPSec instance image.
- Under Network settings, select the
subnet-a subnet
. Under Public address, select from a list of reserved IPs. - In the Access field, enter the login and SSH key to access the VM.
- Click Create VM.
Configure VPN routing
Configure routing between the remote network and your IPSec instance. In the example, we'll use the subnet 192.168.0.0/24
.
Create a route table
Create a route table and add static routes:
- In the management console
, open the Virtual Private Cloud section in the folder where you want to configure routing. - Select the network to create the route table in.
- Open the Route tables tab.
- Click
Create a routing table. - Enter the route table name:
vpn-route
. - Click Add route.
- In the window that opens, enter the remote site's destination subnet prefix. In this example, this is
192.168.0.0/24
. - In the Next hop field, enter the internal IP address of the IPSec gateway. Click Add.
- Click Create route table.
Link the route table to all subnets
To use static routes, link the route table to a subnet. To do this:
- In the management console
, select Virtual Private Cloud in the folder where you want to configure routing. - Select the network with the subnets to assign the route table to.
- In the line with the desired subnet, click
. - In the menu that opens, select Link route table.
- In the window that opens, select the created table from the list.
- Click Link.
- Link the
vpn-route
route table to all three subnets.
Create and configure security groups
To distribute traffic between network segments, create security groups and set up rules for receiving and sending traffic.
Create a security group for a VPN
For a VPN to work properly, allow traffic to be received and transmitted to UDP ports 500
and 4500
from an external network. This is necessary to use the IPSec tunnel. You should also allow traffic to pass between the subnets of your virtual network and the network on the remote site.
- In the management console
, select Virtual Private Cloud in the folder where you want to create a security group. - Open the Security groups tab.
- Click Create group.
- Enter the security group name:
vpn-sg
. - In the Network field, select the network that the security group will refer to.
- Under Rules, create traffic management rules:
- Open the Outgoing traffic tab.
- Click Add rule.
- In the window that opens, set Port to
500
. - In the Protocol field, select
UDP
. - In the Destination field, specify the public address of a remote VPN hub with mask
32
.
- Click Save.
- Click Add rule.
- In the window that opens, set Port to
4500
. - In the Protocol field, select
UDP
. - In the Destination field, specify the public address of a remote VPN hub with mask
32
.
- In the window that opens, set Port to
- Click Save.
- Set up rules that allow traffic between the web servers and VMs on the remote site. Click Add rule.
- In the Port field of the window that opens, click Select the full range.
- In the Protocol field, select
Any
. - In the Destination field, specify the internal network CIDR:
10.0.0.0/8
. - Click Add CIDR and specify the remote site CIDR:
192.168.0.0/24
.
- Create the same rules for incoming traffic.
Create a security group for the internet service VMs
Create a security group named web-service-sg
and set up traffic rules.
Rules for outgoing traffic
Allow outgoing connections to other VM instances in the security group:
- protocol:
Any
, - Type of destination: Security group.
- destination:
Current
.
Rules for incoming traffic
Allow the following incoming connections:
- HTTP connections from multiple test dummy IP addresses:
- Protocol:
TCP
, - Port:
80
, - CIDR:
1.1.1.1/32
,85.32.45.45/32
.
- Protocol:
- HTTPS connections from multiple test dummy IP addresses:
- Protocol:
TCP
, - Port:
443
, - CIDR:
1.1.1.1/32
,85.32.45.45/32
.
- Protocol:
- TCP connections for SSH access:
- Protocol:
TCP
, - Port:
22
, - CIDR:
0.0.0.0/0
.
- Protocol:
- Connections from other VM instances in the security group:
- Protocol:
Any
. - Type of destination: Security group.
- Destination:
Current
.
- Protocol:
- Health checks from the network load balancer:
- Protocol:
TCP
. - Port:
80
. - Source:
Load balancer health checks
.
- Protocol:
Assign the security groups to the VMs
For the security group rules to take effect, assign the groups to the VM network interfaces.
- In the management console
, select Compute Cloud. - Select the
vpn
VM. - Under Network, click
and select Edit network interface. - In the window that opens, select the
vpn-sg
security group. - Click Save.
- Repeat the steps and assign the
web-service-sg
security group to theweb-node-a
,web-node-b
, andweb-node-c
VMs.
Create a network load balancer
The network load balancer will distribute the internet service's incoming traffic across the VMs in the target group.
To create a network load balancer:
- In the management console
, select Network Load Balancer in the folder to create the load balancer in. - Click Create load balancer.
- Enter the load balancer name:
web-service-lb
. - In the Public address field, select List and specify a static public address.
- Click Add listener under Listeners.
- In the window that opens, enter a name for the listener and specify port
80
in the Port and Target port fields. Click Add. - Under Target groups, click Add target group.
- In the Target group field, click on the list and then click Create target group.
- In the window that opens, enter the target group name:
web-tg
. - Select the
web-node-a
,web-node-b
, andweb-node-c
VMs. - Click Create.
- Select the created target group from the list.
- Click Create.
Test the infrastructure
Test the infrastructure and make sure that traffic to the internet service VMs only comes from the addresses allowed by the rules:
- On your computer, run the command:
curl <Network load balancer public IP address>
. Make sure no response is received. - Create a security group named
web-service-test-sg
with no rules and assign it to theweb-node-a
,web-node-b
andweb-node-c
. VMs. - In the
web-service-test-sg
security group, create the following rule for incoming traffic:- Protocol:
TCP
. - port
80
, - CIDR:
<IP address of your computer>/32
.
- Protocol:
- Run the command
curl <Network load balancer public IP address>
on your computer once again. Make sure the Drupal homepage HTML code is returned in response. - Delete the test security group.
Delete the resources you created
To stop paying for the deployed resources, delete the created VMs and the load balancer:
vpn
web-node-a
web-node-b
web-node-c
web-service-lb
Release and delete the static public IP addresses you reserved.