Using the OCI NAT Gateway to allow OCI Instances (connected to a private subnet) to access the internet

As you know by default RFC1918 addresses can not be routed to the internet and to reach the internet the PRIVATE RFC1918 address needs to be translated to a public IP address. Within OCI we can do this using a NAT Gateway inside the corresponding VCN.

This article will explain how internet access is provided from an Instance that is connected to a subnet using a PRIVATE (RFC1918) IPv4 address.

The Steps

• STEP 01: Create a new VCN
• STEP 02: Create a private subnet inside the VCN
• STEP 03: Create a new Instance
• STEP 04: Create a Private Network Definition (so that I can log in to the Instance using Cloud Shell)
• STEP 05: Verify Internet connectivity on the Instance
• STEP 06: Create a NAT Gateway and route the internet traffic to the NAT Gateway

STEP 01: Create a new VCN

If there is already an existing VCN you can skip this step and continue with the next step. If not please continue with opening the hamburger menu.

Click on “Virtual Cloud Networking”.

1. Select the right compartment that you want to work in.
   1. If you have not set up the compartment just use the root compartment
2. Click on “Create VCN”.

1. Provide a VCN Name.
2. Specify the IPv4 CIDR that I want to use inside this VCN.
   1. I make sure I use a /16 CIDR because my IPv4 Subnets (typically /24’s) will be carved out of this CIDR clock.
3. Scroll Down.

Leave everything default and Scroll Down.

Click on “Create VCN”.

STEP 02: Create a private subnet inside the VCN

1. Review if the VCN is available.
2. Click on “Create Subnet”.

1. Specify a Name for the new subnet.
2. For the Subnet Type, I will select “Regional” for now.
3. Specify the IPv4 subnet that I will carve out of the CIDR block I have assigned in the VCN.
   1. Make sure the new /24 CIDR block falls within the /16 determined in the VCN.
4. Scroll down.

1. Select the default route table for the VCN.
2. Make the subnet Private, so that we get private (RFC1918) IP addresses.
3. Scroll down.

1. Select the default DHCP options for the VCN.
2. Select the default Security List for the VCN.
3. Click on Create Subnet.

Notice that the state of the newly created subnet is “Provisioning”.

1. Notice that the state of the newly created subnet is “Available”.
2. Click on the hamburger menu in the top left corner.

STEP 03: Create a new Instance

Select “Instances” from the Pined section.

Click on “Create Instance”.

1. Specify the Name for the instance.
2. Scroll Down.

Leave everything default and Scroll Down.

1. For the Primary network select “Select existing virtual cloud network”.
2. I selected the VCN that I have created earlier.
3. For the subnet select “Select existing subnet”.
4. I select the subnet that I have created earlier.
5. Scroll Down.

1. For the Private IPv4 address select “Automatically assign private IPv4 address”. The box also needs to be checked.
2. Scroll Down.

1. In order the access and manage this Linux Instance you need to work with SSH Keys. For now, I will let OCI Generate a new SSH Key pair.
2. Download the private and public keys on your local computer so I can use these to access and manage this Linux Instance (after creation).

Make sure you download the downloaded private and public keys are your local computer so I can use these to access and manage this Linux Instance (after creation).

1. Scroll Down.
2. Click on “Create” to create the new Linux Instance.

Within a few seconds, you will see that some information is populated that you will need to access the instance like the IP addresses and the username.

1. Eventually the Instance status will be “RUNNING” and I can start logging in to the Instance perform some management tasks and start installing my applications.
2. In the upper right corner of the OCI console you can open Cloud Shell.

STEP 04: Create a Private Network Definition (so that I can log in to the Instance using Cloud Shell)

Select “Cloud Shell”.

The Cloud Shell does not contain the private key.

To upload the private key click on the wheel in the right upper corner.

Select “Upload”.

1. Select “Select from your computer”.
2. Click on “Upload”.

1. Select the private key from your local computer.
2. Click “Open”.

1. Review is the key that you selected is listed.
2. Click on “Upload”.

1. Click on “Hide”.

Issue the ls-l command and verify if you can see the private key.

1. Connect to the instance using the SSH command where you specify the private key.
2. Notice that the connection is timing out.

To connect to your Linux Instance using the PRIVATE IP address the Cloud Shell must get access to the same subnet as where the Linux Instance is connected to.

We can do this by “plugging” the Cloud Shell into the same VCN + Subnet where the Linux Instance also resides.

By default the network is set to “Public” but I am going to change this by creating a new Private Network (on the fly).

1. Click on “Network”,
2. Select “Private network definition list”.

Click on “Create private network definition”.

1. Type in a name.
2. Select the corresponding VCN (where the Linux Instance resides).
3. Select the subnet (where the Linux Instance resides).
4. Check the box” Use active network” to activate the private network right away.
5. Click on “Create”.

1. Notice that the status of the network will change to the newly created Private network with “Connecting”. This will take a few seconds to complete, so be patient”.
2. Also notice the message that it is not possible to create a Private Network Definition” when the Cloud Shell is connecting to a new network.

1. Eventually the Private Network is connected.
2. Notice that the Private Network is also listed.
3. Click on “Close” to close the Private network definition list.

1. Connect to the instance using the SSH command where you specify the private key.
2. Type “yes”
3. Restrict the permissions of the private key and make sure the access is restricted before it can be used.
4. Connect to the instance using the SSH command where you specify the private key.
5. Type “clear” to clean up the terminal.

STEP 05: Verify Internet connectivity on the Instance

1. To verify connectivity to the internet I will do a simple ping to Google’s DNS server.
2. Notice that ping is not working and I have a 100% packet loss.
3. Click on the minimize button of the Cloud Shell Terminal.

In need to create a NAT Gateway.

1. Click on the hamburger menu in the top left corner.

STEP 06: Create a NAT Gateway and route the internet traffic to the NAT Gateway

Click on “Virtual Cloud Networking”.

Scroll down.

Notice that there are no NAT Gateways available.

Click on “NAT Gateways”.

Click on “Create NAT Gateway”.

1. Specify a name for the new NAT Gateway.
2. Select “Ephemeral Public IP address”.
3. Click on “Create NAT Gateway”.

1. Notice that the status of the NAT Gateway is “Available”.
2. Click on “Route Tables”.

To route the traffic from the private subnet to the NAT Gateway so that the internet is reachable a static route need to be created.

Click on the “Default” Route table.

Click on “Add Route Rules”.

1. Select the Target Type to be a “NAT Gateway.
2. Specify the destination to be 0.0.0.0/0 (all network traffic).
3. Select the Target NAT Gateway that was just created.
4. Click on “Add Route Rules”.

1. Notice that the new route rule has been created.
2. Restore the Cloud Shell Terminal.

1. To verify connectivity to the internet I will do a simple ping to Google’s DNS server.
2. Notice that ping is working and I have a 0% packet loss.

I can now access the internet with an Instance that is connected to a Private Subnet with a RFC1981 IPv4 address.

Conclusion

In this article, I have created a new Compute Instance that I have connected to a Private subnet. By default an Instance connected to a Private subnet is not able to reach the internet. I have created a NAT Gateway and routed all traffic to that NAT gateway so that Compute Instance was able to reach the internet.