Using the public facing OCI Network Load Balancer (NLB) to expose your web server pool to the internet

In this article, I will describe how to set up three OCI Instances that will act as a web server. These web servers will all be connected to a private subnet and will be made reachable from the internet using an OCI Network Load Balancer (NLB). The Network Load Balancer will not only make the websites available through the internet but will also balance the load of the incoming connections to these three OCI Instances.

The Steps

• STEP 01: Create a new VCN
• STEP 02: Create a new Public Subnet and Private Subnet
• STEP 03: Create three new OCI Compute Instances
• STEP 04: Create a new OCI Network Load Balancing (NLB)
• STEP 05: Test out the new OCI Network Load Balancer

STEP 01» Create a new VCN

I already have a VCN in place but if you still need to create a new VCN, I have explained how to do this in this article.

Click in the left upper corner of the hamburger menu.

Select “Virtual Cloud Networking” to verify if the Virtual Cloud Network exists.

STEP 02» Create a new Public Subnet and Private Subnet

I already have a Public and Private Subnet in place but if you still need to create new Subnets, I have explained how to do this in this article (Public Subnet) and this article (Private Subnet).

Click on the VCN to review the subnets.

1. Inside my VCN I have a Public and Private Subnet available that I will be using.
2. Click on the hamburger menu in the upper left corner to navigate to the OCI Instances.

I will connect my OCI Compute Instance to the Public Subnet and I will connect the OCI Database to the Private Subnet.

STEP 03» Create three new OCI Compute Instances

Click on “Instances” to create three new OCI Compute Instances.

Let’s start creating the first instance (out of 3).

Click on “Create Instance”.

1. Specify the Name for the instance.
2. Scroll Down.

Click on “Change Image”.

Important

💡 The reason why I am deploying a custom image is because the Instance that I am deploying needs to have a web server installed. In one of my previously written articles I have already created an Instance where I installed the NGINX web server with PHP and I have created a Custom Image based on this Instance so that I do not have to install NGINX with PHP on three separate instances. The article that I have installed the NGINX web server with PHP can be found here.

1. Select My Images.
2. Scroll Down.

1. In my case I will select a custom image that I have created before (that has the NGINX web server with PHP pre-installed).
2. Click on “Select Image”.

1. Review that the custom image is selected.

Important

💡 If you do not have any custom image feel free to select the Oracle Linux 8 Image. Just make sure you follow these instructions here to manually install NGINX and PHP and use these instructions here to install the custom web page for testing purposes.

1. Scroll down.

1. For the Primary network select “Select existing virtual cloud network”.
2. I selected the VCN that I have created earlier.
3. For the PRIVATE subnet select “Select existing subnet”.
4. I select the subnet that I have created earlier.
5. Scroll down.

1. For the Private IPv4 address select “Automatically assign private IPv4 address”. The box also needs to be checked.
2. Scroll down.

I will use existing SSH keys that I have generated before.

1. Select “Upload public key files (.pub)”.
2. Click on “Browse”. Select the public key that is already available.
3. Make sure the .pub SSH key is selected.
4. Scroll down.

Important

💡 When you do not have any existing keys you can select “Generate a key pair for me”. This is explained in this article here.

Click on “Create”.

When the first OCI Compute Instance is created repeat the above steps another two times to create two additional Instances.

So the result should be that THREE OCI Instances are running.

1. Make sure the first OCI Compute Instance is running. In my case, this will be IH-WEBSERVER-01.
2. Make sure the second OCI Compute Instance is running. In my case, this will be IH-WEBSERVER-02.
3. Make sure the third OCI Compute Instance is running. In my case, this will be IH-WEBSERVER-03.
4. Click on the hamburger menu in the upper left corner to navigate to the Network Load Balancers.

At this point, I have three web servers all with a private IP address assigned.

Web server and website on instances

In my case, I have deployed a custom image and this image already has a web server (NGINX and PHP installed. If you choose to deploy a new (vanilla) Oracle Linux Image you need to install NGINX with PHP and the custom webpage manually. This is required to test the Network Load Balancer. If you do not have any custom image feel free to select the Oracle Linux 8 Image. Just make sure you follow these instructions this article to manually install NGINX and PHP. Please use this article to create the custom web page for testing purposes.

Make sure you do this on ALL three OCI Compute Instances.

STEP 04» Create a new OCI Network Load Balancing NLB

Now that I have my OCI Compute Instances in place let's create a new Network Load Balancer <nowiki>(NLB).

1. Click on “Networking”.
2. Click on “Network load balancer”.

Click on “Create network load balancer”.

1. Specify a Load balancer name.
2. Select “Public” for the visibility type (as we want this Network load balancer to be reachable from the internet).
3. Select “Ephemeral IPv4 address” as the public IP address.
4. Click on “Next”.

1. I selected the VCN that I have created earlier.
2. I select the PUBLIC subnet that I have created earlier.
3. Click on “Next”.

1. Specify a Lister name.
2. Select “TCP” for the type of traffic that the Network load balancer needs to listen to.
3. Select “Specify the port” and specify port “80” as I want the Network load balancer will listen on TCP port 80 for incoming connections.
4. Click on “Next”.

1. Specify a Backend set name.
2. Click on “Add backends”.

1. Make sure the first OCI Compute Instance is selected with the correct port. The weight I will keep default for now.
2. Click on “+ Another backend”
3. Make sure the second OCI Compute Instance is selected with the correct port. The weight I will keep default for now.
4. Make sure the third OCI Compute Instance is selected with the correct port. The weight I will keep default for now.
5. Click on “Add backends”.

1. Review the backends.
2. Click on “Next”.

For the health check policy:

1. Specify HTTP as the protocol to use for checking the backend servers.
2. Specify port 80 as the port to use for checking the backend servers.
3. Click on “Next”.

1. Review the Load balancer details and the Listener details
2. Scroll down.

1. Review the Backend set details.
2. Scroll down.

1. Review the Health check policy details.
2. Click on “Create network load balancer”.

When the Network load balancer is created the status will start with “CREATING”.

1. After a few minutes the status will be changed to “ACTIVE”.
2. Because the Health check policy still needs to kick in it may be that the overall health is started with the “Unknown” status.
3. And the same goes for the Backend set health that may start with the “Unknown” status.

1. At some point the overall health is set to “OK”.
2. And the Backend set health is also set to “OK”
3. Make a note of the PUBLIC IP address that is assigned to the Network Load Balancer.

Now I have built the following setup:

STEP 05» Test out the new OCI Network Load Balancer

Now that the OCI Instances are in place (all three of them) and the Network Load Balancer is in place it is time to test this.

1. Open a web browser and browse to the PUBLIC IP address of the Network Load Balancer.
2. Notice the PUBLIC client IP address that I am browsing from (this is the Public IP address of my (home) ISP.
3. Notice the PRIVATE Server IP address which is the IP address of one of the OCI compute Instances.

So what is the algorithm that is used for the OCI Compute Instance selection?

1. Scroll down
2. Notice that the default Load balancing policy is set to “5-tuple-hash”.
3. To change this (or review the other options) click on the three dots.
4. Click on “Edit”.

1. Notice that “5-tuple-hash” is selected.
2. Click on “Cancel”.

Go back to the browser.

1. Click on Refresh.
2. Notice that the PRIVATE Server IP address which is the IP address of one of the OCI compute Instances has been changed from 10.0.2.140 to 10.0.2.7. This confirms that the Network Load Balancer is working.

This is a visual representation of the path that is taken.

1. Open a Private (or Incognito) browser window.
2. Browse to the PUBLIC IP address of the Network Load Balancer.
3. Notice that the PRIVATE Server IP address which is the IP address of one of the OCI compute Instances has been changed from 10.0.2.7 to 10.0.2.140.

This is a visual representation of the path that is taken.

1. Click on Refresh.
2. Notice that the PRIVATE Server IP address which is the IP address of one of the OCI compute Instances has been changed from 10.0.2.140 to 10.0.2.150.

This is a visual representation of the path that is taken.

Now let's do one final test and bring down two OCI Compute Instances.

1. Click on the hamburger menu in the upper left corner
2. Click on Instances.

1. Select the first OCI Compute Instance.
2. Select the second OCI Compute Instance.

1. Click on “Actions”.
2. Click on “Stop”.

Click on “Stop”.

The stop is being processed.

Click on “Close”.

1. Notice that the first OCI Compute Instance is stopped.
2. Notice that the second OCI Compute Instance is stopped.
3. Notice that the third OCI Compute Instance is still running.

This is a visual representation of the OCI Compute Instances.

1. Click on the hamburger menu in the upper left corner
2. Click on “Networking”.
3. Click on “Network load balancer”.

1. Review the “Overall health” this is now “Critical”.
2. Click on the Network load balancer.

1. Review the “Overall health” this is now “Critical”.
2. Review the “Backend sets health” this is now “Critical”.
3. Scroll down.

1. Review the “health” this is now “Critical”.
2. Click on the Backend set.

1. Review the “Health” this is now “Critical”.
2. The backend health has a “2” set next to Critical and this corresponds with the OCI Compute Instances that have gone down.
3. The “1” that is OK is the only OCI Compute Instance that is still up.
4. Click on “Backends”.

1. Notice that the first OCI Compute Instance has a Critical Health.
2. Notice that the second OCI Compute Instance has a Critical Health.
3. Notice that the third OCI Compute Instance has an OK Health.

1. Now let's refresh the web page.
2. Notice the PRIVATE Server IP address which is the IP address of the only OCI compute Instance that is up.

This is a visual representation of the path that is taken.

1. Now let's go back to the instance page
2. Select the first OCI Compute Instance.
3. Select the second OCI Compute Instance.
4. Click on “Actions”.
5. Click on “Start”.

Click on “Start”.

The start is being processed.

Click on “Close”.

Notice that the first and second OCI Compute Instances are running again.

1. Now let's go back to the Network Load Balancer page.
2. Review the “Overall health” this is now “OK”.
3. Click on the Network load balancer.

1. Review the “health” this is now “OK”.
2. Review the “Backend set health” this is now “OK”.
3. Click on “Backend sets”.

1. Review the “health” this is now “OK”.
2. Click on the Backend set.

1. Review the “Health” this is now “Critical”.
2. The “3” that is OK is the only OCI Compute Instance that is up.
3. Click on “Backends”.

Notice that all OCI Compute Instances have an OK Health.

Conclusion

In this article, I have created three (webserver) OCI Compute Instances and attached these to a private subnet. I then created an OCI Network Load Balancer (NLB) that is accessible from the internet. With this, the OCI Network Load Balancer will balance the load based on the 5-tuple load balancing policy to the OCI Compute Instances. I also did some extensive testing by bringing down two of the three OCI Compute Instances and verified if the OCI Network Load Balancer would see this and act as expected.