The tent needs to get HTTPS from the internet, keep its applications closed and allow those applications to read objects and download updates. Each path requires a different decision.
Key concepts
One Virtual Cloud Network (VCN) It's a regional virtual network. Your block CIDR defines a range of addresses. For example, 10.0.0.0/16 may contain a subnet 10.0.1.0/24 and another 10.0.2.0/24. The bigger prefix describes a smaller portion of space. Plan ranges without overlap if you're gonna connect networks.
The Regional sub-networks may cover the region's AD. A public subnetwork allows public IP addresses to their VNIC. A private person forbids them. VNIC It's the virtual interface that connects an instance to the network. To be public doesn't mean that all connections are allowed: proper direction, routes and rules are necessary.
The assistant creation VCN can build subnetworks, gateways and initial rules. Inspects the resultant resources Using a assistant does not remove the need to understand them. DNS allows to solve name to addresses but does not give connectivity or access.
Roads, gateways and Security
One round table decides the next destination of traffic that matches a rule. A path 0.0.0.0/0 It matches any IPv4 that does not have a more specific path. Local connectivity of VCN has implicit routes. There are also configurable routes within the VCN for advanced scenarios. Do not remember that tables can only conduct traffic outside of it. Query VCN Route Tables.
| Destination or necessity | Piece you have to recognize |
|---|---|
| Internet from resources with public IP | Internet Gateway, more routes and rules |
| Internet output from private locations with no intermittent connections initiated from the internet | NAT Gateway |
| Oracle supported services in the same region without crossing the internet | Service Gateway |
| On-premises and connection between VCN | Dynamic Rounding Gateway (DRG) as per design |
| Connection cicpado por internet onto on-premises | Site-to-Site VPN |
| Private Connectivity dedicated to OCI | FastConnect |
The Security Lists apply rules to VNIC of a subnetwork; and Network Security Groups (NSG) VNIC or resources are supported by function. Both define entry and exit rules. A rule status track the connection and allow its response. with stateless you have to explicitly allow both senses. Also check the firewall of the operating system. The path indicates where to go. Security decides what traffic can get through.
Balancers and Health of Application
A receives Retiro traffic by a list and distribute it to servers of a backend setusing a policy and Health checks. A backend that doesn't exceed health check should not get new traffic as a healthy one. To see a VM in state Running does not prove that its application responded.
Load Balancer incorporates 7 cape capabilities for HTTP / HTTPS and also supports TCP. Network Load Balancer It aims at high performance balancing of 3/4 layers, including TCP, UDP and ICMP as listed. The comparison "L7 versus L4" serves as an orientation but does not mean Load Balancer lacks TCP.
A balancing machine public accept traffic through a public address. One Private serves customers with private connectivity. Both require proper routes and controls. Load Balancer's policies include Round Robin, Least Connections and IP Hash; can be assigned pesos To backends. With 1 and 3 weights, Weighted Round Robin distribute about one out of every four requests to the first, and not half. See balancing policies.
Step-by-step example
- Use an VCN with public sub-network for the billing and private for two order servers.
- Configure HTTPS in the list with your certificate. It allows only necessary ports from our customers.
- It allows the scooter to reach the application port and the backend health check port. A function NSG makes it easier to express this relationship.
- Test both servers's health before enabling customer traffic. If you miss, check port and process and rules.
- It gives the private subnetwork a path to NAT for updates and another to Service Gateway for supported Oracle services.
To play the demonstration of a private scorer, replace the internet client with a private VCN connectivity. To change the face's visibility changes who can reach it. does not change the need for backend sets and health checks.
Common errors
- "I have opened the port at a Security List, so there's a path." Check routes and destination as well as rules.
- "NAT publishes my private server." Retiring connections and their responses does not create a public entrance for customers.
- "Service Gateway connects with all websites." It gives private access to Oracle's compatible services, but not to the internet as a whole.
Retirement exercise
A private VM read photos of Object Storage and download packages from a public repository. It should not accept new connections from the Internet. What two gateways would you choose? A list of routes that's good enough to get them to work?
Solution
Service Gateway for Object Storage from the same region and NAT Gateway for public repository. Configure the appropriate routes and allow the necessary output, DNS resolution and responses. To read objects also require permissions IAM. The Roadtable does not replace these controls.
Sources and review
Query VCN, Roads, NSG, Load Balancer y Network Load Balancer. Without looking: compare NSG and Security List, explain NAT versus DRG and warrant a health check.