In this video, I'll discuss and demonstrate usage of an Internet Gateway on the Oracle
Private Cloud Appliance.
I'll begin by showing a compute instance that I've already created.
I'm logged on to the compute web UI and I'll click the Compute View Instances tile on the
dashboard.
The instance I've created for this demonstration is named demo-01 so I'll click this link to
view the details.
I'll click the Networking tab and see that this instance's primary VNIC is on the a Virtual
Cloud Network named demo.
My compute instance has a private IP address of 192.168.1.2 and a public address of 10.133.80.210.
Now that we have this information, I'm going to attempt to ssh into this instance from
my local laptop.
I'll run the ssh command and provide the private key filename and attempt to connect as the
opc user to the public IP address.
After a few seconds, my connection attempt times out and fails.
I know that my ssh private key file is correctly paired with the public key assigned to my
instance.
I know that the opc user exists on this instance and I also know that the IP address is correct.
So why can I not connect?
Let's have a closer look at the VCN for this instance and see what is missing.
From the Compute Web UI, I'll select Networking then Virtual Cloud Networks and view the details
for my demo VCN.
My demo VCN has a Default Route Table so I'll scroll down and view the Resources.
I immediately notice that I do not have an Internet Gateway.
An Internet Gateway is required for me to be able to access my public instance on the
Oracle Private Cloud Appliance.
It's very easy to create an Internet Gateway from the Web UI.
You can also create the gateway from the OCI command line interface using the syntax:
oci network internet-gateway create --compartment-id and then provide the compartment
OCID --is-enabled and then set this to true, which
implies you can disable the gateway by setting this to false
and then --vcn-id and provide the vcn OCID But from the Web UI, I'll click Internet Gateway
under the Resources section.
Next I'll click Create Internet Gateway.
I'll provide a name of demo.
For the purpose of access control you must specify the compartment.
I'll just put the gateway in the same compartment as the VCN.
You have the option of entering Tagging information but I'm not going to do so for this demonstration.
I'll click Create and now I see that my demo Internet Gateway is available.
Let's try to connect into my instance again.
From a terminal window on my local labtop I'll run the same ssh command I ran earlier.
After a few seconds, my connection attempt still times out and fails.
I'll go back to the Web UI and look at the VCN for this instance and see what else is
missing.
Under Resources, I see that I have a route table.
I'll click on this link and see that my route table is available.
I'll click on the Actions menu and select View Details.
I'll scroll down and see that I have no route rules in my route table.
So we need to add a route rule to use the Internet Gateway.
You can create a route table for the VCN and add routes rules from the OCI command line
interface using the syntax: oci network route-table create
--compartment-id and provide the compartment OCID
--vcn-id and provide the OCID of the VCN --route-rules route_rules_json
Route rules are in JSON format.
The value of the --route-rules option is either a string between single quotation marks or
a file specified as file://path_to_file.json.
For this demonstration, I'll click Add Route Rules from the Web UI.
For Target Type, I'll select Internet Gateway from the drop-down list.
I'll enter a CIDR block of 0.0.0.0/0 to represent any IP address.
And I'll select my demo Internet Gateway.
I'll click Create Route Table Rule and after a few seconds, my new route rule is displayed.
Let's try to connect to my instance again.
I'll run the same ssh command I ran earlier.
This time it works and I'm connected to my public compute instance as the opc user.
So to summarize, an Internet Gateway is needed when hosts on both ends of the connection
have a public IP address.
You must add a route rule in the route table for the VCN to use the Internet Gateway.
Other things to note, a given VCN can have only one Internet Gateway.
Security lists are covered in another video but it's worth mentioning here, security list
rules ultimately determine the specific types of traffic that are allowed.
In this video, I used ssh to connect between an on-premise host and a public compute instance
on the Oracle Private Cloud Appliance.
SSH uses TCP protocol and runs on port 22.
If I view the security lists, I see that this port is enabled by default in the Default
Security List for my VCN.
If I delete this ingress rule, I would not be able to SSH into compute instances on this
VCN.
The firewall settings on the instance also need to allow the SSH service.
I'll run the sudo firewall-cmd --list-all on my compute instance and see that this service
is enabled by default as well.
Refer to the Oracle Private Cloud Appliance documentation for more information.
For additional training videos like this, go to oracle.com/goto/pcalearning.
This concludes this video.
Thank you for watching.