Hello.
Welcome to this video on how to configure a VCN, or Virtual Cloud Network, for public
internet access in Oracle Cloud Infrastructure.
To prepare an instance for public internet access, we have to make sure the instance
and VCN configurations are complete.
Starting with the instance, make sure the firewall is configured to allow traffic on
specified ports. For example, port 443 for HTTPS traffic, or port 22 for SSH traffic.
The instance VNIC, which can be primary or secondary, must have a public IP address assigned.
The public IP address can be ephemeral or a reserved public IP address.
The subnet to which the instance is connected must be a public subnet.
The VCN must have an Internet Gateway with the correct route rule.
And finally, ensure that VCN security list rules compliment instance firewall rules.
Let's take a look at configuring the VCN Internet Gateway.
First, lets look at an attempt to connect to an instance on the public internet before
an internet gateway is configured.
We are looking at our Oracle Cloud Infrastructure web console dashboard.
To look at our instance details, we navigate the menu, to Compute, then Instances.
We will be working with instance mor-demoinst-20, so we click on its name to see it details.
We see it is connected to VCN morvcn-101, and its primary VNIC, or virtual network interface
card, is attached to the subnet morvcn-101-publicsub.
And the instance is assigned a public IP address.
For security reasons this address has been, and will be, restricted from view.
The VCN it was associated with, morvcn-101, was created without an internet gateway.
So lets attempt to make an SSH connection to the public IP address of our instance.
Switching to a terminal on our local host, we enter the command to attempt to create
an SSH session with the instance, using the key file and instance public IP address.
The SSH command times out after a few minutes because there is not route to the VCN which
the primary VNIC is attached to.
So to get this working lets configure the internet gateway for our VCN.
Back on our web console, we navigate the menu to Networking, and Virtual Cloud Networks.
We click on the name of our VCN morvcn-101.
Under the Resources section we select Internet Gateways.
Click on the Create Internet Gateway button to open the configuration dialog.
And we give it a name morvcn-101-inet.
We will create the gateway in the same compartment as the VCN, so we leave this selection as
it is.
We finish by clicking Create Internet Gateway.
The new gateway appears on the list of Internet Gateways for this VCN.
A route table rule is required to allow access to the public IP addresses behind this gateway,
so we click on Route Tables.
We click the default route table name to see the rules set for this route table.
There are currently no rules set for our default route table for the VCN.
We click Add Route Rules to add a rule entry to the route table.
There is a warning message displayed, which we will see more about shortly, but first,
from the Target Type drop down, we select Internet Gateway.
For the Destination CIDR Block, we enter all zeros so that anyone on the public internet
can make a request to this instance.
From the Target Internet Gateway drop down, we select the name of our internet gateway,
morvcn-101-inet.
Thats all we need to create the rule, but before we add this rule, lets clarify the
warning message at the top.
By default, every VNIC performs a source/destination check on its network traffic.
The VNIC looks at the source and destination listed in the header of each network packet.
If the VNIC is not the source or destination, then the packet is dropped.
If the VNIC needs to forward traffic, for example if it needs to perform Network Address
Translation, you disable the source/destination check on the VNIC.
By default it is disabled, it is set on the VNIC of the instance, so here how to find
the setting.
Go to the instance details using the menu, Compute and Instances.
Clicking on the name of the instance you see its details page.
Under Resources, select Attached VNICs.
You see the primary VNIC listed for the instance.
To edit the VNIC, click on the three dots menu beside the VINC listed and select Edit
VNIC.
In the Edit dialog, under the name field, is the checkbox for Skip source/destination
check.
To disable the check, you click on the checkbox, to leave it enabled you leave the checkbox
blank.
You can find out more about this at the documentation link here.
Returning to our route rule dialog, we dont need to modify the default setting for the
source/destination check, and leaving the Description blank, we click Add Route Rules.
We are returned to the route table and can see the route rule now added.
We open our terminal again to test if our internet gateway rule is now working.
Clearing the terminal we run the SSH command again to connect to the instance public IP
address.
The connection succeeds because all the configuration requirements for the instance, VCN and internet
gateway have been met.
The instance firewall and subnet security list include a rule for port 22.
The instance primary VNIC is on a public subnet.
The Internet Gateway was configured and the complementary rule created in the VCN Route
Table to use the gateway.
Oracle provides an extensive number of resources which you can use to learn about this subject
and others.
Use the links here to find out more content about this video, as well as Oracle Linux
and using Linux on Oracle Cloud Infrastructure.
Thats the end of the video.
Thanks for watching.