Deploying Instances in a Private Network and exposing them using a Public Gateway

Reviewed on 20 May 2024

Private-Network
instances
Public-Gateway

Private Networks and Public Gateways - Overview

Public Gateways sit at the border of Private Networks and provide extra functionality. They provide features like SSH bastion, and services to deal with traffic entering and exiting the network (NAT). You can add a Public Gateway to each of your Private Networks.

Before you start

To complete the actions presented below, you must have:

A Scaleway account logged into the console
Owner status or IAM permissions allowing you to perform actions in the intended Organization
An SSH key
An Instance

Creating a Private Network for the Instance

Connect to your Instance using SSH.
```
ssh root@<your_instance_ip>
```

Tip

You can connect to your Instance even if it does not have a flexible IP address by using its IPv6 address.

Check the status of your network interfaces using the ip a command. You see the details of the default Ethernet adapter of your Instance:

2: ens2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
  link/ether de:1c:a4:2b:d0:39 brd ff:ff:ff:ff:ff:ff
  inet 10.70.104.113/31 scope global dynamic ens2
    valid_lft 85983sec preferred_lft 85983sec
  inet6 2001:bc8:634:c38::1/64 scope global
    valid_lft forever preferred_lft forever
  inet6 fe80::dc1c:a4ff:fe2b:d039/64 scope link
    valid_lft forever preferred_lft forever

Go to the Private Networks page of the Scaleway console.
Click Create a new Private Network. The Private Network creation wizard displays:
Enter the details of the new Private Network and click Create a Private Network:
- Enter a Name for the Private Network
- Select the region for the Private Network
Note
Make sure to create the Private Network in the same region as your Instance.

Once completed, the list of your Private Networks displays.
Click on the Private Network’s name to display its information.
Click the Attached Resources tab to see the list of Instances attached to the Private Network.
Select your Instance from the drop-down menu and click Add Instance to attach it to the Private Network:

Use the ip a command on the Instance to verify the presence of the new Ethernet interface:

3: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
  link/ether 02:00:00:00:5a:d8 brd ff:ff:ff:ff:ff:ff
  inet6 fe80::ff:fe00:5ad8/64 scope link
    valid_lft forever preferred_lft forever

The Instance is now added to the Private Network but no IP address has been configured. You can configure it manually or use DHCP autoconfiguration with a Public Gateway.

Creating a Public Gateway

Go to the Public Gateways page of the Scaleway console, and click Create a Public Gateway. The Public Gateway creation wizard displays:
Enter the details of the new Public Gateway:
- Choose the Availability Zone of the Public Gateway.
- Select the Public Gateway offer
- Select the Public Gateway IP address. To create a new IP, select Allocate new IP in the drop-down list.
- Enter a name and optional tags for the Public Gateway
Click Create a Public Gateway. The Public Gateway is created, and you are taken to the list of your Public Gateways:
Click Manage to display the Public Gateway Information.
Click + Attach a new Private Network to attach the previously created Private Network to the Public Gateway.
Select the Private Network from the drop-down list, then click Attach Private Network:

Check if the IP address for the Private Network has been assigned to the Instance using the DHCP server of the Private Gateway by running the ip a command:

3: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
  link/ether 02:00:00:00:5a:d8 brd ff:ff:ff:ff:ff:ff
  inet 192.168.0.2/24 brd 192.168.0.255 scope global dynamic ens5
    valid_lft 3513sec preferred_lft 3513sec
  inet6 fe80::ff:fe00:5bea/64 scope link
    valid_lft forever preferred_lft forever

You can see the private IP address 192.168.0.2 has been configured automatically on the interface.

Note

Once the Instance is added to the Private Network and autoconfigured through DHCP, it cannot be accessed through its public IPv4 address anymore. Later in this tutorial, we explain how to configure port forwarding to access your Instances through the Public Gateway’s public IPv4 address.

Configuring port forwarding

Port forwarding allows you to configure a mapping of ports on the IP address of the Public Gateway to IP addresses and ports inside the Private Network. This allows you to access services on Instances in a Private Network without the need for a public IP address on each of them.

Return to the Public Gateways page of the Scaleway console. The list of your Public Gateways displays.
Click «See more Icon» > More Info next to the relevant Public Gateway to display its information.
Click the DHCP tab. Then click View DHCP Status to display the list of devices autoconfigured by the DHCP server:

Tip

As you can see in the screenshot above, both entries have the dynamic type. This means the DHCP server has dynamically assigned an IP address to each device. The assigned IP address may change and the port forwarding will stop working. To avoid this, configure a static lease.

Copy the MAC address of the device you want to configure. Then click Configure DHCP.
Click Edit > Add static association and enter the MAC address and the private IP address for the Instance. Confirm by clicking «Validate Icon»
Click the NAT tab to display the NAT configuration. 5. Click Edit > Add static association and enter the MAC address and the private IP address for the Instance. Confirm by clicking «Validate Icon»
Click the NAT tab to display the NAT configuration.

You can now connect to your Instance using the IP address of the Public Gateway:

ssh root@<public_gateway_ip> -p 2202

You are now logged into the Instance using the IP address of the Public Gateway:

Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-81-generic x86_64)
* Documentation:  https://help.ubuntu.com
* Management:     https://landscape.canonical.com
* Support:        https://ubuntu.com/advantage
root@my-first-instance:~#

Going further

Congratulations, you have completed your first configuration of Instances in a Private Network, attached to a Public Gateway. To move forward, check out our product documentation: