You can connect to your Instance even if it does not have a flexible IP address by using its IPv6 address.
Deploying Instances in a Private Network and exposing them using a Public Gateway
- Private-Network
- instances
- Public-Gateway
Private Networks and Public Gateways - Overview
Public Gateways sit at the border of Private Networks and provide extra functionality. They provide features like SSH bastion, and services to deal with traffic entering and exiting the network (NAT). You can add a Public Gateway to each of your Private Networks.
Before you start
To complete the actions presented below, you must have:
- A Scaleway account logged into the console
- Owner status or IAM permissions allowing you to perform actions in the intended Organization
- An SSH key
- An Instance
Creating a Private Network for the Instance
- Connect to your Instance using SSH.
ssh root@<your_instance_ip>
-
Check the status of your network interfaces using the
ip a
command. You see the details of the default Ethernet adapter of your Instance:2: ens2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000link/ether de:1c:a4:2b:d0:39 brd ff:ff:ff:ff:ff:ffinet 10.70.104.113/31 scope global dynamic ens2valid_lft 85983sec preferred_lft 85983secinet6 2001:bc8:634:c38::1/64 scope globalvalid_lft forever preferred_lft foreverinet6 fe80::dc1c:a4ff:fe2b:d039/64 scope linkvalid_lft forever preferred_lft forever -
Go to the Private Networks page of the Scaleway console.
-
Click Create a new Private Network. The Private Network creation wizard displays:
-
Enter the details of the new Private Network and click Create a Private Network:
- Enter a Name for the Private Network
- Select the region for the Private Network
NoteMake sure to create the Private Network in the same region as your Instance.
Once completed, the list of your Private Networks displays.
-
Click on the Private Network’s name to display its information.
-
Click the Attached Resources tab to see the list of Instances attached to the Private Network.
-
Select your Instance from the drop-down menu and click Add Instance to attach it to the Private Network:
-
Use the
ip a
command on the Instance to verify the presence of the new Ethernet interface:3: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000link/ether 02:00:00:00:5a:d8 brd ff:ff:ff:ff:ff:ffinet6 fe80::ff:fe00:5ad8/64 scope linkvalid_lft forever preferred_lft forever
The Instance is now added to the Private Network but no IP address has been configured. You can configure it manually or use DHCP autoconfiguration with a Public Gateway.
Creating a Public Gateway
-
Go to the Public Gateways page of the Scaleway console, and click Create a Public Gateway. The Public Gateway creation wizard displays:
-
Enter the details of the new Public Gateway:
- Choose the Availability Zone of the Public Gateway.
- Select the Public Gateway offer
- Select the Public Gateway IP address. To create a new IP, select Allocate new IP in the drop-down list.
- Enter a name and optional tags for the Public Gateway
-
Click Create a Public Gateway. The Public Gateway is created, and you are taken to the list of your Public Gateways:
-
Click Manage to display the Public Gateway Information.
-
Click + Attach a new Private Network to attach the previously created Private Network to the Public Gateway.
-
Select the Private Network from the drop-down list, then click Attach Private Network:
-
Check if the IP address for the Private Network has been assigned to the Instance using the DHCP server of the Private Gateway by running the
ip a
command:3: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000link/ether 02:00:00:00:5a:d8 brd ff:ff:ff:ff:ff:ffinet 192.168.0.2/24 brd 192.168.0.255 scope global dynamic ens5valid_lft 3513sec preferred_lft 3513secinet6 fe80::ff:fe00:5bea/64 scope linkvalid_lft forever preferred_lft foreverYou can see the private IP address
192.168.0.2
has been configured automatically on the interface.NoteOnce the Instance is added to the Private Network and autoconfigured through DHCP, it cannot be accessed through its public IPv4 address anymore. Later in this tutorial, we explain how to configure port forwarding to access your Instances through the Public Gateway’s public IPv4 address.
Configuring port forwarding
Port forwarding allows you to configure a mapping of ports on the IP address of the Public Gateway to IP addresses and ports inside the Private Network. This allows you to access services on Instances in a Private Network without the need for a public IP address on each of them.
- Return to the Public Gateways page of the Scaleway console. The list of your Public Gateways displays.
- Click «See more Icon» > More Info next to the relevant Public Gateway to display its information.
- Click the DHCP tab. Then click View DHCP Status to display the list of devices autoconfigured by the DHCP server:
As you can see in the screenshot above, both entries have the dynamic type. This means the DHCP server has dynamically assigned an IP address to each device. The assigned IP address may change and the port forwarding will stop working. To avoid this, configure a static lease.
- Copy the MAC address of the device you want to configure. Then click Configure DHCP.
- Click Edit > Add static association and enter the MAC address and the private IP address for the Instance. Confirm by clicking «Validate Icon»
- Click the NAT tab to display the NAT configuration. 5. Click Edit > Add static association and enter the MAC address and the private IP address for the Instance. Confirm by clicking «Validate Icon»
- Click the NAT tab to display the NAT configuration.
You can now connect to your Instance using the IP address of the Public Gateway:
ssh root@<public_gateway_ip> -p 2202
You are now logged into the Instance using the IP address of the Public Gateway:
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-81-generic x86_64)* Documentation: https://help.ubuntu.com* Management: https://landscape.canonical.com* Support: https://ubuntu.com/advantageroot@my-first-instance:~#
Going further
Congratulations, you have completed your first configuration of Instances in a Private Network, attached to a Public Gateway. To move forward, check out our product documentation: