This topic describes how to allow virtual private clouds (VPCs) with overlapping CIDR blocks to access each other by using VPC NAT gateways.
Background information
Due to early network planning or business consolidation, you may need two VPCs that have overlapping CIDR blocks to communicate with each other. You can create a VPC NAT gateway and configure a NAT IP address for each VPC. The two NAT IP addresses cannot conflict with each other. One VPC uses SNAT to translate source IP addresses to the configured NAT IP address, which allows the VPC to access the other VPC. The other VPC uses the NAT IP address configured in a DNAT entry to provide services. This way, the two VPCs can access each other.
Scenarios
Procedure
Prerequisites
- An Alibaba Cloud account is created. For more information, see Create an Alibaba Cloud account.
- VPCs and vSwitches are created as described in the following table. For more information, see Create a VPC with an IPv4 CIDR block.
VPC name Region CIDR block vSwitch name Zone and CIDR block VPC1 China (Qingdao) 192.168.0.0/16 - Service vSwitch: VSW1
- Transit vSwitch: VSW2
- VSW1: Qingdao Zone B, 192.168.0.0/24
- VSW2: Qingdao Zone C, 192.168.100.0/24
VPC2 China (Qingdao) 192.168.0.0/16 - Service vSwitch: VSW3
- Transit vSwitch: VSW4
- VSW3: Qingdao Zone B, 192.168.0.0/24
- VSW4: Qingdao Zone C, 192.168.200.0/24
- An ECS instance named ECS1 is created in VSW1. An ECS instance named ECS2 is created in VSW3. For more information, see Create an instance by using the wizard.
- A CEN instance is created. For more information, see Create a CEN instance.
- An Enterprise Edition transit router is created in the region where the VPC resides. For more information, see Create a transit router.
Step 1: Create two VPC NAT gateways
Perform the following steps to create a VPC NAT gateway named VPC NATGW1 in VSW2 and a VPC NAT gateway named VPC NATGW2 in VSW4.
- Log on to the NAT Gateway console.
- In the left-side navigation pane, choose .
- On the VPC NAT Gateway page, click Create VPC NAT Gateway.
- On the VPC NAT Gateway (Pay-As-You-Go) page, set the following parameters and click Buy Now. The following table describes the parameters of VPC NATGW1 and VPC NATGW2.
Parameter Description Value Region Select the region where you want to create the VPC NAT gateway. Select China (Qingdao) for both VPC NAT gateways. VPC ID Select the VPC to which the VPC NAT gateway belongs. After you create a VPC NAT gateway, you cannot change the VPC to which it belongs. - VPC NATGW1: VPC1.
- VPC NATGW2: VPC2.
Zones Select the zone to which the VPC NAT gateway belongs. - VPC NATGW1: the zone of VSW2.
- VPC NATGW2: the zone of VSW4.
vSwitch ID Select the vSwitch to which the VPC NAT gateway belongs. We recommend that you select an independent vSwitch. - VPC NATGW1: VSW2.
- VPC NATGW2: VSW4.
Name Enter a name for the VPC NAT gateway. The name must be 1 to 128 characters in length.
- Enter VPC NATGW1.
- Enter VPC NATGW2.
Service-linked Role Displays whether a service-linked role is created for the VPC NAT gateway. If this is your first time using a NAT gateway, including an Internet NAT gateway and a VPC NAT gateway, you must click Create Service-linked Role to create a service-linked role.
- On the Confirm Order page, confirm the information, select the Terms of Service check box, and then click Activate Now. When the message Order complete. appears, it indicates that the VPC NAT gateway is created.
Step 2: Create custom route tables
Perform the following steps to create a custom route table for VSW2 and another for VSW4.
- Log on to the VPC console.
- In the left-side navigation pane, click Route Tables.
- In the top navigation bar, select the region to which the route table belongs.
- On the Route Tables page, click Create Route Table.
- On the Create Route Table page, set the following parameters and click OK. The following table describes the parameters for the custom route tables of VSW2 and VSW4.
Parameter Description Value Resource Group Select the resource group to which the route table belongs. Select All for both route tables. VPC Select the VPC to which the route table belongs. - Route table of VSW2: Select VPC1.
- Route table of VSW4: Select VPC2.
Name Enter a name for the route table. - Route table of VSW2: VSW2VTB.
- Route table of VSW4: VSW4VTB.
Description Enter a description for the route table. - Route table of VSW2: Enter VSW2 custom route table.
- Route table of VSW4: Enter VSW4 custom route table.
- On the Route Tables page, find the route table that you created and click its ID.
- On the details page of the route table, click the Associated vSwitch tab and click Associate vSwitch.
- In the Associate vSwitch dialog box, select the vSwitch that you want to associate and click OK.
- Associate VSW2VTB with VSW2.
- Associate VSW4VTB with VSW4.
Step 3: Attach the VPCs to the CEN instance
- Log on to the CEN console.
- On the Instances page, click the ID of the CEN instance that you want to manage.
- On the Create Connection in the Actions column. tab, find the transit router that you want to manage and click
- On the Connection with Peer Network Instance page, set the following parameters and click OK. The following table describes the parameters of VPC1 connection and VPC2 connection.Note When you perform this operation for the first time, the system automatically creates the service-linked role AliyunServiceRoleForCEN. This role allows the transit router to create an elastic network interface (ENI) in a vSwitch of the VPC to be connected. For more information, see AliyunServiceRoleForCEN.
Parameter Description Value Network Type Select the type of network instance that you want to connect. Select VPC. Region Select the region where the network instance is deployed. Select China (Qingdao). Transit Router The transit router in the selected region is displayed. The transit router in the China (Qingdao) region is displayed. Resource Owner ID Select the Alibaba Cloud account to which the network instance belongs. Select Your Account. Billing Method By default, transit routers use the Pay-As-You-Go billing method. For more information about the billing rules, see Billing rules.
Pay-As-You-Go is displayed. Attachment Name Enter a name for the VPC connection. - VPC1 connection: Enter VPC1.
- VPC2 connection: Enter VPC2.
Networks Select the ID of the VPC to be connected. - VPC1 connection: Select the ID of VPC1.
- VPC2 connection: Select the ID of VPC2.
vSwitch Select a vSwitch in a zone that supports transit routers. - VPC1 connection:
- Qingdao Zone B: Select VSW1.
- Qingdao Zone C: Select VSW2.
- VPC2 connection:
- Qingdao Zone B: Select VSW3.
- Qingdao Zone C: Select VSW4.
Advanced Settings By default, the following advanced features are selected: Associate with Default Route Table of Transit Router, Propagate System Routes to Default Route Table of Transit Router, and Automatically Creates Route That Points to Transit Router and Adds to All Route Tables of Current VPC. The default settings are used.
- Return to the VPC console.
- In the left-side navigation pane, click Route Tables.
- On the Route Tables page, find the system route table of VPC1 and click its ID.
- On the Withdraw in the Route Status in CEN column. tab, find conflicting routes and click
Step 4: Add routes to the custom route table
Perform the following steps to add routes to VSW2VTB and VSW4VTB.
- Log on to the VPC console.
- In the left-side navigation pane, click Route Tables.
- In the top navigation bar, select the region to which the route table belongs.
- On the Route Tables page, find the custom route table that you want to manage and click its ID.
- Choose Add Route Entry. , and click
- In the Add Route Entry panel, set the following parameters and click OK.
Parameter Description Value Name Enter a name for the route. - VSW2VTB: VPCNATGW1ENTRY
- VSW4VTB: VPCNATGW2ENTRY
Destination CIDR Block Enter the CIDR block to which network traffic is forwarded. Set this parameter to the CIDR block of the peer transit vSwitch. - VSW2VTB: 192.168.200.0/24
- VSW4VTB: 192.168.100.0/24
Next Hop Type Select the next hop type. Select Transit Router. Transit Router Select a transit router. - Custom route table of VPC1: VPC1 connection
- Custom route table of VPC2: VPC2 connection
Step 5: Add routes to the system route tables
Repeat the following steps to add routes to the system route tables of VPC1 and VPC2.
- Log on to the VPC console.
- In the left-side navigation pane, click Route Tables.
- In the top navigation bar, select the region to which the route table belongs.
- On the Route Tables page, find the system route table that you want to manage and click its ID.
- Choose Add Route Entry. , and click
- In the Add Route Entry panel, set the following parameters and click OK.
Parameter Description Value Name Enter a name for the route. - System route table of VPC1: VPC1.
- System route table of VPC2: VPC2.
Destination CIDR Block Enter the CIDR block to which network traffic is forwarded. Set this parameter to the CIDR block of the peer transit vSwitch. - System route table of VPC1: 192.168.200.0/24.
- System route table of VPC2: 192.168.100.0/24.
Next Hop Type Select the next hop type. Select NAT Gateway. NAT Gateway Select a NAT gateway. - VSW2VTB: Select VPC NATGW1.
- VSW4VTB: Select VPC NATGW2.
Step 6: Configure an SNAT entry on VPC NATGW1
- Log on to the NAT Gateway console.
- In the left-side navigation pane, choose .
- In the top navigation bar, select the region where the VPC NAT gateway is created.
- On the VPC NAT Gateway page, find the VPC NAT gateway that you want to manage and click SNAT Management in the Actions column.
- On the SNAT Management tab, click Create SNAT Entry.
- On the Create SNAT Entry page, set the following parameters and click OK.
Parameter Description SNAT Entry Specify whether to create an SNAT entry for a VPC, a vSwitch, an ECS instance, or a custom CIDR block. Specify VPC is selected in this example, which specifies that all ECS instances in the VPC to which the VPC NAT gateway belongs use the SNAT entry to access external networks. Select NAT IP Address Select the NAT IP address that is used to access external networks. The default NAT IP address is selected in this example. Entry Name Enter a name for the SNAT entry.
Step 7: Configure a DNAT entry on VPC NATGW2
- Log on to the NAT Gateway console.
- In the left-side navigation pane, choose .
- In the top navigation bar, select the region where the VPC NAT gateway is created.
- On the VPC NAT Gateway page, find the VPC NAT gateway that you want to manage and click DNAT Management in the Actions column.
- On the DNAT Management tab, click Create DNAT Entry.
- On the Create DNAT Entry page, set the following parameters and click OK.
Parameter Description Select NAT IP Address Select the NAT IP address that is used to receive requests from external networks. The default NAT IP address is selected in this example. Select Private IP Address Specify the private IP address of the ECS instance that uses the DNAT entry to communicate with external networks. Select Select by ECS or ENI and then select the private IP address of ECS2. Port Settings Select a DNAT mapping method. Port mapping is used in this example. Select Specific Port. Enter 22 for Frontend Port and Backend Port, and select TCP for Protocol Type. Entry Name Enter a name for the DNAT entry.
Step 8: Test the connectivity
- Log on to ECS1 in VSW1. For more information, see Connection methods.
- Run the
ping
command toping
the default NAT IP address of VPC NATGW2 to test whether ECS1 can access ECS2.The test result shows that ECS1 can access ECS2. - Run the
ssh root@NAT IP address
command, where the NAT IP address is the default NAT IP address of VPC NATGW2. Then, enter the password of ECS2 to test whether ECS1 can remotely connect to ECS2.If the messageWelcome to Alibaba Cloud Elastic Compute Service!
appears, you are connected to ECS2.The test result shows that ECS1 can access ECS2 by using the DNAT feature of VPC NATGW2.