Server Load Balancer:Use a GWLB instance to create a security check system for IPv4 traffic

Example scenario

To enhance business security and reliability, an enterprise wants to route IPv4 traffic over the Internet to NVAs for security checks before forwarding the traffic to application servers for processing.

The enterprise uses GWLB to manage NVAs, which ensures that the traffic is strictly inspected and processed before being forwarded to application servers. The following figure demonstrates the scenario. In this example scenario, the enterprise creates a business VPC and a security VPC using an Alibaba Cloud account in the China (Ulanqab) region.

• The business VPC is responsible for running the application system and has an IPv4 gateway to route traffic over the Internet to NVAs.

  In the business VPC, vSwitches VSW01 and VSW02 are created for two different subnets. In the subnet assinged to VSW01, an application server ECS01 is deployed with the application service for processing client requests deployed in ECS01. In the subnet assigned to VSW02, a GWLB endpoint is created.

• The security VPC is responsible for running NVAs.

  In the security VPC, a GWLB instance is created. NVAs are mounted to the backend server group associated with the GWLB instance. An endpoint service is created in the security VPC with the GWLB instance specified as the service resource of the endpoint service.

A connection is established between the GWLB endpoint and the endpoint service, which is in the Connected state. Traffic over the Internet can be routed to NVAs.

Limits

• One or more NVAs must be running.

• The security group in the backend server group must allow UDP traffic on port 6081.

• An endpoint service must be created in regions and zones where both PrivateLink and GWLB instances are available. For more information about the regions and zones where PrivateLink and GWLB instances are available, see Regions and zones that support PrivateLink and Regions and zones in which GWLB is available.

• The zones where a GWLB endpoint is deployed must be a subset of the zones where a GWLB instance is deployed.

Prerequisites

• A business VPC and a security VPC are created. vSwitches VSW01 and VSW02 are created in Zone B of the business VPC, and vSwitch VSW03 is created in Zone B of the security VPC. For more information, see Create and manage a VPC.

  Note

  The subnet assigned to vSwitch VSW01 is used to deploy application servers, the subnet assigned to vSwitch VSW02 is used to deploy a GWLB endpoint, and the subnet assigned to vSwitch VSW03 is used to deploy a GWLB instance.

• An IPv4 gateway is created, activated, and associated with the business VPC. For more information, see Create and manage an IPv4 gateway.

• Route tables are created for the IPv4 gateway, vSwitch VSW01, and vSwitch VSW02. For more information, see Create and manage a route table.

• An ECS instance ECS01 is created in the business VPC, and application services are deployed in ECS01. A public IP address is assigned for the ECS01 instance if the instance attempts to communicate over the Internet. ECS instances ECS02 and ECS03 are created in Zone B of the security VPC, and NVA images are deployed in ECS02 and ECS03, respectively.

  • For more information about creating ECS instances, see Create an instance on the Custom Launch tab.

  • For more information about deploying NVA images, see Create a custom image from an instance.

• Security groups are created for ECS01, ECS02, and ECS03, with security group rules configured based on your business and security requirements. For more information, see Create a security group.

Procedure

Step 1: Create a GWLB instance

A GWLB instance is a running entity that provides the GWLB service. To use the GWLB service, you must first create a GWLB instance.

1. Log on to the GWLB console.

2. In the top navigation bar, select the region where the GWLB instance is deployed.

3. On the Instances page, click Create GWLB.

4. On the Gateway Load Balancer - Alibaba Cloud International Site, configure the parameters.

   The following table describes only the key parameters. Use the default values for other parameters. For more information about the parameters, see Create and manage a GWLB instance.

   Parameter	Description
   Instance Name	Specify an instance name.
   VPC	Select the security VPC.
   Region and Zone	Select the region in which you want to create the GWLB instance. In this topic, China (Ulanqab) is selected.
   Zone	Select one or more zones. In this example, Ulanqab Zone B is selected, and vSwitch VSW03 in this zone is selected.
   IP version	Select an IP version. In this topic, IPv4 is selected.
   Service-linked Role	The first time you create a GWLB instance, click Create Service-linked Role to create the AliyunServiceRoleForGwlb service-linked role. Note This parameter is displayed only the first time you create a GWLB instance.

5. Click Buy Now and complete the payment.

6. Return to the Instances page and select the region where the GWLB instance is deployed to view the GWLB instance.

Step 2: Create a backend server group

To process client requests forwarded by the GWLB instance, you must create a server group and add backend servers to the server group.

1. In the left-side navigation pane, choose GWLB > Server Groups.

2. On the Server Groups page, click Create Server Group.

3. In the Create Server Group dialog box, configure the parameters and click Create.

   The following table describes only the key parameters. Use the default values for other parameters. For more information about the parameters, see Create and manage a server group.

   Parameter	Description
   Server Group Type	Select a server group type. In this example, Server is selected.
   Server Group Name	Specify a server group name.
   VPC	Select the security VPC in which the ECS instances are deployed. Note Select the VPC in which the GWLB instance is deployed.
   Scheduling Algorithm	Select a scheduling algorithm. In this example, 5-tuple Hashing is selected.
   Health Check Method	Select a health check method or disable health checks. In this example, TCP is selected.
   Health Check Port	Specify a health check port. In this example, 80 is specified.

4. In the The server group is created message, click Add Backend Server.

5. On the Backend Servers tab of the page that appears, click Add Backend Server.

6. In the Add Backend Server panel, set Server Type. In this example, set Server Type to ECS/ENI.

7. Select ECS02 and ECS03 and click Next.

   Note

   • In this example, set Server Type to ECS/ENI.

   • Make sure that NVA images are deployed on the backend servers and that the backend servers use the Geneve protocol.

Step 3: Configure a listener

To forward packets across all ports to the backend servers using the Geneve protocol, you must configure a listener for the GWLB instance and associate the listener with the backend server group.

1. In the left-side navigation pane, choose GWLB > Instances, and click the instance ID.

2. Click the Listeners tab and click Create IP Listener.

3. In the Select Server Group step, set Server Group Type and select the server group that is created.

4. The page displays the backend server list. Click OK.

Step 4: Configure an endpoint service

To allow the GWLB instance to provide services, you must create an endpoint service.

1. Log on to the VPC console.

2. On the Endpoint Service page, click Create Endpoint Service.

3. On the Create Endpoint Service page, configure the parameters and click OK.

   The following table describes only the parameters that are relevant to this topic.

   Parameter	Description
   Region	In this example, China (Ulanqab) is selected.
   Service Resource Type	Select the type of the service resource that you want to add to the endpoint service. In this example, GWLB is selected.
   Select Service Resource	Select the zone where the service resource is available and select the service resource. In this example, Ulanqab Zone B is selected, and the GWLB instance that supports PrivateLink, as created in Step 1: Create a GWLB instance in Zone B, is selected.
   Network Type	In this example, IPv4 is selected.
   Automatically Accept Endpoint Connections	Specify whether the endpoint service automatically accepts connection requests from endpoints. In this example, Yes is selected. Note If you select Yes, after an endpoint is created, the endpoint service automatically accepts connection requests from the endpoint.
   Service Payer	In this example, Service Consumer is selected.

Step 5: Configure a GWLB endpoint

To allow the GWLB instance to communicate with the endpoint service, you must create a GWLB endpoint.

1. Log on to the Endpoint console.

2. On the Interface Endpoint tab of the Endpoints page, click Create Endpoint.

3. On the Create Endpoint page, configure the parameters and click OK.

   The following table describes only the parameters that are relevant to this topic:

   Parameter	Description
   Region	In this example, China (Ulanqab) is selected.
   Endpoint Name	Specify an endpoint name.
   Endpoint Type	Select an endpoint type. In this example, Gateway Endpoint is selected.
   Endpoint Service	In this example, Select Service is selected and the endpoint service, as created in Step 4: Configure an endpoint service, is selected.
   VPC	Select the VPC in which the endpoint is deployed. In this example, the business VPC is selected.
   Zone and vSwitch	Select the zone where the service resource of the endpoint service is deployed and select the vSwitch in this zone. The system automatically creates an endpoint elastic network interface (ENI) in the vSwitch. In this example, Ulanqab Zone B is selected, and VSW02 in Zone B is selected.
   Network Type	In this example, IPv4 is selected.

   Note

   Make sure that the endpoint connection of the endpoint service is in the Connected state.

Step 6: Configure routes

To forward network traffic to the GWLB endpoint, you must configure routes.

1. Log on to the VPC console.

2. In the left-side navigation pane, click Route Tables.

3. In the top navigation bar, select the region to which the route tables belong.

4. On the Route Tables page, click the ID of the route table that you want to modify.

   Note

   Route tables that must be modified include the IPv4 gateway route table, the VSW01 route table, and the VSW02 route table. Modify them one by one.

5. On the Route Entry List tab of the Route Table Details page, click the System Route tab and view the routes that are created by the system.

   Routes destined for the CIDR block of a vSwitch of the VPC to which the route table belongs are automatically added by the system to a custom route table. These routes are used for communication between cloud resources within the vSwitch.

6. Modify system routes: For the IPv4 gateway, on the Route Entry List > System Route tab, find the system route that you want to modify and click Modify in the Actions column. In the Modify Route Entry dialog box, configure the parameters and click OK. Then this route appears on the Custom Route tab. The parameters are described below.

   Parameter	Description
   Destination CIDR Block	Displays the destination CIDR block of traffic. Destination CIDR Block cannot be modified. In this example, 192.168.2.0/24 is displayed.
   Name	Specify a new route name.
   Next Hop	Select the type of the next hop. In this example, GWLB Endpoint is selected.
   GWLB Endpoint	The GWLB endpoint, as created in Step 5: Configure a GWLB endpoint, is selected.

7. Add custom routes: For a vSwitch, click the Custom Route tab, click Add Route Entry, set Destination CIDR Bock and Next Hop, and click OK. Set the parameters as follows:

   • For vSwitch VSW01, Destination CIDR Block is set to 0.0.0.0/0, and Next Hop is set to GWLB Endpoint.

   • For vSwitch VSW02, Destination CIDR Block is set to 0.0.0.0/0, and Next Hop is set to IPv4 Gateway.

Step 7: Verify the results

Test server connectivity

Log on to the application server ECS01 and test its access to the Internet by running the following command:

ping www.aliyun.com

If the output contains information about traffic from the server to the Internet and the traffic keeps growing for a period of time, ECS01 is connected to the Internet and the test is successful.

The output is as follows:

Test traffic through security checks

Log on to the backend server ECS02 or ECS03 and capture all packets on port 6081 by running the following command:

tcpdump -i any port 6081

If the output contains information about requests and responses from ECS01, GWLB has routed traffic to NVAs for security checks and the test is successful.

The output is as follows:

References

• Product overview

  What is GWLB?

• User guide

  • Create and manage a GWLB instance

  • Add and manage IP listeners

  • Create and manage a server group