This topic describes how to use network access control lists (ACLs) to manage communication between a data center and a virtual private cloud (VPC).
Prerequisites
A VPC and a vSwitch are created. For more information, see Create and manage a VPC and Create and manage a vSwitch.
Elastic Compute Service (ECS) instances are created in the vSwitch. For more information, see Create an instance on the Custom Launch tab.
The ECS instances are added to a security group that allows the HTTP services on the ECS instances to be accessed over the Internet. For more information, see Security group rules for allowing websites to provide web services.
Background information
A company has created an Internet-facing Server Load Balancer (SLB) instance and ECS instances. Static pages are hosted on the ECS instances. A listener has been configured for the SLB instance, and the ECS instances are added as backend servers for the SLB instance. By default, Data Center 1 and Data Center 2 can access the static pages through the public IP address of the SLB instance. To meet business requirements, the company wants to allow Data Center 1 to access the static pages, and deny access from Data Center 2 to the static pages.
The following table lists the public IP addresses of the data centers and the SLB instance.
Network | Public IP address |
Data Center 1 | 111.XX.XX.111 |
Data Center 2 | 222.XX.XX.222 |
SLB instance | 33.XX.XX.33 |
You can associate a network ACL with the vSwitch to which the ECS instances belong. Then, you can configure network ACL rules to control inbound and outbound network traffic transmitted through the vSwitch.
Step 1: Create a network ACL
Log on to the VPC console.
In the left-side navigation pane, choose .
In the top navigation bar, select the region to which the network ACL that you want to manage belongs.
On the Network ACL page, click Create Network ACL.
In the Create Network ACL dialog box, set the following parameters and click OK:
VPC: Select the VPC for which you want to create the network ACL.
Name: Enter a name for the network ACL.
Description: Enter a description for the network ACL.
Step 2: Associate the network ACL with a vSwitch
On the Network ACL page, find the network ACL that you want to manage and click its ID.
On the Associated Resources tab, click Associate vSwitch.
In the Associate vSwitch dialog box, select the vSwitch and click OK.
Step 3: Add rules to the network ACL
Add inbound and outbound rules to the network ACL.
On the Network ACL page, find the network ACL that you want to manage and click Create Inbound Rule in the Actions column.
On the Inbound Rule tab, click Manage Inbound Rule.
Set the following parameters and click OK.
Priority
Rule Name
Policy
Protocol
Source IP Addresses
Source Port Range
1
Allow-HTTP-requests-from-Data-Center-1
Allow
TCP
The public IP address of Data Center 1. 111.XX.XX.111 is used in this example.
80/80
3
Drop-HTTP-requests-from-Data-Center-2
Deny
TCP
The public IP address of Data Center 2. 222.XX.XX.222 is used in this example.
80/80
You must add the following inbound rule if the health check feature is enabled for the SLB instance.
Priority
Rule Name
Policy
Protocol
Source IP Addresses
Source Port Range
2
Allow-health-checks
Allow
ALL
The CIDR block used to perform health checks. Set the value to 100.64.0.0/10.
-1/-1
Click the Outbound Rule tab, and then click Manage Outbound Rule.
Set the following parameters and click OK.
Priority
Rule Name
Policy
Protocol
Destination IP Address
Destination Port Range
1
Allow-HTTP-traffic-destined-for-Data-Center-1
Allow
TCP
The public IP address of Data Center 1. 111.XX.XX.111 is used in this example.
1/65535
3
Drop-HTTP-requests-destined-for Data-Center-2
Deny
TCP
The public IP address of Data Center 2. 222.XX.XX.222 is used in this example.
1/65535
You must add the following outbound rule if you enable the health check feature for the SLB instance.
Priority
Rule Name
Policy
Protocol
Destination IP Address
Destination Port Range
2
Allow-health-checks
Allow
ALL
The CIDR block used to perform health checks. Set the value to 100.64.0.0/10.
-1/-1
Step 4: Test the connectivity
To test the connectivity between the data centers and the SLB instance, perform the following steps:
Open the browser on a computer in Data Center 1.
Enter
http://33.XX.XX.33in the address bar of the browser to test the connectivity.The result shows that the device in Data Center 1 can access the static pages on the ECS instances.
Open the browser on a device in Data Center 2.
Enter
http://33.XX.XX.33in the address bar of the browser to test the connectivity.The result shows that the device in Data Center 2 cannot access the static pages on the ECS instances.
