Private Network NAT (Network Address Translation) Gateway

Overview

Private NAT resolves issues such as address conflicts, network communication between different environments, and the need for specific address access by converting cloud service addresses.

Application scenario:

• The access addresses for IDC and cloud VPC instances are conflicting.
• Address conflicts occur across VPCs within the same or different regions in the cloud.
• There are requirements for accessing resources with specific IP addresses.

The virtual private cloud NAT gateway allows Baidu Cloud Compute instances within a VPC to access external private networks and also offers private network access services externally.

Description:

• Before setting up SNAT rules, ensure that private NAT routing is configured in the VPC hosting the private NAT gateway.
• To enable access to external virtual private clouds through a private NAT gateway, SNAT rules must be configured.

Private NAT gateways support both SNAT and DNAT functions:

• Source Network Address Translation (SNAT) provides proxy services, allowing Baidu Cloud Compute instances in a VPC to access external virtual private clouds.
• Destination Network Address Translation (DNAT) maps private NAT IPs to cloud service instances, enabling these instances to provide private access services externally through IP or port mapping.

Quota and limits

The performance of an enhanced private NAT gateway is measured in Capacity Unit (CU). The performance parameters for one CU are:

• New connections (cps): 1,000 per second
• Concurrent connections (conns): 10,000
• Forwarding capacity (bps): 1Gbps

Before Configuration, you should know:

• A single NAT IP can serve simultaneously for both SNAT and DNAT purposes.

• Note when creating new SNAT and DNAT rules:

  • When creating a new SNAT rule, ensure that the source network segment does not conflict with NAT IPs or the source segments of existing SNAT rules.
  • For a new DNAT rule, the intranet IP can only be a single IP (not a network segment); the private IP must differ from the NAT IP and must not conflict with existing DNAT private IPs.
  • In DNAT's full-port mode, the same NAT IP cannot be shared with the specific port mode.

Operation process

Step 1: Create a private NAT gateway

Step 2: Configure private NAT gateway (Create NAT IP segment, create NAT IP address, create SNAT rule, create DNAT rule)

Step 3: Configure the VPC route

Step 4: View monitor

Create private NAT gateway

1. On the VPC Instance List page, select the created VPC instance and click to enter the Details page. To create a NAT gateway in a non-default VPC, you must first create a subnet within that VPC.
2. In the navigation bar, navigate to Network Connection > NAT Gateway > Private NAT, and then click the Create NAT Gateway button.

3. Fill in the following configuration information:

Create NAT IP address range

1. Click NAT instance name to access its details page, then select NAT IP from the left navigation bar to enter the NAT IP segment creation page.
2. The NAT IP address range list indicates that a default NAT IP range is automatically bound during the creation of a private NAT instance, with the option to also create new NAT IP ranges.
3. Click Add next to the Address Range List and complete the following Configuration.

Create NAT IP address

1. Click the NAT instance name to view its details page, then select NAT IP from the left-hand menu to access the NAT IP creation page.
2. A default NAT IP is automatically created within the default address range, but you can also create new NAT IPs.
3. Click Create NAT IP to allocate NAT IPs either randomly by quantity or manually.
4. Fill in the following configuration information:

5. Default NAT IPs cannot be removed. Customized NAT IPs associated with SNAT or DNAT rules must first have those rules disassociated before deletion.

Configure SNAT table

1. Click the NAT instance name or choose Configure SNAT from the operations menu to go to the SNAT Table page.
2. Click on Add SNAT Entry above the SNAT list to open the Add SNAT Entry dialog box.
3. Fill in the following configuration information:

4. Click OK to finalize adding the SNAT entry.

Configure DNAT table

1. Click the NAT instance name or choose Configure DNAT from the operations menu to access the DNAT Table page.
2. Click on Add DNAT Entry above the DNAT list to open the Add DNAT Entry dialog box.
3. Fill in the following configuration information:

Configure the NAT route

1. In the navigation bar, go to the Route Table section, click the route table name, and proceed to the details page.
2. Click on Add Route.

• Source segment: The address or segment before NAT rule translation
• Input the target network segment: specify the segment for the destination IDC or VPC. Note: 0.0.0.0/0 is not supported.
• Select NAT gateway for the route type
• Next hop instance: Choose the ID of the created NAT gateway. Traffic from the source subnet to the destination segment will use this NAT gateway as the next hop.

3. Click OK to finalize the router configuration.

Performance capacity resize

1. Go to the private NAT instance list page, click More in the operation menu of the target instance, then select Performance Capacity Resize.

2. In the Resize Configuration section, enter the desired CU increase.
3. Click "Confirm Order" to finalize the resizing of performance capacity.

View monitor

1. Log in to the Management Console, navigate to "Products & Services" > "Virtual Private Cloud," and select "NAT Gateway" from the left-hand menu to access the list of NAT gateway instances.
2. Select Monitor after the instance, and a floating monitor window will appear on the right side of the page.
3. Click View More to access the Monitor Of Instance Details page.
4. Users can view monitoring information for both the NAT gateway and real servers.

5. On the "Monitor" page, click "Alarm Details" to access the alarm policy configuration section, where you can manage the NAT gateway's alarm strategies. For detailed instructions, please refer to the BCM Alarm Management guide.

   Description:

   • If there are fewer than 10 real servers, all their monitoring information is displayed by default. Users can customize which server monitoring information to display, with a limit of 10 options.

NAT gateway supports TOPN statistics

TOPN: After selecting the time range, statistical method, and metric, enable the TOP display function by clicking the "Refresh" button on the far left. The system will automatically display the IDs of the top 10 real server instances ranked by traffic share based on your selection. Statistical methods include: Average, Maximum, Minimum, Sum. Monitoring metrics include: Inbound traffic, outbound traffic, inbound bandwidth, outbound bandwidth, inbound packet rate, outbound packet rate, and connections. Log in to the Baidu AI Cloud Management Console, go to "Product Service" > "Network" > "Virtual Private Cloud (VPC)," select "NAT Gateway" from the left-hand menu, click on the NAT Gateway Instance Name, navigate to the "Monitor" section on the left, and view the real server monitoring information.

Description:

• The NAT gateway status is "Running", and the SNAT or DNAT status is "available".
• There must be network traffic passing through the NAT gateway for conversion;
• After clicking the Refresh button, there may be a delay before the Traffic Graph appears. Please wait approximately three minutes for it to load.
• Data should be available within the past three days, and the maximum query time span is 30 days.
• The system supports the following three methods for selecting query time: - For a range less than 1 hour (1-59 minutes), the data queried will be up to 1 hour prior. For example, a query started at 20:00 can retrieve data from 18:56 to 19:55. - For a range exceeding 1 hour, queries must be in whole-hour intervals, and the range is limited to 1-12 hours. For example, if a query starts at 20:00 for a 1-12 hour range, the data available will only be before 19:00. - If the range exceeds 1 hour but is not a whole multiple, data within the first hour can be queried along with ranges less than an hour (1-59 minutes).