Private networks

Figure 1009. Private subnet overview

Figure 1010. Terraform subnet creation

resource "hcloud_network" "pNet" {
  name     = "Private network"
  ip_range = "10.0.0.0/8"
}
resource "hcloud_network_subnet" "pSubnet" {
  network_id   = hcloud_network.pNet.id
  type         = "cloud"
  network_zone = "eu-central"
  ip_range     = "10.0.1.0/24"
}
resource "hcloud_network_route" "gateway"{
  network_id = hcloud_network.pNet.id
  destination = "0.0.0.0/0"
  gateway = "10.0.1.20"
}

Figure 1011. Gateway host

resource "hcloud_server" "web" {
    ....
  network {
    network_id = hcloud_network.pNet.id
    ip         = "10.0.1.20"
  }
}

Figure 1012. intern host

resource "hcloud_server" "web" {
    ....
  public_net {
    ipv4_enabled = false
    ipv6_enabled = false
  }
  network {
    network_id = hcloud_network.pNet.id
    ip         = "10.0.1.20"
  }
}

exercise No. 10

Creating a subnet

Follow Figure 1009, “Private subnet overview ” creating two hosts being connected by a private subnet:

Follow Figure 1010, “Terraform subnet creation ” creating both a private network and private subnet.
Your gateway host will have two network interfaces providing connections both to the Internet and your private subnet.

This host will be ssh accessible.
The “intern” host will be connected to your private subnet only. Being isolated from the Internet it will be ssh accessible from your gateway host only. In other words: Access requires two “chained” ssh connections.

For the time being host intern will have no Internet access. Thus package installation or updates are not yet possible.

Note

This topic will be addressed in Adding an application level gateway .
Provide DNS names to be used on your two hosts locally by defining /etc/cloud/templates/hosts.debian.tmpl accordingly.

Tip

Variables of type = object are your friend:

privateSubnet = {
  dnsDomainName  = "intern.g3.hdm-stuttgart.cloud"
  ipAndNetmask   = "10.0.1.0/24"
}

Figure 1013. Lack of internet access

Host “intern” does not have Internet access.
Consequences:
1. No package updates.
2. No package installs
3. ...

Figure 1014. Possible solutions

- Allow IP forwarding on gateway host
- Configure NAT enabling gateway host as router
Use an application level gateway:
1. apt-cacher-ng
2. Squid

Figure 1015. http proxy apt-cacher-ng

‹›

Figure 1016. Cloud-init problem

Problem: apt-cacher-ng installation requires time for service to become available.
Consequence: Package installs on host “intern” must be deferred.
Problem: No standard Terraform “service ready” dependency management hook.

Figure 1017. Service ready query script

#!/bin/bash
echo "Waiting for apt-cacher-ng to launch on port 3142 ..."

while ! nc -z ${frontendPrivatenetIp} 3142; 

  do
     sleep 8 # wait for 8 second before polling again
     echo apt-cacher-ng not yet ready ...
  done

echo "apt-cacher-ng service ready"

Figure 1018. Terraform “service ready” dependency hook

resource "null_resource" "waitForProxy" {
  connection {
    type     = "ssh"
    user     = "devops"
    host_key = ...public_key_openssh
    agent    = "true"
    host     = ...web.ipv4_address
  }
  provisioner "remote-exec" {
    inline=["/usr/bin/waitForAptProxy"]
  }
}

resource "hcloud_server" "intern" {
...
  depends_on = [
    hcloud_network_subnet.pSubnet
   ,null_resource.waitForProxy
  ]
}

exercise No. 11

Adding an application level gateway

This exercise is a follow-up to Creating a subnet . We add an application level gateway providing HTTP access to hosts residing in the private subnet e.g. host intern. Follow the subsequent steps:

Create a hcloud_primary_ip to be used by your gateway host for Internet access. In addition to the datacenter attribute documentation valid values are also on offer by GET /datacenters.
Use Cloud-init for installing apt-cacher-ng on your gateway host listening to the internal network interface only. Modify its configuration accordingly.
Follow Figure 1018, “Terraform “service ready” dependency hook ” for delaying host intern's creation until the apt-cacher-ng service is up and running.
Install supplementary packages on your intern host proofing proper network access. Enable package updates as well.

Prev	Up	Next
Volumes	Home	SDI exercises related DNS server

Cloud provider