DZone
Thanks for visiting DZone today,
Edit Profile
  • Manage Email Subscriptions
  • How to Post to DZone
  • Article Submission Guidelines
Sign Out View Profile
  • Post an Article
  • Manage My Drafts
Over 2 million developers have joined DZone.
Log In / Join
Please enter at least three characters to search
Refcards Trend Reports
Events Video Library
Refcards
Trend Reports

Events

View Events Video Library

Zones

Culture and Methodologies Agile Career Development Methodologies Team Management
Data Engineering AI/ML Big Data Data Databases IoT
Software Design and Architecture Cloud Architecture Containers Integration Microservices Performance Security
Coding Frameworks Java JavaScript Languages Tools
Testing, Deployment, and Maintenance Deployment DevOps and CI/CD Maintenance Monitoring and Observability Testing, Tools, and Frameworks
Culture and Methodologies
Agile Career Development Methodologies Team Management
Data Engineering
AI/ML Big Data Data Databases IoT
Software Design and Architecture
Cloud Architecture Containers Integration Microservices Performance Security
Coding
Frameworks Java JavaScript Languages Tools
Testing, Deployment, and Maintenance
Deployment DevOps and CI/CD Maintenance Monitoring and Observability Testing, Tools, and Frameworks

Because the DevOps movement has redefined engineering responsibilities, SREs now have to become stewards of observability strategy.

Apache Cassandra combines the benefits of major NoSQL databases to support data management needs not covered by traditional RDBMS vendors.

The software you build is only as secure as the code that powers it. Learn how malicious code creeps into your software supply chain.

Generative AI has transformed nearly every industry. How can you leverage GenAI to improve your productivity and efficiency?

Related

  • Deep Dive Into Architecture of MuleSoft Anypoint VPC, VPN and Dedicated Load Balancer
  • Establish Connection Between Google Cloud Platform and MuleSoft Anypoint VPN Using BGP Routing (IPSec Tunneling)
  • Introduction to Network Architecture in AWS Cloud Deployment
  • How Jenkins Can Stay Relevant in the Next Decade

Trending

  • How GitHub Copilot Helps You Write More Secure Code
  • Tired of Spring Overhead? Try Dropwizard for Your Next Java Microservice
  • How To Build Resilient Microservices Using Circuit Breakers and Retries: A Developer’s Guide To Surviving
  • Introducing Graph Concepts in Java With Eclipse JNoSQL, Part 3: Understanding Janus
  1. DZone
  2. Software Design and Architecture
  3. Cloud Architecture
  4. Architecting a Completely Private VPC Network and Automating the Deployment

Architecting a Completely Private VPC Network and Automating the Deployment

Learn how to design and build a truly private virtual private cloud (VPC) network architecture and deploy the architecture with Terraform automation.

By 
Vidyasagar (Sarath Chandra) Machupalli FBCS user avatar
Vidyasagar (Sarath Chandra) Machupalli FBCS
DZone Core CORE ·
Sep. 12, 23 · Tutorial
Likes (8)
Comment
Save
Tweet
Share
5.3K Views

Join the DZone community and get the full member experience.

Join For Free

In today's cloud world, security has taken precedence over resiliency and high availability. With the introduction of Virtual Private Cloud, network security has become critical. In this article, you will learn the best practices to make a virtual private cloud more private and secure than ever before. 

 By the end of this article, you will learn how to:

  • Design a secured VPC private network 
  • Best practices in architecting a VPC private network 
  • Build a high availability VPN and bastion hosts 
  • Use of Terraform automation for cloud infrastructure provisioning

What Is a Private VPC Network?

A virtual private cloud is completely private if there is no public ingress or outgress network traffic. In simple technical terms, there are no public gateways on the subnets (private subnets) and no floating IPs on the Virtual Server Instances (VSIs).

How Do I Connect to This Private VPC Network?

Client-to-site VPN for VPC is one of the two VPN options available on IBM Cloud that provides a client-to-site VPN solution that allows users to connect to IBM Cloud resources through secure, encrypted connections.

Private VPC architecture

Private VPC architecture

What Does This Architecture Address?

  1. The bastion hosts and the client-to-site VPN servers are highly available. 
  2. The VPN creates a secure tunnel to connect from a local machine to the Cloud. 
  3. The bastion host accepts SSH connections from client to site VPN (192.168.x.x). 
  4. The last (final) rule in the stateless access control lists is denying all the inbound and outbound traffic. 
  5. No public gateways are attached to the subnets, and no floating IPs on the virtual server instances (VSIs).
  6. The security groups attached to the VSIs allow traffic only on specific required ports and private IPs. 

Prerequisites

  • IBM Cloud API Key
  • Certificate's CRN from Secrets Manager
  • OpenVPN client to connect to client-to-site VPN from your local machine
  • Setup Terraform  

Provision of the Private VPC Network Using Terraform

Once you have the secrets manager secret with the certificate, launch your terminal and set the following Terraform variables.

launch your terminal and set the following Terraform variables

Secrets Manager
Shell
 
export TF_VAR_ibmcloud_api_key=<IBM_CLOUD_API_KEY> 
export TF_VAR_secrets_manager_certificate_crn=<SECRET_CRN>


Clone the GitHub repository with Terraform and Ansible code:

Shell
 
git clone https://github.com/VidyasagarMSC/private-vpc-network
cd terraform


Run the Terraform commands to provision the VPC resources: subnets, bastion hosts (VSIs), VPN, etc.,

Shell
 
terraform init
terraform plan
terraform apply


Connect to Client-To-Site VPN

  • Once the VPC resources are successfully provisioned, you need to download the VPN client profile.
  • Click the client to site tab and then on the name of the VPN 

Click the client to site tab and then on the name of the VPN

  • Download the profile from the Clients tab
  • The VPN provisioned through Terraform uses certificates. Follow the instructions here to connect to the ovpn client.
  • You should see the successful connection on your OVPN client.

OpenVPN connect client

OpenVPN connect client

Verify the SSH Connection

  • On a terminal, add an SSH private key to the SSH agent with the following command  

Shell
 
ssh-add <LOCATION_OF_PRIVATE_SSH_KEY>


Example: ssh-add ~/.ssh/<NAME_OF_THE_PRIVATE_KEY>

  • Run the following command to SSH into the RHEL VSI through a bastion host. You will be using the private IP address of the bastion in Zone 1

Shell
 
ssh -J root@10.10.0.13 root@10.10.128.13


Command to connect from a bastion host in Zone 2 is ssh -J root@10.10.65.13 root@10.10.128.13

  • Remember, you should be connected to the client-to-site VPN to SSH into the RHEL VSI through the bastion host.
  • Try disconnecting the VPN and SSHing into the RHEL VSI.

What's Next

  • Go through the deployed VPC network architecture and check the ACL and security group inbound and outbound rules. 
  • Check the client-to-site VPN routes (deliver and translate).
  • Though the architecture shows one VPC, this can be expanded to have multiple VPCs, with each VPC playing a different role to bring in the separation of traffic like edge, management, and workload VPCs, respectively.


Architecture Virtual private cloud Cloud vpn

Opinions expressed by DZone contributors are their own.

Related

  • Deep Dive Into Architecture of MuleSoft Anypoint VPC, VPN and Dedicated Load Balancer
  • Establish Connection Between Google Cloud Platform and MuleSoft Anypoint VPN Using BGP Routing (IPSec Tunneling)
  • Introduction to Network Architecture in AWS Cloud Deployment
  • How Jenkins Can Stay Relevant in the Next Decade

Partner Resources

×

Comments
Oops! Something Went Wrong

The likes didn't load as expected. Please refresh the page and try again.

ABOUT US

  • About DZone
  • Support and feedback
  • Community research
  • Sitemap

ADVERTISE

  • Advertise with DZone

CONTRIBUTE ON DZONE

  • Article Submission Guidelines
  • Become a Contributor
  • Core Program
  • Visit the Writers' Zone

LEGAL

  • Terms of Service
  • Privacy Policy

CONTACT US

  • 3343 Perimeter Hill Drive
  • Suite 100
  • Nashville, TN 37211
  • support@dzone.com

Let's be friends:

Likes
There are no likes...yet! 👀
Be the first to like this post!
It looks like you're not logged in.
Sign in to see who liked this post!