Public VCF as-a-Service - Configuring and managing your Edge Gateways

Vedi come Markdown

Find out how to configure your first Edge Gateway on Public VCF as-a-Service, then create and manage the others from the OVHcloud Control Panel

Objective

An Edge Gateway is the network component that connects your Public VCF as-a-Service organisation to the public network. It is essential for your virtual machines to access the Internet.

This guide explains how to configure your first Edge Gateway upon delivery of Public VCF as-a-Service, and how to create, edit and delete Edge Gateways from the OVHcloud Control Panel.

Warning

Edge Gateways are managed exclusively from the OVHcloud Control Panel. This feature is not available in the VMware Cloud Director interface.

Requirements

A Public VCF as-a-Service Advanced offer (the Edge Gateway feature is not available with the Standard offer)
An IP block linked to your Advanced organisation. Linking is done from the Network > Public IP Addresses menu of the OVHcloud Control Panel. An IP block can only be linked to a single Advanced organisation (this feature is not available for Standard organisations)

OVHcloud Control Panel Access

Direct link:
To access your services: Hosted Private Cloud > Public VCF as-a-Service > Select your VCF service

Instructions

Select your organisation, then your Virtual Datacenter and click the Edge Gateway tab.

Configure your first Edge Gateway upon delivery

When your Public VCF as-a-Service organisation is delivered, an Edge Gateway is automatically created and associated with your IP block. It appears in the Edge Gateway tab of your Control Panel.

This Edge Gateway is ready, but for your virtual machines to access the public network, you must create a NAT rule on this Edge Gateway from the VMware Cloud Director interface.

Configure a NAT rule on your Edge Gateway

Log in to your VMware Cloud Director interface, then go to Networking > Edge Gateways. Click your Edge Gateway, then the NAT tab and click New.

The two most common rule types are:

SNAT — outbound Internet access

DNAT — inbound access to a VM

A SNAT (Source NAT) rule allows your virtual machines to access the Internet. Outbound traffic is translated from the VM's private IP address to a public IP address from your IP block.

When to use it? To allow your VMs to initiate connections to the Internet (updates, downloads, API calls, etc.).

Fill in the following fields:

Field	Value
Name	Rule name (e.g. `snat-to-internet`)
Action	`SNAT`
Source IP	IP address or range of your VMs' private network (e.g. `192.168.1.0/24`)
Translated IP	Public IP address from your IP block
Port (optional)	Source port to translate (e.g. `443`). If left empty, applies to all traffic

A DNAT (Destination NAT) rule allows external users to access a service hosted on one of your virtual machines. Inbound traffic is redirected from a public IP address to the VM's private IP address.

When to use it? To expose a service on the Internet (website, SSH server, application, etc.).

Fill in the following fields:

Field	Value
Name	Rule name (e.g. `dnat-web-server`)
Action	`DNAT`
Destination IP	Public IP address from your IP block
Translated IP	Private IP address of the target VM (e.g. `192.168.1.10`)
Port (optional)	Destination port to redirect to the VM (e.g. `80` for HTTP, `443` for HTTPS)

Click Save to apply the rule. It takes effect immediately.

Info

You can create several NAT rules on the same Edge Gateway and enable or disable them individually as needed.

Configure firewall rules

By default, a firewall rule blocks all traffic on your Edge Gateway. You must create allow rules for traffic to pass through.

From the VMware Cloud Director interface, go to Networking > Edge Gateways. Click your Edge Gateway, then the Firewall tab and click New.

Fill in the following fields:

Field	Description
Name	Rule name (e.g. `allow-outbound`)
Direction	`IN-OUT` to allow outbound traffic, `IN` for inbound only
Source	Source IP or `Any` for all origins
Destination	Destination IP or `Any` for all destinations
Service	Relevant port and protocol (e.g. `TCP:443`) or `Any` for all traffic
Action	`Allow` to permit, `Drop` to block

Warning

Rules are evaluated from top to bottom. Place your allow rules before the default block rule, otherwise traffic will be blocked before reaching your rules.

Click Save to apply.

Create a new Edge Gateway

You can create up to 5 Edge Gateways per Virtual Datacenter.

From the Edge Gateway tab, click Create an Edge Gateway.

Fill in the requested information:

Field	Description
Name	Your Edge Gateway's name (can be changed later)
IP Space	IP block to assign to this Edge Gateway (block delivered with the organisation or ordered additionally)

Click Create to confirm.

Info

In your VMware Cloud Director interface, the IP block assigned to your Edge Gateway is visible as an IP Space object. An IP block can only be assigned to one Edge Gateway at a time. Deleting an IP Space in the VCD interface does not detach the IP block from your organisation in the OVHcloud Control Panel. The link between an IP block and your organisation remains manageable from the Network menu of your Control Panel.

Edit an Edge Gateway

You can edit the name and the IP block assigned to an existing Edge Gateway.

From the Edge Gateway tab, click the ... button to the right of the relevant Edge Gateway, then Edit.

Change the name and/or the IP block as needed, then click Edit to confirm.

Warning

Changing the IP block assigned to an Edge Gateway may temporarily interrupt the network connectivity of the virtual machines that use it.

Delete an Edge Gateway

From the Edge Gateway tab, click the ... button to the right of the Edge Gateway to delete, then Delete.

Warning

Deleting an Edge Gateway is irreversible. All virtual machines connected through this Edge Gateway will immediately lose their access to the public network.

Go further

Join our community of users

Questa pagina ti è stata utile?