Virtual Private Cloud (VPC) scenario

Available in VPC

You can build Virtual Private Cloud (VPC) on NAVER Cloud Platform in a variety of ways, depending on your network environment. Major usage scenarios are as follows.

• Creation of single public subnet
• Creation of public subnet and private subnet
• Creation of public subnet and private subnet for on-premise connection
• Inter-VPC private network (peering) configuration

Creation of single public subnet

The creation of a single public subnet scenario is recommended if you'd like to run public web applications on a single tier, such as blogs or simple websites. The configuration is as follows.

The following is the procedure to implement this scenario.

1. Create VPC
2. Create public subnet
3. Set network ACL
4. Set route table
5. Create server

1. Create VPC

First of all, create a VPC on the NAVER Cloud Platform console. You can create it on the console's Services > Networking > VPC menu. The IPv4 CIDR block size of a VPC is /16 (e.g., 10.0.0.0/16), and 65,536 IPs can be used.
You can refer to the following guide:

• VPC creation guide

2. Create public subnet

Once you've created the VPC, build a subnet within the VPC so the network can actually be used. You can set up a public subnet for internet communication. Up to 256 IPs can be used (/24), and each server placed in this space can have one public IP connected. (1:1 NAT)
You can refer to the following guide:

• Subnet creation guide

3. Set network ACL

Once you've created the subnet, set network Access Control List (ACL) for security, which controls inbound and outbound traffic for the subnet.
You can refer to the following guide:

• Network ACL settings guide

In this scenario, the following settings are recommended for network ACL.

• Inbound

• Outbound

4. Set route table

Once you've completed configuring the network ACL, configure a route table which sets the network path. In this scenario, the route table is automatically configured as follows, so the server can communicate with other instances in the VPC or the internet.

You can refer to the following guide:

• Route table settings guide

5. Create server

Once you've completed setting the route table, create a server to place in the VPC created. Select the VPC and subnet previously created when creating the server, and then enter the ACG mentioned above. Once the server has been created, connect to the server, and create a web server. Check if the HTTP communication works.
You can refer to the following guide:

• Server creation guide

Creation of public subnet and private subnet

The creation of public subnet and private subnet scenario is recommended if you'd like to run public web applications while blocking public access to private servers (e.g., DB). The configuration is as follows.

The following is the procedure to implement this scenario.

1. Create VPC
2. Create public subnet and private subnet
3. Set network ACL
4. Set public subnet route table
5. Create NAT Gateway
6. Set private subnet route table
7. Create servers

1. Create VPC

First of all, create a VPC on the NAVER Cloud Platform console. You can create it on the console's Services > Networking > VPC menu. The IPv4 CIDR block size of a VPC is /16 (e.g., 10.0.0.0/16), and up to 65,535 IPs can be used.
You can refer to the following guide:

• VPC creation guide

2. Creation of public subnet and private subnet

Once you've created the VPC, build a subnet within the VPC so the network can actually be used. Subnet can be divided into two main categories, public subnet and private subnet.

• Public subnet: Up to 256 IPs can be used by setting the subnet's CIDR to 10.0.0/24. Each server placed in this space can have one public IP connected. (1:1 NAT)
• Private subnet: Up to 256 IPs can be used by setting the subnet's CIDR to 10.0.0/24. Servers placed in this space don't receive traffic from the internet. If you add a NAT Gateway to it, then sending and receiving traffic via the internet become available.

You can refer to the following guide:

• Subnet creation guide

3. Set network ACL

Once you've created the subnet, set network Access Control List (ACL) for security, which controls inbound and outbound traffic for the subnet.
You can refer to the following guide:

• Network ACL settings guide

In this scenario, the following settings are recommended for network ACL.

• Public Subnet: Inbound

• Public Subnet: Outbound

• Private Subnet: Inbound

• Private Subnet: Outbound

4. Set public subnet route table

Once you've completed configuring the network ACL, configure a route table which sets the network path. In this scenario, the public subnet route table is automatically configured as follows, so the server can communicate with other instances in the VPC or the internet.

You can refer to the following guide:

• Route table settings guide

5. Create NAT Gateway

Create a NAT Gateway to connect servers in a private subnet to the internet.
You can refer to the following guide:

• NAT Gateway creation guide

6. Set private subnet route table

Only local items are automatically configured for the private subnet route table, so you have to set the NAT Gateway's network path separately. If communication with the entire internet site is required, then you can enter 0.0.0.0/0 as the destination and configure as follows.

You can refer to the following guide:

• Route table settings guide

7. Create server

Once you've completed setting the route table, create a server to place in the VPC created. Select the VPC and subnet previously created when creating the server, and then enter the ACG mentioned above. Once the server has been created, connect to the server, and create a web server. Check if the HTTP communication works.
You can refer to the following guide:

• Server creation guide

Creation of public subnet and private subnet for on-premise connection

The creation of public subnet and private subnet for on-premise connection scenario is recommended if you'd like to run public web applications while communicating with the customer's business place. The configuration is as follows.

The following is the procedure to implement this scenario.

1. Create VPC
2. Create public subnet and private subnet
3. Set network ACL
4. Set public subnet route table
5. Create Virtual Private Gateway
6. Create IPsec VPN
7. Set private subnet route table
8. Create server

1. Create VPC

First of all, create a VPC on the NAVER Cloud Platform console. You can create it on the console's Services > Networking > VPC menu. The IPv4 CIDR block size of a VPC is /16 (e.g., 10.0.0.0/16), and 65,536 IPs can be used.
You can refer to the following guide:

• VPC creation guide

2. Creation of public subnet and private subnet

Once you've created the VPC, build a subnet within the VPC so the network can actually be used. Subnet can be divided into two main categories, public subnet and private subnet.

• Public subnet: Up to 256 IPs can be used by setting the subnet's CIDR to 10.0.0/24. Each server placed in this space can have one public IP connected. (1:1 NAT)
• Private subnet: Up to 256 IPs can be used by setting the subnet's CIDR to 10.0.0/24. Servers placed in this space don't receive traffic from the internet. If you add a NAT Gateway to it, then sending and receiving traffic via the internet become available.

You can refer to the following guide:

• Subnet creation guide

3. Set network ACL

Once you've created the subnet, set network Access Control List (ACL) for security, which controls inbound and outbound traffic for the subnet.
You can refer to the following guide:

• Network ACL settings guide

In this scenario, the following settings are recommended for network ACL.

• Public Subnet: Inbound

• Public Subnet: Outbound

• Private Subnet: Inbound

• Private Subnet: Outbound

4. Set public subnet route table

Once you've completed configuring the network ACL, configure a route table which sets the network path. In this scenario, the public subnet route table is automatically configured as follows, so the server can communicate with other instances in the VPC or the internet.

You can refer to the following guide:

• Route table settings guide

5. Create Virtual Private Gateway

Create a Virtual Private Gateway to connect servers in a private subnet to customer's on-premise server.
You can refer to the following guide:

• Virtual Private Gateway creation guide

6. Create IPsec VPN

To create a managed IPsec VPN, fill in a subscription request form and submit it via the sales representative in charge or customer inquiry. (the process planned to be automated later)
The subscription request form can be downloaded from the portal's Support > Library.
Proceed with the following steps once you receive the confirmation the subscription has started.
(Currently, the subscription is started manually after receiving the form. We plan to launch the automated product soon.)

7. Set private subnet route table

Only local items are automatically configured for the private subnet route table, so you have to set the Virtual Private Gateway's network path separately. You can use the customer's on-premise server as the destination and configure as follows.

You can refer to the following guide:

• Route table settings guide

8. Create server

Once you've completed setting the route table, create a server to place in the VPC created. Select the VPC and subnet previously created when creating the server, and then enter the ACG mentioned above. Once the server has been created, connect to the server, and create a web server. Check if the HTTP communication works.
You can refer to the following guide:

• Server creation guide

Inter-VPC private network (peering) configuration

This is recommended if you would like to set up a private communication channel between two different VPCs. Essentially, communication is possible via public IPs. However a private network is built for security and stability.
This scenario is based on a situation where a connection is to be set up between VPC A with Subnets A and B, and VPC B with Subnets C and D. The configuration is as follows.

The following is the procedure to implement this scenario.

1. Create VPC
2. Create subnet
3. Set network ACL
4. Create VPC peering
5. Set route table
6. Create server

1. Create VPC

First of all, create two VPCs on the NAVER Cloud Platform console. You can create it on the console's Services > Networking > VPC menu. The IPv4 CIDR block size of each VPC is /16 (e.g., 10.0.0.0/16), and 65,536 IPs can be used.
You can refer to the following guide:

• VPC creation guide

2. Create subnet

Once you've created the VPC, build a subnet within the VPC so the network can actually be used. Subnet can be divided into two main categories, public subnet and private subnet.

• Public subnet: Up to 256 IPs can be used by setting the subnet's CIDR to 10.0.0/24. Each server placed in this space can have one public IP connected. (1:1 NAT)

• Private subnet: Up to 256 IPs can be used by setting the subnet's CIDR to 10.0.0/24. Servers placed in this space don't receive traffic from the internet. If you add a NAT Gateway to it, then sending and receiving traffic via the internet become available.

• Subnet creation guide

3. Set network ACL

Set network Access Control List (ACL) to control inbound and outbound traffic for the subnet. The subnet in the VPC that will request peering needs to set network ACL to allow traffic to the VPC on the other side.
You can refer to the following guide:

• Network ACL settings guide

In this scenario, the following settings are recommended for network ACL.

• Inbound

• Outbound

4. Create VPC peering

Once you've set up the network ACL, request inter-VPC communication through the VPC peering menu. It's an one-way communication, so the requesting VPC and accepting VPC need to be specified. The accepting VPC can be another VPC in your account, or a VPC in another account. If you'd like the communication to be two-way, then create two networks by specifying the requesting VPC and accepting VPC in reverse.
You can refer to the following guide:

• VPC peering creation guide

5. Set route table

After creating the VPC peering, configure a route table which sets the network path. The subnet in the VPC that requested peering needs to set routing to the VPC on the other side. If Subnet A (public subnet) in VPC A requested peering to VPC B's Subnet C, then the route table can be configured as follows.

You can refer to the following guide:

• Route table settings guide

6. Create server

Once you've completed setting the route table, create a server in each of the two VPCs created. Select the VPC and subnet previously created when creating the server, and then enter the ACG mentioned above. Once the server has been created, connect to the server, and create a web server. Check if the HTTP communication works.
You can refer to the following guide:

• Server creation guide