File Storage NAS:Mount a NAS across same-region VPCs via PrivateLink

Introduction

PrivateLink enables service interaction over the Alibaba Cloud private network. You can use PrivateLink to unidirectionally access services that are deployed in other VPCs over a private network. This eliminates the need for a public network egress, such as a NAT Gateway or an elastic IP address (EIP). Service interaction data does not traverse the internet, which ensures higher security and better network quality.

The endpoint service for PrivateLink supports using a Network Load Balancer (NLB) instance as a service resource. An NLB instance receives requests from clients and distributes the requests to backend servers based on listener rules. When you use an NLB instance as a service resource for an endpoint service, you can configure a single NLB instance to serve multiple zones, eliminating the need to create a separate service resource for each zone.

Scenario

This topic uses an example to show how an ECS instance in VPC1 accesses a General-purpose NAS file system that uses the NFS protocol and is located in VPC2. The instances and file system belong to the same account and region. You must create an NLB instance in VPC2 that spans two zones. Then, create two backend server groups named S1 and S2, and add the two access ports of the NAS file system (111 and 2049) to the backend server groups of the NLB instance. Then, create an endpoint service and add the NLB instance as a service resource. In VPC1, create an endpoint. After the endpoint is connected to the endpoint service and runs as expected, the ECS instance in VPC1 can access the NAS file system in VPC2 over the private network.

The following table describes the network plan for the two VPCs in this topic. The CIDR blocks of VPC1 and VPC2 can overlap without affecting each other.

Limits

• When you create an endpoint service, the selected region must support both PrivateLink and NLB. For more information about the regions that support these services, see Regions and zones that support PrivateLink and Regions and zones that support NLB.

• An endpoint and an endpoint service can be connected only if they are in the same zone. The zones for endpoints must be a subset of the zones for service resources. We recommend that you deploy service resources across all or as many zones as possible in a region. This allows the service to be called by endpoints in different zones.

• PrivateLink does not support IPv6 access by default. To use this feature, contact your account manager.

• You can use PrivateLink to mount only General-purpose NAS file systems across VPCs in the same region.

Prerequisites

• You have created VPC1 and VPC2 in the China (Chengdu) region. In VPC1, you have created a vSwitch in Zone A and another vSwitch in Zone B. In VPC2, you have also created a vSwitch in Zone A and another vSwitch in Zone B. For more information, see Create a VPC with an IPv4 CIDR block.

• You have created an ECS instance in Zone A of VPC1 to act as the mount client. You have created a General-purpose NAS file system in Zone A of VPC2. For more information, see Create an instance by using the wizard and Create a file system.

• You have created a security group in VPC1. You can configure security group rules based on your business and security requirements. For more information, see Create a security group.

Step 1: Create an internal-facing NLB instance

1. Log on to the NLB console.

2. In the top navigation bar, select the region in which the NLB instance is deployed.

3. On the Instances page, click Create NLB.

4. On the NLB (Pay-As-You-Go) International Site page, configure the NLB instance with the following parameters and click Buy Now.

   Parameter	Description
   Region	Select the region where you want to deploy the instance. In this example, select China (Chengdu).
   Instance network type	Select the network type of the instance. In this example, only Private is supported.
   VPC	Select the VPC in which you want to deploy the instance. In this example, select VPC2.
   Zone	Select the zones where you want to deploy the instance. You must select at least two zones. In this example, select Chengdu Zone A and the vSwitch in Zone A, and Chengdu Zone B and the vSwitch in Zone B.
   IP Version	Select the IP version of the instance. IPv4: The NLB instance can be accessed only by using IPv4 addresses. Dual-stack: The NLB instance can be accessed by using both IPv4 and IPv6 addresses.
   Instance Name	Enter a name for the instance.
   Resource group	Select a resource group for the NLB instance. In this example, select the default resource group.
   Service-linked role	If you are creating an NLB instance for the first time, click Create Service-linked Role to create a service-linked role.

Step 2: Create backend server groups

1. In the left-side navigation pane, choose NLB > Server Group.

2. In the top navigation bar, select a region.

3. On the Server Group page, click Create Server Group.

4. In the Create Server Group dialog box, set the following parameters and click Create.

   Parameter	Description
   Server Group Type	Select a type for the server group. In this example, select IP.
   Server Group Name	Enter a name for the server group. In this example, enter S1.
   VPC	Select the VPC to which the backend server group belongs. In this example, select VPC2.
   Backend Server Protocol	Select a backend protocol. In this example, select TCP.
   Scheduling Algorithm	Select a scheduling algorithm. In this example, use the default algorithm Weighted Round-robin.
   Enable IPv6	Specifies whether to enable IPv6. After you enable IPv6, you can add both IPv4 and IPv6 backend servers to the server group. If you do not enable IPv6, you can add only IPv4 backend servers. Note If IPv6 is disabled for the VPC that you selected, this feature is disabled by default.
   Connection Draining	After you enable connection draining, existing connections can continue to transmit data for a period of time when you remove backend servers or when health checks fail. Connection Draining Timeout Period: If you enable connection draining, you must specify a timeout period. In this example, this feature is disabled by default.
   Preserve client IP	Specifies whether to preserve client IP addresses. Server groups of the IP type do not automatically carry client source IP addresses. To retrieve client IP addresses, use the Proxy Protocol in the listener configuration.
   Forward all ports	Specifies whether to enable all-port forwarding. After you enable this feature, you do not need to specify ports when you add backend servers. NLB forwards traffic to the backend server port that matches the frontend request port. Note To enable all-port forwarding for a listener, you must also enable this feature for the backend server group. In this example, this feature is disabled by default.
   Configure Health Check	Specifies whether to enable health checks. In this example, this feature is enabled by default. After you enable health checks, you can click Modify to change the health check configurations. In this example, the default configurations are used.

5. After the server group is created, find S1 and click its ID.

6. Click the Backend Servers tab and then click Add IP Address.

7. In the Add Backend Servers panel, enter the virtual IP address (VIP) of the NAS mount target and click Next.

   You can run the ping command on an ECS instance to obtain the VIP of the mount target. The following code provides an example:

   • Run the following command:

     ping 19f04a4****-i****.cn-chengdu.nas.aliyuncs.com

   • The following code shows a sample output:

     [root@xxx ~]# ping 19-xxx_95.cn-chengdu.nas.aliyuncs.com
     PING 19f04a4xxx:95.cn-chengdu.nas.aliyuncs.com (192.168.2.168) 56(84) bytes of data.

8. Set the port and weight for the added NAS instance and click OK.

   Set the port to 111 and keep the weight at its default value.

   After the creation is successful, repeat the steps above to create backend server group S2, setting the port to 2049 when you add backend servers.

   Note

   For an SMB file system, you only need to create one backend server group and set the port to 445.

Step 3: Configure listeners

1. In the left-side navigation pane, choose NLB > Instances.

2. On the Instances page, find the NLB instance and click its ID.

3. Click the Listener tab, and on the Listener tab, click Create Listener.

4. On the Configure Listener wizard page, complete the following configurations and click Next.

   Parameter	Description
   Load balancer protocol	Select the protocol for the listener. In this example, select TCP.
   Multi-port Listening/Forwarding	Specifies whether to enable the full-port feature. After this feature is enabled, the NLB instance listens on all ports within the specified port range and forwards requests to the corresponding ports on backend servers. In this example, this feature is disabled by default.
   Listener Port Range	The listener port is used to receive and process requests. Select 111. Note If the file system uses the SMB protocol, select 445.
   Listener name	Enter a name for the listener.
   Advanced settings	Expand this section to configure advanced settings. In this example, the default values are used.

5. In the Server Group step, select the backend server group S1 that you created in Step 2 and click Next.

   Important

   The selected backend server group must correspond to the listener port. Otherwise, you cannot mount or access the NAS file system.

6. In the Confirm step, confirm the listener configurations and click Submit.

7. In the Load Balancer Business Configuration Wizard dialog box, click OK to return to the Instance Management page.

   When the Health Check Status of the listener is Healthy, the backend server (the VIP of the NAS instance) can process requests forwarded by the NLB instance.

8. Repeat Step 4 to Step 7, set the listener port to 2049, and configure the server group as S2 in the Server Group configuration wizard.

   Note

   If you use a file system with the SMB protocol, you need to configure a listener only for port 445.

Step 4: Create an endpoint service

1. Log on to the endpoint service console.

2. In the top navigation bar, select the region where you want to create the endpoint service. In this example, select China (Chengdu).

3. On the Endpoint Service page, click Create Endpoint Service.

4. On the Create Endpoint Service page, configure the endpoint service with the following parameters and click OK.

   Parameter	Description
   Service Resource Type	Select the type of service resource for the endpoint service. In this example, select NLB.
   Select Service Resource	Select the zone and the service resource within that zone. In this example, select Chengdu Zone A, and then click + Add Service Resource to select Chengdu Zone B. For both zones, select the NLB instance created in Step 1 as the service resource.
   Automatically Accept Endpoint Connections	Specifies whether to automatically accept connection requests from endpoints. In this example, select No.
   Enable Zone Affinity	Specifies whether to enable zone-affinity. In this example, select No.
   Resource Group	Select the resource group to which the endpoint service belongs.
   Description	Enter a description for the endpoint service.

Step 5: Create an endpoint

1. Log on to the endpoint console.

2. In the top navigation bar, select the region where you want to create the endpoint. In this example, select China (Chengdu).

3. On the Endpoints page, click the Interface Endpoint tab, and then click Create Endpoint.

4. On the Create Endpoint page, configure the endpoint with the following parameters and click OK.

   Parameter	Description
   Endpoint Name	Enter a name for the endpoint.
   Endpoint Type	Select the type of the endpoint. In this example, select Interface Endpoint.
   Endpoint Service	Select the destination endpoint service. In this example, click Select Service and select the endpoint service that you created in Step 4: Create an endpoint service.
   VPC	Select the VPC to which the endpoint belongs. In this example, select VPC1.
   Security Group	Select a security group to associate with the endpoint ENI. The security group controls data traffic from VPC1 to the endpoint ENI. Note Make sure that the security group rules allow access from the client to the endpoint ENI.
   Zone and vSwitch	Select a zone that corresponds to the endpoint service and a vSwitch within that zone. The system automatically creates an endpoint ENI in the vSwitch. In this example, select Chengdu Zone A and a vSwitch in Zone A. Then, click + Add vSwitch to select Chengdu Zone B and a vSwitch in Zone B.
   Resource Group	Select the destination resource group.
   Description	Enter a description for the endpoint.

   After the endpoint is created, you can view the domain name and IP address of the endpoint in each zone.

   On the endpoint details page, click the Zone and ENI tab to view the ENI and IP address corresponding to each zone. The status of each ENI is Connected.

Step 6: Accept the connection request

The endpoint service must accept the connection request from the endpoint. After the request is accepted, VPC1 can access the endpoint service through the endpoint.

1. Log on to the endpoint service console.

2. In the top navigation bar, select the region where the endpoint service is created. In this example, select China (Chengdu).

3. On the Endpoint Service page, find the endpoint service that you created in Step 4 and click its ID.

4. On the details page of the endpoint service, click the Endpoint Connections tab. Find the destination endpoint and click Allow in the Actions column.

   After you accept the connection request, the connection status of the endpoint changes from Disconnected to Connected. This indicates that the endpoint service can process requests sent from the endpoint. You can use the domain name or IP address of the endpoint that you obtained in Step 5 to access the endpoint service.

Step 7: Mount the file system

1. Connect to the ECS instance. For more information, see Connection methods.

2. Test the network connectivity between VPC1 and VPC2.

   This example uses Telnet to test the connectivity. Before you start the test, make sure that Telnet is installed. Verify connectivity to the endpoint IP addresses generated in Step 5. The following command is a test example. Replace the endpoint IP address and port number based on your business requirements.

   telnet 10.0.23.151 2049

   If no error is returned after you run the command, the network connection between VPC1 and VPC2 is established.

3. Mount the file system.

   1. Install an NFS client. For more information, see Install an NFS client.

      Note

      If you use a Windows operating system, see Mount an SMB file system.

   2. Mount the file system.

      Use any IP address of the endpoint that you obtained in Step 5 to mount the file system. The following code shows a sample mount command:

      sudo mount -t nfs -o vers=3,nolock,proto=tcp,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport 10.0.23.117:/ /mnt

      Note

      On a Windows operating system, run the following command:

      net use Z: \\10.0.23.151\myshare

What to do next

When you no longer need to use the NAS file system on the ECS instance, unmount the file system before you delete the NLB instance, endpoint, and other related resources. If you delete these resources before you unmount the file system, your operating system may become slow or unresponsive when you run commands.

• Release file system resources

  • To unmount a file system, see Unmount a file system by running a command.

  • If you no longer need to store data in NAS or want to stop the service, see Release a file system.

• Release NLB resources

  For more information, see Release an instance.

• Release endpoint resources

  For more information, see Delete an endpoint service.

Related documentation

• You can also use Cloud Enterprise Network (CEN) to mount a file system across VPCs in the same region. For more information, see Use CEN to mount a NAS file system across VPCs in the same region.

• If you need to mount a file system across regions or accounts, see Use CEN to mount a NAS file system across accounts and regions.

• If you need to mount a file system from an on-premises data center, see Access a file system from an on-premises data center.

• If you need to migrate data from an on-premises data center, a local NAS, or OSS to a NAS file system on Alibaba Cloud, see Data migration.