Platform For AI:Accelerate public network access with a private gateway

Prerequisites

• You have created a Virtual Private Cloud (VPC) and a vSwitch for the DSW instance. We recommend using the 192.168.0.0/16 CIDR block for your VPC to avoid IP address conflicts with PAI clusters. For more information, see Create and manage a VPC.

• You have created a security group for the VPC. For more information, see Create a security group.

Billing

Internet NAT Gateway and Elastic IP Address (EIP) are billed as separate cloud products. Charges continue to accrue even when your DSW instance is stopped. To avoid unnecessary costs, delete these resources when they are no longer needed.

Procedure

The following steps use a DSW instance as an example. The same procedure applies to DLC instances.

1. Log on to the NAT Gateway console and create an Internet NAT Gateway. The following table describes the key parameters. For detailed steps, see Create an Internet NAT gateway.

   If you have multiple Internet NAT Gateways in your VPC, see High availability deployment of an Internet NAT gateway in a single zone for network design and deployment solutions.

   Parameter	Description
   Region	Select the same region as your VPC. If you do not specify a region, the VPC's region is used by default.
   Network and Zone	Select the Virtual Private Cloud (VPC) and vSwitch of your DSW instance.
   EIP	If no Elastic IP Address instances are available, click Purchase EIP to purchase one. We recommend setting the maximum bandwidth as high as possible.

2. Create an SNAT entry. On the Internet NAT Gateway page, click the name of your new gateway. Go to the SNAT Management tab and click Create SNAT Entry. When you create the entry, select VPC to set the source CIDR block to 0.0.0.0/0, which means all CIDR blocks in the VPC can access the internet through this SNAT entry. Select the bound Elastic IP Address (EIP) as the public IP address. If you have purchased multiple EIPs, you can use a single IP or multiple IPs. After the SNAT entry is created, its status is displayed as Available. For detailed steps, see Create an snat entry.

3. Log on to the PAI console. In the upper-left corner, select the same region as your VPC. Configure the network parameters on the creation page for a new DSW instance. For an existing instance, click Change Settings to open the page. The key parameters are described below. For information about other parameters, see Create a DSW instance.

   Parameter	Description
   VPC Settings	This parameter is available only if you select the public resource group for Resource Quota. Select the Virtual Private Cloud, vSwitch, and security group.
   Security Group ID
   vSwitch ID
   Internet Access Gateway	Select Private Gateway. The DSW instance uses the private gateway to access the internet. If you have not purchased an Internet NAT Gateway, associated an EIP, and configured an snat entry, the instance cannot access the internet.

4. Test the network connectivity.

   1. Open the DSW instance and click Terminal in the top menu bar.

   2. Run the ping www.aliyun.com command to test the network connectivity.

      Receiving reply packets indicates that the DSW instance can access the internet through the private gateway.

      Example output:

      PING www.aliyun.com.w.cdngslb.com (47.118.XX.XX) 56(84) bytes of data.
      64 bytes from 47.118.XX.XX (47.118.XX.XX): icmp_seq=1 ttl=59 time=5.96 ms
      64 bytes from 47.118.XX.XX (47.118.XX.XX): icmp_seq=2 ttl=59 time=5.83 ms
      64 bytes from 47.118.XX.XX (47.118.XX.XX): icmp_seq=3 ttl=59 time=5.83 ms
      64 bytes from 47.118.XX.XX (47.118.XX.XX): icmp_seq=4 ttl=59 time=5.84 ms
      64 bytes from 47.118.XX.XX (47.118.XX.XX): icmp_seq=5 ttl=59 time=5.86 ms

Appendix: Block internet access for an instance

If your security requirements prohibit internet access for DSW or DLC instances, set the Private Gateway parameter to Private Gateway when configuring the instance. Do not create an Internet NAT Gateway or SNAT entries. This restricts the instance to accessing data only within its VPC.