This topic describes the default network settings for RDS Custom instances. This topic also describes how to initialize the network environment for custom images.
Default network settings for RDS Custom instances
By default, two network interface controllers (NICs) are configured for an RDS Custom instance in dual-NIC mode: a primary NIC and an elastic network interface (ENI). In most cases, the primary NIC is named eth0 and the ENI is named eth1.
eth0: created in the management virtual private cloud (VPC). Only traffic from the management CIDR block 100.100.0.0/16 of the Elastic Compute Service (ECS) instance can flow over eth0 due to security group limits.
NoteIP addresses 100.100.2.136 and 100.100.2.138 are the IP addresses of the Private DNS service. Traffic from the IP addresses flows over eth1.
eth1: created in the user VPC. In most cases, all traffic flows over eth1 except for traffic from the management CIDR block of the ECS instance. Security groups are used to manage inbound and outbound traffic.
The following figures show information about the NICs, route tables, and iptables firewall rules of your RDS Custom instance after you connect to the instance. For more information, see Connect to an RDS Custom instance.
-
Run the
ip address showcommand to check the status of the NICs on the instance.1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether 00:16:3e:10:32:d8 brd ff:ff:ff:ff:ff:ff inet 20.xxx.xxx.xxx/16 brd 20.xxx.xxx.xxx scope global dynamic eth0 valid_lft 315357595sec preferred_lft 315357595sec inet6 fe80::xxx:xxx:xxx:xxx/64 scope link valid_lft forever preferred_lft forever 3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether 00:16:3e:48:f2:e7 brd ff:ff:ff:ff:ff:ff inet 172.xxx.xxx.xxx/20 brd 172.xxx.xxx.xxx scope global dynamic eth1 valid_lft 315357597sec preferred_lft 315357597sec inet6 fe80::xxx:xxx:xxx:xxx/64 scope link valid_lft forever preferred_lft forever -
Run the
route -ncommand to view the route table of the instance.Traffic flows only over eth1.
Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.xxx.xxx.xxx 0.0.0.0 UG 0 0 0 eth1 100.100.0.0 20.xxx.xxx.xxx 255.255.0.0 UG 0 0 0 eth0 100.100.2.136 172.xxx.xxx.xxx 255.255.255.255 UGH 0 0 0 eth1 100.100.2.138 172.xxx.xxx.xxx 255.255.255.255 UGH 0 0 0 eth1 169.xxx.xxx.xxx 0.0.0.0 255.255.0.0 U 1003 0 0 eth1 172.xxx.xxx.xxx 0.0.0.0 255.255.240.0 U 0 0 0 eth1 -
Run the
iptables -L -ncommand to view the default iptables configuration of the instance.Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
If you fail to connect to your RDS Custom instance after you manage the route tables, iptables firewall rules, and NIC configurations, including eth0 restart, you can restart the instance to initialize the network environment for the instance. For more information, see Restart an RDS Custom instance.
The RDS Custom instance uses the /etc/rds_custom_init.sh script to perform network initialization. Do not delete this script, or network initialization will fail.
Initialize the network environment for custom images
When you create an RDS Custom instance from a custom image, RDS Custom automatically configures the /etc/rds_custom_init.sh network initialization script for most public images. Supported images include Alibaba Cloud Linux 3, Alibaba Cloud Linux 2, CentOS 8, CentOS 7, Debian 11, Debian 10.5, AlmaLinux 9.2, Ubuntu 22, Ubuntu 20, and Ubuntu 16. To use other custom images, you must manually create the rds_custom_init.sh script in the source instance before you create the custom image.
The rds_custom_init.sh script provides the following key functions:
Use the network configuration for eth1 and start related services for systems that cannot automatically activate ENIs.
Modify the route configuration to point the default route to eth1 and point the management CIDR block 100.100.0.0/16 of the ECS instance to eth0.
Modify the route configuration to point the IP addresses 100.100.2.136 and 100.100.2.138 of the Private DNS service to eth1.
When an RDS Custom instance starts, the system records the gateway of eth0 in the /etc/eth0_gateway file and automatically configures the /etc/rds_custom_init.sh script for most public images. If you plan to perform any network-related initializations on the instance, ensure that you manually run the /etc/rds_custom_init.sh script after your initializations are complete. If the eth1 interface becomes unavailable (for example, its IP address is not recognized), contact us or reconfigure the network to restore eth1 functionality.
Manually create the script and configure settings for the script to run at startup
-
Create the
rds_custom_init.shscript in the /etc directory with the following content. -
Run the
chmod a+x /etc/rds_custom_init.shcommand to grant executable permissions to the script. -
Edit the
/etc/rc.localfile to configure therds_custom_init.shscript to run on startup.-
For operating systems other than Ubuntu, add
/etc/rds_custom_init.shto the/etc/rc.localfile and grant the necessary permissions to/etc/rc.local.chmod 777 /etc/rc.local -
For Ubuntu operating systems, configure and enable the
rc-local.service.-
Edit the
/lib/systemd/system/rc-local.servicefile and add the following content.[Install] WantedBy=multi-user.target -
Configure the
rc-local.serviceto start on startup.# Configure the service to run at startup. systemctl enable rc-local.service # Check whether the service is configured to run at startup. systemctl is-enabled rc-local.service -
Start the
rc-local.service.# Start the service. systemctl start rc-local.service # Check the service. systemctl status rc-local.service
NoteBy default, Ubuntu 20.04, Ubuntu 22.04, and Ubuntu 24.04 support the secondary ENIs that are bound in automatic configuration. If automatic configuration fails, perform the following operations.
-
-