Server Load Balancer:Quick security inspection for IPv4 traffic with GWLB

Example scenario

To enhance security and reliability, an enterprise routes inbound IPv4 traffic from the internet to network virtual appliances (NVAs) for security inspection before it reaches the application servers. The enterprise can use GWLB to manage the NVAs and ensure that all traffic undergoes rigorous inspection before it is distributed to the application servers. This topic uses an example in which an enterprise uses an Alibaba Cloud account to create a business VPC and a security VPC in the China (Ulanqab) region.

• The business VPC hosts the application system and contains an IPv4 gateway to route internet-bound traffic to the NVAs.

  In the business VPC, an application server vSwitch and a GWLB endpoint vSwitch are created. In the application server vSwitch, an ECS instance is created to serve as an application server, and application services are deployed on the instance. A GWLB endpoint is created in the GWLB endpoint vSwitch.

• The security VPC hosts the NVAs.

  In the security VPC, a GWLB instance is created, and the NVAs are added to its backend server group. An endpoint service is also created in the security VPC, and the GWLB instance is added as a service resource.

After the GWLB endpoint and the endpoint service are connected, traffic from the internet can be routed to the NVAs for inspection.

Limitations

• At least one NVA must be running.

• The security group of the backend servers must allow UDP traffic on port 6081.

• When you create an endpoint service, you must select a region and an availability zone that support both PrivateLink and GWLB instances. For more information about the regions that support PrivateLink and GWLB instances, see Regions and availability zones that support PrivateLink and Regions and availability zones that support GWLB.

• The availability zones of the GWLB endpoint must be a subset of the availability zones of the endpoint service.

Prerequisites

• A business VPC and a security VPC have been created. In availability zone B of the business VPC, an application server vSwitch and a GWLB endpoint vSwitch have been created. In availability zone B of the security VPC, a GWLB vSwitch has been created. For more information, see Create a VPC and a vSwitch.

• An IPv4 gateway has been created, activated, and associated with the business VPC. For more information, see Create and manage an IPv4 gateway.

• Route tables have been created for the IPv4 gateway, the application server vSwitch, and the GWLB endpoint vSwitch. For more information, see Create and manage a route table.

• An ECS instance for the application server has been created in the business VPC, and application services have been deployed on the instance. If the ECS instance needs to communicate with the internet, you must assign a public IP address to the instance. In availability zone B of the security VPC, ECS instances ECS01 and ECS02 have been created, and NVA images have been deployed on each instance. Make sure that your ECS01 and ECS02 instances support jumbo frames. Geneve encapsulation adds 68 bytes to the original packet, which may cause the packet size to exceed 1,500 bytes. For more information, see Maximum transmission unit (MTU).

  • For information about instance types that support jumbo frames, see Instance families that support jumbo frames.

  • For more information about how to create an ECS instance, see Create an instance by using the wizard.

  • For more information about how to deploy an NVA image, see Create a custom image from an instance.

• Security groups have been created for the application server ECS instance, ECS01, and ECS02. You can configure security group rules based on your business and security requirements. For more information, see Create a security group.

Procedure

Step 1: Create a GWLB instance

An instance is a load balancing service entity. You must first create a GWLB instance.

1. Log on to the Gateway Load Balancer console.

2. In the top navigation bar, select the region where you want to create the GWLB instance.

3. On the Instances page, click Create GWLB.

4. On the Gateway Load Balancer purchase page, configure the following parameters.

   This section describes only the relevant parameters. Use the default values for other parameters. For more information about the parameters, see Create and manage GWLB instances.

   Parameter	Description
   Instance name	Enter a name for the instance.
   VPC	Select the security VPC to which the instance belongs.
   Region and zone	Select the region to which the instance belongs. In this example, China (Ulanqab) is selected.
   Zone	Select at least one availability zone. In this example, Ulanqab Zone B and the vSwitch of the GWLB vSwitch in this availability zone are selected.
   IP version	Select the IP version of the instance. In this example, IPv4 is selected.
   Service-Linked Role	When you create a GWLB instance for the first time, click Create Service-Linked Role to create a Service-Linked Role named AliyunServiceRoleForGwlb. Note This parameter appears only when you create a GWLB instance for the first time.

5. Click Buy Now and follow the on-screen instructions to complete the payment.

6. Return to the Instances page and select the region to view the new instance.

Step 2: Create a backend server group

You need to create a server group and add backend servers to accept client requests forwarded by the GWLB.

1. In the left-side navigation pane, choose GWLB > Server Group.

2. On the Server Group page, click Create Server Group.

3. In the Create Server Group dialog box, configure the parameters for the server group and click Create.

   This section describes only the relevant parameters. For more information, see Create and manage a server group.

   Parameter	Description
   Server Group Type	Select a server group type. In this example, Server is selected.
   Server Group Name	Enter a name for the server group.
   VPC	From the VPC drop-down list, select the security VPC in which the ECS instances are deployed. Note Make sure that the selected VPC is the same as the VPC that you selected when you created the GWLB instance.
   Scheduling Algorithm	Select a scheduling algorithm. In this example, 5-tuple Hashing is selected.
   Health Check Method	Select a health check method or disable health checks. In this example, TCP is selected.
   Health Check Port	Enter the health check port. In this example, port 80 is used.

4. In the The server group is created. dialog box, click Add Backend Server.

5. On the Backend Servers tab, click Add Backend Server.

6. In the Add Backend Server panel, select Server.

   In this example, the server type is set to ECS/ENI.

7. Select the ECS01 and ECS02 instances that you created, and then click OK.

   Note

   • In this example, the server type is set to ECS/ENI.

   • Make sure that you have deployed NVA images on the backend servers and that the backend servers can process Geneve traffic.

Step 3: Configure a listener

Configure a listener for the instance and associate it with the backend server group to forward traffic from all ports to the backend servers over the Geneve protocol.

1. In the left-side navigation pane, choose GWLB > Instances, and then click the ID of the instance.

2. Click the Listeners tab and then click Create IP Listener.

3. On the Create IP Listener configuration page, select a Server Group Type, and then select the server group that you created.

4. The list of added servers appears on the page. Click OK.

Step 4: Configure an endpoint service

A service provider needs to use an endpoint service to enable the GWLB to provide services externally.

1. Log on to the PrivateLink console.

2. On the Endpoint Service page, click Create Endpoint Service.

3. On the Create Endpoint Service page, configure the endpoint service with the following information, and then click OK.

   Only the configurations relevant to this topic are listed here.

   Parameter	Description
   Region	In this example, China (Ulanqab) is selected.
   Service Resource Type	The type of service resource for the endpoint service. In this example, GWLB is selected.
   Select Service Resource	Select the availability zone of the service resource and the service resource within that availability zone. In this example, the availability zone is set to Ulanqab Zone B. The service resource for Zone B is the GWLB instance created in Step 1.
   IP Version	In this example, IPv4 is selected.
   Automatically Accept Endpoint Connections	Select whether to automatically accept connection requests from endpoints. In this example, Yes is selected. Note If you enable this feature, the endpoint service automatically accepts connection requests after an endpoint is created.
   Service Payer	In this example, Service Consumer is selected.

Step 5: Configure a GWLB endpoint

As the service consumer, create a GWLB endpoint to connect to the endpoint service.

1. Log on to the PrivateLink console.

2. On the Endpoints page, click the Interface Endpoint tab, and then click Create Endpoint.

3. On the Create Endpoint page, configure the endpoint with the following information, and then click OK.

   Only the configurations that are highly relevant to this topic are listed here.

   Parameter	Description
   Region	In this example, China (Ulanqab) is selected.
   Endpoint Name	Enter a custom name for the endpoint.
   Endpoint Type	Select the type for the endpoint. In this example, GWLB Endpoint is selected.
   Endpoint Service	In this example, first click Select Service, and then select the endpoint service created in Step 4.
   VPC	Select the VPC to which the endpoint belongs. In this example, the ID of the business VPC is selected.
   Zones and vSwitches	Select the availability zone that corresponds to the endpoint service, and then select a vSwitch within that zone. The system automatically creates an endpoint elastic network interface (ENI) in the vSwitch. In this example, the availability zone is set to Ulanqab Zone B and the ID of the GWLB endpoint vSwitch in Zone B is selected.
   IP Version	In this example, IPv4 is selected.

   Note

   Make sure that the connection status of the endpoint is Connected.

Step 6: Configure routes

As the service consumer, configure routes to direct traffic to the GWLB endpoint.

1. Log on to the VPC console.

2. In the left-side navigation pane, click Route Tables.

3. In the top navigation bar, select the region where the route tables are located.

4. On the Route Tables page, click the ID of the target route table.

   Note

   The target route tables include the route table for the IPv4 gateway, the route table for the application server vSwitch, and the route table for the GWLB endpoint vSwitch. Configure them one by one.

5. On the route table details page, click the Route Entry List tab, click System Route, and view the system route entries.

   The system automatically adds the following system route to a custom route table:

   A route entry with a destination CIDR block that matches the CIDR block of a vSwitch in the VPC to which the route table belongs. This route is used for communication between cloud resources within the vSwitch.

6. To modify a system route entry in the route table for the IPv4 gateway, find the target system route entry on the Route Entry List > System Route tab. In the Actions column, click Modify. In the Modify Route Entry dialog box, configure the following parameters and then click OK. The route entry then appears as a custom route entry.

   Parameter	Description
   Destination CIDR Block	The destination CIDR block for forwarding traffic. The Destination CIDR Block cannot be modified. In this example, the destination CIDR block is 192.168.2.0/24.
   Name	Modify the name of the route entry.
   Next Hop Type	Select a next hop type. In this example, Gateway Load Balancer endpoint is selected.
   GWLB Endpoint	Select the GWLB Endpoint created in Step 5.

7. To add a custom route entry when configuring the route tables for the application server vSwitch and the GWLB endpoint vSwitch, click Custom Route, enter the destination CIDR block and next hop type, and then click OK.

   • When you configure the route table for the application server vSwitch, create a custom route entry with the destination CIDR block set to 0.0.0.0/0 and the next hop type set to Gateway Load Balancer endpoint.

   • When you configure the route table for the GWLB endpoint vSwitch, create a custom route entry with the destination CIDR block set to 0.0.0.0/0 and the next hop type set to IPv4 Gateway.

Step 7: Verify the configuration

Test connectivity

Log on to the application server ECS instance and run the following command to test its connectivity to the internet:

ping www.aliyun.com

A continuous stream of responses indicates that the connectivity test is successful.

The following code provides a sample output:

[xxx@xxx ~]# ping www.aliyun.com
PING www.aliyun.com.w.cdngslb.com (180.213.xxx.xxx) 56(84) bytes of data.
64 bytes from 180.213.xxx.xxx (180.213.xxx.xxx): icmp_seq=1 ttl=53 time=15.4 ms
64 bytes from 180.213.xxx.xxx (180.213.xxx.xxx): icmp_seq=2 ttl=53 time=13.5 ms
64 bytes from 180.213.xxx.xxx (180.213.xxx.xxx): icmp_seq=3 ttl=53 time=13.5 ms
64 bytes from 180.213.xxx.xxx (180.213.xxx.xxx): icmp_seq=4 ttl=53 time=13.5 ms
64 bytes from 180.213.xxx.xxx (180.213.xxx.xxx): icmp_seq=5 ttl=53 time=13.7 ms
64 bytes from 180.213.xxx.xxx (180.213.xxx.xxx): icmp_seq=6 ttl=53 time=13.5 ms

Test security inspection

Log on to ECS01 or ECS02 and run the following command to capture all packets on port 6081:

tcpdump -i any port 6081

If the command output shows request and response data from the application server ECS instance, this confirms that GWLB has successfully routed the traffic to the NVA for security inspection.

The following code provides a sample output:

[root@xxx ~]# tcpdump -i any port 6081
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
15:15:49.578469 IP 10.0.10.16.57480 > xxx.6081: Geneve, Flags [C], vni 0x0, options [32 bytes]: IP 192.168.2.123.ssh > wan.adventz.com.43200: Flags [S.], seq 980244545, ack 540151794, win 29200, options [mss 1460], length 0
15:15:49.578482 IP xxx.57480 > 10.0.10.16.6081: Geneve, Flags [C], vni 0x0, options [32 bytes]: IP 192.168.2.123.ssh > wan.adventz.com.43200: Flags [S.], seq 980244545, ack 540151794, win 29200, options [mss 1460], length 0
15:15:49.610110 IP 10.0.10.16.55139 > xxx.6081: Geneve, Flags [C], vni 0x0, options [32 bytes]: IP 192.168.2.123 > 180.213.xxx.xxx: ICMP echo request, id 16612, seq 17, length 64
15:15:49.610116 IP xxx.55139 > 10.0.10.16.6081: Geneve, Flags [C], vni 0x0, options [32 bytes]: IP 192.168.2.123 > 180.213.xxx.xxx: ICMP echo request, id 16612, seq 17, length 64
15:15:49.625531 IP 10.0.10.16.55139 > iz0jl8dnd7ratzjksyin3z.6081: Geneve, Flags [C], vni 0x0, options [32 bytes]: IP 180.213.xxx.xxx > 192.168.2.123: ICMP echo reply, id 16612, seq 17, length 64
15:15:49.625535 IP xxx.55139 > 10.0.10.16.6081: Geneve, Flags [C], vni 0x0, options [32 bytes]: IP 180.213.xxx > 192.168.2.123: ICMP echo reply, id 16612, seq 17, length 64
15:15:49.797614 IP 10.0.10.16.60600 > iz0jl8dnd7ratzjksyin3z.6081: Geneve, Flags [C], vni 0x0, options [32 bytes]: IP ptr.default.58593 > 192.168.2.123.tproxy: Flags [S], seq 1189139317, win 65535, length 0
15:15:49.797625 IP xxx.60600 > 10.0.10.16.6081: Geneve, Flags [C], vni 0x0, options [32 bytes]: IP ptr.default.58593 > 192.168.2.123.tproxy: Flags [S], seq 1189139317, win 65535, length 0

References

• Overview:

  What is Gateway Load Balancer?

• Console operations:

  • Create and manage GWLB instances

  • Add and manage IP listeners

  • Create and manage server groups