Lab: Network Configuration for Bi-directional Traffic Connectivity

Objective

The main goal of this lab is to establish bi-directional traffic connectivity between an instance located in a Public Subnet (acting as a Jump Server) bastion-server and an instance located in a Private Subnet (acting as an Application Server) app-server within the same Virtual Cloud Network (VCN).

---

Architecture Overview

In a secure cloud architecture, production workloads (like Application Servers or Databases) are isolated inside a Private Subnet to protect them from direct internet access. To manage, configure, or troubleshoot these private instances safely, we use a bridge known as a Jump Server located in a Public Subnet.

---

Key Concepts

What is a Jump Server (Bastion Host)?

A Jump Server (sometimes referred to as a Bastion Host) is a hardened, public-facing virtual machine deployed in a Public Subnet.

• Purpose: It acts as a single, controlled entry point to access instances located inside private subnets.
• How it works: Instead of exposing your Private Application Server directly to the internet, you first SSH/RDP into the Jump Server (which has a Public IP). From inside the Jump Server, you then connect to the Private Server using its Private IP.
• Security Benefit: It minimizes the attack surface. You only need to open security ports (like Port 22 for SSH) for one public instance rather than all your internal servers.

---

Lab Components

Component	Subnet Type	IP Address Type Allowed	Role
VCN	N/A	Internal CIDR Block	Network Boundary
Jump Server VM	Public Subnet	Public & Private IP	Gateway for Admins
Application Server VM	Private Subnet	Private IP Only	Hosts Secure Workloads

---

Prerequisites

Before starting the configuration, ensure you have:

• A registered Oracle Cloud Infrastructure (OCI) Account.
• A VCN created with both a Public and a Private Subnet.
• SSH Key pairs generated for instance access.

---

First we will create private subnet as public subnet has been already created for the Jump Server(bastion-server)

Note: Before creating a private subnet, we will first create a dedicated Security List(sl-private-subnet) and Route Table(rt-private-subnet) specifically for it, ensuring complete isolation from the public subnet's configurations.

Now we can see our Public and Private subnets are created, we can see the Jump Server(bastion-server) is already running in the public subnet

and we will now create the Application Server in the private subnet.

As we can see, the app-server has been successfully created in the Private Subnet, with only a Private IP address assigned and no Public IP address.

Configuration Steps

Step 1 : Check connectivity

First, we login to jump server (bastion-server) via public key

Ingress and Egress security rule of public subnet(hub-custom-sl)

Now for ping from jump server to application server first we define Ingress and Egress security rule of private subnet(sl-private-subnet)

In Ingress rule we have given the IPv4 CIDR Block of public subnet with the protocol ICMP

Note-(Here if we don't define anything in egress rule still ping will work)

Now, attempt to ping the application server from the jump server using the command ping

as we can see ping is working means connection is established

Now for telnet to connect on port 22 we need to add just one Ingress rule in private subnet(sl-private-subnet)

here we have given the source CIDR as IPv4 CIDR Block of public subnet with the protocol TCP and destination port 22

As we can see telnet on port 22 is working now means connection is established to an application server

Step 2 : Generating keys

Now create a directory named Keys

mkdir keys

ls -lrth

go to the Keys directory

cd keys

now create a file named private key in pem format (like privatekey.pem)

vi privatekey.pem

press esc i then paste the private key content(that we have downloaded earlier in pem format before converting into .ppk) then save and exit

again press esc then type :wq! and press enter for save and exit

next change the access permissions of privatekey.pem file

chmod 600 privatekey.pem

first check the path where your key is?

pwd

Now, attempt to access the private application server(app-server) by executing the following command.

ssh -i /home/opc/keys/privatekey.pem [email protected]

As we can see, we have successfully configured and established connectivity between the public(jump server) to private server(app-server).