I have an instance named bastion_server-01 in the public subnet public subnet-hub-vcn of VCN hub-vcn. Now, I am going to create another instance named amazon_server in the private subnet private subnet-hub-vcn of VCN hub-vcn to test TCP connectivity on Port 22 of this instance from bastion_server-01 using Telnet.

Creating Instance in Private Subnet

While creating an instance in a private subnet, I prefer to name it after the associated application. For example, if I am creating a server for the Amazon application, I will name it amazon_server. I am choosing the same public key for instance creation that I created earlier and used for bastion_server-01; however, you can create a new one based on specific requirements. In the snapshot below, you will see two servers bastion_server-01 and amazon_server where amazon_server does not have any public IP because it was created inside a private subnet.

Allow Required Protocols in SL

Before we start testing connectivity for the TCP protocol on a specific port using telnet, we first need to ensure basic connectivity with the ping command. However, before that, we must check the rules in the security lists of the public and private subnets to verify whether they allow the required protocols, ports, and IPs.

Allow Login

I have already allowed log in for bastion_server-01 and for allowing log in to amazon_server I need to allow incoming traffic on Port 22 from private IP of bastion_server-01 using TCP protocol

Allow Basic Connectivity

For allowing basic connectivity between amazon_server and bastion_server-01 I need to allow outgoing traffic from bastion_server-01 to private IP of amazon_server using ICMP protocol also I need to allow incoming traffic from private IP of bastion_server-01 to amazon_server.

1. Public Subnet's SL

2. Private Subnet's SL

Allow Internet Connectivity on Public Subnet

ping is a fundamental network diagnostic tool included with our OS but telnet is an older and insecure tool disabled by default so we need to install Telnet separately from OS's package manager. For downloading any package from package manager we need to connect to the internet and in this case we mostly don't know the port, protocol, and IP address so I need to allow outgoing traffic from bastion_server-01 to 0.0.0.0/0 using all protocols.

Check Basic Connectivity

To check basic connectivity between bastion_server-01 and amazon_server, I need to run the ping command in the terminal of either instance. I prefer running the ping command inside the terminal of bastion_server-01 because it is comparatively easier. Let’s log in to bastion_server-01 using PuTTY and run ping 10.0.1.52, where 10.0.1.52 is the private IP of amazon_server.

When I run the ping command, it shows that packet exchange is successfully taking place between the two instances.

Check TCP Connection on Port 22

First, I need to install the telnet package on bastion_server-01 using my OS’s package manager, dnf. I am running Oracle Linux version 9; for versions 8 and 9, it is recommended to use the new package manager dnf. However, if you are on older versions such as 5, 6, or 7, you will need to use the legacy package manager yum. To proceed, switch to the root user using sudo su - root and then run dnf install telnet -y or you can provide root privilege to a single command only by running sudo dnf install telnet -y.

Now I will run telnet 10.0.1.52 22 to test TCP connectivity on Port 22 of amazon_server, which will verify whether I will be able to log in to amazon_server.

We can see the result which says Connected to 10.0.1.52 which means the connection is successful. To exit a telnet session press and hold the Ctrl key, then press the ] key. This will break our active connection and bring us to the telnet> prompt, type quit and press Enter.