LAB 29 ‐ Create & Configure Network Manually - gautam-amitesh/OCI GitHub Wiki

Earlier, I created a VCN using the VCN Wizard, which set up networking in OCI with default settings. These settings included a VCN, Subnets, Security Lists, Route Table, and Gateway. Now, I want to create the network manually. I prefer a clean start after terminating the current network setup, which is only possible if all child resources and VNIC dependencies attached to it are detached or destroyed.

VCN Deletion

  1. Navigation

    Navigation menu > Networking > Virtual Cloud Networks

  2. Click Actions and then click Delete

  3. Check Search compartments for resources associated with this VCN. and then if you want to scan specific compartments then check Specific compartments or if you want to scan all compartments then check All Compartments. I have already terminated associated instances so I will only select network compartment. Click Scan.

  4. Once scan is completed ensure that you have all required permission to delete resources and click Delete All

  5. Once deleting is completed you will not see that VCN

VCN Creation

  1. Click Create VCN

  2. Provide Name and select Compartment

  3. Type IPv4 CIDR Blocks then click Add to list

  4. Click Create VCN

Create Public Subnet

  1. Navigate to Subnets and click Create Subnet

  2. Provide Name and select Compartment

  3. Leave Subnet Type to Regional(Recommended)

  4. Provide IPv4 CIDR Block

  5. OCI provides Default Route Table later on we will change it

  6. I am creating public subnet so I will select Public Subnet

  7. OCI provides Default Security List but once I will create custom security list then I will attach it to this subnet

  8. Click Create Subnet

Create Private Subnet

  1. Click Create Subnet

  2. Provide Name and select Compartment

  3. Leave Subnet Type to Regional(Recommended)

  4. Provide IPv4 CIDR Block

  5. OCI provides Default Route Table later on we will change it

  6. I am creating private subnet so I will select Private Subnet

  7. OCI provides Default Security List but once I will create custom security list then I will attach it to this subnet

  8. Click Create Subnet

Create Security List

For Public Subnet

  1. Navigation

  2. Click Create Security List

  3. Provide Name and select Compartment

  4. I prefer to add rules while creating SL so click Another Ingress Rule for ingress rule and click Another Egress Rule for egress rule and add as many rules you need, I am allowing outgoing connection using all protocol to 0.0.0.0/0 for installing telnet but after installation I will remove this egress rule and only tcp protocol will be left allowed.

  5. Click Create Security List

For Private Subnet

  1. Click Create Security List

  2. Provide Name and select Compartment

  3. I prefer to add rules while creating SL so click Another Ingress Rule for ingress rule and click Another Egress Rule for egress rule and add as many rules you need I don't need egress rule for my private subnet so I will only create ingress rule

  4. Click Create Security List

Add Security Lists

To Public Subnet

  1. Navigation

    Navigation menu > Networking > Virtual Cloud Networks > VCN (specific vcn) > Subnets > public_subnet > Security > Add Security List

  2. Select Compartment** then select** Security List and finally click Add Security List

  3. Remove default security list and when confirmation dialogue box appears click Remove again

To Private Subnet

  1. Navigation

    Navigation menu > Networking > Virtual Cloud Networks > VCN (specific vcn) > Subnets > private_subnet > Security > Add Security List

  2. Select Compartment** then select** Security List and finally click Add Security List

  3. Remove default security list and when confirmation dialogue box appears click Remove again

Gateway

Gateway is an intermediary network node that connects two distinct networks operating on different protocols or subnets by acting as the entry and exit point for traffic between them. In OCI, it is created at the VCN level, but it sits on the boundary of the VCN, not inside the VCN or subnet. Think of a gateway as an advanced post office with an IP address that can open an envelope (packet), read where it is trying to go, inspect it, rewrite information if needed, and decide where to send it next.

Node is any active physical or virtual device with a distinct network address that is connected to a network and can generate, receive, store, or transmit data. There are two type of Node, First one is Endpoint (Host Nodes) like, Laptops, Smartphones, Printers, and Database Servers. Second one is Intermediary Nodes like, Routers and Gateways that handle data forwarding.

Distinct Networks are independent communication domains that cannot exchange data directly at the local link level without intermediary translation.

Create Internet Gateway

Internet Gateway: As the name suggests, this is the door of a VCN which allows instances to communicate with the internet.

  1. Navigation

    Navigation menu > Networking > Virtual Cloud Networks > VCN (hub_vcn-manual) > Gateways > Internet Gateways > Create Internet Gateway

  2. Give it a Name and select Compartment

  3. I have not created route table yet but if you want to associate a route table click Advanced options then select Compartment and Route Table and finally click Create Internet Gateway.

Routing

Route is a single instructional path (one simple rule or direction) that tells a device how to reach a specific destination network. A Route Table is the in-memory (device's volatile memory) database where all these individual route instructions live. In OCI, a Route Table is created inside the VCN as a resource, but it is enforced by associating it with subnets (or individual VNIC/gateways).

The Gateway is the VCN's exterior door and the Route Table is the subnet-level directory that tells packets whether they are allowed to take the route leading to that door.

Working

Instance (private & public IP) >> Security List (Egress) >> Subnet Route Table >> Internet Gateway (private IP => public IP) >> Remote Server

Remote Server >> Internet Gateway >> Security List (Ingress) >> Instance

Create Route Table

  1. Navigation

    Navigation menu > Networking > Virtual Cloud Networks > VCN (hub_vcn-manual) > Routing > Create Route Table

  2. Give it a Name and select Compartment

  3. Click Another Route Rule and select Target Type

  4. Provide Destination CIDR Block as 0.0.0.0/0, select Compartment, and select Target Internet Gateway

  5. Finally click Create

Add Route Rules

  1. Navigation

    Navigation menu > Networking > Virtual Cloud Networks > VCN (hub_vcn-manual) > Subnets > public_subnet > Actions > Edit

  2. Select Route Table from the dropdown and click Save changes

  3. Verify the change

Create Private & Public Instance

  1. Log in bastion_server

  2. Test ping to amazon_server

  3. Install telnet in bastion_server and test TCP connectivity on Port 22 of amazon_server

  4. Let's create private key and try to log in amazon_server from bastion_server

Working