TH 13 ‐ HUB and SPOKE Model - gautam-amitesh/OCI GitHub Wiki
Earlier, I used to practice a somewhat insecure architecture, where I placed my bastion_server in the Public Subnet and the amazon_server in the Private Subnet, both within a single Virtual Cloud Network (VCN). To improve this architecture, I need to adopt the HUB & SPOKE Model. According to this model, the bastion_server should reside in the HUB VCN, while the amazon_server should be moved to the Private Subnet of a distinct VCN, referred to as the SPOKE VCN which can be one or more than one. This architecture enhances security by adding an extra layer of protection, as both servers are separated into completely distinct networks (VCNs). However, we can still connect these servers directly using a single DRG, and the same applies to Spoke VCNs. We can better understand this architecture in the below diagram which I created using draw.io.
In the above diagram we can see, when we send an SSH remote login request from our local computer to the bastion_server using the TCP protocol, it first goes to the Internet Gateway, which directly routes it to the virtual firewall (Security Lists). If the request is allowed, only then are we able to log in.
In the above diagram we can also see, if the bastion_server needs to connect to the internet, the request is first checked by the Security Lists. If permitted, the Route Table then routes it to the Internet Gateway.
It is also shown that when we send an SSH remote login request from the bastion_server to the amazon_server using the TCP protocol, it first goes to the Security Lists. If outbound traffic is allowed, it proceeds to the Route Table, which routes it to the Dynamic Routing Gateway (DRG). The DRG dynamically forwards the request to its destination—in this case, the amazon_server. The request then reaches the Security Lists of the amazon_server, and if it is allowed to enter, we can successfully log in.
- Dynamic Routing Gateway: In OCI DRG is a free, software-defined (virtual) router created at the Region level (scoped to our Tenancy and a specific Compartment) that provides a path for private network traffic between our VCNs and networks outside that VCN's region or tenancy. While intra-region egress charges are free, standard inter-region egress charges apply. We create VCN Attachments where we attach DRG to our VCNS (upto 300 VCNs within the DRG region) and then it dynamically routes the traffic to the specific VCN Attachment by intercepting packets and asking where it want to go. We can create multiple DRGs for different VCNs, the default service limit is
5to50depending on the environment (type of tenancy, subscription model, and infrastructure realm). We can check our account's exact DRG limit directly in the OCI Console under Governance & Administration > Limits, Quotas, and Usage. Generally it is a bad practice to create multiple DRGs.
- Note: By default, incoming traffic does not require the Route Table to reach the server. However, we can configure it to do so if we need to intercept, redirect, or inspect incoming traffic before it reaches the workload.