Abiquo and AWS networks

Abiquo virtual datacenter network options in AWS

When you create a virtual datacenter in Abiquo, you have the following options to create a network:

1. Default private network

2. None

3. Custom private subnet or public subnet

Open

Create a virtual datacenter in AWS with network options

Abiquo will create an AWS VPC according to these options as described in the following sections.

Create a virtual datacenter with a Default network

If the user creates a virtual datacenter with a Default network, then Abiquo creates a VPC and a private subnet.

Open

The default network is a private subnet

Abiquo can create a VPC with no network

The user can choose not to create networks when they create a virtual datacenter. Then Abiquo will create an AWS VPC with no public subnet, internet gateway, or NAT gateway (and no expensive elastic IP!) Abiquo will still create an address range for the VPC, and the user should enter these details.

If you do not create the networks when you create the VDC, you cannot connect to your VMs or use NAT for outward internet connectivity.

How to create a public subnet and connect to your VM

If you created your VDC with the None option for networks, to connect to a VM in an AWS create a public subnet and use an elastic IP, with the following steps.

1. In your virtual datacenter, go to Network → Private

2. Click + add and when you create the network, select the Internet gateway checkbox.

3. Edit your VM and add an IP from the public subnet

4. Connect to your VM as usual. For more details, see How to deploy a VM in AWS using Abiquo.

How to allow your VMs to connect to the internet

If you created a VDC in AWS with the None option for networks, to allow outward NAT connectivity from VMs in your VDC, do these steps.

1. Create a private network in your VDC (select the Internet gateway checkbox) to create a public subnet. Abiquo marks this network with a globe symbol

2. Create a private network in your VDC and select the NAT gateway checkbox, to create a NAT gateway and a private subnet with access to the NAT gateway

3. Edit your VM and add an IP from the private subnet with access to the NAT gateway

Create a virtual datacenter with a custom network

With a Custom private network, the user can specify a private subnet or a public subnet for the VPC. To create a public subnet, select the Internet gateway checkbox.

When you create a VDC with a custom private network, you can also specify the address range of the virtual network. And you can create, onboard, and delete address ranges from AWS. See Manage address ranges.

How Abiquo creates a virtual private cloud

Abiquo can create a virtual datacenter with a public subnet, a private subnet, or no networks. After you create a virtual datacenter, you can create more private networks, which are private subnets or public subnets in your AWS VPC. You can also create private subnets with a route to a NAT gateway. This will let you create a configuration similar to the AWS configuration of a VPC with private subnets and NAT (see https://docs.aws.amazon.com/vpc/latest/userguide/vpc-example-private-subnets-nat.html).

Abiquo creates a VPC in AWS with one Availability zone only.

Abiquo creates a public subnet with the name entered by the user, and the AWS provider ID will be in the format subnet-xxxx.

A NAT gateway uses a private IP in the public subnet. The primary private IP of the NAT gateway is automatically assigned by AWS.

In Abiquo, we always set the first IP in a network as the gateway, because according to the documentation, it is reserved for the VPC router. See https://docs.aws.amazon.com/vpc/latest/userguide/subnet-sizing.html.

The public IP of a NAT gateway enables access to the internet from the private subnet, but it does not allow incoming connections.

To connect from outside the VPC, you will need at least one VM with an IP address in the public subnet, and one public IP. To allow connections to your VM via the public IP, AWS automatically creates a DNAT rule using the internet gateway.

When you create a VPC in Abiquo, it does not onboard the IPs of the private subnets. You need to synchronize each network to onboard its IPs.

Technical notes about AWS networks

The following notes describe how Abiquo manages AWS networks in virtual datacenters.

• VPC network

  • Abiquo creates a VPC with a minimum network size of /16 and a subnet of size /24, or with the sizes defined by the user in address ranges (address spaces) and in default network configuration

  • The user can create the VPC with no subnets, a private subnet, or a public subnet

• Private networks

  • Abiquo private networks are VPC subnets. They can be private subnets, public subnets, or private subnets with a NAT gateway (requires an existing public subnet)

• Private subnets

  • A private subnet (of a VPC network) is a private connect network in AWS

  • Abiquo will associate the network with the main route table

• Creating public subnets

  • If the user selects the internet gateway checkbox, Abiquo routes network traffic to the internet gateway. This is a public subnet, and Abiquo marks it with a globe symbol

  • If there is no internet gateway, Abiquo will create a new one, and a new route table with a route to the internet gateway for all destinations (0.0.0.0/0)

  • If an internet gateway exists, but there is no route table with a route to the internet gateway for all destinations, Abiquo will create a new route table

• Private subnets with NAT gateway

  • VMs in private networks with a NAT gateway assigned will have internet access through the public subnet.

  • To create a NAT gateway, Abiquo will reuse floating IPs that are not assigned to a VDC

  • A NAT gateway requires an existing public subnet

  • If there is no public NAT gateway, Abiquo will create a new one using the first public subnet it finds, with a new route table that will have a route to the public NAT gateway for destinations to 0.0.0.0/0

  • If a NAT gateway already exists, but there is no route table with a route to the NAT gateway for destinations to 0.0.0.0/0, Abiquo will create a new route table

  • If there are more than one NAT gateway, Abiquo will use the first one that it finds

• Elastic IPs

  • To be able to connect to VMs over the internet, Abiquo users must add a private IP address in a public subnet, and then attach public IPs, which are Elastic IPs in AWS

  • AWS may charge for Elastic IPs when they are NOT in use, i.e. when they are not assigned to a VM or when the VM is not deployed in AWS. Amazon will also charge for the Elastic IP in a NAT gateway

• Availability zones

  • To deploy VMs to different Availability zones, create a private network (VPC subnet) in each zone and add IP addresses from the private networks to your VMs

  • The private subnets in the same availability zone as a public subnet will have internet access through the public subnet.

• IP addresses

  • AWS reserves the first four IP addresses and the last IP address of a VPC private connect network.

  • For a network that is defined to start with address 0, the first available IP address will be address 4 and the gateway address is address 1.

  • You can onboard and synchronize existing VMs and create new IP addresses through Abiquo, including multiple Elastic IPs.

  • For a VM, the maximum number of IP addresses is determined by the AWS hardware profile (instance type). See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI

  • Abiquo adds IPs in the same subnet to the same elastic network interface.

  • For information about Elastic Network Interfaces, see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

• Deleting subnets and NAT gateways

  • When the user deletes a public subnet, if the subnet is used by a NAT gateway that still has other subnets routing to it, the delete will fail. Otherwise Abiquo will delete the public subnet and the NAT gateway

  • If the subnet is the last subnet associated to a routing table, and the routing table is not the main one, Abiquo will also delete the routing table