2.1.5 VCN & private subnet (step-by-step in Terraform)
For this example, we will keep the the same child compartment "WildTestCompartment" from previous example VCN & public subnet (new compartment)
I suggest you read the previous example before continuing with this one.
Private subnet vs. Public subnet
As you might already notice in VCN &public subnet tutorial, when you assign a public subnet to your instance (with a public IP), in order to make possible the communication with the Internet (outbound and inbound traffic), you need to set-up an Internet Gateway, as well.
However, there are situations when one does not want the hosts/services to be accessed from the outside (inbound), and yet to still be able to access the Internet (outbound) for performing certain actions, such as updates.
In this scenario, your hosts will be provided a private subnet (and private IPs), along with a NAT Gateway.
Adapting your Terraform code
We have already discussed about what we need for a VCN &private subnet:
NAT gatewayprivate IP
For the public subnet, we have used the resource oci core internet gateway
In the example for private subnet, we need to create a new terraform file, for configuring and setting up the NAT gateway for our compartment.
For this case, we will be using the resource oci core nat gateway
Our nat_gateway.tf file has the following content:
root@deploymentmachine:/home/nat_example# more nat_gateway.tf
resource "oci_core_nat_gateway" "WildTestNATGateway" {
compartment_id = oci_identity_compartment.WildTestCompartment.id
display_name = "WildTestNATGateway"
vcn_id = oci_core_virtual_network.WildTestVCN.id
}Next change, will be reflected on the Route Table.
We are keeping the same resource oci core route tableHowever, changes to be implemented on the routing rules consist in providing the Nat Gateway:
... and the private IP
This change will be reflected when configuring the subnet.
The same resource will be used, oci core subnet.
If you read carefully the documentation, you will find the following information about "prohibit_public_ip_on_vnic"
prohibit_public_ip_on_vnic- (Optional) Whether VNICs within this subnet can have public IP addresses. Defaults to false, which means VNICs created in this subnet will automatically be assigned public IP addresses unless specified otherwise during instance launch or VNIC creation[...]. IfprohibitPublicIpOnVnicis set to true, VNICs created in this subnet cannot have public IP addresses (that is, it's a private subnet).
Taking in consideration that piece of documentation, my "subnet.tf" file will have the following addition:
The code example
Content of the folder nat_example:
Content of provider.tf
Content of variables.tf
Content of compartment.tf
Content of vcn.tf
Content of nat_gateway.tf
Content of route.tf
Content of subnet.tf
Content for dhcp options, dhcp_opt.tf:
Content of security lists, security_list.tf:
Deploying VCN &private subnet
As usual, for deploying, use the three main terraform commands:
terraform init
terraform plan
terraform apply
Check deployed Resources in OCI Cloud
Go to Menu > Networking > Virtual Cloud Networks
From List Scope, check if your new compartment WildTestCompartment has been created, and if so, select it:
Check if private subnet was created:
Check the Security Lists:
The Ingress Rules:
The Egress Rules:
And of course, check the NAT Gateway:
Destroying resources
For destroying resources, run the "terraform destroy" command:
Last updated