Features
The NAT Firewall toggle supports traffic control and security protection based on private network assets, as well as network traffic forwarding based on SNAT and DNAT.
NAT CFW Use Cases
| Working Mode | Prerequisite | Use Case |
|---|---|---|
| New mode | The tenant has an EIP that can access the public network. | If there is no NAT gateway in the current region, the new mode allows you to use the built-in NAT features of NAT Firewall to enable specified instances to access the Internet through the firewall. |
| Access mode | The VPC under the tenant can connect to the Internet through a NAT gateway. | If there is a NAT gateway in the current region or you want to keep the egress IP address of the public network unchanged, the access mode allows for seamless integration of NAT Firewall between the NAT Gateway and CVM instance. |
NAT Firewall Routing Principles
Assume that VPC 1 and VPC 2 of a tenant need to connect to CFW. Traffic routing should be implemented first. In this example, a cross-tenant ENI is used to achieve traffic routing. The main implementation principles are as follows:
- The NAT Firewall engine is an overlay instance of the reserved account.
- Each VPC connected to the NAT Firewall will be assigned a firewall subnet under the VPC, and a cross-tenant ENI will be created for the firewall. This ENI serves as a traffic routing NIC of the VPC and will be assigned a high availability virtual IP address from the traffic routing subnet, to achieve high availability.
- If you switch the next hop route to the high availability virtual IP address of the traffic routing NIC, the traffic will be directed to the firewall.
- If a cross-tenant egress network port is assigned from one of the VPCs, for example, the ENIWan port in the figure on the left side, all VPC traffic will access the public network through the ENIWan port. To ensure high availability, you can assign a high availability virtual IP address to the ENIWan port. You can also bind the virtual IP address to an EIP to realize public network access.
Traffic that accesses a VPC passes through the subnet routes of the VPC. Based on the principle that larger subnets have higher priorities, traffic is selected and directed to a NAT Firewall. Then, NAT forwarding is performed to access public networks. In new mode, you can bind the ENIWan port to an EIP. In access mode, you can bind the ENIWan port to a NAT gateway.