DocsICP FilingConsole
官方文档
首页

Create a NAT firewall instance

更新时间：
复制 MD 格式
产品详情
我的收藏

This topic describes how to use Terraform to create a NAT firewall instance.

Note

You can run the sample code in this topic online.Run now

Prerequisites

  • An Alibaba Cloud account has full permissions for all resources. Leaking the credentials of your Alibaba Cloud account poses a significant security risk. We recommend that you use a Resource Access Management (RAM) user and create an AccessKey for that user. For more information, see Create a RAM user and Create an AccessKey.

  • The RAM user must have Cloud Firewall permissions and the AliyunBSSFullAccess permission to manage the User Center. For more information, see Manage RAM user permissions.

    {
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "yundun-cloudfirewall:CreateSecurityProxy",
                "yundun-cloudfirewall:DescribeNatFirewallList",
                "yundun-cloudfirewall:DeleteSecurityProxy"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "bssapi:*",
                "bss:*"
            ],
            "Resource": "*"
        }
    ]
}

  • Set up a Terraform runtime environment. You can use one of the following methods to run Terraform.

    Use Terraform in Explorer: Alibaba Cloud provides an online runtime environment for Terraform that does not require installation. You can log on to use and test Terraform online. This method is ideal for quickly testing and debugging Terraform at no cost.

    Cloud Shell: Alibaba Cloud Shell has pre-installed Terraform components and pre-configured identity credentials. You can run Terraform commands directly in Cloud Shell. This method is ideal for quickly and cost-effectively accessing and using Terraform.

    Install and configure Terraform locally: This method is suitable for scenarios that have poor network connectivity or require a custom developer environment.

    Important

    Ensure that your Terraform version is v0.12.28 or later. To check the version, run the terraform --version command.

Resources used

alicloud_cloud_firewall_nat_firewall: NAT firewall.

Create a NAT firewall

Procedure

This example shows how to create a NAT firewall.

  1. Create a working directory. In the directory, create a configuration file named main.tf. The main.tf file is the main Terraform file. It defines the resources to be deployed.

    variable "name" {
  default = "terraform-example"
}
variable "region" {
  default = "cn-heyuan"
}
provider "alicloud" {
  region = var.region
}
# Create a VPC 
resource "alicloud_vpc" "vpc" {
  vpc_name   = "dd-tf-vpc-01"
  cidr_block = "192.168.0.0/16"
}
# Create a vSwitch with the CIDR block 192.168.10.0/24
resource "alicloud_vswitch" "vsw" {
  vpc_id       = alicloud_vpc.vpc.id
  cidr_block   = "192.168.10.0/24"
  zone_id      = "cn-heyuan-a"
  vswitch_name = "dd-tf-vpc-01-example-1"
}
resource "alicloud_nat_gateway" "default2iRZpC" {
  eip_bind_mode    = "MULTI_BINDED"
  vpc_id           = alicloud_vpc.vpc.id
  nat_gateway_name = var.name
  payment_type     = "PayAsYouGo"
  vswitch_id       = alicloud_vswitch.vsw.id
  nat_type         = "Enhanced"
  network_type     = "internet"
}
resource "alicloud_eip_address" "defaultyiRwgs" {
  address_name = var.name
}
resource "alicloud_eip_association" "defaults2MTuO" {
  instance_id   = alicloud_nat_gateway.default2iRZpC.id
  allocation_id = alicloud_eip_address.defaultyiRwgs.id
  mode          = "NAT"
  instance_type = "Nat"
}

resource "alicloud_snat_entry" "defaultAKE43g" {
  snat_ip           = alicloud_eip_address.defaultyiRwgs.ip_address
  snat_table_id     = alicloud_nat_gateway.default2iRZpC.snat_table_ids
  source_vswitch_id = alicloud_vswitch.vsw.id
}

resource "alicloud_cloud_firewall_nat_firewall" "default" {
  nat_gateway_id = alicloud_nat_gateway.default2iRZpC.id
  nat_route_entry_list {
    nexthop_type     = "NatGateway"
    route_table_id   = alicloud_vpc.vpc.route_table_id
    nexthop_id       = alicloud_nat_gateway.default2iRZpC.id
    destination_cidr = "0.0.0.0/0"
  }
  firewall_switch = "close"
  vswitch_auto    = "true"
  status          = "closed"
  region_no       = "cn-heyuan"
  lang            = "en"
  proxy_name      = "CFW-example"
  vswitch_id      = alicloud_snat_entry.defaultAKE43g.source_vswitch_id
  strict_mode     = "0"
  vpc_id          = alicloud_vpc.vpc.id
  vswitch_cidr    = "192.168.20.0/24"
}

  2. Run the following command to initialize the Terraform runtime environment.

    terraform init

    The following output indicates that the initialization is successful.

    Initializing the backend...

Initializing provider plugins...
- Reusing previous version of hashicorp/alicloud from the dependency lock file
- Using previously-installed hashicorp/alicloud v1.233.1

╷
│ Warning: Additional provider information from registry
│ 
│ The remote registry returned warnings for registry.terraform.io/hashicorp/alicloud:
│ - For users on Terraform 0.13 or greater, this provider has moved to aliyun/alicloud. Please update your source in required_providers.
╵

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

  3. Create an execution plan and preview the changes.

    terraform plan

  4. Run the following command to create the NAT firewall.

    terraform apply

    When prompted, enter yes and press the Enter key. Wait for the command to complete. The following output indicates that the NAT firewall was created successfully.

    Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

alicloud_eip_address.defaultyiRwgs: Creating...
alicloud_vpc.vpc: Creating...
alicloud_vpc.vpc: Creation complete after 6s [id=vpc-f8z5jo13wgl5r7hvaune1]
alicloud_vswitch.vsw: Creating...
alicloud_eip_address.defaultyiRwgs: Creation complete after 8s [id=eip-f8zl1g2y5l3dntqquisq2]
alicloud_vswitch.vsw: Creation complete after 4s [id=vsw-f8z2brmg92u7q0n6z8tj4]
alicloud_nat_gateway.default2iRZpC: Creating...
alicloud_nat_gateway.default2iRZpC: Still creating... [10s elapsed]
alicloud_nat_gateway.default2iRZpC: Still creating... [20s elapsed]
alicloud_nat_gateway.default2iRZpC: Still creating... [30s elapsed]
alicloud_nat_gateway.default2iRZpC: Creation complete after 36s [id=ngw-f8z11qox17rucwjb19z9q]
alicloud_snat_entry.defaultAKE43g: Creating...
alicloud_eip_association.defaults2MTuO: Creating...
alicloud_eip_association.defaults2MTuO: Creation complete after 1s [id=eip-f8zl1g2y5l3dntqquisq2:ngw-f8z11qox17rucwjb19z9q]
alicloud_snat_entry.defaultAKE43g: Still creating... [10s elapsed]
alicloud_snat_entry.defaultAKE43g: Creation complete after 13s [id=stb-f8z0medq9q9m76xzz6zf6:snat-f8zw224vtt4ke9kzinpjq]
alicloud_cloud_firewall_nat_firewall.default: Creating...
alicloud_cloud_firewall_nat_firewall.default: Still creating... [10s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [20s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [30s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [40s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [50s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [1m0s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [1m10s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [1m20s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [1m30s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [1m40s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [1m50s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [2m0s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [2m10s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [2m20s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [2m30s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [2m40s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [2m50s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [3m0s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [3m10s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [3m20s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [3m30s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [3m40s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [3m50s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [4m0s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [4m10s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [4m20s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [4m30s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [4m40s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [4m50s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [5m0s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [5m10s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Still creating... [5m20s elapsed]
alicloud_cloud_firewall_nat_firewall.default: Creation complete after 5m21s [id=proxy-natf0200977a7dd4bad910c]

Apply complete! Resources: 7 added, 0 changed, 0 destroyed.

  5. Verification results

    Run the terraform show command

    Run the following command to query the details of the resources created by Terraform.

    terraform show

    ce7063de33d512f0828a52ddde422ff6

    Log on to the Cloud Firewall console

    image

Clean up resources

If you no longer need the resources created by Terraform, run the following command to release them. For more information about the terraform destroy command, see Common commands.

terraform destroy

Complete example

Sample code

variable "name" {
  default = "terraform-example"
}
variable "region" {
  default = "cn-heyuan"
}
provider "alicloud" {
  region = var.region
}
# Create a VPC 
resource "alicloud_vpc" "vpc" {
  vpc_name   = "dd-tf-vpc-01"
  cidr_block = "192.168.0.0/16"
}
# Create a vSwitch with the CIDR block 192.168.10.0/24
resource "alicloud_vswitch" "vsw" {
  vpc_id       = alicloud_vpc.vpc.id
  cidr_block   = "192.168.10.0/24"
  zone_id      = "cn-heyuan-a"
  vswitch_name = "dd-tf-vpc-01-example-1"
}
resource "alicloud_nat_gateway" "default2iRZpC" {
  eip_bind_mode    = "MULTI_BINDED"
  vpc_id           = alicloud_vpc.vpc.id
  nat_gateway_name = var.name
  payment_type     = "PayAsYouGo"
  vswitch_id       = alicloud_vswitch.vsw.id
  nat_type         = "Enhanced"
  network_type     = "internet"
}
resource "alicloud_eip_address" "defaultyiRwgs" {
  address_name = var.name
}
resource "alicloud_eip_association" "defaults2MTuO" {
  instance_id   = alicloud_nat_gateway.default2iRZpC.id
  allocation_id = alicloud_eip_address.defaultyiRwgs.id
  mode          = "NAT"
  instance_type = "Nat"
}

resource "alicloud_snat_entry" "defaultAKE43g" {
  snat_ip           = alicloud_eip_address.defaultyiRwgs.ip_address
  snat_table_id     = alicloud_nat_gateway.default2iRZpC.snat_table_ids
  source_vswitch_id = alicloud_vswitch.vsw.id
}

resource "alicloud_cloud_firewall_nat_firewall" "default" {
  nat_gateway_id = alicloud_nat_gateway.default2iRZpC.id
  nat_route_entry_list {
    nexthop_type     = "NatGateway"
    route_table_id   = alicloud_vpc.vpc.route_table_id
    nexthop_id       = alicloud_nat_gateway.default2iRZpC.id
    destination_cidr = "0.0.0.0/0"
  }
  firewall_switch = "close"
  vswitch_auto    = "true"
  status          = "closed"
  region_no       = "cn-heyuan"
  lang            = "en"
  proxy_name      = "CFW-example"
  vswitch_id      = alicloud_snat_entry.defaultAKE43g.source_vswitch_id
  strict_mode     = "0"
  vpc_id          = alicloud_vpc.vpc.id
  vswitch_cidr    = "192.168.20.0/24"
}
Previous：Create an access control policy in a specific policy group for a VPC firewallNext：Create a VPC firewall for a CEN transit router with Terraform