Description

Ensure instances that only have a private network address use an OVHcloud managed Gateway (an OpenStack router) to reach the internet for updates and outbound connections, instead of being given a public IP address just for outbound traffic.

Rationale

Giving private instances a public IP for outbound access also exposes them to inbound connections from the internet. A managed Gateway provides outbound connectivity through network address translation while keeping the instances unreachable from outside, which reduces their attack surface.

Impact

  • Private instances can reach the internet without being exposed

  • Reduces the number of public IP addresses

  • The Gateway is billed by size and usage

Default Value

By default, no Gateway is created. Instances on a private network have no internet access unless a Gateway or public IP is used.

Pre-Requisites

  • Permission to manage the Public Cloud project

  • A private network with a subnet

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, under Network, select Gateway and check whether a Gateway is attached to the private network.

  4. In Instances, check for private instances that also have a public IP only for outbound access.

  5. If private instances lack a Gateway, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, under Network, select Gateway and click Create a Gateway (an active vRack is required).

  4. Select the region and Gateway size, name the Gateway, attach the private network (or click Add a private network), and click Create a Gateway.

  5. Remove the public network interface from instances that no longer need it.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. Delete the Gateway, and re-add a public interface to instances that need outbound access.

Reference