Building a Production Environment on Alibaba Cloud VPC

A major issue with the default Alibaba Cloud Classic Network is that each ECS instance must have a public IP address; otherwise, it cannot directly access the internet (if bandwidth is set to 0, no public IP is assigned).

Additionally, the Classic Network makes it difficult to hide server details, posing security risks.

Deployment Diagram

The servers created based on the VPC in Alibaba Cloud are deployed as shown below:

Alibaba Cloud VPC Server Deployment Topology

Deployment Method Description

The main steps are:

• Create a Virtual Private Cloud (VPC); I selected the 10.0.0.0 network.
• No need to create a router separately; the VPC comes with one by default.
• Create a vSwitch and configure the subnet; here we use 10.0.1.0.
• Create ECS instances under the vSwitch and set the network bandwidth to 0. This prevents the allocation of a public IP, meaning they cannot directly access the internet.
  • Create multiple Web server ECS instances.
  • Create one minimum-configuration ECS instance intended for controlling other servers, such as accepting external SSH logins and using docker-machine to manage other internal servers.
• Create a NAT Gateway and configure the following under the NAT Gateway:
  • Purchase a Bandwidth Package.
    • Without a bandwidth package, you cannot access the internet.
    • When purchasing the bandwidth package, buy 2 public IP addresses within it (by default, only 1 is purchased).
  • Configure SNAT, pointing it to the vSwitch created above. This allows all hosts under this vSwitch to access the internet, using 1 IP address from the bandwidth package.
  • Configure DNAT, mapping port 22 of the other IP address from the bandwidth package to the control server created above.
• Create a Load Balancer of type Public Internet and add all Web servers to it.

Main Objectives

The primary goals of this solution are:

• The external network cannot directly access internal business servers (specifically Web servers).
• The external network must log into the control server first, then access internal servers from there.
• All internal servers access the external network through a unified NAT Gateway.
• Users access exposed internal services via the Load Balancer.

Subsequently, we will build a container cluster service based on Docker Swarm Mode using this solution as a foundation.