Securely access remote instances with a bastion host

Create a subnet

1. Click Subnets under Network on the left pane, then click Create.

   1. Under Location, select a geography, region and zone.
   2. Enter vpc-secure-bastion-subnet as name, then select the Virtual Private Cloud you created.
   3. Select the same resource group as for your VPC.
   4. Leave the Address prefix as it is and select the Total IP addresses as 256.

2. Switch the Public gateway to Attached.

   Attach a public gateway to the subnet to allow all attached resources to communicate with the public internet.

3. Click Create subnet to provision it.

Create and configure bastion security group

Let's create a security group and configure inbound rules to your bastion VSI (virtual server instance).

1. Select Security groups under Network, then click Create.

2. Enter vpc-secure-bastion-sg as name and select the VPC you created earlier.

3. Select the same resource group as for your VPC.

4. Now, create the following inbound rules by clicking Add in the inbound section. They allow SSH access and Ping (ICMP). The values are shown in the table below.

   Bastion: Inbound rules

   Protocol	Port / Value	Source type
   TCP	Port range: 22-22	Any
   ICMP	Type: 8,Code: Leave empty	Any

   To enhance security further, the inbound traffic could be restricted to the company network or a typical home network. You could run curl ipecho.net/plain ; echo to obtain your network's external IP address and use that instead.

5. Click Create security group to create it.

Create a bastion instance

With the subnet and security group already in place, next, create the bastion virtual server instance.

1. Under Subnets on the left pane, select vpc-secure-bastion-subnet.
2. Click on Attached resources and under Attached instances, click Create to provision a new virtual server called vpc-secure-bastion-vsi under the same resource group as your subnet.
3. Pick a Location and make sure to later use the same location again.
4. Under Image click on Change image. Use the search field to select Ubuntu Linux as your Operating system. You can pick any version of the image.
5. Click Change profile, select Compute as category and pick cx2-2x4 (2 vCPUs and 4 GB RAM) as your profile.
6. Create a new SSH key, click New key
   1. Enter vpc-ssh-key as key name.
   2. Select the same resource group as for your VSI.
   3. Leave the Region as is.
   4. Copy the contents of your existing local SSH key and paste it under Public key.
   5. Click Add SSH key.
7. Scroll to select the VPC under Networking
8. Make sure that Virtual network interface is selected and vpc-secure-bastion-subnet is listed as subnet. Click the edit icon for that subnet.
   1. First, under Network attachment and virtual network interface details, verify that vpc-secure-bastion-subnet is selected. Click Next.
   2. For Network in the Security Groups section, uncheck the default security group and mark vpc-secure-bastion-sg. Click Next.
   3. In the IP configuration dialog leave everything as is and click Next.
   4. Last, review everything and finish by clicking Save.
9. Click Create virtual server.
10. Once the instance is up and Running, click on vpc-secure-bastion-vsi and reserve a floating IP by clicking on the Edit icon under Network interfaces, then under Floating IP address selecting Reserve a new floating IP. Click Save to finish.

Test your bastion

Once your bastion's floating IP address is active, try connecting to it using ssh:

ssh -i ~/.ssh/<PRIVATE_KEY> root@<BASTION_FLOATING_IP_ADDRESS>

Create a subnet

To create a new subnet,

1. Click Subnets under Network on the left pane, then click Create.
   1. Enter vpc-secure-private-subnet as name, then select the VPC you created.
   2. Select the same resource group as for your VPC.
   3. Select a Location.
   4. Leave the Address prefix as it is and select the Total IP addresses as 256.
2. Switch the Public gateway to Attached.
3. Click Create subnet to provision it.

Create a security group

To create a new security group:

1. Click Security groups under Network, then click Create.
2. Enter vpc-secure-private-sg as name and select the VPC you created earlier.
3. Click Create security group.

Create a virtual server instance

To create a virtual server instance in the newly created subnet:

1. Click on the subnet vpc-secure-private-subnet created earlier under Subnets.
2. Click Attached resources, under Attached instances, click Create.
3. To configure the instance:
   1. Enter a unique name, vpc-secure-private-vsi and resource group as earlier.
   2. Select the same Location already used by the bastion virtual server.
   3. Select Public type of virtual server.
   4. Under Image click on Change image. Use the search field to select Ubuntu Linux as your Operating system. You can pick any version of the image.
   5. Click Change profile, select Compute as category and pick cx2-2x4 (2 vCPUs and 4 GB RAM) as your profile.
   6. For SSH keys pick the SSH key you created earlier for the bastion.
4. Further down, select the VPC your created. Similar to above, click the edit icon for vpc-secure-private-subnet under Network attachment and virtual network interface details.
   1. Next, verify that vpc-secure-private-subnet is selected. Click Next.
   2. For Network in the Security Groups section, uncheck the default security group and mark vpc-secure-private-sg. Click Next.
   3. In the IP configuration dialog leave everything as is and click Next.
   4. Last, review everything and finish by clicking Save.
5. Click Create virtual server.

Add virtual server instance(s) to the maintenance security group

For administrative work on the servers, you have to associate the specific virtual servers with the maintenance security group. In the following, you will enable maintenance, log into the private server, update the software package information, then disassociate the security group again.

Let's enable the maintenance security group for the server.

1. Navigate to Security groups and select vpc-secure-maintenance-sg security group.
2. Click on the Attached resources tab and in the filter select Virtual server interface.
3. Click Edit virtual server interfaces to see a list of VSIs. Expand the list and check the selection next to the Interfaces column for vpc-secure-private-vsi.
4. Click Save for the changes to be applied.

Connect to the instance

To SSH into an instance using its private IP, you will use the bastion host as your jump host.

1. In the left menu, select Virtual server instances in the Compute section. Note the Reserved IP (private IP) address for vpc-secure-private-vsi.

2. Use the ssh command with -J to log into the server with the bastion floating IP address you used earlier and the server Private IP address you just looked up.

   ssh -J root@<BASTION_FLOATING_IP_ADDRESS> root@<PRIVATE_IP_ADDRESS>
   

   -J flag is supported in OpenSSH version 7.3+. In older versions -J is not available. In this case the safest and most straightforward way is to use ssh's stdio forwarding (-W) mode to "bounce" the connection through a bastion host. e.g., ssh -o ProxyCommand="ssh -W %h:%p root@<BASTION_FLOATING_IP_ADDRESS" root@<PRIVATE_IP_ADDRESS>

Install software and perform maintenance tasks

Once connected, you can install software on the virtual server or perform maintenance tasks.

1. First, update the software package information:

   apt-get update
   

2. Install the desired software, e.g., Nginx or MySQL or IBM Db2.

When done, disconnect from the server with exit command.

To allow HTTP/HTTPS requests from the internet user, assign a floating IP to the VSI and open required ports (80 - HTTP and 443 - HTTPS) via the inbound rules in the security group of private VSI.

Disable the maintenance security group

Once you're done installing software or performing maintenance, you should remove the virtual servers from the maintenance security group to keep them isolated.

1. Navigate to Security groups and select vpc-secure-maintenance-sg security group.
2. Click Attached resources, then Edit virtual server interfaces.
3. Expand the virtual server instances and uncheck the selection next to the Interfaces column for vpc-secure-private-vsi.
4. Click Save for the changes to be applied.

You may repeat the ssh command from above with the jump host option. It should fail now.