Skip to main content

Connect a server in a C-DC to a dedicated server in a different pool

You can connect a server in a CDC and a dedicated server located in different pools. Connectivity is established over a private network via Selectel Global Router.

How it works

A dedicated server in a C-DC connects to the Global Router through a firewall. For this, the firewall behind which the server is located must be connected to private network switches.

A dedicated server in another pool also connects to the Global Router. Dedicated servers, with the exception of some Chipcore Line servers, are connected to private network switches by default.

Connect a server in a C-DC to a dedicated server in a different pool over a private network

  1. Connect the firewall to the private network.
  2. Create a global router.
  3. Connect the network and subnet to the router up to the dedicated server VLAN outside the CDC.
  4. Connect the network and subnet to the router up to the CDC.
  5. Configure the firewall in the CDC.
  6. Configure the dedicated server outside the CDC.

1. Connect the firewall to the private network

  1. Create a ticket to connect the firewall in the CDC to the private network. In the ticket, specify:

    • CDC firewall number; it can be viewed in the control panel: in the top menu, click Products → Firewalls → firewall page;
    • the port number on the firewall for connecting to the private network switch.

  2. Wait for a Selectel employee to confirm that the firewall in the C-DC has been connected to the private network.

2. Create a Global Router

  1. In the control panel, in the top menu, click Products and select Global Router.
  2. Click Create router. Each account has a limit of five global routers.
  3. Enter the router name.
  4. Click Create.
  5. If the router was created with the status ERROR or is stuck in one of the statuses, create a ticket.

3. Connect the network and subnet to the router for the dedicated server VLAN outside the C-DC

You can connect a new network to the router or an existing network if it is not already connected to any of the account's global routers.

  1. In the Control panel, from the top menu, click Products and select Global Router.

  2. Open the router page → Networks tab.

  3. Click Create network.

  4. Enter a network name. It will only be used in the control panel.

  5. Select the Servers and hardware service.

  6. Select the location of the network.

  7. Select or enter a VLAN.

  8. If you want to create a network to an internal segment (Q-in-Q), specify its tag — a number from 2 to 4094. If a network already exists for the VLAN, you must specify the Q-in-Q segment of this VLAN.

  9. Enter a subnet name. It will only be used in the control panel.

  10. Enter the CIDR — the IP address and mask of the private subnet. You can enter a new subnet or an existing private server subnet if it has not yet been added to any of the global routers in the account. The subnet must meet the following conditions:

    • belong to the RFC 1918 private address range: 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16;
    • have a size of at least /29, because three addresses will be occupied by Selectel network equipment;
    • do not overlap with other subnets added to this router — there must be no identical IP addresses within subnets on the same router;
    • if a Managed Kubernetes cluster on cloud servers is connected to the global router network, the subnet must not overlap with the ranges 10.10.0.0/16, 10.96.0.0/12, 10.250.0.0/16, and 10.251.0.0/24. If a cluster on dedicated servers is connected to the network — with the ranges 10.10.0.0/16, 10.222.0.0/16, 10.250.0.0/16, 10.251.0.0/24, and 172.250.0.0/14. These subnets are used in Managed Kubernetes internal addressing, and their use may lead to conflicts in the global router network.

  11. Enter the gateway IP or leave the first address from the subnet, which is assigned by default. Do not assign this address to your devices to avoid network disruption.

  12. Enter the service IPs or leave the last addresses from the subnet, which are assigned by default. Do not assign these addresses to your devices to avoid network disruption.

  13. Click Create network.

  14. Optional: check the network topology on the global router. In the Control panel, from the top menu, click Products → Global Router → router page → Network map.

  15. If you specified a Q-in-Q tag in step 8, enable Q-in-Q on the switch port and configure the network interface of the private network specified in step 10. Learn more in the Configure Q-in-Q section of the Q-in-Q instructions.

4. Connect the network and subnet to the router for the C-DC

  1. In the control panel, in the top menu, click Products and select Global Router.

  2. In the Selectel Global Router section, open the router page → Networks tab.

  3. Click Create network.

  4. Enter a network name. It will only be used in the Control panel.

  5. Select the Servers and Hardware service.

  6. Select a pool.

  7. Select a VLAN.

  8. If you want to create a network for the internal VLAN segment (Q-in-Q), specify its tag — a number from 2 to 4094.

  9. Enter a subnet name. It will only be used in the Control panel.

  10. Enter a CIDR — the IP address and mask of the private subnet. The subnet must meet the following conditions:

    • belong to the private address range according to RFC 1918: 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16;
    • be at least /29 in size, since three addresses will be occupied by Selectel network equipment;
    • not overlap with other subnets added to this router — there must be no identical IP addresses in the subnets of one router;
    • if a Managed Kubernetes cluster on cloud servers is connected to the global router network, the subnet must not overlap with the ranges 10.10.0.0/16, 10.96.0.0/12, 10.250.0.0/16, and 10.251.0.0/24. If a cluster on dedicated servers is connected to the network, with the ranges 10.10.0.0/16, 10.222.0.0/16, 10.250.0.0/16, 10.251.0.0/24, and 172.250.0.0/14. These subnets are used for internal Managed Kubernetes addressing, and their use may cause conflicts in the global router network.

  11. Enter the gateway IP or leave the first address of the subnet, which is assigned by default. Do not assign this address to your devices, so as not to disrupt network operation.

  12. Enter service IPs or leave the last addresses of the subnet, which are assigned by default. Do not assign these addresses to your devices, so as not to disrupt network operation.

  13. Click Create network.

  14. Optional: check the network topology on the global router. In the control panel, in the top menu, click Products → Global Router → router page → Network map.

  15. If you specified a Q-in-Q tag in step 8, make sure that you configured Q-in-Q. When configuring, use the subnet you specified in step 10.

5. Configure the firewall in the C-DC

  1. Connect to FortiGate via GUI.

  2. Create and configure a private interface with a dedicated subnet:

    2.1. Go to Network → Interfaces.

    2.2. Click Create New → Interface.

    2.3. In the Address field, enter an IP address from the private subnet that you connected to the global router up to the CDC, for example, 192.168.100.2/28.

  3. Add a static route to the subnet that you connected to the global router up to the VLAN of the dedicated server outside the CDC:

    3.1. Go to Network → Static Routes.

    3.2. Click Create New → IPv4 Static Route.

    3.3. In the Destination field, enter the destination subnet — the subnet you connected to the global router up to the VLAN of the dedicated server outside the CDC.

    3.4. In the Gateway Address field, enter the gateway — the IP address you assigned to the global router when connecting the network up to the CDC in step 11.

    3.5. In the Interface field, specify the local interface you created in step 2.

  4. Configure a security policy that will allow traffic from the dedicated server outside the C-DC to the dedicated server in the C-DC:

    4.1. Go to Policy & Objects → Firewall Policy.

    4.2. Click Create New.

    4.3. Enter a policy name.

    4.4. In the Incoming Interface field, select the interface for which you configured the IP address in step 2.

    4.5. In the Outgoing Interface field, select the interface to which the dedicated server in the CDC is connected.

    4.6. In the Source field, enter another IP address from the same private subnet that you configured on the firewall in step 2. This address will be used on the dedicated server outside the CDC.

    4.7. In the Destination field, enter the IP address of the dedicated server in the CDC.

    4.8. Click Save.

  5. Configure a security policy that will allow traffic from the dedicated server outside the C-DC to the dedicated server in the C-DC:

    5.1. Go to Policy & Objects → Firewall Policy.

    5.2. Click Create New.

    5.3. Enter a policy name.

    5.4. In the Incoming Interface field, select the interface to which the dedicated server in the CDC is connected.

    5.5. In the Outgoing Interface field, select the interface for which you configured the IP address in step 2.

    5.6. In the Source field, enter the IP address of the dedicated server in the CDC.

    5.7. In the Destination field, enter the IP address that will be used on the dedicated server outside the CDC.

    5.8. Click Save.

6. Configure the dedicated server outside the C-DC

  1. Assign an IP address from the subnet you connected to the global router up to the server outside the CDC to the private network interface. Use the Configure private network interface section of the Configure network interface on server instruction.

  2. Configure a static route on the network interface you configured in step 1. In the route, specify: