Networking

How traffic flows

A single node uses the routed-host topology: the node routes between its LAN and the tenants’ private networks. Three address spaces meet there:

Addresses	Belong to	Reachable from the LAN
The node’s management address	The node	Yes
VPC addresses (the default VPC is 172.31.0.0/16)	Instances’ private NICs	No: private by design
Floating IP ranges	Instances and load balancers that hold one	Yes, once the LAN router routes the range to the node

VPCs and subnets

A VPC is a project’s private network; a subnet is a range inside it, in one availability zone. Every project gets a default VPC. A VPC with an internet gateway (the default) gives every instance outbound access through the node, with or without a floating IP.

stratumctl vpcs create app --cidr-block 172.16.0.0/16 --project p-web
stratumctl subnets create app-a --vpc vpc-abc123 --cidr-block 172.16.1.0/24 --type public --project p-web
stratumctl vpcs set-igw vpc-abc123 --disable --project p-web    # no internet gateway

Each subnet’s .3 address is its DNS resolver; DHCP hands it out.

Security groups

Stateful firewalls on instance NICs. A new group allows all egress and no ingress.

stratumctl security-groups create web --project p-web
stratumctl security-groups rules add sg-abc123 --direction ingress --protocol tcp \
  --from-port 443 --to-port 443 --source 0.0.0.0/0 --project p-web

--source is a CIDR, or another group with --source-type security-group.

Floating IPs

A floating IP is a LAN address mapped one to one onto an instance’s private address, inbound and outbound.

stratumctl floating-ips allocate --project p-web
stratumctl floating-ips associate fip-abc123 --nic nic-abc123 --project p-web

Or at launch: stratumctl instances create ... --public-ip.

The floating IP pool

The pool is the ranges set at install. For a range to work, the LAN router must route it to the node; see LAN access. Console: Admin › Platform › Catalog › Floating IP Pools.

To add a range later:

stratumctl meta-fip-pools add --cidr 198.51.100.0/24
stratumctl meta-fip-pools list

Pick ranges that nothing else on the LAN uses, and that do not overlap the node’s networks or the ranges the platform keeps for itself (100.64.0.0/10, 10.255.0.0/16, 10.88.0.0/16, 10.89.0.0/16).

Public names

With DNS forwarding of the parent domain in place, these names resolve from the LAN:

Name	Points at
stratum.<parent>	The API, over TLS.
lb-<id>.elb.<region>.<parent>	A load balancer.
i-<id>.compute.<parent>	An instance with a floating IP, in a VPC with DNS hostnames on.

stratumctl instances get <id> shows an instance’s public DNS name. Inside the VPC the same name resolves to the private address. Turn instance names off or on per VPC:

stratumctl vpcs set-dns-hostnames vpc-abc123 --disable --project p-web

For a name of your own, create an alias record in a hosted zone; see DNS.