Soracom Canal
VPC Peering Configuration
Requirements
To configure Canal with an AWS VPC Peering Connection, you will need the following information:
- Your AWS account number
- The ID of the AWS VPC you want to connect to, such as
vpc-12345678 - The AWS Region where your VPC is located
- The CIDR block of your VPC, which should comply with RFC 1918
The CIDR block of your VPC must be within one of the following IP address ranges:
10.0.0.0/8(excluding10.21.0.0/16; see Limitations below)172.16.0.0/12192.168.0.0/16
If you don't have a VPC yet, follow the instructions in the Creating a VPC section in this document.
In addition, you will need to create a Type-F Virtual Private Gateway.
Limitations
When you create a Virtual Private Gateway (VPG), Soracom will automatically allocate resources for the VPG within the 10.21.0.0/16 IP address range. As a result, your VPC cannot include this IP address range. If your AWS VPC uses a CIDR block that includes this range, you will need to create a new VPC with a CIDR block which does not include this range.
Configuration
Creating a VPG
Creating a VPG will incur fees. Refer to the Pricing & Fee Schedule for more information.
Follow the instructions from the Virtual Private Gateway Configuration documentation to create a new VPG with the following options:
- Name - Any name to identify this VPG
- Type - Either
Type-F.Type-EVPGs do not support Peering Connections. - Use internet gateway -
ONorOFF - Rendezvous Point - When creating a Type-F VPG, you can select the region where your VPG will be located in, in order to maximize the Peering Connection performance. When creating a Type-C VPG, this will be set automatically to Frankfurt (Germany).
- CIDR Range for device subnet - (blank) or custom CIDR block
For more information on each option, refer to the VPG Configuration documentation.
Add a Peering Connection
While your first VPC peering connection is included with your cost of your VPG, adding additional peering connections will incur additional fees. Refer to the Pricing & Fee Schedule for more information.
With a VPG created, we can now add an AWS Peering Connection in order to connect it to our AWS VPC.
-
Login to the User Console. From the Menu, open the VPG screen.
-
From the list of VPGs, click the name of the VPG you want to configure to open its settings page.
-
From the Basic settings tab, VPC Peering Connections panel, click the Add button.
-
Enter your AWS Account ID, the AWS VPC ID, the AWS Region, and the VPC CIDR Block:
Then click the Save button.
This will initiate a Peering Connection request with your AWS account. Next, we'll accept the connection request to complete the Peering Connection setup.
Accept the Peering Connection Request
-
Login to the AWS Management Console . From the Services menu, open the VPC dashboard.
-
Click the Peering Connections section.
-
Select the Peering Connection request in the list. Its Status should appear as pending-acceptance.
-
Click the Actions menu, then select Accept Request.
A dialog will appear asking if you want to update your VPC's routing table. In order to route traffic correctly between the Soracom VPG and your AWS VPC, we need to add a new routing rule.
-
Click the Modify my route tables now link.
-
From the list of route tables, select the route table that is attached to your VPC. The Explicitly Associated column should indicate that it is associated with 1 Subnet.
-
Click the Routes tab. Then add a new destination with the following values:
- Destination - The CIDR range of your VPG. If not previously noted, this range can be found in the VPG overview table under VPG IP Address Range. For example:
100.64.0.0/10. - Target -
pcx-xxxxxxxx. The Target option tells the VPC that traffic returning to the VPG should be routed using the selected Peering Connection. As you typepcx, the approved Peering Connection should appear automatically.
Then click the Save button.
- Destination - The CIDR range of your VPG. If not previously noted, this range can be found in the VPG overview table under VPG IP Address Range. For example:
Canal is now configured, and Air SIM devices that are attached to the VPG will be able to connect to network resources within your VPC.
Testing Canal
To test the Canal connection, simply create a network resource within your VPC.
For example, you can create a basic EC2 instance, making sure that it belongs to your VPC, and is assigned a static IP address within your VPC's CIDR block range.
Then connect to the EC2 instance to install and start an Apache webserver with its default welcome page.
Configure your EC2 instance's Security Group to allow inbound HTTP traffic on port 80 from 0.0.0.0/0 any source.
Finally, test that your Air SIM device is able to view or curl the default Apache webpage using the EC2 instance's private IP address.
Configuring your EC2 instance to allow inbound traffic from 0.0.0.0/0 (any source) is intended only to simplify testing. Leaving this configuration as-is will expose your EC2 instance to external access.
Once you have verified that your devices are able to reach your EC2 instance, you should update this configuration to, for example, only allow traffic from your VPG by changing the source CIDR block to match the Requester CIDRs found in your list of VPC Peering connections, or remove this configuration altogether if you plan on using a different protocol.
Reference
Creating a VPC
-
Login to the AWS Management Console . From the Services menu, open the VPC dashboard. Then click the Create VPC button.
-
In the Select a VPC Configuration screen, choose VPC with a Single Public Subnet and click the Select button.
-
Enter a VPC name for this VPC. You can leave the other settings with their default values, or configure a different IPv4 CIDR block and other settings if desired.
Note: When creating a VPC which you intend to use with Soracom Canal, ensure that the IPv4 CIDR block does not include the
10.21.0.0/16IP address range. Soracom will allocate resources within this IP address range. If you specify a CIDR block which includes this IP address range, you will have to create a new VPC.Then click the Create VPC button.
-
Once the VPC has been created, it will appear in the list of VPCs:
-
To enable the Internet gateway for the VPC, select the VPC from the list. Then click the Overview tab, and click the item listed next to Route table:
-
Set the Internet gateway
igw-xxxxxxxxfor the0.0.0.0/0target.
Then click the Save button.
Finding the Requirements
You can find your AWS account number by logging into the AWS Management Console . On the upper right corner of the console, click the ? support menu, then select Support Center. Your AWS account number will be displayed at the top of the navigation menu on the left side:
To find the ID and CIDR block of a VPC, click the Services menu and open the VPC dashboard. Then click the Your VPCs section. The VPC ID and CIDR block will be listed:
Terminating Canal Connections
If you no longer need a closed network connection using Canal you may delete the VPG associated with the Canal connection. If you would like to keep using your VPG but remove the Canal connection, please contact our support team for further assistance.