# Bastion Host Today, we'll create a Bastion Host, a secure gateway, in our Virtual Private Cloud (VPC). This host will act as a bridge, allowing us to securely access our private instances located in the VPC's private subnet. Let's dive in right away. --- ### Analogy A bastion host is like a secure gatekeeper for your network, ensuring no one can bypass it to get inside. It checks everyone's identity and keeps a record of all entries, allowing only authorized users. With minimal features to reduce risks, it is well-protected against attacks, acting like a vigilant gatekeeper monitoring and controlling access to the castle. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716987047248/252564ec-e7b1-41e4-af32-9ecb15cfd41c.png align="center") --- ### Task 1: Create a VPC Search for **VPC** in the search box. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716950280998/1252a27b-0427-4ba2-8bc5-91f40f8bf8c6.png align="center") Click on `Create VPC`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716950395854/b0b3e8ae-9af6-4e94-ac09-a68754a68577.png align="center") Provide a suitable name for your VPC and provide CIDR range. Leaving all other configurations as default, Click on `Create VPC`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716950486711/784e53fb-b982-4707-9f84-baf6a338da8b.png align="center") Our VPC is created. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716987449164/c8e6857b-4cf5-47d1-8c53-61791c05c92b.png align="center") --- ### Task 2: Creating an Internet Gateway Internet Gateway to provide our VPC internet access. On the VPC dashboard, **On Internet gateways**, click on `Create Internet gateway`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716950564132/0feeea5f-8cdd-4243-acc0-ebaec5047535.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716950705596/b9083f60-4fbb-4596-aa5f-5f73a0187bc2.png align="center") Provide a suitable name for your IG and click on `Create internet gateway`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716950752148/8fda38c1-22d7-4ce6-9062-11e55cf48144.png align="center") Now, we have to attach it to our VPC. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716950787079/2bd22309-db1c-4de7-8981-f7d4b19c1bfe.png align="center") Select your VPC and click on `Attach internet gateway`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716987556567/82e0586e-9fbb-487e-81da-726ec408d4e5.png align="center") --- ### Task 3: Creating Subnets ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716950960041/43bcefa7-5fa2-4bc6-b2ed-f34540e3b267.png align="center") On the VPC dashboard, On **Subnets**, click on `Create subnet`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716950995399/c65abfb8-af36-4aa1-b13f-eaf449fd01ed.png align="center") Select your VPC. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716951039344/56094164-ecdc-4a54-a991-af5609762415.png align="center") First, we are going to create Public subnet. Provide a suitable name for your subnet and an eligible CIDR range. For this project, we're only using single Availability Zone. Click on `Add new subnet`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716951215930/ef673ec3-57ec-495c-89a9-922903edeb7b.png align="center") Now, we'll set up our Private subnet. Provide a suitable name, choose the AZ and an eligible CIDR range. Click on `Create subnet`. We've successfully created two subnets. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716951346417/891b9f56-ad1b-479b-a1b0-89d552be6df7.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716989530514/b3ad263c-bdff-4b9b-9ab2-2c346d12c398.png align="center") --- ### Task 4: Creating Route Tables On VPC dashboard, On **Route tables**, click on `Create route table`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716951412917/f9678549-f5f0-4497-9808-f4e77fbba248.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716951761665/51dd2ce4-e3ad-4b7a-9048-66c7d28f3acb.png align="center") Provide name for your route table, select your VPC and click on `Create route table`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716951825409/303c7b17-fde7-4a9b-a60b-12915764e9d4.png align="center") After creating route table, on **Subnet associations**, click on `Edit subnet associations`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716951887618/5ed2d60c-0076-47d6-8179-ba79d92bd9b4.png align="center") Tick your Public subnet and click on `Save associations`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716951930171/65b25406-59f7-460c-a1d1-b7f3789dc13f.png align="center") Now, Click on `Edit routes`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716951963429/5acb8853-0461-418e-a09f-4fd1402a629c.png align="center") Add route and configure the above configurations. Select your Internet Gateway and click on `Save changes`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716952051474/7479f0c8-9e59-4fc7-8974-32edaabed52f.png align="center") The Public subnet can access the Internet now. Now, it's time to set up our Private subnet. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716952179179/01616b83-f65a-4016-87e7-9acd3ab77718.png align="center") Provide name for your Private route table and select your VPC and click on `Create route table`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716952237272/862f0380-9ecf-4e00-a2c2-1c038ebf3159.png align="center") On **Subnet associations**, click on `Edit subnet associations`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716952283253/b66cf4d4-5b3f-4764-a66d-04c9f0995732.png align="center") Tick your Private subnet and click on `Save associations`. For this Private route table, we do not have to configure any additional routes. The route table entry `10.0.0.0/16` with the target `local` indicates that traffic within this IP range is allowed to communicate within the VPC. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716989755109/40f0c621-7413-4d5f-8141-a594c57e11fb.png align="center") --- ### Task 5: Creating EC2 instances Search for **EC2** on the search box. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716952457857/ec9d4371-8e6d-4ca8-ad24-6396ec4d4978.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716952501367/f0faf5ea-915b-4a86-8a56-65d9e4ca30b3.png align="center") Click on `Launch instance`. We'll create our Bastion Host first. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716952588957/b9b20f69-1093-4820-b529-d7d79b719f7f.png align="center") Provide name for your Bastion Host, select **Ubuntu** as an AMI, choose free tier instance if available. Create a new key pair. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716952674272/dddd1f3e-d52b-4398-8060-75b5dded632c.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716952719376/26ab633f-889b-4ebd-ac47-e9a3f8d1b086.png align="center") Edit Network settings. Select your VPC, choose your Public subnet and Enable Auto-assign public IP. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716952782976/bf824f1b-a310-41b7-bb8b-25ed11d26915.png align="center") By default, we're provided with an Inbound Security Group Rules. We can SSH into this instance from anywhere on the internet. Leaving all other configurations as default, click on `Launch instance`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716952953211/2f29b627-3ae8-4044-9658-966727d25aa6.png align="center") Now, let's create Private instance. Click on `Launch instances`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716953024855/bd4fd9f7-c526-4d21-a02f-3cd8c4e8df90.png align="center") Provide a name for your instance, select your AMI, select the instance type, and create a new key pair. You can also use an existing key pair that was created earlier. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716953134878/9f3089d2-7499-48f2-89d3-0ae2d573a561.png align="center") I'm creating separate keys for different instances. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716953186667/85a6ad58-1367-4834-87d3-5d694fc4d6dd.png align="center") Edit Network Settings. Select your VPC, choose your Private subnet and leave Auto-assign public IP as default. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716953253200/53583eb4-a4b6-4f77-8440-f4d080578ba7.png align="center") In the Inbound Security Group Rules, the Source type should not be set to "Anywhere." We must configure it to allow SSH access only from the resources that resides in our Public subnet. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716953381935/130de17a-6a22-49b7-800f-3f1b6c0e817d.png align="center") This ensures that only instances within the Public subnet can SSH into the instance. Leave all other configurations as default and Click on `Launch instance`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716953545112/92a990ed-9175-406c-a02b-3bebc23239cb.png align="center") We've created two instances. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716989865490/6b907e39-0cd1-49f3-be84-ab0fae522d81.png align="center") --- ### Task 6: SSH into our Bastion Host Select your Bastion Host and now click on `Connect`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716953647542/2b362202-5db7-4a64-a3fa-da117f8afb3d.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716953727510/4f289b53-5986-4d8f-a457-d40dd400320d.png align="center") On SSH client, we have to follow some steps shown there. I'm in my SSH client, i.e., terminal. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716953804573/ea9c33eb-4f21-4b41-9de3-fce1bde811a3.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716953845938/485a2519-1391-4fdb-b7d9-8a0951d00763.png align="center") Copy the command and paste into your terminal. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716988013063/639ca9a0-9bac-4296-9ab0-a2352fd5de89.png align="center") You can view your permissions using the following command: ```bash ls -l ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716961708419/fcc444ef-9fea-4145-8db7-eb43b425673d.png align="center") We have changed the file permissions to make it readable by the owner only. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716954002059/225521a7-83bd-4ee6-9e3f-1bef6e906e57.png align="center") Copy the command & paste into your terminal. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716954044575/9a8fa7e2-5ad5-49aa-8276-8a66a3c97fb8.png align="center") Make sure your key file is present in your working directory; otherwise, provide the full path to the key file. Proceed with `yes`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716954170848/36c19d31-636e-4372-b3e9-736e44545fdc.png align="center") Now, we have logged into our instance using SSH. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716989964466/fe9670dc-2bf7-4c73-aa94-2096a242a471.png align="center") --- ### Task 7: Copying the Key File Open new terminal in your **local computer**. We're copying the private key file that is in our local computer to our Bastion Host. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716958263649/060442cd-d166-479b-ad86-7914abc74290.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716960314059/dd0153c1-2e4c-43f2-a25c-3706bac3761a.png align="center") ```bash ssh -i "myKey.pem" ubuntu@3.83.154.159 ``` For ease, copy the command that we use to SSH into our instance. It's so to modify it a bit. Paste the command in your **Desktop's** terminal. ```bash scp -i "myKey.pem" privateKey.pem ubuntu@3.83.154.159:/path/to/destination/ ``` Replace and add commands/configurations as required. Here's a breakdown of the command: * `scp` stands for Secure Copy. It is a command-line utility that allows you to securely copy files and directories between two locations. * `-i my-key.pem`: Specifies the identity file (private key) to use for **authentication**. * `privateKey.pem`: Specifies the source file on your local machine that you want to copy. * `ubuntu@3.83.154.159:/path/to/destination/`: Specifies the destination on the remote Alright. To see your present working directory, In your **Bastion terminal**, type command: ```bash pwd ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716961158200/3c0d62be-6880-41dd-8689-0e605ba47cc6.png align="left") Now, replace the `/path/to/destination/` with your pwd location in your **Desktop's** terminal. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716960733542/43f78eba-afaa-40e3-a7dc-457394c05835.png align="center") Now see if the key has been successfully copied into our Bastion Host by listing files/folders in our **Bastion's** terminal. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716961422760/fc7616f6-a0cc-4b11-9d56-6fb0b1279c9c.png align="left") We can see that the private key has been copied from our local computer to the remote instance. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716990122325/38234f5a-5b42-400f-a2e2-d0bf81f77c05.png align="center") --- ### Task 8: SSH Login to Private Instance It's time to SSH log in into our Private instance. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716962077383/8280fe9a-99a9-4a50-bc52-1b5d4d167034.png align="center") Select your Private instance and click on `Connect`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716962113686/ea483a52-c68c-404c-a596-000d93252ba6.png align="center") Copy the command. But before that, let's see what permissions are set initially, ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716962201158/989a1b71-b9c5-4146-ae7e-3080c4252cc0.png align="center") We can see there are `read/write` for **Owner**, `read/write` for **Group** & `read` permissions for **Others**. It is recommended to set the permissions of the file or directory to the minimum necessary for the required operations. So, let's do that. Paste the command that you had copied into the **Bastion's** terminal. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716962446213/a95ee1ac-ae50-4cf4-b0f0-1d77a55ebef3.png align="center") We can see the file permissions have been changed now. Now, copy the SSH command. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716962495845/34577337-9deb-4fab-9413-0a7af036b814.png align="center") Paste into your terminal. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716962570893/735438d0-919c-4f40-bcd7-9951cf34d7a4.png align="center") Proceed with `yes`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716962623157/3ea136a7-aea0-4461-9fb2-637c8d127473.png align="center") Now we are into our Private instance. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716962674769/d8dd29a5-4374-487d-ab94-7adf168c3afb.png align="center") You can verify this by examining the details in the instance configurations. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716990233847/bb1b8f3f-6619-4e7a-9ede-0b17d50d040f.png align="center") Alright, that's our work done. --- ### Conclusion This configuration helps keep our Private instance secure by limiting direct access from the internet. Instead, we can access it securely through the Bastion host. This setup is a common practice for enhancing security in cloud environments. --- ### Task 8: Clean Up 1. **Terminating instances.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716962908793/9b29e8a3-4aed-47c4-9c9b-101b3b30460f.png align="center") Select both of your instances, on **Instance state**, click on `Terminate instance`. 2. **Deleting Route tables.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716962908793/9b29e8a3-4aed-47c4-9c9b-101b3b30460f.png align="left") Search for **VPC** in the search box. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716963093734/568e641a-8fc8-4b6d-b92a-b18803c12fef.png align="center") On Route tables **Subnet associations**, click on `Edit subnet associations`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716963152693/b426aeae-266c-4df6-8e6b-6d309ad20063.png align="center") Uncheck the box and click on `Save associations`. Do the same for Private Route tables. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716963249528/fc2e47d4-3d2c-47e4-957f-38607f8654f7.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716963262944/17452ff2-ea48-477a-86d1-a5fd11fcb17b.png align="center") Now, as we do not have any associations, we can delete the route tables. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716963362225/077d8de6-537d-4847-b3c7-8b5c4e45673e.png align="center") 3. **Deleting Subnets** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716963439585/298496fb-86cc-4761-9efd-f8667bf04384.png align="center") Tick both of your subnets and on **Actions panel**, click `Delete subnet`. 4. **Deleting Internet Gateway.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716963527716/18e2dca6-2f59-4351-8c6c-c30086bab8f2.png align="center") Before we are able to delete the IG, we've to detach it from our VPC. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716963594766/e3fee0ff-669f-4de2-b428-17f9527d1656.png align="center") After detaching from our VPC, we can delete our Internet gateway. 5. **Deleting VPC.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1716963702825/caef33e0-d5b5-4ce7-af6d-fbf22e658053.png align="center") Now, we have cleaned up our resources that we had used in our lab session. --- Alright folks, See you in the next one!