fck-nat

https://fck-nat.dev/stable
Admin
fck-nat is a cost-effective, configurable NAT solution for AWS that provides ARM and x86 AMIs...
Tokens:5,352
Snippets:46
Trust Score:6.4
Update:2 months ago
Show doc for...
Tokens:
Raw
### Configure fck-nat with Terraform Module

Source: https://fck-nat.dev/stable/deploying

Use the official fck-nat Terraform module for deployment. This example shows basic configuration, including optional high-availability and CloudWatch agent enablement.

```terraform
module "fck-nat" {
  source = "RaJiska/fck-nat/aws"

  name                 = "my-fck-nat"
  vpc_id               = "vpc-abc1234"
  subnet_id            = "subnet-abc1234"
  # ha_mode              = true                 # Enables high-availability mode
  # eip_allocation_ids   = ["eipalloc-abc1234"] # Allocation ID of an existing EIP
  # use_cloudwatch_agent = true                 # Enables Cloudwatch agent and have metrics reported

  update_route_tables = true
  route_tables_ids = {
    "your-rtb-name-A" = "rtb-abc1234Foo"
    "your-rtb-name-B" = "rtb-abc1234Bar"
  }
}

```

--------------------------------

### Find Public fck-nat AMIs

Source: https://fck-nat.dev/stable

Use this AWS CLI command to list available fck-nat AMIs in your account. Ensure you have the AWS CLI installed and configured.

```bash
# Amazon Linux 2023 based AMIs
aws ec2 describe-images --owners 568608671756 --filters 'Name=name,Values=fck-nat-al2023-*'
```

--------------------------------

### Get EC2 Instance Pricing Information

Source: https://fck-nat.dev/stable/choosing_an_instance_size

This command fetches pricing data for EC2 instances from the AWS Pricing API and extracts the on-demand USD price per unit, saving it to a JSON file. It filters for compute instances in 'US East (N. Virginia)'.

```bash
aws pricing get-products \
    --service-code AmazonEC2 \
    --filters "Type=TERM_MATCH,Field=location,Value=US East (N. Virginia)" \
    --region us-east-1 \
| jq -rc '.PriceList[]' \
| jq -rc 'select(.product.productFamily=="Compute Instance")' \
| jq -r '{ (.product.attributes.instanceType): { price: (.terms.OnDemand[].priceDimensions[].pricePerUnit.USD | tonumber) }}' \
| jq -s add > instance-pricing.json
```

--------------------------------

### Get EC2 Instance Network Information

Source: https://fck-nat.dev/stable/choosing_an_instance_size

This command retrieves network bandwidth details for EC2 instance types and formats the output into a JSON file. It extracts vCPUs and network performance metrics.

```bash
aws ec2 describe-instance-types \
    --output json \
| jq '.InstanceTypes[] | { (.InstanceType): { vcpus: .VCpuInfo.DefaultVCpus, baseline: .NetworkInfo.NetworkCards[0].BaselineBandwidthInGbps, burst: .NetworkInfo.NetworkPerformance}}' \
| jq -s add > instance-networking.json
```

--------------------------------

### Merge and Analyze Instance Data

Source: https://fck-nat.dev/stable/choosing_an_instance_size

This command merges instance networking and pricing data, filters for valid entries, calculates maximum egress bandwidth considering vCPU limits, determines the Gbps per dollar ratio, and computes monthly pricing. The results are sorted by ratio to identify the best value instances.

```bash
jq -s '.[0] * .[1]' instance-pricing.json instance-networking.json \
| jq 'with_entries(select(.value | has("baseline") and has("price") and .price > 0.0))' \
| jq 'to_entries | map(.value |= . + {max_egress: (if .vcpus < 32 then ([.baseline, 5.0] | min) else .baseline / 2 end) }) | map(.value |= . + {ratio: (.max_egress / (.price | tonumber)), price_monthly: (.price * 730)}) | sort_by(.value.ratio) | from_entries' > instance-merged.json
```

--------------------------------

### Deploy fck-nat with CDK (Standard Mode)

Source: https://fck-nat.dev/stable/deploying

Deploy fck-nat in standard mode using CDK's built-in NatInstanceProviderV2. This configuration requires specifying the machine image for fck-nat.

```typescript
const natGatewayProvider = new NatInstanceProviderV2({
    instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.NANO),
    machineImage: new LookupMachineImage({
        name: 'fck-nat-al2023-*-arm64-ebs',
        owners: ['568608671756'],
    })
})
const vpc = new Vpc(this, 'vpc', {
    natGatewayProvider,
});
natGatewayProvider.securityGroup.addIngressRule(Peer.ipv4(vpc.vpcCidrBlock), Port.allTraffic());

```

--------------------------------

### Build Custom fck-nat AMI with Packer

Source: https://fck-nat.dev/stable

Build your own fck-nat AMI using Packer by specifying a custom variable file. This allows for customization of base image, region, and architecture.

```bash
packer build -var-file="your-var-file.pkrvars.hcl" ./packer/fck-nat.pkr.hcl
```

--------------------------------

### CloudFormation Template for fck-nat Deployment

Source: https://fck-nat.dev/stable/deploying

This template provisions the essential resources for fck-nat, including a network interface, IAM role and instance profile, launch template, auto-scaling group, and security group. It assumes a VPC with public and private subnets already exists.

```yaml
Parameters:
  VpcIdParameter:
    Type: AWS::EC2::VPC::Id
  SubnetIdParameter:
    Type: AWS::EC2::Subnet::Id
  CIDRParameter:
    Type: String
    Default: "10.0.0.0/16"
  FckNatAMIParameter:
    Type: AWS::EC2::Image::Id

Resources:
  FckNatInterface:
    Type: AWS::EC2::NetworkInterface
    Properties:
      Description: FckNat Gateway Interface
      SubnetId: !Ref SubnetIdParameter
      GroupSet:
        - !GetAtt [FckNatSecurityGroup, GroupId]
      SourceDestCheck: false
  FckNatAsgInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref FckNatRole
  FckNatLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    DependsOn: FckNatRole
    Properties:
      LaunchTemplateName: FckNatLaunchTemplate
      LaunchTemplateData:
        ImageId: !Ref FckNatAMIParameter
        InstanceType: t4g.nano
        NetworkInterfaces:
          - DeviceIndex: 0
            AssociatePublicIpAddress: true
            Groups:
            - !GetAtt [FckNatSecurityGroup, GroupId]
        IamInstanceProfile:
          Name: !Ref FckNatAsgInstanceProfile
        UserData:
          Fn::Base64: !Sub |
            #!/bin/bash
            echo "eni_id=${FckNatInterface}" >> /etc/fck-nat.conf
            service fck-nat restart
  FckNatAsg:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MaxSize: "1"
      MinSize: "1"
      DesiredCapacity: "1"
      LaunchTemplate:
        LaunchTemplateId: !Ref FckNatLaunchTemplate
        Version: !GetAtt FckNatLaunchTemplate.LatestVersionNumber
      VPCZoneIdentifier:
        - !Ref SubnetIdParameter
      Tags:
        - Key: Name
          Value: fck-nat
          PropagateAtLaunch: true
    UpdatePolicy:
      AutoScalingScheduledAction:
        IgnoreUnmodifiedGroupSizeProperties: true
  FckNatSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for FckNat
      SecurityGroupIngress:
        - CidrIp: !Ref CIDRParameter
          IpProtocol: "-1"
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          Description: Allow all outbound traffic by default
          IpProtocol: "-1"
      VpcId: !Ref VpcIdParameter
  FckNatRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
        Version: "2012-10-17"
      Policies:
        - PolicyName: AttachNatEniPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - ec2:AttachNetworkInterface
                  - ec2:ModifyNetworkInterfaceAttribute
                Effect: Allow
                Resource: "*"
            Version: "2012-10-17"
        - PolicyName: AssociateNatAddressPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - ec2:AssociateAddress
                  - ec2:DisassociateAddress
                Effect: Allow
                Resource: "*"
            Version: "2012-10-17"

```

--------------------------------

### Deploy fck-nat with Terraform Resources

Source: https://fck-nat.dev/stable/deploying

Manually deploy fck-nat using Terraform resources. This involves defining an AMI data source, a network interface, and an EC2 instance.

```terraform
data "aws_ami" "fck_nat" {
  filter {
    name   = "name"
    values = ["fck-nat-al2023-*"]
  }

  filter {
    name   = "architecture"
    values = ["arm64"]
  }

  owners      = ["568608671756"]
  most_recent = true
}

resource "aws_network_interface" "fck-nat-if" {
  subnet_id       = aws_subnet.subnet_public.id
  security_groups = [aws_default_security_group.default_security_group.id]

  source_dest_check = false
}

resource "aws_instance" "fck-nat" {
  ami           = data.aws_ami.fck_nat.id
  instance_type = "t4g.nano"

  network_interface {
    network_interface_id = aws_network_interface.fck-nat-if.id
    device_index         = 0
  }
                                                                             
}

```

--------------------------------

### Deploy fck-nat with CDK (High Availability)

Source: https://fck-nat.dev/stable/deploying

Use this TypeScript CDK construct to deploy fck-nat in high-availability mode. It automatically configures routing and ensures a new instance is launched if the current one terminates.

```typescript
const natGatewayProvider = new FckNatInstanceProvider({
    instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.NANO),
});
const vpc = new Vpc(this, 'vpc', {
    natGatewayProvider,
});
natGatewayProvider.securityGroup.addIngressRule(Peer.ipv4(vpc.vpcCidrBlock), Port.allTraffic());

```

--------------------------------

### CloudWatch Agent Configuration for fck-nat Metrics

Source: https://fck-nat.dev/stable/features

This configuration enables the CloudWatch agent to collect network, netstat, ethtool, and memory metrics for fck-nat instances. Ensure you are aware of CloudWatch metrics costs before enabling.

```json
{
  "agent": {
    "metrics_collection_interval": 60,
    "run_as_user": "root",
    "usage_data": false
  },
  "metrics": {
    "namespace": "fck-nat",
    "metrics_collected": {
      "net": {
        "resources": ["ens5", "ens6"],
        "measurement": [
          { "name": "bytes_recv", "rename": "BytesIn",  "unit": "Bytes" },
          { "name": "bytes_sent", "rename": "BytesOut",  "unit": "Bytes" },
          { "name": "packets_sent", "rename": "PacketsOutCount",  "unit": "Count" },
          { "name": "packets_recv", "rename": "PacketsInCount",  "unit": "Count" },
          { "name": "drop_in", "rename": "PacketsDropInCount",  "unit": "Count" },
          { "name": "drop_out", "rename": "PacketsDropOutCount",  "unit": "Count" }
        ]
      },
      "netstat": {
        "measurement": [
          { "name": "tcp_syn_sent", "rename": "ConnectionAttemptOutCount",  "unit": "Count" },
          { "name": "tcp_syn_recv", "rename": "ConnectionAttemptInCount",  "unit": "Count" },
          { "name": "tcp_established", "rename": "ConnectionEstablishedCount",  "unit": "Count" }
        ]
      },
      "ethtool": {
        "interface_include": ["ens5", "ens6"],
        "metrics_include": [
          "bw_in_allowance_exceeded",
          "bw_out_allowance_exceeded",
          "conntrack_allowance_exceeded",
          "pps_allowance_exceeded"
        ]
      },
      "mem": {
        "measurement": [
          { "name": "used_percent", "rename": "MemoryUsed",  "unit": "Percent" }
        ]
      }
    },
    "append_dimensions": {
      "InstanceId": "${aws:InstanceId}",
      "AutoScalingGroupName": "${aws:AutoScalingGroupName}"
    }
  }
}
```
Tokens:
Raw