{"id":8101,"date":"2022-04-04T20:32:50","date_gmt":"2022-04-04T20:32:50","guid":{"rendered":"https:\/\/www.use-snip.com\/kb\/?post_type=ht_kb&p=8101"},"modified":"2024-12-14T16:41:32","modified_gmt":"2024-12-14T16:41:32","slug":"setting-ips-for-aws-deployments","status":"publish","type":"ht_kb","link":"https:\/\/www.use-snip.com\/kb\/knowledge-base\/setting-ips-for-aws-deployments\/","title":{"rendered":"Setting IPs for AWS deployments"},"content":{"rendered":"

This article covers how to set IP values for an AWS virtual machine (VM) deployments as well as what firewall rules are needed for your SNIP<\/strong> <\/span>NTRIP Caster<\/a> to get and send data.\u00a0\u00a0 While these instructions are for Amazon Web Services (AWS) machines, the process is very similar for other VM vendors<\/p>\n

Background<\/h2>\n

It is very common to host a SNIP<\/strong> <\/span>NTRIP Caster on a leased virtual machine (VM).\u00a0 This is an easy way to place your network on the public internet and to obtain a static IP so others (your end users) can find your Caster.\u00a0 This configuration, once set up, is very reliable and inexpensive (~$60\/mth).\u00a0 For many businesses it is a preferable (and cost effective) over additional monthly fees for a static IP from their local ISP vendor.\u00a0 Some larger firms select a VM deployment over an in-house one simply because their IT staff does not want to open a port to outside users.<\/p>\n

AWS offer a large number of host machine configurations to select from, as well as dozens of world-wide regional deployment locations where the actual hardware will reside.\u00a0 Simply select a region near your base of users.\u00a0 [Aside:<\/em><\/span> The additional small latency which a more distant region causes is typically of little concern in NTRIP operations.\u00a0 And RTCM messages are time tagged to overcome this.]\u00a0 Select any instance type that has has least two<\/strong> cores and 4G of memory. SNIP<\/span> <\/strong>has been optimized to use 2 or more cores. Do not select the single core instances that “sleep” when there is no processing to be done.\u00a0 Such a machine is of no value for NTRIP where the data is arriving on a 24×7 basis every second.\u00a0 See this article<\/a> for further details on minimum system requirements.\u00a0 Consider also creating an “Elastic IP<\/a>” so that the assigned IP value you are given will not change if the machine instance is ever restarted.
\n<\/span><\/p>\n

In general, you will want to select a “t2.medium” instance to run.\u00a0\u00a0 This provides an AMD64 architecture with 4GB of memory and more than enough network performance to support thousands of users.\u00a0 If your concurrent connected bases will exceed 500+ devices, you may want to upgrade to a “t2.large” instance for the additional memory it provides.<\/p>\n

The size of the machine you select (and hence the monthly cost) will also depend on what other services you run on the host machine.\u00a0 If, for example, you will run a WordPress web site<\/a> on the same machine, you many need to increase the machine size to accommodate this.<\/p>\n

The account you create with AWS to control your host machine(s) is in no way shared with SNIP<\/strong> <\/span>or our support staff.\u00a0 If we need to assist you with technical support, we can simply watch your machine using Teamviewer<\/a> when you allow us to do so.\u00a0 Protect your account details, as well as the PEM file you are given with the initial passwords.<\/p>\n

The IP settings dialog<\/strong><\/h2>\n

The host machine that SNIP<\/strong> <\/span>resides on has no understanding of the internet nor how to reach it.\u00a0 Nor does it know how other machines reach it (what IP or URL they used).\u00a0 The IP Settings Dialog<\/a> is used to set these values, mapping the values entered to hyperlinks in various reports that SNIP<\/strong><\/span> creates and sends to others.<\/p>\n

\"\"<\/a><\/p>\n

In an AWS deployment environment, you must enter both the “public” IP of the host machine in the below dialog (click to enlarge), as well as the actual machine IP of the network card that the host sees.\u00a0 You may also wish to enter a URL name string if you have registered this IP with a DNS (Domain Name Server).\u00a0 Press the IP map<\/strong> button to open this dialog. \u00a0 [Aside:<\/em><\/span> You must also open the correct firewall posts on both the host machine and in the AWS control panel. This is covered in the next steps. This is similar to the process used with a home-based deployment; you must open ports on the host machine and also on the DSL router device provided by your ISP.\u00a0 And the port forwarding must route the traffic to the port that SNIP<\/strong> <\/span>is listening on at the host machine. ]<\/p>\n

The background image of the AWS desktop will display the key values you need in the upper right corner.\u00a0 These can also be found listed in the EC2 Management Console (the dashboard<\/em>) for each instance.\u00a0\u00a0 Here is a screen image for the above machine.<\/p>\n

\"\"<\/a><\/p>\n

WARNING<\/span>: Do not set the machine IP value to be “127.0.0.1”\u00a0 (LOCALHOST). This simply will not work and SNIP<\/span> will not receive any connections.\u00a0 Use the actual host machine value.<\/b><\/p>\n

Set these values to match your own machine and save.\u00a0 If you have created a DNS entry for this IP on a domain, enter that as well.<\/p>\n

Debugging Advice<\/strong>: When you toggle between the Connect<\/strong><\/em> and Disconnect<\/strong><\/em> buttons, you will see the text “Listening<\/em>” and “Offline<\/em>” displayed.\u00a0 If you press Connect<\/em> and do not see Listening<\/em>, then SNIP<\/strong><\/span> was unable to take control of the indicated network IP and port.\u00a0 The console log will display error messages about this, the most common case being an incorrectly typed entry.\u00a0 When SNIP<\/strong> <\/span>is displaying Listening<\/em>, then you will see any connection events in the console log\u00a0 [Set the log threshold to “Minor” and check the box marked Show Protocol Details<\/em>. See also this article<\/a>.] No console entries indicates no one is managing to connect, which in turn suggests a firewall issue needs to be resolved.<\/p>\n

Before any connection can occur, we must ensure that two different firewalls are set to allow in-bound connections; this is covered next.<\/p>\n

The Host machine firewall<\/h2>\n

Your AWS instance contains a firewall, which (like most firewalls) defaults to not allowing inbound traffic. You must add a new “rule” that tells the firewall to allow such traffic.\u00a0 You can add this rule in several ways, and you can also limit its application to specific programs.\u00a0 Here we simply open port 2101 (use whatever port you will have SNIP<\/strong><\/span> listen on) for TCP style traffic.\u00a0 [Aside:<\/em> NTRIP uses TCP style packets and not UDP for its traffic]<\/p>\n

Proceed as follows.\u00a0 Log on to the host machine desktop, press the windows “start” button and type “Firewall” – select the program Windows Defender Firewall<\/strong>. Press the Advanced setting<\/strong> button (along the left side, bottom) to get to the actual program.\u00a0 You will see a dialog similar to the below.<\/p>\n

\"\"<\/a><\/p>\n

Press “Inbound Rules” found in the left hand column tree-view and the display will change to list the existing rules as shown below. [In the below image the SNIP<\/strong> <\/span>NTRIP rules have already been added, on your own machine other rules will be shown. ] The default setup has several dozen pre-configured rules. The presence of a green check mark indicates that a rule is activated.<\/p>\n

\"\"<\/p>\n

We must add a new rule for in-bound TCP traffic to support NTRIP.\u00a0 Press the “New Rule…<\/strong>” button found at the right side under Actions<\/strong>.\u00a0 This bring up a multiple step dialog guide you over completing the rule.<\/p>\n

The first step is what the basic type of rule will be, select Port<\/strong> and click next…<\/p>\n

\"\"<\/p>\n

The next step specifies what protocol and ports are involved.\u00a0 Select TCP<\/strong> and enter the port SNIP<\/strong><\/span> will be a listener on (typically 2101), and press next…<\/p>\n

Aside:\u00a0<\/em> If you will be using SNIP<\/strong><\/span> as an AVL server, enter that port here as well (typically 5012).\u00a0 If you will be using Raw TCP\/IP connections, enter those ports as well (typically 3000~3010).\u00a0 You can also enter these as individual rules if desired.<\/p>\n

\"\"<\/p>\n

The next step specifies what action is to be taken when there is traffic on the indicated port(s).\u00a0 Set the radio button for Allow the Connection<\/strong> and press next…<\/p>\n

\"\"<\/p>\n

The next step specifies where to apply the rule.\u00a0 Check all the buttons shown (as you want to rule applied for all connections) and press next…<\/p>\n

\"\"<\/p>\n

The final step specifies what name the rule is to be given (and an optional description).\u00a0 You can enter anything you like here but we suggest “SNIP NTRIP Allowed 2101” or something similar.\u00a0 Press finish when done. The new rule is effective immediately.<\/p>\n

The AWS firewall<\/h2>\n

In addition to the host machine firewall the AWS environment provides another firewall we must open to allow in-bound traffic.\u00a0 This is done using the AWS EC Dashboard panel to configure the security settings to be used.<\/p>\n

Proceed as follows.\u00a0 Log on to your AWS account and the AWS EC Dashboard. The top part of the display shows all your instances.\u00a0 You will have one entry here for each machine you have configured in the current region.\u00a0 You may need to change regions (menu at the very top along right side) to see the machine you want.\u00a0 Once you find the instance, select it with the blue check box along to left side.\u00a0 This causes the tabs with the “description” detail in the lower half of the page to be updated to this machine.<\/p>\n

When you created the host machine instance you assigned it to a “security group” which we will now edit.\u00a0 The name of the security group was whatever you selected, but a default name like xxx-launch-wizard-1<\/em> is common.\u00a0 You can find the security group shown (as a hyperlink) in the table in the upper section (if you scroll right) or in the lower section (in the section called ‘security groups’). In any event, click that to bring up the set of rules being used.\u00a0 You will again see a double layout style display with the sets of security groups (perhaps only one) at the top and a set of tabs below.\u00a0\u00a0 Select the tab marked “Inbound rules” to see the existing rules associated with this group.<\/p>\n

Your display will look something like this now. [In the below image the SNIP<\/strong><\/span> NTRIP rules have already been added, on your own machine other rules will be shown. (And the IP6 rule shown in not in fact needed)]<\/p>\n

\"\"<\/a><\/p>\n

Press the button marked Edit inbound rules<\/strong>\u00a0 (upper right corner) and you will be presented with a more readable table of this same data which you can edit when needed.\u00a0 At the very bottom of the page you will now see the button Add rule<\/strong>.\u00a0 Press this and a new “empty” rule will appear which you can edit.<\/p>\n

\"\"<\/a><\/p>\n

Fill out the entries as shown below.<\/p>\n

\"\"<\/a><\/p>\n

Press Save Rules<\/strong> at the very bottom of the page.\u00a0 AWS will assign a unique rule number to the rule and validate it.\u00a0 The new rule is effective after a short delay (perhaps a minute).<\/p>\n

Your Caster should now receive and reply to any traffic from others on the public internet.<\/p>\n

How can I test it?<\/h2>\n

Use our monitoring tool at http:\/\/monitor.use-snip.com\/<\/a> to check.\u00a0 Enter either the DNS name or the IP you entered above, and the public port.\u00a0 If your NTRIP Caster can be reached from the public internet, this tool will report on the Caster table it sends back.\u00a0 If it is unable to find a table (after a time out period it reports an error) then your Caster is not yet visible to others outside of your local environment.<\/p>\n","protected":false},"excerpt":{"rendered":"

This article covers how to set IP values for an AWS virtual machine (VM) deployments as well as what firewall rules are needed for your SNIP NTRIP Caster to get and send data.\u00a0\u00a0 While these instructions are for Amazon Web Services (AWS) machines, the process is very similar for other […]<\/p>\n","protected":false},"author":13,"comment_status":"open","ping_status":"closed","template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"ht-kb-category":[115],"ht-kb-tag":[514,515,183,190],"class_list":["post-8101","ht_kb","type-ht_kb","status-publish","format-standard","hentry","ht_kb_category-getting-started","ht_kb_tag-aws","ht_kb_tag-firewall","ht_kb_tag-ip","ht_kb_tag-setup"],"_links":{"self":[{"href":"https:\/\/www.use-snip.com\/kb\/wp-json\/wp\/v2\/ht-kb\/8101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.use-snip.com\/kb\/wp-json\/wp\/v2\/ht-kb"}],"about":[{"href":"https:\/\/www.use-snip.com\/kb\/wp-json\/wp\/v2\/types\/ht_kb"}],"author":[{"embeddable":true,"href":"https:\/\/www.use-snip.com\/kb\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/www.use-snip.com\/kb\/wp-json\/wp\/v2\/comments?post=8101"}],"version-history":[{"count":22,"href":"https:\/\/www.use-snip.com\/kb\/wp-json\/wp\/v2\/ht-kb\/8101\/revisions"}],"predecessor-version":[{"id":9235,"href":"https:\/\/www.use-snip.com\/kb\/wp-json\/wp\/v2\/ht-kb\/8101\/revisions\/9235"}],"wp:attachment":[{"href":"https:\/\/www.use-snip.com\/kb\/wp-json\/wp\/v2\/media?parent=8101"}],"wp:term":[{"taxonomy":"ht_kb_category","embeddable":true,"href":"https:\/\/www.use-snip.com\/kb\/wp-json\/wp\/v2\/ht-kb-category?post=8101"},{"taxonomy":"ht_kb_tag","embeddable":true,"href":"https:\/\/www.use-snip.com\/kb\/wp-json\/wp\/v2\/ht-kb-tag?post=8101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}