LAB 54 (Service Gateway (SGW) testing )

Service Gateway

A Service Gateway in Oracle Cloud Infrastructure (OCI) enables resources inside a Virtual Cloud Network (VCN) to privately access Oracle services without traversing the public Internet.

With a Service Gateway, instances in a Private Subnet can connect to services such as Object Storage using only private IP addresses. All traffic remains within Oracle’s private backbone network, improving both security and performance.

Why Do We Need a Service Gateway?

In many enterprise environments, application servers are deployed in private subnets without public IP addresses. These servers often need secure access to Oracle services for tasks such as:

Storing application backups in Object Storage

Downloading files or packages from Object Storage

Accessing supported Oracle services without Internet exposure

Without a Service Gateway, traffic would need to flow through an Internet Gateway or NAT Gateway, which introduces unnecessary Internet traversal. A Service Gateway provides a private, secure, and efficient path to Oracle services.

Real-World Example

Scenario:

• An application server is deployed in a private subnet.

• Daily backups must be stored in OCI Object Storage.

• The server has no public IP.

Solution:

A Service Gateway is configured, allowing backup traffic to flow securely within Oracle’s private network:

Application Server
       │
       ▼
Service Gateway
       │
       ▼
Object Storage

The backup data never leaves Oracle’s internal network.

Key Benefits

• Private access to Oracle services

• No public IP required

• Traffic does not traverse the Internet

• Enhanced security and compliance

• Commonly used for Object Storage backups and log archival

• Ideal for resources in private subnets

NAT Gateway vs Service Gateway

                 OCI REGION

        +--------------------------+
        |      Object Storage      |
        +------------+-------------+
                     ^
                     |
             Service Gateway
                     ^
                     |
      +----------------------------+
      |     Private Subnet         |
      |                            |
      |  Application Server        |
      |  (No Public IP)            |
      +----------------------------+

Traffic remains within Oracle’s private network — no Internet exposure.

Steps to configure Service Gateway

Step 1 Login to the server

Login to the Private Instance through the Hub/Jump Host.

From the HUB Host, connect to the Private Instance:

ssh -i <private-key> opc@<private-instance-private-ip>

Step 2 – Verify the Backup Files

After logging in to the Private Instance, verify the existing backup files.

ls -lrth

Step 3 – Push the Backup Files to the Bucket

oci os object put -bn <bucket_name> --file <file_path>

oci os object put -bn bucket-20260812-2252 --file scripts06092026.tar

Expected Result:

The backup file upload fails because the Private Instance does not currently have connectivity to Object Storage through the Service Gateway.

Step 4 – Check the Route Table

Check the Route Table associated with the Private Subnet to verify whether a route to the Oracle Services Network through the Service Gateway is configured.

In OCI Console: VCN → Private Subnet → Route Table → Route Rules

The required Service Gateway route is not present in the Route Table.

Step 5 – Create the Service Gateway

Create a Service Gateway in the VCN.

In OCI Console: VCN → Resources → Service Gateways → Create Service Gateway

Select:

Name: asus_sgw

Services: All <Region> Services in Oracle Services Network

The Service Gateway is created successfully and its status shows Available.

Step 6 – Configure the Route Table

Configure the Route Table associated with the Private Subnet to use the Service Gateway.

In OCI Console: VCN → Private Subnet → Route Table → Route Rules → Add Route Rules

Add the following route:

Destination Type: Service

Destination: All <Region> Services in Oracle Services Network

Target Type: Service Gateway

Target: asus_sgw

Description: Allow access to OCI Services through Service Gateway

Step 7 – Push the Backup Files to the Bucket

After configuring the Service Gateway and adding the required route to the Route Table, upload the backup file from the Private Instance to the Object Storage bucket using the OCI CLI.

oci os object put -bn <bucket_name> --file <file_path>

oci os object put -bn bucket-20260812-2252 --file /tmp/scripts06092026.tar

After configuring the Service Gateway and the required Route Table rule, the Private Instance successfully accessed Object Storage and the backup file was uploaded successfully.

Step 8 – Verify the Backup File in the Object Storage Bucket

Verify that the backup file has been successfully uploaded to the Object Storage bucket.

In OCI Console: Object Storage → Buckets → Select the Bucket → Objects

Check whether the uploaded backup file is present in the bucket.

Expected Result:

The backup file should be visible in the Object Storage bucket with the correct file name and size.