Network Setup

This page provides detailed configuration instructions for setting up Direct Market Access (DMA) network connectivity to the Bitnomial Exchange.

AWS PrivateLink

AWS PrivateLink allows the exchange to share an AWS Network Load Balancer (NLB) with another AWS account easily.

The exchange needs the DMA participant's AWS account ID and the DMA participant needs the exchange's VPC Endpoint service name and ports for the various services. Contact help@exchange.bitnomial.com to exchange this information.

1. Exchange adds DMA participant's AWS account to the list of authorized AWS accounts on the PrivateLink service
2. The DMA participant adds an Interface type VPC Endpoint with the exchange's VPC Endpoint service name to their VPC with an appropriate security group.

AWS Direct Connect

AWS Direct Connect allows DMA participants to connect to AWS from their private datacenter over a fiber connection. Contact help@exchange.bitnomial.com to learn more about the AWS Direct Connect onboarding

VPC Peering

DMA participants can use AWS VPC Peering to peer DMA participant VPCs with Bitnomial VPCs.

1. Bitnomial assigns VPC CIDR block and Availability Zone to the DMA participant.
2. The participant reports VPC ID and AWS Account ID to Bitnomial.
3. Bitnomial sends peering request to the participant, and reports request ID to the participant.
4. Participant accepts peering request and creates route to Bitnomial subnet.

Example VPC Peering Values

The tables below outlines example values for what information needs to be exchanged.

From the participant to Bitnomial:

From Bitnomial to the participant:

VPN

Customer DMA connectivity is provided via an IPsec VPN using BGP routing. A primary and backup tunnel are provided for fail-over redundancy.

To establish a VPN connection (4 steps):

1. Customer Information Gathering

The customer reports the intended public IP address of the VPN server to Bitnomial.

2. Bitnomial VPN Configuration

Bitnomial provisions customer access and the VPN connection and reports the primary and backup tunnel IP addresses to the customer. Primary and backup pre-share keys will be communicated via a conference call set up by Bitnomial.

3. Customer VPN Configuration

The customer configures Primary/Backup Tunnels Phase 1 (IKE) with the following information:

The customer configures Primary/Backup Tunnels Phase 2 (IPsec) with the following information:

4. VPN Tunnel Confirmation

Both Bitnomial and the customer confirm primary and backup tunnel statuses are UP.

Routing

Bitnomial uses static IP routing and address blocks to avoid overlapping IP addresses (per RFC 1918). Customers assign hosts within the assigned range. For example, a customer may be assigned a CIDR Block of the form 10.192.5.0/24.

Firewalls need to allow TCP traffic from the order entry gateway/pricefeed IPs and ports that have been allocated. Customers can test exchange connectivity by attempting to login to their order entry gateway/pricefeed.

Note: ICMP messages (pings) are disabled.