Networking
CIDR Allocation Overview
RaaS AWS network space is divided into several ranges, each serving a specific purpose:
| Range | Purpose |
|---|---|
172.16.128.0/18 |
Management accounts |
172.31.0.0/16 |
Development |
10.136.0.0/16 |
US production customers |
10.138.0.0/16 |
EMEA production customers |
10.140.0.0/16 |
APAC production customers |
10.104.29.0/24 |
HSCN IPAM (management account side) |
Management Account Space
| Account | CIDR | Notes |
|---|---|---|
| raas-uk management | 172.16.140.0/22 |
EU management VPC |
| raas-us management | 172.16.144.0/22 |
US management VPC |
| raas-uk routing | 172.16.191.0/24 |
UK HSCN routing infrastructure |
EMEA Production Customers (10.138.0.0/16)
| Customer code | CIDR | Notes |
|---|---|---|
| synlab | 10.138.0.0/23 |
|
| westherts | 10.138.2.0/23 |
|
| uk | 10.138.4.0/23 |
|
| uk-hscn | 10.138.8.0/25 |
|
| thechristie | 10.138.12.0/23 |
|
| beh | 10.138.14.0/24 |
|
| camdenisling | 10.138.15.0/24 |
|
| lincolnshire | 10.138.19.0/24 |
|
| nwas | 10.138.25.0/24 |
|
| tavistock | 10.138.28.0/24 |
|
| westhscn | 10.138.29.0/25 |
HSCN IPAM (10.104.29.0/24)
These addresses are management account HSCN infrastructure — the termination nodes and customer VPN endpoints that sit on the HSCN side.
| Resource | IP / Range | Notes |
|---|---|---|
| uk-hscn | 10.104.29.128 |
|
| hscn-customer-vpn-endpoint | 10.104.29.18 |
|
| VPN Termination Node 1 (primary) | 10.104.29.4 |
StrongSwan node 1 |
| VPN Termination Node 2 (standby) | 10.104.29.20 |
StrongSwan node 2 |
| westherts (prod/test) | 10.104.29.64/29 |
prod: .64, test: .65 |
| camdenisling (prod/test/dev) | 10.104.29.72/29 |
prod: .72, test: .73, dev: .74 |
| thechristie (prod/test/dev) | 10.104.29.80/29 |
prod: .80, test: .81, dev: .82 |
| lincolnshire (prod/dev/test) | 10.104.29.88/30 |
prod: .88, dev: .89, test: .90 |
VPN Routing
Standard Customers
Standard (non-HSCN) customers connect via AWS managed site-to-site VPN to a VPN Gateway in their customer account. Traffic flows:
HSCN Customers
HSCN customers connect via the HSCN private WAN through Redcentric, then via IPsec to the StrongSwan termination nodes in the management account. Traffic flows:
NHS Trust systems → HSCN WAN → Redcentric → IPsec VPN →
StrongSwan (10.104.29.4 or .20) → Transit Gateway →
Customer VPC → Rhapsody
Routes in the HSCN customer VPC are managed via the hscn-connection-stack repo. See HSCN VPN Operations → Updating Routes.
Subnet Layout
A standard RaaS customer VPC typically contains:
| Subnet | Purpose | Example CIDR |
|---|---|---|
| Public | Proxy instances, VPN endpoints | 10.x.0.0/24 |
| Private — Prod | Rhapsody prod instance | 10.x.1.0/24 |
| Private — NonProd | Rhapsody nonprod instance | 10.x.2.0/24 |
| Secondary AZ | HA failover | 10.x.3.0/24 |
The secondary AZ subnet is required so the Auto Scaling Group can launch a replacement instance in a different zone if the primary fails.
Transit Gateway
| Resource | ID |
|---|---|
| HSCN Transit Gateway | tgw-039e174fce8f69655 |
| HSCN TGW Route Table | tgw-rtb-09351fe404a1a0891 |
The TGW connects the management VPC to all HSCN customer VPCs. Route propagation is managed via Terraform in the hscn-connection-stack repo.