Raja's Exocortex

Alpine Linux VPC Gateway Setup

#TODO: requires testing of all the below instructions, esp fw-on.sh.

Introduction

vpcgw is the exit gateway between the tenant VPC environment and external networks. The vpcgw has two NICs - External and Internal and it provides the below functions:

  1. Provides SNAT for all VPC traffic that is exiting to external networks (LAN to WAN)
  2. Exposes internal VPC services to external networks via DNAT rules (WAN to LAN).

SNAT and DNAT packet mangling is performed using iptables.

vpcgw VM is configure with two NICs:

  1. External NIC (EXT_IF) connected to upstream firewall . EXT_IF network has a dynamic IP assigned via DHCP in the border edge network.
  2. Internal NIC (INT_IF) connected to VPC network. INT_IF is the gateway for all VPC VMs and has static IP 10.10.10.1.

The VPC LAN is assumed to be 10.10.10.0/24 for all tenant VPC networks. As tenant VPCs are isolated on Layer 2, there is no problem using the same 10.10.10.0/24 network subnet for all VPCs at the same time.

The Border Edge LAN that connects vpcgw to external networks is assumed to be 192.168.250.0/24 with upstream firewall at 192.168.250.1. The fw-on.sh script ensures EXT_IF traffic originates only from WAN/firewall and not from other vpcgw routes on the border edge network.

Step 1: Setup Alpine Linux MicroVM

Install alpine-linux-microvm and install iptables.

Step 2: Enable IP Forwarding in sysctl

# Filename: /etc/sysctl.d/local.conf
#
# Enable ip forwading
net.ipv4.ip_forward=1

Step 3: Install iptables

apk add --no-cache iptables  # install iptables package
rc-update add iptables       # start iptables on boot

rc-service iptables save     # write iptables rules to disk
rc-service iptables start

Step 4: iptables Rule Set for vpcgw

#!/bin/sh
#
# iptables firewall script for vpcgw
# Filename: /usr/local/sbin/fw-on.sh
#
# SNAT all INT_IF traffic to EXT_IF IP
# DNAT EXT_IF ports to predefined internal IP/port
# Assumes LAN subnet is 10.10.10.0/24
#         Border Edge subnet is 192.168.250.0/24

IPTABLES=/usr/sbin/iptables
EXT_IF=eth0
INT_IF=eth1

set -x

# Reset iptables
$IPTABLES -P INPUT   ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT  ACCEPT
$IPTABLES -t nat    -F
$IPTABLES -t mangle -F
$IPTABLES -F
$IPTABLES -X

# IPTABLES POLICY START

# Permit established traffic
$IPTABLES -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -m conntrack --ctstate INVALID -j DROP

# Permit all traffic to the loopback interface
$IPTABLES -A INPUT -i lo -j ACCEPT

# Drop traffic between different vpcgw in the border edge network
# vpcgw accept traffic only from firewall or WAN networks, not from within border edge network
$IPTABLES -A INPUT -i $EXT_IF -s 192.168.250.1    -j ACCEPT -m comment --comment "Permit traffic from firewall"
$IPTABLES -A INPUT -i $EXT_IF -s 192.168.250.0/24 -j DROP   -m comment --comment "Drop all other border edge network traffic"

# Permit all ICMP traffic
$IPTABLES -A INPUT -p icmp -j ACCEPT

## DNAT RULES

# DNAT support services
$IPTABLES -t nat -A PREROUTING -i $EXT_IF -p tcp --dport  31 -j DNAT --to-destination 10.10.10.31:53   -m comment --comment "coredns"
$IPTABLES -t nat -A PREROUTING -i $EXT_IF -p udp --dport  31 -j DNAT --to-destination 10.10.10.31:53   -m comment --comment "coredns"

# DNAT Win11 VMs published over RDP and noVNC
$IPTABLES -t nat -A PREROUTING -i $EXT_IF -p tcp --dport  51 -j DNAT --to-destination 10.10.10.51:3306 -m comment --comment "RDP"
$IPTABLES -t nat -A PREROUTING -i $EXT_IF -p tcp --dport  52 -j DNAT --to-destination 10.10.10.52:8443 -m comment --comment "noVNC"

# #TODO add more DNAT rules as required

# DNAT Ubuntu VMs published over kasmVNC
$IPTABLES -t nat -A PREROUTING -i $EXT_IF -p tcp --dport  71 -j DNAT --to-destination 10.10.10.71:8443 -m comment --comment "kasmVNC"

# #TODO add more DNAT rules as required


# Drop all other traffic
#$IPTABLES -A INPUT -m limit --limit 10/min -j LOG --log-prefix "iptables-drop-INPUT:"
$IPTABLES -P INPUT DROP

# NAT all LAN traffic to internet
$IPTABLES -t nat -A POSTROUTING -s 10.10.10.0/24 -o $EXT_IF -j MASQUERADE

Step 5: Persisting Changes

/usr/local/sbin/fw-on.sh    # load new iptables ruleset
rc-service iptables save    # Persist ruleset across reboots