Page tree
Skip to end of metadata
Go to start of metadata

You can set up your virtual server configuration so that it can function as a gateway for the network interface. Such a configuration overrides firewall rules and accepts all traffic to the VS from the selected network interface. This functionality provides the ability for third party gateways and load balancers to be used as OnApp virtual server.

For the VS to function as a gateway at least two IPs are required: one private and one public. A VS cannot be used as a gateway for a network interface if the network interface does not contain IPs or if it contains only public IPs.

To use a virtual server as a gateway for a network interface:

  1. Go to Control Panel > Virtual Servers > Label > Networking > Firewall. On the page that loads the Default firewall rules section displays the list of network interfaces for which this VS can function as a gateway.
  2. Select the command for the network interface, it can be either ACCEPT or DROP. If you select the DROP option, the Use as Gateway slider will become inactive, but you can save the configuration and all the traffic from the network interface will be dropped.
  3. Move the Use as Gateway slider to the right if you want the VS to function as a gateway for the network interface.
  4. Click the Save Default Firewall Rules button to apply changes.

    The configurations in steps 5 and 6 are only examples that were tested on CentOS 6. You can use them at your own risk. You may require different configurations for other operating systems.

  5. Add the following commands in the console of the gateway VS:

    echo 1 > /proc/sys/net/ipv4/ip_forward
    iptables -t nat -A POSTROUTING -s IP_range ! -d IP_range -o public_network_interface_name -j MASQUERADE
    iptables -I FORWARD -i private_network_interface_name -o public_network_interface_name -j ACCEPT
    iptables -I FORWARD -o public_network_interface_name -i private_network_interface_name -j ACCEPT

    Where you need to indicate the range of IPs for which the VS will serve as a gateway and the name of the public and private network interfaces for the gateway VS. The IP range should contain only the IPv4 IPs (e.g. 10.10.10.0/24).

  6. Add the following commands in the console of the VS that is to send traffic through the gateway VS:

    route delete -net default
    route add -net default gw gateway_VS_IP

    Where you need to indicate the IP of the gateway VS for this server.

 

You can view the list of virtual servers that are used as gateways on a compute resource by going to Control Panel > Settings > Compute Resources > Label > Tools > Gateway Servers. The page that loads shows the list of gateway servers on a compute resource with their details.

 

When you set default firewall rules for a VS two additional iptables rules are added on the compute resource on which the VS is built. The iptables rules will contain the range of IPs for which the VS will serve as a gateway and the identifier of the gateway VS:

iptables -A FORWARD -s IP_range ! -d IP_range -m physdev --physdev-out gateway_VS_identifier -j gateway_VS_identifier
iptables -A FORWARD ! -s IP_range -d IP_range -m physdev --physdev-in gateway_VS_identifier -j ACCEPT gateway_VS_identifier

 

 

  • No labels