Contact UsGet started

Implementing a secure high-availability network infrastructure with a dedicated DMZ based on the next-generation firewall

Written by
Updated at November 14, 2024

Using this tutorial, you will deploy a high-availability fail-safe network infrastructure with a dedicated DMZ segment and comprehensive protection based on the Next-Generation Firewall. The infrastructure elements are hosted in two availability zones and grouped by purpose into individual folders. This solution enables you to publish generally available web resources, such as front-end applications, in a DMZ that is isolated from the internal infrastructure and ensures security and high availability of the entire perimeter.

The solution diagram is given below.

The solution has the following basic segments (folders):

  • The public folder contains Application Load Balancer to enable public access from the internet to applications published in the DMZ.
  • The mgmt folder is designed for hosting NGFWs and cloud infrastructure management resources. It includes two VMs with firewalls (fw-a and fw-b), a VM of the centralized firewall management server (mgmt-server), and a VM for accessing the VPN-based control segment (jump-vm).
  • The dmz folder enables you to publish applications with public access from the internet.
  • The app and database folders can be used to host the business logic of applications (in this tutorial, no VMs are placed there).

For more information, see the project repository.

To deploy a secure high-availability network infrastructure with a dedicated DMZ based on the Next-Generation Firewall:

  1. Prepare your cloud.
  2. Prepare the environment.
  3. Deploy your resources.
  4. Set up firewall gateways.
  5. Enable the route-switcher module.
  6. Test the solution for performance and fault tolerance.

If you no longer need the resources you created, delete them.

Prepare your cloud

Sign up for Yandex Cloud and create a billing account:

  1. Go to the management console and log in to Yandex Cloud or create an account if you do not have one yet.
  2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one.

If you have an active billing account, you can go to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

The infrastructure support cost includes:

Required quotas

Warning

The tutorial involves deploying a resource-intensive infrastructure.

Make sure your cloud has sufficient quotas not being used by resources for other jobs.

Amount of resources used by the tutorial
Resource Amount
Folders 7
Instance groups 1
Virtual machines 6
VM vCPUs 18
VM RAM 30 GB
Disks 6
SSD size 360 GB
HDD size 30 GB
Cloud networks 7
Subnets 14
Route tables 4
Security groups 10
Static public IP addresses 2
Public IP addresses 2
Static routes 17
Buckets 1
Cloud functions 1
Triggers for cloud functions 1
Total RAM for all running functions 128 MB
Network load balancers (NLB) 2
NLB target groups 2
Application load balancers (ALB) 1
ALB backend groups 1
ALB target groups 1

Prepare the environment

The tutorial uses Windows software and the Windows Subsystem for Linux (WSL).
The infrastructure is deployed using Terraform.

Configure WSL

  1. Check if WSL is installed on your PC. To do this, run the following command in the CLI terminal:

    wsl -l

    If WSL is installed, the terminal will display a list of available distributions, for example:

    Windows Subsystem for Linux Distributions:
docker-desktop (Default)
docker-desktop-data
Ubuntu

  2. If WSL is not installed, install it and repeat the previous step.

  3. In addition, you can install on WSL a familiar Linux distribution, e.g., Ubuntu.

  4. To make the installed distribution the default system, run:

    wsl --setdefault ubuntu

  5. To switch the terminal to the Linux subsystem operation mode, run:

    wsl ~

Note

All the steps described below are completed in the Linux terminal.

Create a service account with the admin privileges for the cloud

  1. In the management console, select the folder where you want to create a service account.

  2. In the list of services, select Identity and Access Management.

  3. Click Create service account.

  4. Enter a name for the service account, e.g., sa-terraform.

    The name format requirements are as follows:

    • The name must be from 3 to 63 characters long.
    • It may contain lowercase Latin letters, numbers, and hyphens.
    • The first character must be a letter and the last character cannot be a hyphen.

  5. Click Create.

  6. Assign the account the admin role:

    1. On the management console home page, select the cloud.
    2. Click the Access permissions tab.
    3. Find the sa-terraform account in the list and click .
    4. Click Edit roles.
    5. Click Add role in the dialog box that opens and select the admin role.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

  1. Create a service account:

    yc iam service-account create --name sa-terraform

    Where name is the service account name. The naming requirements are as follows:

    • The name must be from 3 to 63 characters long.
    • It may contain lowercase Latin letters, numbers, and hyphens.
    • The first character must be a letter and the last character cannot be a hyphen.

    Result:

    id: ajehr0to1g8bh0la8c8r
folder_id: b1gv87ssvu497lpgjh5o
created_at: "2023-03-04T09:03:11.665153755Z"
name: sa-terraform

  2. Assign the account the admin role:

    yc resource-manager cloud add-access-binding <cloud_ID> \
  --role admin \
  --subject serviceAccount:<service_account_ID>

    Result:

    done (1s)

To create a service account, use the create REST API method for the ServiceAccount resource or the ServiceAccountService/Create gRPC API call.

To assign the service account a role for a cloud or folder, use the updateAccessBindings REST API method for the Cloud or Folder resource:

  1. Select the role to assign to the service account. You can find the description of the roles in the Yandex Identity and Access Management documentation in the Yandex Cloud role reference.

  2. Get the ID of the service accounts folder.

  3. Get an IAM token required for authorization in the Yandex Cloud API.

  4. Get a list of folder service accounts to find out their IDs:

    export FOLDER_ID=b1gvmob95yys********
export IAM_TOKEN=CggaATEVAgA...
curl \
  --header "Authorization: Bearer ${IAM_TOKEN}" \
  "https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts?folderId=${FOLDER_ID}"

    Result:

    {
 "serviceAccounts": [
  {
   "id": "ajebqtreob2d********",
   "folderId": "b1gvmob95yys********",
   "createdAt": "2018-10-18T13:42:40Z",
   "name": "my-robot",
   "description": "my description"
  }
 ]
}

  5. Create the request body, e.g., in the body.json file. Set the action property to ADD and roleId to the appropriate role, such as editor, and specify the serviceAccount type and service account ID in the subject property:

    body.json:

    {
  "accessBindingDeltas": [{
    "action": "ADD",
    "accessBinding": {
      "roleId": "editor",
      "subject": {
        "id": "ajebqtreob2d********",
        "type": "serviceAccount"
      }
    }
  }]
}

  6. Assign a role to a service account. For example, for a folder with the b1gvmob95yys******** ID:

    export FOLDER_ID=b1gvmob95yys********
export IAM_TOKEN=CggaAT********
curl \
  --request POST \
  --header "Content-Type: application/json" \
  --header "Authorization: Bearer ${IAM_TOKEN}" \
  --data '@body.json' \
  "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:updateAccessBindings"

Install the required utilities

  1. Install Git using the following command:

    sudo apt install git

  2. Install Terraform:

    1. Go to the root directory:

      cd ~

    2. Create a folder named terraform and open it:

      mkdir terraform
cd terraform

    3. Run the following command to download the terraform_1.3.9_linux_amd64.zip archive from the official website:

      curl --location --remote-name https://hashicorp-releases.yandexcloud.net/terraform/1.3.9/terraform_1.3.9_linux_amd64.zip

    4. Install the zip utility and unpack the ZIP archive:

      apt install zip
unzip terraform_1.3.9_linux_amd64.zip

    5. Add the path to the folder with the executable to the PATH variable:

      export PATH=$PATH:~/terraform

    6. Make sure that Terraform is installed by running this command:

      terraform -help

  3. Create a configuration file specifying the provider source for Terraform:

    1. Create a file named .terraformrc using the native nano editor:

      cd ~
nano .terraformrc

    2. Add the following section to the file:

      provider_installation {
  network_mirror {
    url = "https://terraform-mirror.yandexcloud.net/"
    include = ["registry.terraform.io/*/*"]
  }
  direct {
    exclude = ["registry.terraform.io/*/*"]
  }
}

      For more information about setting up mirrors, see the Terraform documentation.

Deploy your resources

  1. Clone the yandex-cloud-examples/yc-dmz-with-high-available-ngfw GitHub repository and go to the yc-dmz-with-high-available-ngfw folder:

    git clone https://github.com/yandex-cloud-examples/yc-dmz-with-high-available-ngfw.git
cd yc-dmz-with-high-available-ngfw

  2. Set up the CLI profile to run operations on behalf of the service account:

    If you do not have the Yandex Cloud command line interface yet, install and initialize it.

    The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

    1. Create an authorized key for your service account and save the file:

      yc iam key create \
  --service-account-id <service_account_ID> \
  --folder-id <ID_of_folder_with_service_account> \
  --output key.json

      Where:

      • service-account-id: Service account ID.
      • folder-id: ID of the folder in which the service account was created.
      • output: Name of the file with the authorized key.

      Result:

      id: aje8nn871qo4a8bbopvb
service_account_id: ajehr0to1g8bh0la8c8r
created_at: "2023-03-04T09:16:43.479156798Z"
key_algorithm: RSA_2048

    2. Create a CLI profile to run operations on behalf of the service account:

      yc config profile create sa-terraform

      Result:

      Profile 'sa-terraform' created and activated

    3. Set the profile configuration:

      yc config set service-account-key key.json
yc config set cloud-id <cloud_ID>
yc config set folder-id <folder_ID>

      Where:

      • service-account-key: File with the service account authorized key.
      • cloud-id: Cloud ID.
      • folder-id: Folder ID.

    4. Add the credentials to the environment variables:

      export YC_TOKEN=$(yc iam create-token)
export YC_CLOUD_ID=$(yc config get cloud-id)
export YC_FOLDER_ID=$(yc config get folder-id)

  3. Get your PC's IP address:

    curl 2ip.ru

    Result:

    192.240.24.87

  4. Open the terraform.tfvars file in the nano editor to edit as follows:

    1. The line with the cloud ID:

      cloud_id = "<cloud_ID>"

    2. The line with a list of allowed public IP addresses for jump-vm access:

      trusted_ip_for_access_jump-vm = ["<PC_external_IP>/32"]

  5. Deploy the resources in the cloud using Terraform:

    1. Initialize Terraform:

      terraform init

    2. Check the Terraform file configuration:

      terraform validate

    3. Check the list of cloud resources you are about to create:

      terraform plan

    4. Create resources:

      terraform apply

Set up firewall gateways

As an example, this tutorial describes steps for configuring firewalls named FW-A and FW-B with basic access control policies and NAT required to test performance and fault tolerance, but insufficient to deploy an infrastructure in the production environment.

Connect to the control segment via a VPN

After deploying the infrastructure, the mgmt folder will contain a VM named jump-vm based on an Ubuntu image with the WireGuard VPN configured for a secure connection. Set up a VPN tunnel to jump-vm on your PC to access the mgmt, dmz, app, and database segment subnets.

To set up the VPN tunnel:

  1. Get the username in the Linux subsystem:

    whoami

  2. Install WireGuard on your PC.

  3. Open WireGuard and click Add Tunnel.

  4. In the dialog box that opens, select the jump-vm-wg.conf file in the yc-dmz-with-high-available-ngfw folder.
    To find the directory created in a Linux subsystem, e.g., Ubuntu, type the file path in the dialog box address bar:

    \\wsl$\Ubuntu\home\<Ubuntu_user_name>\yc-dmz-with-high-available-ngfw

    Where <Ubuntu_user_name> is the name of the current Linux distribution user.

  5. Click Activate to activate the tunnel.

  6. Check network connectivity with the management server via the WireGuard VPN tunnel by running the following command in the terminal:

    ping 192.168.1.100

    Warning

    If the packets fail to reach the management server, make sure that the mgmt-jump-vm-sgsecurity group rules for incoming traffic have your PC external IP address specified.

Run SmartConsole

To manage and set up the Check Point solution, install and run the SmartConsole GUI client:

  1. Connect to the NGFW management server by opening https://192.168.1.100 in your browser.

  2. Sign in using the admin username and the admin password.

  3. In the Gaia Portal interface that opens, download the SmartConsole GUI client. To do this, click Manage Software Blades using SmartConsole. Download Now!.

  4. Install SmartConsole on your PC.

  5. Get the SmartConsole access password:

    terraform output fw_smartconsole_mgmt-server_password

  6. Open SmartConsole and sign in with the admin username, 192.168.1.100 management server IP address, and SmartConsole password.

Add the firewall gateways

Add the FW-A firewall gateway to the management server using the Wizard:

  1. In the Objects drop-down list at the top left, select More object types → Network Object → Gateways and Servers → New Gateway....

  2. Click Wizard Mode.

  3. In the dialog box that opens, enter the following:

    • Gateway name: FW-A
    • Gateway platform: CloudGuard IaaS
    • IPv4: 192.168.1.10

  4. Click Next.

  5. Get the firewall access password:

    terraform output fw_sic-password

  6. In the One-time password field, type the previously obtained password.

  7. Click Next and Finish.

In the same way, add the FW-B firewall gateway to the management server using the following values:

  • Gateway name: FW-B
  • IPv4: 192.168.2.10

Configure the FW-A gateway network interfaces

Configure the eth0 network interface of the FW-A gateway:

  1. In the Gateways & Servers tab, open the FW-A gateway setup dialog.
  2. In the Network Management tab, the Topology table, select the eth0 interface and click Modify....
  3. Under Leads To, select Override.
  4. Next to the Specific option, hover over the FW-A-eth0 interface name and click the edit icon in the window that opens.
  5. In the dialog box that opens, rename FW-A-eth0 to mgmt.
  6. Under Security Zone, activate Specify Security Zone and select InternalZone.

Similarly, configure the eth1, eth2, eth3, and eth4 network interfaces:

  1. For the eth1 interface, specify ExternalZone under Security Zone. Do not rename this interface.
  2. Rename the eth2 interface to dmz, activate Interface leads to DMZ, and specify DMZZone.
    Set up Automatic Hide NAT to hide the addresses of VMs hosted in the DMZ segment with access to the internet. To do this:
    1. In the dmz interface editing dialog box, click Net_10.160.1.0 and go to the NAT tab.
    2. Activate Add automatic address translation rules, select Hide from the drop-down list and enable Hide behind gateway.
    3. Repeat these same steps for Net_10.160.2.0.
  3. Rename the eth3 interface to app and specify InternalZone.
  4. Rename the eth4 interface to database and specify InternalZone.

Configure the FW-B gateway network interfaces

Configure the FW-B gateway network interfaces the same way as those of the FW-A gateway. When naming the interfaces, select existing names from the list.
To select an interface name from currently set ones:

  1. Under Leads To, select Override.
  2. Find the relevant name in the drop-down list next to the Specific option.

Warning

Renaming the interfaces again will cause the network object name replication error when setting security policies.

Create network objects

  1. In the Objects drop-down list at the top left, select New Network... to create networks named public - a and public - b with the following data:

    Name Network address Net mask
    public - a 172.16.1.0 255.255.255.0
    public - b 172.16.2.0 255.255.255.0

  2. Select New Network Group... to create a group named public and add the public - a and public - b networks to it.

  3. Select New Host... to create hosts with the following data:

    Name IPv4 address
    dmz-web-server 10.160.1.100
    FW-a-dmz-IP 10.160.1.10
    FW-a-public-IP 172.16.1.10
    FW-b-dmz-IP 10.160.2.10
    FW-b-public-IP 172.16.2.10

  4. Select More object types → Network Object → Service → New TCP... to create a TCP service for the application deployed in the DMZ segment and specify TCP_8080 as its name and 8080 as the port.

Set security policy rules

To add a security rule:

  1. In the Security policies tab, select Policy under Access Control.
  2. In the rule table, right-click next to the New Rule option in the context menu and select Above or Below.
  3. In a new line:
    • In the Name column, enter Web-server port forwarding on FW-a.
    • In the Source column, click + and select the public object.
    • In the Destination column, select the FW-a-public-IP object.
    • In the Services & Applications column, select the TCP_8080 object.
    • In the Action column, select Accept.
    • In the Track column, select Log.
    • In the Install On column, select the FW-a object.

In the same way, add other rules from the basic rule table below to test the firewall policies, run NLB health checks, publish a test application from the DMZ segment, and test its fault tolerance.

No Name Source Destination VPN Services & Applications Action Track Install On
1 Web-server port forwarding on FW-a public FW-a-public-IP Any TCP_8080 Accept Log FW-a
2 Web-server port forwarding on FW-b public FW-b-public-IP Any TCP_8080 Accept Log FW-b
3 FW management & NLB healthcheck mgmt FW-a, FW-b, mgmt-server Any https, ssh Accept Log Policy Targets (All gateways)
4 Stealth Any FW-a, FW-b, mgmt-server Any Any Drop Log Policy Targets (All gateways)
5 mgmt to DMZ mgmt dmz Any Any Accept Log Policy Targets (All gateways)
6 mgmt to app mgmt app Any Any Accept Log Policy Targets (All gateways)
7 mgmt to database mgmt database Any Any Accept Log Policy Targets (All gateways)
8 ping from dmz to internet dmz ExternalZone Any icmp-reguests (Group) Accept Log Policy Targets (All gateways)
9 Cleanup rule Any Any Any Any Drop Log Policy Targets (All gateways)

Set up a static NAT table

Source NAT ensures that an application response passes through the same firewall as the user's request. Destination NAT routes user requests to the network traffic load balancer that the application's web server group is installed behind.

Headers of packets received from Application Load Balancer with user requests to the application published in the DMZ will be translated to the Source IPs of the firewall DMZ interfaces and the Destination IPs of the web server traffic load balancer.

To set up the NAT tables of the FW-A gateway:

  1. Go to the NAT subsection of the Access Control section.
  2. In the rule table, right-click next to the New Rule option in the context menu and select Above or Below.
  3. In a new line:
    • In the Original Source column, click +and select the public object.
    • In the Original Destination column, select the FW-a-public-IP object.
    • In the Original Services column, select the TCP_8080 object.
    • In the Translated Source column, select the FW-a-dmz-IP object.
    • In the Translated Destination column, select the dmz-web-server object.
    • In the Install On column, select the FW-a object.
  4. Make sure to change the NAT method for FW-a-dmz-IP. To do this, right-click the FW-a-dmz-IP object in the table and select NAT Method > Hide.

In the same way, set up the static NAT table for the FW-B gateway based on the table below:

No Original Source Original Destination Original Services Translated Source Translated Destination Translated Services Install On
1 public FW-a-public-IP TCP_8080 FW-a-dmz-IP (Hide) dmz-web-server Original FW-a
2 public FW-b-public-IP TCP_8080 FW-b-dmz-IP (Hide) dmz-web-server Original FW-b

Apply the security policy rules

  1. Click Install Policy at the top left of the screen.
  2. In the dialog box that opens, click Push & Install.
  3. In the next dialog, click Install and wait for the process to finish.

Enable the route-switcher module

After you complete the NGFW setup, make sure that FW-A and FW-B health checks return Healthy. To do this, in the Yandex Cloud management console, the mgmt folder, select Network Load Balancer and go to the route-switcher-lb-... network load balancer page. Open the target group and make sure the target resources are Healthy. If they are Unhealthy, check that FW-A and FW-B are up and running and configured.

Once the FW-A and FW-B status changes to Healthy, open the route-switcher.tf file and change the start_module parameter value of the route-switcher module to true. To enable the module, run this command:

terraform plan
terraform apply

Within 5 minutes, the route-switcher module starts providing fault tolerance of outgoing traffic across the segments.

Test the solution for performance and fault tolerance

Test the system performance

  1. To find out the public IP address of the load balancer, run the following command in the terminal:

    terraform output fw-alb_public_ip_address

  2. Make sure the network infrastructure can be accessed from the outside by opening the following address in the browser:

    http://<public_IP_address_of_ALB_load_balancer>

    If the system is accessible from the outside, you will see the Welcome to nginx! page.

  3. Make sure the firewall security policy rules that allow traffic are active. To do this, go to the yc-dmz-with-high-available-ngfw folder on your PC and connect to a VM in the DMZ segment over SSH:

    cd ~/yc-dmz-with-high-available-ngfw
ssh -i pt_key.pem admin@<internal_IP_address_of_VM_in_DMZ_segment>

  4. To check that there is access from the VM in the DMZ segment to a public resource on the internet, run this command:

    ping ya.ru

    The command must run according to the ping from dmz to internet rule that allows traffic.

  5. Make sure the security policy rules that prohibit traffic are applied.
    To check that Jump VM in the mgmt segment cannot be accessed from the dmz segment, run this command:

    ping 192.168.1.101

    The command must fail according to the Cleanup rule that prohibits traffic.

Testing fault tolerance

  1. Install httping on your PC to make regular HTTP requests:

    sudo apt-get install httping

  2. To find out the public IP address of the load balancer, run the following command in the terminal:

    terraform output fw-alb_public_ip_address

  3. Enable incoming traffic to the application published in the DMZ segment by making the following request to the ALB public IP:

    httping http://<public_IP_address_of_ALB_load_balancer>

  4. Open another terminal and connect to a VM in the DMZ segment over SSH:

    ssh -i pt_key.pem admin@<internal_IP_address_of_VM_in_DMZ_segment>

  5. Set a password for the admin user:

    sudo passwd admin

  6. In the Yandex Cloud management console, change the parameters of this VM:

    1. In the list of services, select Compute Cloud.
    2. In the list of VMs, choose the one you need, click , and select Edit.
    3. In the Additional column, select Grant access to serial console.

  7. Connect to the VM serial console, enter the admin username and the password you set earlier.

  8. Enable outgoing traffic from the VM in the DMZ segment to a resource on the internet using ping:

    ping ya.ru

  9. In the Yandex Cloud console, in the mgmt folder, stop the fw-a VM by emulating the recovery of the main firewall.

  10. Monitor the loss of packets sent by httping and ping. After FW-A fails, there may be a traffic loss for 1 minute on average with subsequent traffic recovery.

  11. Check that the FW-B address is used in the dmz-rt route table, the dmz folder, for the next hop.

  12. In the Yandex Cloud management console, run the fw-a VM by emulating the recovery of the main firewall.

  13. Monitor the loss of packets sent by httping and ping. After FW-A recovers, there may be a traffic loss for 1 minute on average with subsequent traffic recovery.

  14. Check that the FW-A address is used in the dmz-rt route table, the dmz folder, for the next hop.

How to delete the resources you created

To stop paying for the resources you created, run the command:

terraform destroy

Terraform will permanently delete all the resources: networks, subnets, VMs, load balancers, folders, etc.

As the resources you created reside in folders, a faster way to delete all resources is to delete all the folders using the Yandex Cloud console and then delete the terraform.tfstate file from the yc-dmz-with-high-available-ngfw folder on your PC.

Previous
Implementing fault-tolerant scenarios for network VMs
Next
Cloud infrastructure segmentation with Check Point Next-Generation Firewall