Contact UsGet started

Creating and configuring a UserGate gateway in firewall mode

Written by
Updated at October 17, 2024

UserGate is a next-generation firewall created by a Russia-based company of the same name.

You will create a UserGate virtual machine in Yandex Cloud and set up the gateway for firewall mode. To learn about advanced UserGate features, take the free course UserGate Getting Started.

To deploy a UserGate gateway and check its health:

  1. Prepare your cloud.
  2. Create a cloud network and subnet.
  3. Reserve a static public IP address.
  4. Create a UserGate VM.
  5. Set up the UserGate NGFW via the administrative console.
  6. Set up routing in the subnet.
  7. Test the firewall.

If you no longer need the resources you created, delete them.

Getting started

Sign up for Yandex Cloud and create a billing account:

  1. Go to the management console and log in to Yandex Cloud or create an account if you do not have one yet.
  2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one.

If you have an active billing account, you can go to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

The price for the UserGate gateway includes:

Create a cloud network and subnet

Create a cloud network with subnets in the availability zones that will host your VM.

  1. On the folder page in the management console, click Create resource and select Network.
  2. Enter a name for the network: usergate-network.
  3. Enable the Create subnets option.
  4. Click Create network.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

  1. Create a network named usergate-network:

    yc vpc network create usergate-network

    Result:

    id: enptrcle5q3d********
folder_id: b1g9hv2loamq********
created_at: "2022-06-08T09:25:03Z"
name: usergate-network
default_security_group_id: enpbsnnop4ak********

    For more information about the yc vpc network create command, see the CLI reference.

  2. Create a subnet named usergate-subnet-ru-central1-a in the ru-central1-a availability zone:

    yc vpc subnet create usergate-subnet-ru-central1-a \
  --zone ru-central1-a \
  --network-name usergate-network \
  --range 10.1.0.0/16

    Result:

    id: e9bnnssj8sc8********
folder_id: b1g9hv2loamq********
created_at: "2022-06-08T09:27:00Z"
name: usergate-subnet-ru-central1-a
network_id: enptrcle5q3d********
zone_id: ru-central1-a
v4_cidr_blocks:
- 10.1.0.0/16

    For more information about the yc vpc subnet create command, see the CLI reference.

  1. In the configuration file, describe the network parameters for usergate-network and its subnets:

    resource "yandex_vpc_network" "usergate-network" {
  name = "usergate-network"
}

resource "yandex_vpc_subnet" {
  name           = "usergate-subnet-ru-central1-a"
  zone           = "ru-central1-a"
  network_id     = "${yandex_vpc_network.usergate-network.id}"
  v4_cidr_blocks = ["10.1.0.0/16"]
}

    For more information, see the descriptions of the yandex_vpc_network and yandex_vpc_subnet resources in the Terraform provider documentation.

  2. Make sure the configuration files are correct.

    1. In the command line, go to the folder where you created the configuration file.

    2. Run a check using this command:

      terraform plan

    If the configuration is described correctly, the terminal will display a list of created resources and their parameters. If the configuration contains any errors, Terraform will point them out.

  3. Deploy cloud resources.

    1. If the configuration does not contain any errors, run this command:

      terraform apply

    2. Confirm creating the resources: type yes in the terminal and press Enter.

  1. Create a network named usergate-network using the NetworkService/Create gRPC API call or the create REST API method for the Network resource.
  2. Create a subnet named usergate-subnet-ru-central1-a using the SubnetService/Create gRPC API call or the create REST API method for the Subnet resource.

Reserve a static public IP address

The gateway will need a static public IP address.

  1. In the management console, go to the page of the folder you want to reserve an IP address in.
  2. In the list of services, select Virtual Private Cloud.
  3. In the left-hand panel, select IP addresses.
  4. Click Reserve address.
  5. In the window that opens, select the ru-central1-a availability zone.
  6. Click Reserve address.

Run this command:

yc vpc address create --external-ipv4 zone=ru-central1-a

Result:

id: e9b6un9gkso6********
folder_id: b1g7gvsi89m3********
created_at: "2022-06-08T17:52:42Z"
external_ipv4_address:
  address: 178.154.253.52
  zone_id: ru-central1-a
  requirements: {}
reserved: true

For more information about the yc vpc address create command, see the CLI reference.

In the configuration file, describe the parameters of the yandex_vpc_address public IP address:

resource "yandex_vpc_address" "usergate-addr" {
name = "usergate-addr"
external_ipv4_address {
  zone_id = "ru-central1-b"
  }
}

For more information, see the vpc_address resource description in the Terraform provider documentation.

Create a UserGate VM

  1. On the folder page in the management console, click Create resource and select Virtual machine.

  2. In the Name field, enter the VM name: usergate-firewall.

  3. Select the availability zone: ru-central1-a.

  4. Under Image/boot disk selection, click the Cloud Marketplace tab, then select the UserGate NGFW image.

  5. Under Computing resources:

    • Select the platform: Intel Ice Lake.

    • Specify the required number of vCPUs and the amount of RAM:

      • vCPU: 4
      • Guaranteed vCPU share: 100%
      • RAM: 8 GB

      Note

      These parameters are appropriate for functional testing of the gateway. To calculate the parameters for the production workload, read the UserGate official recommendations.

  6. Under Network settings:

    • Select usergate-network and usergate-subnet-ru-central1-a.
    • In the Public address field, select from a list of reserved IPs.

  7. Under Access, specify the information required to access the VM:

    • Enter the username in the Login field.

    • In the SSH key field, paste the contents of the public key file.

      You will need to create a key pair for the SSH connection yourself; see Creating an SSH key pair for details.

  8. Click Create VM.

  1. Create an SSH key pair.

  2. Run this command:

    yc compute instance create \
  --name usergate-firewall \
  --memory 8 \
  --cores 4 \
  --zone ru-central1-a \
  --create-boot-disk image-folder-id=standard-images,image-family=usergate-ngfw \
  --ssh-key <path_to_public_part_of_SSH_key> \
  --public-address=<reserved_IP_address>

    Result:

    id: fhm2na1siftp********
folder_id: b1g86q4m5vej********
created_at: "2022-06-09T11:15:52Z"
name: usergate-firewall
zone_id: ru-central1-a
platform_id: standard-v2
resources:
  memory: "8589934592"
  cores: "4"
  core_fraction: "100"
status: RUNNING
boot_disk:
  mode: READ_WRITE
  device_name: fhmiq60rni2t********
  auto_delete: true
  disk_id: fhmiq60rni2t********
network_interfaces:
- index: "0"
  mac_address: d0:0d:2b:a8:3c:93
  subnet_id: e9bqlr188as7********
  primary_v4_address:
    address: 10.1.0.27
    one_to_one_nat:
      address: 51.250.72.1
      ip_version: IPV4
fqdn: fhm2na1siftp********.auto.internal
scheduling_policy: {}
network_settings:
  type: STANDARD
placement_policy: {}

    For more information about the yc compute instance create command, see the CLI reference.

  1. Get an ID of the latest version of the UserGate NGFW gateway from the list of public images.

  2. In the configuration file, describe the parameters of the usergate-firewall VM:

    resource "yandex_compute_disk" "boot-disk" {
  name     = "boot-disk"
  type     = "network-hdd"
  zone     = "ru-central1-a"
  size     = "110"
  image_id = "<UserGate_NGFW_image_ID>"
}

resource "yandex_compute_instance" "usergate-firewall" {
  name        = "usergate-firewall"
  platform_id = "standard-v3"
  zone        = "ru-central1-a"
  hostname    = "usergate"
  resources {
    cores         = 4
    core_fraction = 100
    memory        = 8
  }

  boot_disk {
    disk_id = yandex_compute_disk.boot-disk.id
  }

  network_interface {
    subnet_id          = "${yandex_vpc_subnet.usergate-subnet.id}"
    nat                = true
    nat_ip_address     = <reserved_IP_address>
  }

    For more information, see the yandex_compute_instance resource description in the Terraform provider documentation.

  3. Make sure the configuration files are correct.

    1. In the command line, go to the folder with the configuration file.

    2. Run a check using this command:

      terraform plan

    If the configuration is described correctly, the terminal will display a list of created resources and their parameters. If the configuration contains any errors, Terraform will point them out.

  4. Deploy cloud resources.

    1. If the configuration does not contain any errors, run this command:

      terraform apply

    2. Confirm creating the resources: type yes in the terminal and press Enter.

Create the usergate-firewall VM using the create REST API method for the Instance resource.

Set up the UserGate NGFW via the administrative console

To set up a gateway, go to the UserGate NGFW administrative console at https://<VM_public_IP_address>:8001 and log in with the default credentials: Admin for the username and utm for the password.

When you are logged in, the system prompts you to change the default password and update the OS.

Set up the gateway to run in firewall mode

Configure UserGate NGFW:

  1. In the top menu, select Settings.
  2. In the menu on the left, go to Network ⟶ Zones.
  3. Click the Trusted zone name.
  4. Click Access control, then enable Administration console. Click Save.
  5. In the menu on the left, go to Network ⟶ Interfaces.
  6. Click the port0 network interface name.
  7. On the General tab, select the Trusted zone from the list in the Zone field. Click Save.
  8. In the menu on the left, click Network policies ⟶ Firewall.
  9. Click the name of the Allow trusted to untrusted preset rule.
  10. Go to the Destination tab and disable the Untrusted zone. Click Save.
  11. Enable the Allow trusted to untrusted rule. To do this, select the line with the rule and click Enable at the top of the screen.
  12. In the menu on the left, click Network policies ⟶ NAT and routing.
  13. Click the name of the NAT from Trusted to Untrusted preset rule.
  14. Go to the Destination tab and change the destination zone from Untrusted to Trusted. Click Save.
  15. Enable the NAT from Trusted to Untrusted rule. To do this, select the line with the rule and click Enable at the top of the screen.

Now the gateway has been set up.

Set up the traffic filtering rules

We recommend using the following default policies: Block to botnets, Block from botnets, and Example block RU RKN by IP list. First change several parameters in them:

  1. Click Network policies ⟶ Firewall.
  2. Click the name of the preset rule.
  3. Go to the Source tab and change the source zone from Untrusted to Trusted.
  4. Go to the Destination tab and disable the Untrusted zone.
  5. Click Save.
  6. Enable the selected rule. To do this, select the line with the rule and click Enable at the top of the screen.

For higher security, set up more traffic filtering rules:

  1. Click Network policies ⟶ Firewall.

  2. Add the first blocking rule:

    1. At the top of the screen, click Add.

    2. Specify the rule parameters:

      • Name: Block QUIC protocol.
      • Action: Deny.

    3. Go to the Source tab and select Trusted.

    4. Click Service.

    5. Click Add.

    6. Select Quick UDP Internet Connections and click Add. After that, click Close.

    7. Click Save.

  3. Add the second blocking rule:

    1. At the top of the screen, click Add.

    2. Specify the rule parameters:

      • Name: Block Windows updates.
      • Action: Deny.

    3. Go to the Source tab and select Trusted.

    4. Click Applications.

    5. Click Add ⟶ Add applications.

    6. Select the Microsoft Update app and click Add.

    7. Select the WinUpdate app and click Add. After that, click Close.

    8. Click Save.

You can also add other traffic filtering rules. We don't recommend combining services and applications in the same rule. The rule might not trigger in this case.

Set up routing for the subnet

Create a static route:

  1. In the management console, go to the folder you need to create a static route in.

  2. In the list of services, select Virtual Private Cloud.

  3. In the left-hand panel, select Route tables.

  4. Click Create.

  5. Enter a name for the route table. The naming requirements are as follows:

    • The name must be from 3 to 63 characters long.
    • It may contain lowercase Latin letters, numbers, and hyphens.
    • The first character must be a letter and the last character cannot be a hyphen.

  6. (Optional) Add a description of a route table.

  7. Select the usergate-network network.

  8. Click Add route.

  9. In the window that opens, enter the prefix for the target subnet (0.0.0.0) and select 0 from the drop-down list.

  10. Specify next hop, i.e., the internal IP address of the UserGate VM named usergate-firewall.

  11. Click Add.

  12. Click Create route table.

To use static routes, link the route table to a subnet:

  1. In the left-hand panel, select Subnets.
  2. In the usergate-subnet-ru-central1-a row, click .
  3. In the menu that opens, select Link route table.
  4. In the window that opens, select the created table from the list.
  5. Click Link.

To create a route table and add static routes:

  1. View the description of the CLI command for creating route tables:

    yc vpc route-table create --help

  2. Get the IDs of cloud networks in your cloud:

    yc vpc network list

    Result:

    +----------------------+--------------------+
|          ID          |      NAME          |
+----------------------+--------------------+
| enp846vf5fus******** | usergate-network   |
+----------------------+--------------------+

  3. Create a route table in the usergate-network network:

    yc vpc route-table create \
  --name=test-route-table \
  --network-id=enp846vf5fus******** \
  --route destination=0.0.0.0/0,next-hop=10.129.0.24

    Where:

    • name: Name of the route table.
    • network-id: ID of the network where the table will be created.
    • route: Route settings, which include these two parameters:
      • destination: Destination subnet prefix in CIDR notation.
      • next-hop: Internal IP address of the UserGate VM named usergate-firewall.

    Result:

    ...done
id: enpsi6b08q2v********
folder_id: b1gqs1teo2q2********
created_at: "2019-06-24T09:57:54Z"
name: test-route-table
network_id: enp846vf5fus********
static_routes:
- destination_prefix: 0.0.0.0/0
  next_hop_address: 10.129.0.24

To use static routes, link the route table to a subnet:

  1. Get a list of subnets in your cloud:

    yc vpc subnet list

    Result:

    +----------------------+-------------------------------+----------------------+----------------------+---------------+-----------------+
|          ID          |               NAME            |      NETWORK ID      |    ROUTE TABLE ID    |       ZONE    |      RANGE      |
+----------------------+-------------------------------+----------------------+----------------------+---------------+-----------------+
| b0c4l3v9jrgd******** | usergate-subnet-ru-central1-a | enpjsdf771h0******** |                      | ru-central1-a | [10.130.0.0/24] |
+----------------------+-------------------------------+----------------------+----------------------+---------------+-----------------+

  2. Assign the routing table to the subnet the web service will run in, e.g., usergate-subnet-ru-central1-a:

    yc vpc subnet update b0c4l3v9jrgd******** --route-table-id e2l5345dlgr1********

    Result:

    ..done
id: b0c4l3v9jrgd********
folder_id: b1gqs1teo2q2********
created_at: "2019-03-12T13:27:22Z"
name: subnet-1
network_id: enp846vf5fus********
zone_id: ru-central1-a
v4_cidr_blocks:
- 192.168.0.0/24
route_table_id: e2l5345dlgr1********

To create a route table and add static routes:

  1. In the configuration file, describe the parameters of the resources you want to create:

    • name: Name of the route table. The name format is as follows:

      • The name must be from 3 to 63 characters long.
      • It may contain lowercase Latin letters, numbers, and hyphens.
      • The first character must be a letter and the last character cannot be a hyphen.

    • network_id: ID of the network the table will be created in.

    • static_route: Static route description:

      • destination_prefix: Destination subnet prefix in CIDR notation.
      • next_hop_address: Internal IP address of the VM from the allowed ranges the traffic will be routed through.

    Here is an example of the configuration file structure:

    resource "yandex_vpc_route_table" "usergate-rt-a" {
  name       = "<route_table_name>"
  network_id = "<network_ID>"
  static_route {
    destination_prefix = "0.0.0.0/0"
    next_hop_address   = "10.129.0.24"
  }
}

    To add, update, or delete a route table, use the yandex_vpc_route_table resource and specify the network in the netword id field, e.g. network_id = "${yandex_vpc_network.lab-net.id}".

    For more information about the yandex_vpc_route_table resource parameters in Terraform, see the provider documentation.

  2. Make sure the configuration files are correct.

    1. In the command line, go to the folder where you created the configuration file.

    2. Run a check using this command:

      terraform plan

    If the configuration is described correctly, the terminal will display a list of created resources and their parameters. If the configuration contains any errors, Terraform will point them out.

  3. Deploy cloud resources.

    1. If the configuration does not contain any errors, run this command:

      terraform apply

    2. Confirm creating the resources: type yes in the terminal and press Enter.

      All the resources you need will then be created in the specified folder. You can check the new resources and their configuration using the management console or this CLI command:

      yc vpc route-table list

Test the firewall

To test your firewall, create a test web service and make sure that you can access it from the internet.

Set up a test VM

  1. Create a VM from a public Linux image in the usergate-subnet-ru-central1-a subnet. In the VM settings, enable the serial console.

  2. To connect to the VM via the CLI, run the command:

    yc compute connect-to-serial-port --instance-name <VM_name>

    Where:
    --instance-name: Test VM name.

  3. Start the test web service:

    sudo python3 -m http.server 80

    The web server will listen to requests on port 80 and return a list of directories and files from the folder.

Use the firewall to set up a reverse proxy to the web service

  1. In the UserGate administrator web console, in the top menu, select Settings.

  2. On the left in the Global portal section, select Web portal, and set up access by an HTTP address:

    1. Click Add to open the portal adding dialog.
    2. Tick the Enabled option on.
    3. In the Name field, enter Test web portal.
    4. In the URL field, enter http://<IP_address_of_UserGate_VM>.
    5. Leave SSL profile at default.
    6. In the Certificate field, select CA (Default).
    7. Click Save.

  3. Select Reverse proxy servers and add a new server:

    1. Click Add to open the server adding dialog.
    2. In the Name field, enter Local server.
    3. In the Server address field, enter <internal_IP_address_of_test_VM>, e.g., 10.129.0.24.
    4. In the Port field, enter 80.
    5. Click Save.

  4. Select Reverse proxy rules and add a new rule:

    1. Click Add to open the rule adding dialog.
    2. Tick the Enabled option on.
    3. In the Name field, enter Access to local server.
    4. In the Reverse proxy server field, select Local server.
    5. In the Ports field, enter 5550.
    6. Click Save.

    This completes setting up access to a local server. The firewall will accept requests on port 5550 and forward them to port 80 on the test VM IP address.

Test that the web server is available from the internet

  1. Make sure that you can execute a request against the web service at the URL:

    http://<IP_address_of_UserGate_VM>:5550

    This should return a list of directories and files in the folder.

  2. In the UserGate administrator web console, in the top menu, select Logs and reports.

  3. On the left side of the Logs section, select Web access log and make sure that you can see an entry about executing the Access to local server rule.

How to delete the resources you created

To stop paying for the resources you created:

  1. Delete the usergate-firewall and local-service VMs.
  2. Delete the static public IP address.
Previous
Secure user access to cloud resources based on WireGuard VPN
Next
Implementing fault-tolerant scenarios for network VMs