Chapter 2. Tutorial: Limit egress with Google Cloud Next Generation Firewall

Procedure

1. Create the VPC by running the following command:

   $ gcloud compute networks create ${prefix}-vpc --subnet-mode=custom

2. Create the worker subnets by running the following command:

   $ gcloud compute networks subnets create ${prefix}-worker \
       --range=10.0.2.0/23 \
       --network=${prefix}-vpc \
       --region=${region} \
       --enable-private-ip-google-access

3. Create the control plane subnets by running the following command:

   $ gcloud compute networks subnets create ${prefix}-control-plane \
       --range=10.0.0.0/25 \
       --network=${prefix}-vpc \
       --region=${region} \
       --enable-private-ip-google-access

4. Create the Private Service Connect (PSC) subnets by running the following command:

   $ gcloud compute networks subnets create ${prefix}-psc \
       --network=${prefix}-vpc \
       --region=${region} \
       --stack-type=IPV4_ONLY \
       --range=10.0.0.128/29 \
       --purpose=PRIVATE_SERVICE_CONNECT

   These examples use the subnet ranges of 10.0.2.0/23 for the worker subnet, 10.0.0.0/25 for the control plane subnet, and 10.0.0.128/29 for the PSC subnet. Modify the parameters to meet your needs. Ensure the parameter values are contained within the machine CIDR you set earlier in this tutorial.

Procedure

1. Run this command to create a global network firewall policy:

   $ gcloud compute network-firewall-policies create \
       ${prefix} \
       --description "OpenShift Dedicated Egress Firewall" \
       --global

2. Run this command to attach the new policy to the VPC you created earlier:

   $ gcloud compute network-firewall-policies associations create \
         --name ${prefix}-vpc-association \
         --firewall-policy ${prefix} \
         --network ${prefix}-vpc \
         --global-firewall-policy

Procedure

1. Reserve an IP address for Cloud NAT by running the following command:

   $ gcloud compute addresses create ${prefix}-${region}-cloudnatip \
       --region=${region}

2. Create a Cloud Router by running the following command:

   $ gcloud compute routers create ${prefix}-router \
       --region=${region} \
       --network=${prefix}-vpc

3. Create a Cloud NAT by running the following command:

   $ gcloud compute routers nats create ${prefix}-cloudnat-${region} \
       --router=${prefix}-router --router-region ${region} \
       --nat-all-subnet-ip-ranges \
       --nat-external-ip-pool=${prefix}-${region}-cloudnatip

Procedure

1. Create a private DNS zone for the googleapis.com domain by running the following command:

   $ gcloud dns managed-zones create ${prefix}-googleapis \
       --visibility=private \
       --networks=https://www.googleapis.com/compute/v1/projects/${project_id}/global/networks/${prefix}-vpc \
       --description="Private Google Access" \
       --dns-name=googleapis.com

2. Begin a record set transaction by running the following command:

   $ gcloud dns record-sets transaction start \
       --zone=${prefix}-googleapis

3. Stage the DNS records for Google APIs under the googleapis.com domain by running the following commands:

   $ gcloud dns record-sets transaction add --name="*.googleapis.com." \
       --type=CNAME restricted.googleapis.com. \
       --zone=${prefix}-googleapis \
       --ttl=300

   $ gcloud dns record-sets transaction add 199.36.153.4 199.36.153.5 199.36.153.6 199.36.153.7 \
       --name=restricted.googleapis.com. \
       --type=A \
       --zone=${prefix}-googleapis \
       --ttl=300

4. Apply the staged record set transaction you started above by running the following command:

   $ gcloud dns record-sets transaction execute \
       --zone=$prefix-googleapis

Procedure

1. Create a blanket allow rule for private IP (Request for Comments (RFC) 1918) address space by running the following command:

   $ gcloud compute network-firewall-policies rules create 500 \
       --description "Allow egress to private IP ranges" \
       --action=allow \
       --firewall-policy=${prefix} \
       --global-firewall-policy \
       --direction=EGRESS \
       --layer4-configs all \
       --dest-ip-ranges=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

2. Create an allow rule for HTTPS (tcp/443) domains required for OpenShift Dedicated by running the following command:

   Note

   If you receive an error "Cannot have rules with the same priorities", the rule already exists. You can verify it with:

   $ gcloud compute network-firewall-policies rules describe 500 --firewall-policy=${prefix} --global-firewall-policy
   $ gcloud compute network-firewall-policies rules describe 600 --firewall-policy=${prefix} --global-firewall-policy

   To re-create the rules, first delete them:

   $ gcloud compute network-firewall-policies rules delete 500 --firewall-policy=${prefix} --global-firewall-policy
   $ gcloud compute network-firewall-policies rules delete 600 --firewall-policy=${prefix} --global-firewall-policy

   $ gcloud compute network-firewall-policies rules create 600 \
       --description "Allow egress to OpenShift Dedicated required domains (tcp/443)" \
       --action=allow \
       --firewall-policy=${prefix} \
       --global-firewall-policy \
       --direction=EGRESS \
       --layer4-configs tcp:443 \
       --dest-fqdns accounts.google.com,pull.q1w2.quay.rhcloud.com,http-inputs-osdsecuritylogs.splunkcloud.com,nosnch.in,api.deadmanssnitch.com,events.pagerduty.com,api.pagerduty.com,api.openshift.com,mirror.openshift.com,observatorium.api.openshift.com,observatorium-mst.api.openshift.com,console.redhat.com,infogw.api.openshift.com,api.access.redhat.com,cert-api.access.redhat.com,catalog.redhat.com,sso.redhat.com,registry.connect.redhat.com,registry.access.redhat.com,cdn01.quay.io,cdn02.quay.io,cdn03.quay.io,cdn04.quay.io,cdn05.quay.io,cdn06.quay.io,cdn.quay.io,quay.io,registry.redhat.io,quayio-production-s3.s3.amazonaws.com

   Important

   The firewall blocks any traffic if you did not create any matching rules. To allow access to other resources, such as internal networks or other external endpoints, create additional rules with a priority of less than 1000. For more information on how to create firewall rules, see the Additional resources.

Procedure

1. Authenticate by running the following command:

   $ gcloud init

2. Log in to your Google Cloud account by running the following command:

   $ gcloud auth application-default login

3. Log in to the OpenShift Cluster Manager CLI tool by running the following command:

   $ ocm login --use-auth-code

   You can now clean up the resources you created as part of this tutorial. To respect resource dependencies, delete them in the reverse order of their creation.

4. Delete the association of the firewall policy with the VPC by running the following command:

   $ gcloud compute network-firewall-policies associations delete \
         --name network-${prefix}-vpc \
         --firewall-policy=${prefix} \
         --global-firewall-policy \
         --project=${project_id}

5. Delete the global network firewall policy by running the following command:

   $ gcloud compute network-firewall-policies delete ${prefix} --global --project=${project_id}

6. List and delete all user-defined DNS records from the Private DNS zone:

   $ gcloud dns record-sets list \
       --project=${project_id} \
       --zone=${prefix}-googleapis \
       --filter="type!=NS AND type!=SOA" \
       --format="value(name,type)" | while read name type; do
     gcloud dns record-sets delete "$name" \
       --project=${project_id} \
       --zone=${prefix}-googleapis \
       --type="$type"
   done

7. Delete the Private DNS Zone by running the following command:

   $ gcloud dns managed-zones delete ${prefix}-googleapis --project=${project_id}

8. Delete the Cloud NAT gateway:

   $ gcloud compute routers nats delete ${prefix}-cloudnat-${region} \
       --router=${prefix}-router \
       --router-region=${region} \
       --project=${project_id}

9. Delete the Cloud Router by running the following command:

   $ gcloud compute routers delete ${prefix}-router --region=${region} --project=${project_id}

10. Delete the reserved IP address by running the following command:

    $ gcloud compute addresses delete ${prefix}-${region}-cloudnatip --region=${region} --project=${project_id}

11. Delete the worker subnet by running the following command:

    $ gcloud compute networks subnets delete ${prefix}-worker --region=${region} --project=${project_id}

12. Delete the control plane subnet by running the following command:

    $ gcloud compute networks subnets delete ${prefix}-control-plane --region=${region} --project=${project_id}

13. Delete the Private Service Connect (PSC) subnet by running the following command:

    $ gcloud compute networks subnets delete ${prefix}-psc --region=${region} --project=${project_id}

14. Delete the VPC by running the following command:

    $ gcloud compute networks delete ${prefix}-vpc --project=${project_id}