How to Route Traffic from a Kubernetes Cluster Using the Twingate Client
Introduction
The purpose of this guide is to demonstrate how the Twingate headless Client can be used as a router to connect to your remote resources from within a GKE cluster.
Production Environments
The information in this article is to be used as a guide only and therefore it is recommended all security and configuration best practices are followed if deploying this method into a production environment.
The general idea is to use the Twingate Headless Client in a dedicated Virtual Machine that acts as a Router from the perspective of the GKE Cluster:
![](/docs-assets/4fab895/docs/static/bd2f8608a94e3e1eaeb10801fcc58c4d/1e088/93e611e-Untitled-2022-07-25-1511.png)
We can then enter the required details:
![](/docs-assets/4fab895/docs/static/27c2efb8b8b6f757af4870222147091c/e17e5/817d77d-Screenshot_2022-07-21_at_17.20.32.png)
![](/docs-assets/4fab895/docs/static/3ea5a12a474b9d01ee274c801649657c/e17e5/42cbf1a-Screenshot_2022-07-21_at_17.22.04.png)
You can leave the remaining default settings and click create.
Twingate Router Setup
We must first setup the virtual machine which will run the Twingate client and also act as a router for any internal services which need to communicate to resources within Twingate. This virtual machine will run in “headless” mode and therefore require a service account to be created.
Setting up a service account
To create a service account, open your Twingate admin page, select Team and then the services tab:
![](/docs-assets/4fab895/docs/static/a6a8d4e7447f805d60e7e0b3cfe1058b/a9b70/9112f50-Screenshot_2022-07-21_at_16.49.51.png)
Click on Create Service Account and give it a sensible name:
![](/docs-assets/4fab895/docs/static/eea648d6f1c4ea225e35cfffda83328b/d68e4/e670396-Screenshot_2022-07-21_at_16.52.12.png)
You should then generate a dedicated service key:
![](/docs-assets/4fab895/docs/static/6d09b041eb7e03605ca685def3022e3f/409e6/d883d75-Screenshot_2022-07-21_at_16.53.09.png)
![](/docs-assets/4fab895/docs/static/2acfef9d0d4ea6f165f89a0282cea839/772e8/cfb09ae-Screenshot_2022-07-21_at_16.53.58.png)
Once you generate the key, take a copy of the Key Object as this is what the headless client uses to authenticate.
Handling Keys
As this key is used to authenticate, it is important you keep this safe.
Setting up the virtual machine
Again, use the GCP console to search for ”VM instances”, then select ”Create Instance“.
![](/docs-assets/4fab895/docs/static/c6aa360e909ebf29c90678f0a3b7c0eb/3dd3e/4b1caee-Screenshot_2022-07-22_at_08.20.07.png)
Enter a suitable name and place the virtual machine in the same region you setup the subnet in the VPC previously.
VM Sizing
For this example we have used the smallest machine type, this should be reviewed for production workloads depending on throughput.
![](/docs-assets/4fab895/docs/static/ed3756863bab5866c00ef0b129e20227/08c0b/3fc1652-Screenshot_2022-07-22_at_08.22.24.png)
Scrolling down to Boot Disk, select change:
![](/docs-assets/4fab895/docs/static/3ee64e09d185a4b30c87de59877c62b8/a07a7/40ad8b3-Screenshot_2022-07-22_at_08.26.24.png)
Change the OS to Ubuntu:
![](/docs-assets/4fab895/docs/static/da919c955bf9dd3ca3f849e13c560aca/b1cde/310f213-Screenshot_2022-07-22_at_08.27.05.png)
And pick the version to the x86/64 image
![](/docs-assets/4fab895/docs/static/a593a226a27605dc7fa1d42043131e6e/ef9e5/b29cae6-Screenshot_2022-07-22_at_08.28.01.png)
Then click Select to select this as your machine image.
Next expand the networking section.
![](/docs-assets/4fab895/docs/static/1aa8e1d4cb153ebedadb7840766f61ee/38070/22b13d3-Screenshot_2022-07-22_at_08.29.49.png)
Expand the Networking section and tick the IP Forwarding checkbox:
![](/docs-assets/4fab895/docs/static/d16970d9f99200e0cc89b37806a8760b/75706/1ace803-Screenshot_2022-07-22_at_08.36.46.png)
Scroll down to Network Interfaces and delete the pre-configured interface:
![](/docs-assets/4fab895/docs/static/94daccea1542f87b57e0b1ac3b8fca57/6e88f/9a78ef8-Screenshot_2022-07-22_at_08.31.23.png)
Click Add Network Interface and select the network and subnet you created previously:
![](/docs-assets/4fab895/docs/static/1f81df3b26e0f940532b68f76955453f/89a37/804054a-Screenshot_2022-07-22_at_08.32.59.png)
(The remaining settings can be changed to suit your requirements but for the purpose of this guide we will just click the create button with no added configuration.)
Configuring the virtual machine
To enable access to the virtual machine we will need to configure a firewall rule to allow SSH, navigate back to the VPC networking section and select the VPC network you created earlier.
Scrolling to the bottom of the page, select Firewalls and then click Add firewall rule.
![](/docs-assets/4fab895/docs/static/e050fab6e41099f8fa8fcd2c5917f9b8/1e088/22c0000-Screenshot_2022-07-22_at_08.40.02.png)
Create a new firewall rule with a name of your choice. We will want to change the Targets to All instances in the network, the source IP to 0.0.0.0/0
and specifying tcp port 22
.
This rule will expose port 22 to the internet, if you would like to restrict this further please see this official guide.
![](/docs-assets/4fab895/docs/static/5809c65a33e007fb786b7d70c46144f1/a65ce/d68ca7a-Screenshot_2022-07-22_at_08.44.38.png)
Now we can connect to the virtual machine by going back to the VM instance screen and clicking on the SSH button.
![](/docs-assets/4fab895/docs/static/52b1b7b238c38c611d98e7c21b6eb8a8/1e088/6406e67-Screenshot_2022-07-22_at_09.06.10.png)
This will popup a new window and you should now have access to the virtual machine shell.
Installing Twingate
We will be installing the Twingate Client in “headless” mode which means that it will authenticate using the service account we created earlier. It also means that it can be run in the background without any interaction.
The following steps are taken from the official guide here. If you are having issues with these steps, please refer to the official guide.
Installation
Enter the following command in the terminal / shell:
curl https://binaries.twingate.com/client/linux/install.sh | sudo bash
After a few moments the installation will complete.
Next we need to create the file which will be used to configure the headless client, create a new file and copy the contents of the key you saved earlier:
nano /tmp/service_key.json
![](/docs-assets/4fab895/docs/static/d29debd0ed998238f0eb603210b27cb0/74cfa/2d8133a-Screenshot_2022-07-22_at_09.17.17.png)
Save this file.
New to Nano?
More information on using the nano editor can be found at https://linuxize.com/post/how-to-use-nano-text-editor/
We can then use this file in the Twingate setup by running the following:
sudo twingate setup --headless /tmp/service_key.json
You will see that this has completed the setup:
Twingate Setup 1.0.58.46266 | 0.129.0Copying service keySetup is complete.
We can now start Twingate:
sudo twingate start
You should see that it has successfully started and connected:
Starting Twingate service in headless modeTwingate has been startedWaiting for status...online
Next we will need to setup the virtual machine so it can route the traffic from inside the network via the new Twingate connection.
First we need to allow** ip forwarding**:
sudo nano /etc/sysctl.conf
Scroll down this file and uncomment net.ipv4.ip_forward=1:
![](/docs-assets/4fab895/docs/static/b42a2cd8bde25c94f9c31c48a5e8581e/5fad2/c6abc00-Screenshot_2022-07-22_at_09.25.02.png)
Save the file.
Then we need to run the following command to apply the changes:
sudo sysctl -p
Next we need to make changes to iptables on the virtual machine by entering the following commands:
Working with Network Interfaces
ens4
in the commands below corresponds to the name of the Network Interface on the VM itself: yours may be
different. If it is, replace ens4
with the name of your own interface.
sudo iptables --append FORWARD --in-interface ens4 --out-interface sdwan0 --jump ACCEPT
sudo iptables --append FORWARD --in-interface sdwan0 --out-interface ens4 --match state --state RELATED,ESTABLISHED --jump ACCEPT
sudo iptables -t nat --append POSTROUTING --out-interface sdwan0 --jump MASQUERADE
To ensure these rules remain when the VM is restarted we can install the following:
sudo apt install iptables-persistent -y
Enter YES on both screens when they popup.
That is all the configuration required on the router.
The remote environment
We will need a remote network and resource which we allow our headless client to communicate with. Setting up the remote network in Twingate is beyond the scope of this guide, but you can find information on how to do this here.
For the purpose of this guide we will use a remote network with a simple application deployed with an internal IP address of 10.43.40.159:
![](/docs-assets/4fab895/docs/static/6eb725571224cc982170f5019cfbe490/edf96/dcb44f5-Screenshot_2022-07-22_at_09.52.40.png)
Click the Add Access button and give the GKE-Router service access to the resource you have created.
![](/docs-assets/4fab895/docs/static/05af144bc494455ca18ab2933f98c7e3/9ff85/a02b66a-Screenshot_2022-07-22_at_09.54.34.png)
We can now test this access by going back to the VM in GCP and running a simple CURL command:
This can take a few minutes to update the permissions so you may need to wait a few minutes for this to work.
curl 10.43.40.159
Depending on what your resource is serving may mean you need to run a different command.
Which then returns the HTML from the Ghost web site:
...<!DOCTYPE html><html lang="en"><head>
<title>GHOST BLOG</title> <meta charset="utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <meta name="HandheldFriendly" content="True" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" />
<link rel="stylesheet" type="text/css" href="/assets/built/screen.css?v=4c7ae18aa5" />...
This shows the router has access to the Twingate resource, now we can create a GKE cluster and setup access from it.
Setting up the GKE cluster
Again using the search facility in the GCP console, search for GKE.
![](/docs-assets/4fab895/docs/static/da05c6c5cf306c077e78f6fa3253a2b9/c1724/55a9169-Screenshot_2022-07-22_at_10.00.01.png)
Click on create to create a new cluster, selecting a standard cluster.
![](/docs-assets/4fab895/docs/static/bfc50d39ff2e4d6c0a9653ef29c9e7b0/b06ae/b200374-Screenshot_2022-07-22_at_10.01.04.png)
Name the cluster and make sure it is in the same region and zone as the router.
This is minimal configuration for this guide so you may want to alter other settings in the GKE cluster to suit your requirements.
![](/docs-assets/4fab895/docs/static/902069bc254c014725cbea9aeb53ec67/db783/eee68e5-Screenshot_2022-07-22_at_10.04.17.png)
Select Networking and make sure the cluster is in the network and subnet you created earlier.
![](/docs-assets/4fab895/docs/static/c21af86bfcb46bf5ac928b0e89191457/db783/898c282-Screenshot_2022-07-22_at_11.26.53.png)
Click create to start creating the new GKE cluster, this process will take a few minutes.
Adding the static route
In order for the traffic to route properly from outside of the router VM (ie from the Kubernetes Cluster), we need to add a static route to the Twingate Resource IP address and ensure this is sent via the router.
Navigate back to the VPC network settings page and click on routes.
![](/docs-assets/4fab895/docs/static/60d3ca734e13c8a6fd7f0d3d6636fbd9/d4770/3bc7dab-Screenshot_2022-07-22_at_10.12.33.png)
Click on create route.
Enter in the relevant details for your new route, below is an example based on the configuration in this guide.
You will see that the destination IP range is the IP address used in the example above: This should be your own resource IP address or range used in the remote network.
As shown below, make sure you specify the correct network and the next hop as the VM instance created earlier.
![](/docs-assets/4fab895/docs/static/16ebfca09f6a5eb2b9e293b0c7db5945/74cfa/7e7ecf6-Screenshot_2022-07-22_at_10.14.00.png)
Click the create route button.
Updating firewall rules
By default the GKE cluster and pods will not have access to “talk” to the router VM. Therefore we need to add firewall rules to allow this.
On the VPC network page click on Firewall and Create Firewall Rule.
Firewall Rules
This example adds two firewall rules with access to the whole subnet. You may want to consolidate into one rule and make these rules more restrictive based on your requirements.
Inbound from the cluster IPs:
You can find the IP addresses of the GKE nodes from the VM instances page
![](/docs-assets/4fab895/docs/static/aff802cb6c77eb5e255707745ed0c1d4/f73a1/c09e635-Screenshot_2022-07-22_at_11.32.27.png)
![](/docs-assets/4fab895/docs/static/57860d32b65a46b22699861f40aec643/04abd/5c385e8-Screenshot_2022-07-22_at_11.33.10.png)
Inbound from the pod IP range:
You can find the pod and service IP range from the GKE cluster information page:
![](/docs-assets/4fab895/docs/static/a13192f01a93af964a6edc3cd25f7dae/1e088/7daeecc-Screenshot_2022-07-22_at_11.37.55.png)
Then we can add these to a firewall rule:
![](/docs-assets/4fab895/docs/static/f8dfcb364bd18253b6705e649ebaeea9/86389/9b71252-Screenshot_2022-07-22_at_11.40.30.png)
![](/docs-assets/4fab895/docs/static/66d9a546365a9504d324967d16fa71c6/07eba/5f96cd9-Screenshot_2022-07-22_at_11.39.57.png)
Then click on the create button.
Testing the route from GKE
We will deploy a simple pod to the GKE cluster to allow us to test the route. First we need to access the cluster, the following command will copy the connection information and authentication to your local KUBECONFIG.
Setting up the gcloud cli and kubectl is beyond the scope of this guide.
gcloud container clusters get-credentials twingate-demo --region europe-west1-b
Check you have access to the cluster:
kubectl get pods -A
We can then create a simple pod, create a new file called ubuntu.yaml with the following contents:
apiVersion: v1kind: Podmetadata: name: ubuntu labels: app: ubuntuspec: containers: - name: ubuntu image: ubuntu:18.04 command: ["/bin/sleep", "3650d"] imagePullPolicy: IfNotPresent resources: limits: memory: "128Mi" cpu: "500m" securityContext: capabilities: add: - NET_ADMIN restartPolicy: Always
Then we can apply this to the cluster:
kubectl apply -f ubuntu.yaml
You should see the pod being created and in a running state:
NAMESPACE NAME READY STATUS RESTARTS AGEdefault ubuntu 1/1 Running 0 45m
We can then access the pod with the following command:
kubectl exec -it ubuntu /bin/bash
Curl is not required for this setup
We will install it to make sure connectivity between the Pods and the Twingate Resource works.
Once inside the pod we need to install CURL by running the following:
apt updateapt install curl -y
Once CURL is installed we can test the connection to our remote resource:
curl 10.43.40.159
All being well you should see a response back from the remote resource:
As mentioned previously, depending on what the remote resource is, you may need to use a different command to test connectivity.
...<!DOCTYPE html><html lang="en"><head>
<title>GHOST BLOG</title> <meta charset="utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <meta name="HandheldFriendly" content="True" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" />
<link rel="stylesheet" type="text/css" href="/assets/built/screen.css?v=4c7ae18aa5" />...
Pod Connectivity
Any pods within your cluster should now be able to communicate with this remote resource!
Thank you for taking the time to read this guide, if you have any questions or issues when using this guide, please contact us, we appreciate any feedback.
Last updated 2 months ago