Skip to main content

Installation Overview

DIY & TERRAFORM ➜​

If you require complex or custom routing, and have Infrastructure-as-Code for your deployments already, this is where you will find key information.

QUICK START ➜​

For a 5-minute deployment, assuming secure defaults, from within the marketplace console itself. This will totally lock down your VPC from the get-go unless monitoring mode or appropriate FQDN-based egress firewall rules exist for outbound connections, and VMs needing to bypass DiscrimiNAT are network-tagged with bypass-discriminat.

CONFIG REFERENCE ➜​

The various ways GCP-native Firewall Rules can be annotated with appropriate FQDN allowlists and traffic monitoring rules after deployment of DiscrimiNAT.

DEFAULT PREFERENCES ➜​

Global level preferences for controlling logs verbosity, wildcards exposure and monitoring mode.

LOGS REFERENCE ➜​

Fields, filters and recipes to find what you need from DiscrimiNAT's config and flow logs in GCP Logs Explorer.

ARCHITECTURE​

Pertaining to the Quick Start only. If you go down the DIY route, the architecture will be as per your design.

A DiscrimiNAT Firewall becomes the NAT solution for your VPC, making the use or presence of other NAT gateways redundant.

It is architected along the Internal TCP/UDP load balancers as next hops guide from Google Cloud. As the guide suggests, these NAT instances are simply a bump-in-the-wire with:

  • no explicit client configuration
  • load balancing
  • proactive health-checks

MARKETPLACE​

Launch Free Trial on Google Cloud

The DiscrimiNAT Firewall is listed on the Google Cloud Marketplace. The architecture discussed above is available as a Deployment Manager template to launch on subsequent steps from marketplace subscription.