Installation Overview
DIY ➜
If you require complex or custom routing, and have Infrastructure-as-Code for your deployments already, this is where you will find the key information. Terraform practitioners pick this option.
QUICK START ➜
For a 5-minute deployment, assuming secure defaults, from within the marketplace console itself. This will totally lock down your VPC from the get-go unless appropriate FQDN-based egress firewall rules exist for outbound connections, and VMs needing to bypass DiscrimiNAT completely are network-tagged with bypass-discriminat.
CONFIG REFERENCE ➜
The various ways GCP-native Firewall Rules can be annotated with appropriate FQDN allowlists and traffic monitoring rules after deployment of DiscrimiNAT.
LOGS REFERENCE ➜
Fields, filters and recipes to find what you need from DiscrimiNAT's config and flow logs in GCP.
ARCHITECTURE
Pertaining to the Quick Start only. If you go down the DIY route, the architecture will be as per your design.
A DiscrimiNAT Firewall becomes the NAT solution for your VPC, making the use or presence of other NAT gateways redundant.
It is architected along the Internal TCP/UDP load balancers as next hops guide from Google Cloud. As the guide suggests, these NAT instances are simply a bump-in-the-wire with:
- no explicit client configuration
- load balancing
- proactive health-checks
Shared VPC support has landed in v2.3. Contact our DevSecOps for any questions or help with deployment.
MARKETPLACE
The DiscrimiNAT Firewall is listed on the Google Cloud Marketplace. The architecture discussed above is available as a Deployment Manager template to launch on subsequent steps from the marketplace subscription.