News
BackRouter With Internet Gateway for Private Networks
Private networks enable communication when not all participating systems are supposed to be accessible from the internet – for example, between a web server and a database server. However, it is usually not possible to do without internet access entirely, such as when you want to install software and patches on the isolated server. With the newly introduced router, you now have an internet gateway with SNAT for IPv4 available "out of the box" for outbound connections.
Isolation in private networks
By default, every server at cloudscale is assigned a public IP address and is therefore accessible from the internet. However, when you create a server (and also at a later time via the API), you can specify that the server should have an additional or exclusive connection to a private network.
A database server, for example, could have a private network interface only – a web server can then access the database through this private network, while direct access (or attacks) from the internet are impossible from the outset. The web server, for its part, is present on both networks: it is accessible to your users on the "public" network and connected to the database on the private network.
Internet gateway as a new connection option
To access the DB server from outside – for example, for maintenance work – you have several options. You can use an SSH chain or tunnel and first connect from outside to the web server (or a separate jump host), and from there to the DB server. You can also set up a dedicated firewall server (e.g., using OPNsense or pfSense) and use routing, port forwarding, or a VPN there. Finally, you could use a load balancer and create pools, each with a single pool member, to forward SSH connections to specific servers.
A separate issue, however, is how your DB server can access the internet without a "public" interface – for example, to download a software update. In particular, you could use a proxy or NAT gateway that you set up on the web or firewall server. With our new "Router" feature, you can now save yourself this work: In no time at all, you will have a NAT gateway for the servers on your private network, without having to worry about configuration details or ongoing maintenance.
Setting up a router with internet gateway
You can create a router by issuing a simple API call, and then connect it to the desired private network with one more API call. In addition to a "display name" to clearly identify the router later, you specify which IP address it should have on the private network. You can then have DHCP assign this address to your servers as "default gateway" - and outbound connections will work right away, while your servers remain "invisible" from the outside.
As always, you can find the required API calls in our API documentation, including sample requests and responses. We have also already updated our Terraform provider, Ansible collection, and Go SDK so you can manage the router "as code" along with your other cloud resources. Our new router with internet gateway not only saves you time and effort, but it is also affordable: we charge just CHF 1.00 per day per router – regardless of how many servers in your private network are using it.
By the way: You can also connect two or more private networks to a single router. In that case, however, keep in mind that the router not only acts as a gateway to the internet for all of these networks, but also enables communication between the connected private networks – a feature you can, of course, use even without internet gateway.
To connect to your isolated servers "from the outside", there are a variety of approaches you can implement depending on your tools, preferences, and security considerations. Connections "from the inside to the outside", on the other hand, should above all be simple and reliable – and that is exactly what our new router with internet gateway now offers you "out of the box".
On the right route,
Your cloudscale team