How to use your own virtual firewall with Copaco VMware Cloud

Summary

In some cases you want to deploy your own virtual firewall. It is not possible to have a direct internet connection to your virtual firewall since the edge is the demarcation point.

This article describes how you can use your own virtual firewall behind the Copaco VMware Cloud edge.

Prerequisites

• An active Copaco VMware Cloud subscription;

• Deployed the virtual appliance.

Getting Started

This article is divided into 5 parts. You may use the ‘on this page’ section to skip to a different part easily.

Creating required networks

To correctly do this, two Copaco VMware Cloud networks need to be created.

• WAN network: this network is a routed network and only used for the connection between the virtual firewall and edge.

• LAN network: this network is a isolated network and used for LAN traffic and is used for the VMs behind the virtual firewall.

1. Click Networks and click New.

   

2. Select Current Organization Virtual Data Center and click Next.

   

3. Select Routed and click Next.

   

4. Select the edge and click Next.

   

5. Enter the name “WAN”, fill in the gateway CIDR and click Next.
   In this example we will use the 192.168.10.0/24 subnet with a gateway address 192.168.10.1.

   

6. Optional you can use an IP pool 192.168.10.2 -192.168.10.4 since only the virtual firewall will be a member of this “WAN” network. Click Add and Next.

   

7. Untick “Use Edge DNS” and specify your DNS servers (you can also use other public DNS servers) and click Next.

   

8. Review the configuration and click Finish.

   

   
   Now we will to create the LAN network.
   

9. Click on Networks, and click New.

   

10. Select Current Organization Virtual Data Center and click Next.

    

11. Select Isolated and click Next.

    

12. Enter the name “LAN”, fill in the gateway CIDR and click Next.
    In this example we going to use the 192.168.20.0/24 subnet with a gateway address 192.168.20.1.

    

13. Optional you can use an IP pool 192.168.20.2 -192.168.20.100 where the virtual firewall will be a member together with all other VMs of this isolated LAN network. Click Add and Next.

    

14. Optionally: Specify your DNS server and click Next.

    

15. Verify the configuration and click Finish.

    

16. The two networks are created.

    

Connecting the networks

Now the networks are created, both the LAN and WAN networks need to be connected to the virtual firewall. The LAN Network also needs to be connected to the VMs.

In this example we are going to assign the IP address for the virtual firewall WAN interface 192.168.10.3 and for the LAN interface 192.168.20.3. For the VM LAN interface we are going to use the 192.168.20.4

1. Go to Virtual Machines and click on DETAILS for the virtual firewall.

   

2. Click NICs.

   

3. Click Edit.

   

4. Change the Network, IP Mode and IP settings for the WAN network and click Save.
   Adapter Type VMXNET3 (only if it is supported by vendor; check vendor documentation, otherwise you can choose E1000E)
   Network WAN
   IP Mode Static - Manual
   IP 192.168.10.3

   

5. .Click New.

   

6. Change the Network, IP Mode and IP settings for the LAN network and click Save.
   Adapter Type VMXNET3 (only if it is supported by vendor; check vendor documentation, otherwise you can choose E1000E)
   Network LAN
   IP Mode Static - Manual
   IP 192.168.20.3

   

7. The networks are attached to the Virtual_Firewall.

   

8. Go back to Virtual Machines and click on DETAILS for the VM.

   

9. Click NICs, and click Edit

   

10. Click New (or edit).

    

11. Change the Network, IP Mode and IP settings for the VM and click Save.
    Here yo need to specify the following:
    Adapter Type VMXNET3
    Network LAN
    IP Mode Static - Manual
    IP 192.168.20.5

    

12. Now the network is attached to the VM.

    

Configure NICs

After the WAN and LAN networks are connected, they need to be configured. Configuring them depends on the type and vendor used. For the WAN interface you should select the interface which is created during the network creation, which in our example is: 192.186.10.3 and for the LAN interface it should be 192.168.20.3.

On the VMs you must specify the LAN interface IP address of the virtual firewall as the gateway.

Creating Edge Firewall Rules

Now you need to create the following Edge Firewall Rules;

• A Rule to forward all the traffic from the edge to the Virtual Firewall.

• A Rule to forward all the traffic from the Virtual Firewall to the Edge.

1. Click Edges.

   

2. Click on the name of the edge.

   

3. Click IP settings and write down the IP address under IP addresses, you need this during configuration of the firewall rules.

   

4. Click SERVICES.

   

5. Click on Firewall and toggle Show only user-defined rules ON.

   

6. Click the + sign.

   

7. Create a firewall rule with the following settings and click Save changes.
   Name incoming traffic
   Source Any
   Destination the IP address that you have found in step 3
   Service Any
   Action Any
   

8. Click in destination column on IP.

   

9. Enter the IP address and click Keep.

   

10. Click the + sign to add the outgoing rule.

    

11. Create a firewall rule with the following settings and click Save changes.
    Name outgoing traffic
    Source WAN IP from the virtual firewall (192.168.10.3)
    Destination Any
    Service Any
    Action Any

    

Configuring the Edge NAT Rules

Now you need to create the following NAT rules;

• A Nat rule that will NAT all incoming traffic to the Virtual Firewall

• A Nat rule that will NAT all outgoing traffic to the Edge

1. Go to NAT.

   

2. Click on + DNAT Rule

   

3. Click SELECT to select the edge IP.

   

4. Click KEEP.

   

5. Specify the WAN IP from the virtual firewall (192.168.10.3) as Translated IP and give it a description. Click KEEP.

   

6. Click on + SNAT Rule for creating the outgoing NAT rule.

   

7. Specify the WAN IP from the Virtual Firewall as Original Source IP and select the public IP from the edge as translated source IP and click KEEP.

   

8. Click Save changes.

   

9. The incoming and outgoing traffic is now going through your own virtual firewall.