Skip to main content

Install Gateway on Docker

Deploy Camouflage gateway nodes using Docker to provide access to your private networks.

Prerequisites​

  • Docker Engine 20.10 or later
  • Access to the Camouflage management backend
  • Network connectivity to relay servers
  • Appropriate firewall rules for private network access

Understanding Gateways​

Gateways in Camouflage serve as entry points to private networks. They:

  • Run as isolated daemon containers
  • Bridge between the Camouflage network and local resources
  • Are dynamically created when networks are configured
  • Automatically clean up when networks are removed

Installation​

1. Pull the Gateway Image​

docker pull camouflagenetworks/camouflage-gateway:latest

2. Create Gateway Configuration​

Gateways are typically created automatically by the management backend, but for manual setup:

Create /opt/camouflage/gateway/config.yaml:

gateway:
  network_id: "your-network-id"
  relay_url: "https://relay.yourdomain.com:61700"

authentication:
  token: "your-gateway-token"

networking:
  subnet: "10.100.0.0/24"
  dns_servers:
    - "8.8.8.8"
    - "1.1.1.1"

routing:
  default_route: false
  advertise_routes:
    - "192.168.1.0/24"
    - "10.0.0.0/8"

logging:
  level: "info"
  format: "json"

3. Run Gateway Container​

docker run -d \
  --name camouflage-gateway \
  --restart unless-stopped \
  --cap-add NET_ADMIN \
  --cap-add SYS_MODULE \
  --device /dev/net/tun \
  -v /opt/camouflage/gateway/config.yaml:/etc/camouflage/config.yaml \
  -e GATEWAY_NETWORK_ID=your-network-id \
  -e GATEWAY_TOKEN=your-gateway-token \
  camouflagenetworks/camouflage-gateway:latest

4. Verify Gateway Status​

docker logs camouflage-gateway

Expected output:

[INFO] Gateway starting...
[INFO] Connected to relay at relay.yourdomain.com:61700
[INFO] Network configured: 10.100.0.0/24
[INFO] Gateway ready

Configuration Options​

Environment Variables​

VariableDescriptionRequired
GATEWAY_NETWORK_IDNetwork identifierYes
GATEWAY_TOKENAuthentication tokenYes
GATEWAY_RELAY_URLRelay server URLYes
GATEWAY_LOG_LEVELLogging levelNo (default: info)
GATEWAY_DNS_SERVERSDNS servers (comma-separated)No

Required Capabilities​

Gateways require special Docker capabilities:

  • NET_ADMIN - Network configuration
  • SYS_MODULE - Kernel module loading
  • /dev/net/tun - TUN device access

Network Configuration​

To make local networks accessible through the gateway:

routing:
  advertise_routes:
    - "192.168.1.0/24"   # Office network
    - "10.0.0.0/16"      # Internal services

Split Tunneling​

Configure which traffic goes through the gateway:

routing:
  default_route: false  # Don't route all traffic
  include_routes:
    - "192.168.1.0/24"  # Only route specific networks

Management via Backend​

The recommended approach is using the management backend:

Create Gateway via API​

curl -X POST https://backend.yourdomain.com/api/v1/networks/123/gateways \
  -H "Authorization: Bearer your-api-token" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "office-gateway",
    "advertise_routes": ["192.168.1.0/24"]
  }'

The backend will:

  1. Generate gateway token
  2. Create gateway daemon container
  3. Configure networking
  4. Return gateway details

Docker Compose Example​

Create docker-compose.yml:

version: '3.8'

services:
  gateway:
    image: camouflagenetworks/camouflage-gateway:latest
    container_name: camouflage-gateway
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    devices:
      - /dev/net/tun
    environment:
      - GATEWAY_NETWORK_ID=${NETWORK_ID}
      - GATEWAY_TOKEN=${GATEWAY_TOKEN}
      - GATEWAY_RELAY_URL=${RELAY_URL}
      - GATEWAY_LOG_LEVEL=info
    volumes:
      - ./config.yaml:/etc/camouflage/config.yaml
      - gateway-data:/var/lib/camouflage
    networks:
      - host

volumes:
  gateway-data:

networks:
  host:
    external: true

Deploy:

docker-compose up -d

Monitoring​

Health Check​

docker exec camouflage-gateway camouflage-cli status

Output:

{
  "status": "connected",
  "network_id": "net-123",
  "connected_peers": 5,
  "bytes_sent": 1048576,
  "bytes_received": 2097152,
  "uptime": 3600
}

Logs​

# Follow logs
docker logs -f camouflage-gateway

# Last 100 lines
docker logs --tail=100 camouflage-gateway

Metrics​

Access gateway metrics:

curl http://localhost:9090/metrics

Security Considerations​

  1. Token Security - Store gateway tokens securely
  2. Network Isolation - Use Docker networks for isolation
  3. Firewall Rules - Restrict access to gateway container
  4. Regular Updates - Keep gateway image updated

Troubleshooting​

Gateway Won't Connect​

Check relay connectivity:

docker exec camouflage-gateway ping relay.yourdomain.com

Verify token:

docker logs camouflage-gateway | grep -i auth

Missing Capabilities​

Ensure required capabilities are granted:

docker inspect camouflage-gateway | grep -A 10 CapAdd

TUN Device Issues​

Verify TUN device:

docker exec camouflage-gateway ls -la /dev/net/tun

Load TUN module if missing:

sudo modprobe tun

Routing Issues​

Check routing table:

docker exec camouflage-gateway ip route

Verify iptables rules:

docker exec camouflage-gateway iptables -L -n -v

Multiple Gateways​

Run multiple gateways for different networks:

# Gateway 1
docker run -d \
  --name gateway-office \
  --cap-add NET_ADMIN \
  --cap-add SYS_MODULE \
  --device /dev/net/tun \
  -e GATEWAY_NETWORK_ID=office-net \
  -e GATEWAY_TOKEN=token1 \
  camouflagenetworks/camouflage-gateway:latest

# Gateway 2
docker run -d \
  --name gateway-datacenter \
  --cap-add NET_ADMIN \
  --cap-add SYS_MODULE \
  --device /dev/net/tun \
  -e GATEWAY_NETWORK_ID=dc-net \
  -e GATEWAY_TOKEN=token2 \
  camouflagenetworks/camouflage-gateway:latest

Next Steps​

See Also​