Skip to main content

Gateway Setup Guide

Complete guide to setting up and configuring gateway nodes in your Camouflage network.

Overview​

Gateways provide entry points to private networks, allowing Camouflage clients to access resources that aren't directly connected to the network.

Setup Workflow​

1. Prerequisites Check​

Before creating a gateway:

  • ✅ Relay server is deployed and accessible
  • ✅ Management backend is running
  • ✅ Network is created in the management console
  • ✅ Docker installed on gateway host
  • ✅ Gateway host has access to private resources

2. Create Network​

If you haven't already, create a network:

# Via API
curl -X POST https://backend.yourdomain.com/api/v1/networks \
  -H "Authorization: Bearer your-token" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "office-network",
    "subnet": "10.100.0.0/24",
    "description": "Office network access"
  }'

Or via Web Console:

  1. Navigate to Networks → Create Network
  2. Fill in network details
  3. Click Create

3. Create Gateway Node​

Via Web Console​

  1. Go to Networks → Select your network
  2. Click Gateways tab
  3. Click Add Gateway
  4. Configure gateway:
    • Name: office-gateway
    • Advertise Routes: 192.168.1.0/24
    • DNS Servers: 8.8.8.8, 1.1.1.1
  5. Click Create
  6. Copy the generated token

Via API​

curl -X POST https://backend.yourdomain.com/api/v1/networks/123/gateways \
  -H "Authorization: Bearer your-token" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "office-gateway",
    "advertise_routes": ["192.168.1.0/24"],
    "dns_servers": ["8.8.8.8", "1.1.1.1"]
  }'

Response:

{
  "id": "gw-456",
  "name": "office-gateway",
  "network_id": "net-123",
  "token": "gw_token_abc123...",
  "advertise_routes": ["192.168.1.0/24"],
  "status": "pending"
}

4. Deploy Gateway Container​

Use the token from step 3:

docker run -d \
  --name camouflage-gateway-office \
  --restart unless-stopped \
  --cap-add NET_ADMIN \
  --cap-add SYS_MODULE \
  --device /dev/net/tun \
  -e GATEWAY_NETWORK_ID=net-123 \
  -e GATEWAY_TOKEN=gw_token_abc123... \
  -e GATEWAY_RELAY_URL=https://relay.yourdomain.com:61700 \
  camouflagenetworks/camouflage-gateway:latest

5. Verify Gateway Connection​

Check gateway status:

# Via logs
docker logs camouflage-gateway-office

# Via API
curl https://backend.yourdomain.com/api/v1/gateways/gw-456 \
  -H "Authorization: Bearer your-token"

Expected response:

{
  "id": "gw-456",
  "name": "office-gateway",
  "status": "connected",
  "connected_at": "2025-01-01T12:00:00Z",
  "peer_count": 5,
  "bytes_sent": 1048576,
  "bytes_received": 2097152
}

Configuration Options​

Route Advertisement​

Advertise specific routes through the gateway:

advertise_routes:
  - "192.168.1.0/24"    # Office LAN
  - "10.0.10.0/24"      # Internal services
  - "172.16.0.0/16"     # Legacy systems

These routes become accessible to all nodes in the network.

DNS Configuration​

Configure DNS servers for the gateway:

dns_servers:
  - "8.8.8.8"           # Google DNS
  - "1.1.1.1"           # Cloudflare DNS
  - "192.168.1.1"       # Local DNS server

ACL Rules​

Apply ACL rules to control access:

{
  "rules": [
    {
      "action": "allow",
      "source": "10.100.0.0/24",
      "destination": "192.168.1.0/24",
      "ports": [22, 80, 443],
      "protocol": "tcp"
    },
    {
      "action": "deny",
      "source": "*",
      "destination": "192.168.1.100",
      "description": "Block access to sensitive server"
    }
  ]
}

Advanced Configuration​

High Availability​

Deploy multiple gateways for redundancy:

# Primary gateway
docker run -d \
  --name gateway-primary \
  --cap-add NET_ADMIN --cap-add SYS_MODULE \
  --device /dev/net/tun \
  -e GATEWAY_NETWORK_ID=net-123 \
  -e GATEWAY_TOKEN=token1 \
  -e GATEWAY_PRIORITY=100 \
  camouflagenetworks/camouflage-gateway:latest

# Backup gateway
docker run -d \
  --name gateway-backup \
  --cap-add NET_ADMIN --cap-add SYS_MODULE \
  --device /dev/net/tun \
  -e GATEWAY_NETWORK_ID=net-123 \
  -e GATEWAY_TOKEN=token2 \
  -e GATEWAY_PRIORITY=50 \
  camouflagenetworks/camouflage-gateway:latest

Clients will prefer the gateway with higher priority.

Custom Routing​

Configure advanced routing:

routing:
  # Don't route all traffic through gateway
  default_route: false

  # Only route specific networks
  include_routes:
    - "192.168.1.0/24"
    - "10.0.10.0/24"

  # Never route these networks
  exclude_routes:
    - "192.168.1.100/32"  # Exclude specific host

  # Metric for route preference
  metric: 100

NAT and Port Forwarding​

Enable NAT for internet access:

nat:
  enabled: true
  masquerade: true

port_forwarding:
  - external_port: 8080
    internal_ip: "192.168.1.100"
    internal_port: 80
    protocol: tcp

Monitoring and Management​

View Gateway Status​

# List all gateways
curl https://backend.yourdomain.com/api/v1/gateways \
  -H "Authorization: Bearer your-token"

# Get specific gateway
curl https://backend.yourdomain.com/api/v1/gateways/gw-456 \
  -H "Authorization: Bearer your-token"

View Connected Peers​

curl https://backend.yourdomain.com/api/v1/gateways/gw-456/peers \
  -H "Authorization: Bearer your-token"

Gateway Metrics​

# Prometheus metrics
curl http://gateway-host:9090/metrics

# Specific metrics via API
curl https://backend.yourdomain.com/api/v1/gateways/gw-456/metrics \
  -H "Authorization: Bearer your-token"

Lifecycle Management​

Update Gateway​

# Pull latest image
docker pull camouflagenetworks/camouflage-gateway:latest

# Restart with new image
docker stop camouflage-gateway-office
docker rm camouflage-gateway-office

# Run with same configuration
docker run -d \
  --name camouflage-gateway-office \
  ... [same options as before]

Remove Gateway​

# Stop and remove container
docker stop camouflage-gateway-office
docker rm camouflage-gateway-office

# Delete from backend
curl -X DELETE https://backend.yourdomain.com/api/v1/gateways/gw-456 \
  -H "Authorization: Bearer your-token"

Troubleshooting​

Gateway Not Connecting​

  1. Check relay connectivity:

    docker exec camouflage-gateway-office ping relay.yourdomain.com

  2. Verify token:

    docker logs camouflage-gateway-office | grep -i token

  3. Check firewall:

    # On gateway host
    sudo iptables -L -n -v

Routes Not Propagating​

  1. Verify advertised routes:

    docker exec camouflage-gateway-office ip route

  2. Check ACL rules:

    • Ensure ACLs allow the advertised routes

  3. Restart gateway:

    docker restart camouflage-gateway-office

Performance Issues​

  1. Check resource usage:

    docker stats camouflage-gateway-office

  2. Increase resources:

    docker update --cpus=2 --memory=4g camouflage-gateway-office

  3. Review logs for errors:

    docker logs --tail=100 camouflage-gateway-office

Best Practices​

  1. Security

    • Rotate gateway tokens regularly
    • Use ACLs to restrict access
    • Monitor gateway logs for suspicious activity

  2. High Availability

    • Deploy multiple gateways
    • Use different physical hosts
    • Configure priority for failover

  3. Monitoring

    • Enable metrics collection
    • Set up alerts for gateway failures
    • Monitor bandwidth usage

  4. Maintenance

    • Keep gateway images updated
    • Regular testing of failover
    • Document gateway configurations

Next Steps​

See Also​