search

gravitl / netmaker

Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.
https://netmaker.io
Other
9.52k stars 552 forks source link

A way to separate dashboard and API TCP ports for better security #1505

Closed kid-alan closed 2 years ago

kid-alan commented 2 years ago

Hello there, team!

I highly appreciate the effort you are putting in this project.

We want to better secure our Netmaker installation, so we are trying to separate the web-dashboard access from the API communication of the netclients. The access to the web dashboard = compromise of the whole private network, since it becomes trivial to create a token and instantly get an access to the network.

The Goal

The goal is:

  1. Hide the web dashboard behind a firewall, so that it would be only accessible from our premises.
  2. Leave the API accessible from the whole internet, so that no additional firewall configuration is required to connect an additional node.

Example https://dashboard.netmaker.com:8080 for web control; behind the firewall https://api.netmaker.com:443 for nodes communication; accessible from anywhere

Configuration

We are running a standard docker-compose configuration described in this doc: https://netmaker.readthedocs.io/en/master/quick-start.html. As far as I can see, netclients are communicating with the netmaker using the same port :443, as a https web interface.

Could you please guide me to the solution? I have tried a couple of options, like changing different ports in docker-compose.yml configuration, but wasn't able to achieve my goal. Perhaps I can ask you for a little help, since you have a better understanding of the system overall.

If you need any additional info, I will be glad to provide it! Any help will be appreciated. Perhaps you could even suggest some alternative way of securing the system.

afeiszli commented 2 years ago

In the labels of your netmaker-ui section of your docker-compose:

  1. you need to add this line:

    • traefik.http.middlewares.nmui-security-1.ipwhitelist.sourcerange=YOUR_IP_CIDR

  2. you need to change this line:

    • traefik.http.routers.netmaker-ui.middlewares=nmui-security@docker to this:
    • traefik.http.routers.netmaker-ui.middlewares=nmui-security-1@docker,nmui-security@docker

After that, docker-compose down / up and you should be good.

Replace YOUR_IP_CIDR with the whitelist ip range (can be multiple ranges)

afeiszli commented 2 years ago

Note: this solution does not require changing the netmaker UI ports.