How to Configure a Droplet as a VPC Gateway

Configure Gateway Droplet

To configure your gateway Droplet, you need to configure its IP forwarding and the NAT settings.

Configure IP Forwarding

IP forwarding allows the Droplet to act as a router and forward packets to target Droplets within your VPC network.

To enable IP forwarding, connect to your Droplet and run:

sysctl -w net.ipv4.ip_forward=1

To persist these changes, open /etc/sysctl.conf in a text editor:

nano /etc/sysctl.conf

Add the line net.ipv4.ip_forward=1 to the bottom of the file, then save it. Depending on your Linux distribution, this line may already exist in the file, commented out. In this case, uncomment it by deleting the # at the beginning of the line.

    
        
            
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1

        
    

Configure NAT

Network address translation (NAT) converts the private IP addresses associated with your VPC network’s traffic to the IP address of your internet gateway, and vice versa. This allows the gateway to correctly route traffic between your backend resources and the public internet. You can configure the gateway Droplet to perform NAT using the native Linux utility, iptables.

Using the following iptables command, configure the gateway Droplet to translate traffic from your VPC network’s subnet to the public IP of the gateway Droplet, replacing <vpc_network_prefix> with your VPC network’s private IP prefix:

iptables -t nat -A POSTROUTING -s <vpc_network_prefix> -o eth0 -j MASQUERADE

To locate your VPC network’s prefix in the control panel, click Networking in the main menu, then select the VPC tab. From the list of VPC networks, locate the target network. The network’s prefix is listed beside the public name in the second column.

Note

On DigitalOcean Droplets, the default name for the public network interface is eth0. If you have changed this, replace eth0 in the iptables command with the correct interface name.

You can find your Droplet’s public interface name with ip:

ip -br a

The -br flag returns only basic information about the Droplet’s network interfaces for better readability. The a argument returns all IP addresses associated with the Droplet’s network interfaces.

To persist these changes so that the NAT rule is automatically enabled when the Droplet boots up, install iptables-persistent:

sudo apt-get install iptables-persistent

Upon successful installation, iptables-persistent asks if you want to save the current IPv4 rules. Select Yes.

To save future IPv4 rule changes, use the command iptables-save > /etc/iptables/rules.v4.

Configure Backend Droplets

After configuring the gateway Droplet, you need to configure new IP routes for any backend Droplets that should use the gateway to access the internet. These routes direct traffic destined for the internet through the gateway Droplet.

Because you are redirecting the backend Droplet’s internet traffic through the gateway Droplet, you need to log in to the backend Droplet from the gateway Droplet. Otherwise, the SSH connection drops once you change the IP routes.

To log in to the backend Droplet from the gateway Droplet, open a new terminal on your local machine and run the following ssh command with the ProxyCommand option, replacing the <public_IP_of_gateway_Droplet> and <private_IP_of_backend_Droplet> values with the applicable IP addresses. The ProxyCommand option tells SSH to connect to the gateway Droplet first, and then use that connection to connect to the backend Droplet:

ssh -o ProxyCommand="ssh -W %h:%p root@<public_IP_of_gateway_Droplet>" root@<private_IP_of_backend_Droplet>

Once logged into the backend Droplet, you need to add an IP route to its network configuration that retains the Droplet’s access to its metadata endpoint (169.254.169.254). The metadata endpoint is a service provided by DigitalOcean that allows the Droplet to access data about itself, like its IP address, DNS name server settings, and network interface information.

To do this, locate the backend Droplet’s original gateway IP address by sending the following curl request to the metadata endpoint:

curl -s http://169.254.169.254/metadata/v1/interfaces/public/0/ipv4/gateway

The command returns the backend Droplet’s current gateway address.

To create the necessary IP route, run the following command, replacing the <your-gateway-IP> value with the gateway IP address returned in the curl request:

ip route add 169.254.169.254 via <your-gateway-IP> dev eth0

The command line returns a blank prompt when executed.

Next, add your gateway Droplet’s IP as a route to the backend Droplet’s network configuration:

ip route change default via <private_IP_of_gateway_Droplet>

To persist these changes and ensure that the Droplet boots with the new default route, you need to remove the old gateway route and add the new gateway route to the Droplet’s network configuration file. Before you do, we recommend making a backup make a copy of the default network configuration file:

cp /etc/netplan/50-cloud-init.yaml /etc/netplan/50-cloud-init.yaml.backup

To edit your network configuration file, open /etc/netplan/50-cloud-init.yaml in a text editor:

nano /etc/netplan/50-cloud-init.yaml

Then remove the routes stanza containing the Droplet’s original gateway IP address from the eth0 interface and add the new route to the eth1 interface, as shown in the example below:

    
        
            
  GNU nano 6.2                                     /etc/netplan/50-cloud-init.yaml                                               
# This file is generated from information provided by the datasource.  Changes
# to it will not persist across an instance reboot.  To disable cloud-init's
# network configuration capabilities, write a file
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
# network: {config: disabled}
network:
    version: 2
    ethernets:
        eth0:
            addresses:
            - 137.184.174.21/20
            - 10.20.0.7/16
            match:
                macaddress: 86:bc:46:82:4d:95
            mtu: 1500
            nameservers:
                addresses:
                - 67.207.67.3
                - 67.207.67.2
                search: []
            routes:
            -   to: 0.0.0.0/0
                via: <original gateway address>
# Remove this route from the file.                
            set-name: eth0
        eth1:
            addresses:
            - 10.118.0.4/20
            match:
                macaddress: 5a:59:57:e0:f3:9d
            mtu: 1500
            nameservers:
                addresses:
                - 67.207.67.3
                - 67.207.67.2
                search: []
            routes:
            -   to: 0.0.0.0/0
                via: <private IP address of gateway Droplet>
            set-name: eth1

        
    

Save the changes and exit the file. Then run the following command to apply the new network configuration:

netplan apply -debug

The -debug flag returns any YAML formatting errors in the configuration file. If formatted correctly, the command returns a blank prompt.