Skip to content

Commit 1ad7c72

Browse files
defguard-communitygitbook-bot
authored andcommitted
GITBOOK-137: Updated reverse proxy and gRPC security
1 parent 3359cbe commit 1ad7c72

File tree

3 files changed

+154
-70
lines changed

3 files changed

+154
-70
lines changed

SUMMARY.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@
8686
* [Configuration](deployment-strategies/configuration.md)
8787
* [Running Gateway on OPNsense firewall](deployment-strategies/running-gateway-on-opnsense-firewall.md)
8888
* [Running Gateway on MikroTik routers](deployment-strategies/running-gateway-on-mikrotik-routers.md)
89-
* [Reverse Proxy configuration using NGINX](deployment-strategies/reverse-proxy-configuration-using-nginx.md)
89+
* [Reverse Proxy configuration using Nginx](deployment-strategies/reverse-proxy-configuration-using-nginx.md)
9090
* [High Availability and Failover](deployment-strategies/high-availability-and-failover.md)
9191
* [Updating and version compatibility](deployment-strategies/updating-and-version-compatibility.md)
9292
* [Migration guides](deployment-strategies/upgrading.md)

deployment-strategies/grpc-ssl-communication.md

Lines changed: 100 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,83 @@
11
# Securing gRPC communication
22

3-
Defguard Core has two main communication endpoints:
3+
Defguard components exchange data over gRPC, which must be properly secured to protect sensitive information and prevent unauthorized access.
44

5-
1. gRPC port for communicating with Defguard Gateways,
6-
2. gRPC port for communicating with Defguard Core.
5+
## Firewall rules
76

8-
{% hint style="danger" %}
9-
It is **critical** that:
7+
Defguard components expose two ports that require firewall-level protection:
108

11-
1. Defguard Core's gRPC port is open on a firewall only for IP addresses of Defguard Gateway nodes.
12-
2. Defguard Proxy's gRPC port is open on a firewall only for the IP address of Defguard Core.
13-
3. If you want an additional layer of security, then you should create a **custom SSL Certificate Authority (CA)**, and provide Core, Proxy and Gateway Certificates from that CA so **any other connections to the gRPC services will not be accepted.**
14-
4. Even if you have secured the network ports/firewall and do not want to create a custom SSL CA, please secure gRPC traffic with SSL and a reverse proxy.
15-
{% endhint %}
9+
* Defguard Core exposes a gRPC port for communication with Defguard Gateways.
10+
* Defguard Proxy exposes a gRPC port for communication with Defguard Core.
11+
12+
Limit access to gRPC ports:
13+
14+
* Allow Core’s gRPC port only from Gateway IPs.
15+
* Allow Proxy’s gRPC port only from Core’s IP.
16+
17+
## SSL encryption
18+
19+
Even if you already use [SSL on a reverse proxy](reverse-proxy-configuration-using-nginx.md#obtaining-ssl-certificates), this only protects external traffic. Internal gRPC connections between Proxy, Core, and Gateways occur behind the proxy and must also be encrypted and authenticated. These connections carry sensitive operational data and should never be left unprotected.
20+
21+
You can **choose one** of two approaches:
22+
23+
* [Trusted CA certificates](grpc-ssl-communication.md#trusted-ca-certificates) (simple) – use certificates issued by a recognized Certificate Authority (e.g., Let’s Encrypt). This ensures encrypted traffic and verifies the identity of each component. This approach assumes you're already using [reverse proxy with SSL termination](reverse-proxy-configuration-using-nginx.md#obtaining-ssl-certificates) for Defguard Core or Defguard Proxy.
24+
* [Custom internal CA](grpc-ssl-communication.md#custom-internal-ca) (recommended) – create your own Certificate Authority and issue certificates for Core, Proxy, and Gateway. This enables mutual TLS (mTLS), so only trusted Defguard components can communicate.
25+
26+
Choose one of these options based on your environment: trusted CA for simplicity, or a custom CA for full Zero Trust mutual authentication.
27+
28+
### Trusted CA certificates
29+
30+
If you followed our [guide on configuring SSL for reverse proxy](reverse-proxy-configuration-using-nginx.md#obtaining-ssl-certificates) your certificates should be located in the following path `/etc/letsencrypt/live/domain.name/`. Use the PEM-formatted CA certificate for configuring Defguard components.  
31+
32+
#### Configure Defguard Core
33+
34+
Add path to CA certificate file using command line arguments:
35+
36+
```bash
37+
defguard --proxy-grpc-ca /etc/letsencrypt/live/domain.name/chain.pem
38+
```
1639

17-
## Custom SSL CA and certificates
40+
or using the service's configuration file:
1841

19-
To secure not only with firewall communication between all Defguard gRPC components, a custom SSL chain of certificates should be used. This way the trust will be ensured on the Transport Layer Security (TLS) level.
42+
```toml
43+
proxy_grpc_ca = "/etc/letsencrypt/live/domain.name/chain.pem"
44+
```
45+
46+
or using environment variable:
47+
48+
```bash
49+
env DEFGUARD_PROXY_GRPC_CA=/etc/letsencrypt/live/domain.name/chain.pem \
50+
defguard
51+
```
52+
53+
#### Configure Defguard Gateway
2054

21-
It is important to embed a correct domain name into the certificate as _X509v3 Subject Alternative Name_. The domain name must match the one under which a service is being hosted.
55+
Add path to CA certificate file using command line arguments:
2256

23-
### Quick setup
57+
```bash
58+
defguard-gateway --grpc-ca /etc/letsencrypt/live/domain.name/chain.pem
59+
```
60+
61+
or using the service's configuration file:
62+
63+
```toml
64+
grpc_ca = "/etc/letsencrypt/live/domain.name/chain.pem"
65+
```
66+
67+
or using environment variable:
68+
69+
```bash
70+
env DEFGUARD_GRPC_CA=/etc/letsencrypt/live/domain.name/chain.pem \
71+
defguard-gateway
72+
```
73+
74+
### Custom internal CA
75+
76+
{% hint style="warning" %}
77+
It is important to embed a correct domain name into the certificate as _X509v3 Subject Alternative Name_. The domain name must match the one **under which a service is being hosted**.
78+
{% endhint %}
79+
80+
#### Generate certificates
2481

2582
To quickly generate a set of SSL certificates using [OpenSSL](https://openssl-library.org) or [LibreSSL](https://www.libressl.org), use the following:
2683

@@ -52,19 +109,25 @@ To display certificate file contents:
52109
openssl x509 -noout -text -in core.crt
53110
```
54111

55-
### Defguard configuration
56-
57-
#### Defguard Core
112+
#### Configure Defguard Core
58113

59-
Using command line arguments
114+
Add paths to certificate files using command line arguments:
60115

61116
```sh
62117
defguard --grpc-cert path/to/core.crt \
63118
--grpc-key path/to/core.key \
64119
--proxy-grpc-ca path/to/ca.crt
65120
```
66121

67-
Using environment variables
122+
or using the service's configuration file:
123+
124+
```toml
125+
grpc_cert = "path/to/core.crt"
126+
grpc_key = "path/to/core.key"
127+
proxy_grpc_ca = "path/to/ca.crt"
128+
```
129+
130+
or using environment variables:
68131

69132
```sh
70133
env DEFGUARD_GRPC_CERT=path/to/core.crt \
@@ -73,57 +136,50 @@ env DEFGUARD_GRPC_CERT=path/to/core.crt \
73136
defguard
74137
```
75138

76-
#### Defguard Proxy
139+
#### Configure Defguard Proxy
77140

78-
Using command line arguments
141+
Add paths to certificate files using command line arguments:
79142

80143
```sh
81144
defguard-proxy --grpc-cert path/to/proxy.crt \
82145
--grpc-key path/to/proxy.key
83146
```
84147

85-
Using environment variables
148+
or using the service's configuration file:
149+
150+
```toml
151+
grpc_cert = "path/to/core.crt"
152+
grpc_key = "path/to/core.key"
153+
```
154+
155+
or using environment variables:
86156

87157
```sh
88158
env DEFGUARD_PROXY_GRPC_CERT=path/to/proxy.crt \
89159
DEFGUARD_PROXY_GRPC_KEY=path/to/proxy.key
90160
defguard-proxy
91161
```
92162

93-
### Defguard Gateway
163+
#### Configure Defguard Gateway
94164

95-
Using command line arguments
165+
Add paths to certificate files using command line arguments:
96166

97167
```sh
98168
defguard-gateway --grpc-ca path/to/ca.crt
99169
```
100170

101-
Using environment variables
102-
103-
```sh
104-
env DEFGUARD_GRPC_CA=path/to/ca.crt \
105-
defguard-gateway
106-
```
107-
108-
Using configuration file
171+
or using the service's configuration file:
109172

110173
```toml
111174
grpc_ca = "path/to/ca.crt"
112175
```
113176

114-
## Trusted CA (eg. Let'sEncrypt or others)
177+
or using environment variables:
115178

116-
Often (like in the standalone package based installation tutorial) gRPC communication can be secured by a reverse proxy (NGINX, Caddy, Traefik, etc.) that handles SSL termination. It's common to use typical trusted CA (that is used for typical HTTPS traffic) like Let'sEncrypt or others.
117-
118-
{% hint style="danger" %}
119-
While this secures the transport layer and encrypts communication between Defguard components - it does not provide authorization between gRPC components like Custom CA does.
179+
```sh
180+
env DEFGUARD_GRPC_CA=path/to/ca.crt \
181+
defguard-gateway
182+
```
120183

121-
Thus, this type of SSL termination should only be done if you trust your network and have secured gRPC ports on firewall.
122-
{% endhint %}
123184

124-
If Defguard Core or Defguard Proxy are using reverse proxy with SSL termination, then only you need to configure CA certificate paths for:
125185

126-
* Defguard Gateway – in _gateway.toml_ add path to CA certificate file (in PEM format); for example, when using standard Let'sEncrypt installation ([Certbot](https://certbot.eff.org)), you configure the CA path like this:
127-
* `grpc_ca = "/etc/letsencrypt/live/domain.name/chain.pem"`
128-
* Defguard Core – similarily, you need to configure Proxy CA certificate file using **DEFGUARD\_PROXY\_GRPC\_CA** environment variable:
129-
* `DEFGUARD_PROXY_GRPC_CA: /etc/letsencrypt/live/domain.name/chain.pem`

deployment-strategies/reverse-proxy-configuration-using-nginx.md

Lines changed: 53 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,84 @@
1-
# Reverse Proxy configuration using NGINX
1+
# Reverse Proxy configuration using Nginx
22

33
## Introduction
44

55
This guide explains how to configure [NGINX](https://nginx.org/) as a reverse proxy for Defguard's components (Core and Proxy). The reverse proxy acts as an intermediary between users and Defguard services, handling HTTPS requests, routing internal gRPC communication, and ensuring encrypted connections between all components.
66

77
To provide HTTPS encryption, this guide also uses [Certbot](https://certbot.eff.org/), a free, open-source tool from the [Let’s Encrypt](https://letsencrypt.org/) project. Certbot automatically issues and renews SSL/TLS certificates, allowing you to secure your Defguard domains without manual certificate management.
88

9-
### Installing NGINX and Certbot
9+
{% hint style="info" %}
10+
We assume in this guide that you run your Core and Proxy services on separate servers, and you run Certbot and Nginx on each one of them.
11+
{% endhint %}
1012

11-
To install and prepare NGINX with Let’s Encrypt certificates:
13+
## Installing Nginx and Certbot
14+
15+
Run the followign command to install Nginx and Certbot.
1216

1317
```bash
1418
apt install nginx certbot
15-
systemctl enable nginx.service
16-
systemctl start nginx.service
1719
```
1820

19-
Disable the default configuration to avoid conflicts:
21+
Disable the default Nginx configuration to avoid conflicts:
2022

2123
```bash
2224
unlink /etc/nginx/sites-enabled/default
2325
```
2426

25-
### Obtaining SSL Certificates
27+
## Obtaining SSL certificates
28+
29+
Use Certbot to generate SSL certificates. 
30+
31+
For each service (Core, Proxy), run the following command on the server that your domain’s DNS records resolve to. Ensure that inbound traffic on port 80 is allowed by the firewall and that no other process is using this port.
32+
33+
{% hint style="info" %}
34+
Certbot verifies domain ownership using the HTTP-01 challenge, where it temporarily serves a validation file over port 80 for the exact domain you are requesting a certificate for. 
35+
36+
If the request fails with a timeout or connection error, Let’s Encrypt could not reach this temporary server. This usually means the DNS record for that domain does not point to the correct public IP of the machine running Certbot, port 80 is blocked (firewall or Security Group), an IPv6 (AAAA) record is published but not supported on the server, or another service is already using port 80. 
2637

27-
Before configuring NGINX, issue valid SSL certificates for your domains.\
28-
In this example we use:
38+
Ensure the domain’s DNS resolves to this server’s public IP, inbound port 80 is open, and no other service is binding the port before trying again.
39+
{% endhint %}
2940

30-
* Core: **my-server.defguard.net**
31-
* Enrollment (Proxy): **enroll.defguard.net**
41+
### Obtaining SSL certificate for Core service
3242

33-
Generate certificates with Certbot:
43+
Use the following command to generate certificate with Certbot. Replace the example domain for the Core service (my-server.defguard.net) with your own.
3444

3545
```bash
3646
certbot certonly \
3747
--non-interactive \
3848
--agree-tos \
3949
--standalone \
4050
41-
-d my-server.defguard.net \
42-
-d enroll.defguard.net
51+
-d my-server.defguard.net
4352
```
4453

45-
Certbot will generate certificate in fullchain.pem and privkey.pem in the following paths:
54+
Certbot will generate certificate in fullchain.pem and privkey.pem in the following path:
4655

4756
```
4857
/etc/letsencrypt/live/my-server.defguard.net
58+
```
59+
60+
### Obtaining SSL certificate for Proxy service
61+
62+
Use the following command to generate certificate with Certbot. Replace the example domain for the Proxy service (enroll.defguard.net) with your own.
63+
64+
```bash
65+
certbot certonly \
66+
--non-interactive \
67+
--agree-tos \
68+
--standalone \
69+
70+
-d enroll.defguard.net
71+
```
72+
73+
Certbot will generate certificate in fullchain.pem and privkey.pem in the following path:
74+
75+
```
4976
/etc/letsencrypt/live/enroll.defguard.net
5077
```
5178

52-
### Defguard Core NGINX configuration
79+
## Configuring and starting Nginx
80+
81+
### Configuring and starting Nginx for Core service
5382

5483
Create a new configuration file for the Core service:
5584

@@ -104,13 +133,12 @@ server {
104133
}
105134
```
106135

107-
Enable the configuration and reload NGINX:
136+
Enable the configuration and start Nginx:
108137

109-
```bash
110-
ln -s /etc/nginx/sites-available/my-server.defguard.net.conf /etc/nginx/sites-enabled/my-server.defguard.net.conf
111-
112-
systemctl reload nginx.service
113-
```
138+
<pre class="language-bash"><code class="lang-bash"><strong>ln -s /etc/nginx/sites-available/my-server.defguard.net.conf /etc/nginx/sites-enabled/my-server.defguard.net.conf
139+
</strong>
140+
systemctl start nginx.service
141+
</code></pre>
114142

115143
To verify, run:
116144

@@ -124,7 +152,7 @@ alive
124152
If you use this simple setup and run all services on one server, you can use [NGINX access restrictions](https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-proxied-tcp/) for securing core and allowing to access the _my-server.defguard.net_ only to selected networks - blocking the direct access from the Internet.
125153
{% endhint %}
126154

127-
### Defguard Proxy (Enrollment Service) NGINX configuration
155+
### Configuring and starting Nginx for Proxy service
128156

129157
The Proxy service exposes APIs for enrollment, remote onboarding, and desktop client configuration.\
130158
Create its NGINX configuration file:
@@ -206,12 +234,12 @@ ln -s /etc/nginx/sites-available/enroll.defguard.net.conf /etc/nginx/sites-enabl
206234
systemctl restart nginx.service
207235
```
208236

209-
### Security Recommendations
237+
## Security Recommendations
210238

211239
* Only expose **HTTPS ports (443)** for web access.
212240
* Do **not** expose internal **gRPC ports** (444, 50051, 50055) directly to the Internet.
213241

214-
### Summary
242+
## Summary
215243

216244
After completing the configuration:
217245

0 commit comments

Comments
 (0)