0

let's imagine a simple system deployed on GCP. There is public, authenticated (token, IP whitelisting) API exposed by our system. There is a protected resource R (SQL database) that is accessible by API. We would like to add to our system additional possibility accessing via VPN for some our clients, it means that part of R should be accessible only via VPN and, other part of R should accessible still via public API. Can you hint me how to correctly design it?

3
  • What's GCP? Please add details (diagram, device types, configs) of your current setup. Or is this a general question? – Zac67 Mar 2 at 7:30
  • It is general question – Gilgamesz Mar 2 at 7:39
  • Unfortunately, questions about host/server/VM configurations are off-topic here. You could try to ask this question on Server Fault for a business network. – Ron Maupin Mar 2 at 13:15
1

Generally, you put a public server in a demilitarized zone (DMZ).

Optimally, you configure public services and private services to different interfaces/IP addresses. Alternatively, you can use different TCP ports (e.g. port 443 to public HTTPS access and port 8443 for private/administrative HTTP access).

On the public-facing firewall, you permit traffic to the public IP/port (possibly using port forwarding/destination NAT, depending on design). On the firewall facing the private network, you can permit traffic to more services.

Then you can add a VPN gateway, allowing VPN peers access to more than the public services.

2
  • Thanks for your response. > Then you can add a VPN gateway, allowing VPN peers access to more than the public services. How to do it? – Gilgamesz Mar 2 at 7:56
  • What are your premises? We can't detail the selection, design and configuration of a VPN solution within the scope of this site. – Zac67 Mar 2 at 9:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.