Site Requirements

Network access requirements

  3 minute read  

Trustgrid’s architecture consists of Nodes deployed at the Edge (on-premise) and management infrastructure built in AWS. Nodes create tunnels to other nodes for data transfer, and to the management infrastructure for control. All tunnels are TLS connections and must be permitted by any firewall between

Recommendations

At least 10 Mbps download speed is recommended for reasonable performance during upgrades. Actual bandwidth requirement will be specific to the workloads running across the device.

Hardware devices are recommended to be connected to ports configured for 1000 Mbps and full duplex with auto negotiation on.

Network Requirements for All Nodes

In order to connect to the Trustgrid Control Plane, the following outbound traffic must be allowed from the node’s configured primary interface IP address

Trustgrid Control Plane

  • TCP Port 443 and TCP 8443 to:
    • 35.171.100.16/28
    • 34.223.12.192/28

Trustgrid Data Plane

Nodes carry customer traffic over encrypted tunnels to gateway nodes. Each node must be able to reach every gateway it peers with on the gateway’s configured public IP and port (typically TCP/UDP port 8443). UDP is only used when UDP tunnels are enabled on the gateway.

The port is set per gateway. If a gateway listens on a non-default port, write the firewall rules for the port actually in use.

Application-Aware (Layer 7) Firewalls

Application-aware (Layer 7) firewalls need more than a port-based allow. The tunnel is encrypted, so the firewall cannot identify it. It passes the handshake while classifying the flow, then drops the rest as unidentified UDP. The tunnel looks healthy but carries no traffic.

On these firewalls, allow UDP to the gateway addresses on the configured port with a rule that does not depend on application identification. Check your firewall vendor’s documentation for how to write that rule. See Edge Node Behavior When UDP Tunnels are Blocked by Application Inspection for symptoms and verification.

Additional Required Network Access

  • TCP/UDP Port 53 to the configured DNS servers. These DNS servers must be accessible from the WAN/outside interface IP and be able to resolve DNS requests for the trustgrid.io domain

Container Address Space

By default, Trustgrid uses the address space 172.18.0.0/16 for the container bridge network. Assigning an interface an IP address in this range can cause unexpected behavior and should be avoided. If required, you can work with Trustgrid support to override the default network.

Gateway Node Network Requirements

In addition to being able to connect to the Control Plane resource outlined above, Gateway Nodes must be allowed to receive inbound traffic on their configured public IP and port (typically TCP/UDP port 8443). Both the advertised public IP and port are configurable when enabling a node as a gateway. Client-side requirements are under Trustgrid Data Plane, including a note on application-aware firewalls.

Public Cloud Appliance Requirements

When deploying Trustgrid nodes in public clouds such as AWS, Azure, or GCP, additional network access may be required to the instance metadata services. These services are used to retrieve instance specific information such as tags, region, and other attributes. This is typically hosted at 169.254.169.254 on port TCP 80 and/or 443.

Additionally when utilizing cluster features such as automatic route failover and IP Failover the nodes will need to be able to reach the cloud provider APIs to manage routing and IP assignments. Please refer to the specific cloud provider documentation for details on required API endpoints and access methods.