Gateways and Relays

Overview

Gateways serve as the primary entry point to a StrongDM network. Gateways have an assigned IP address and optional DNS entry.

Relays, much like gateways, are how the StrongDM network connects with resources such as databases and servers. Unlike a gateway, the relay does not listen for client connections. When might this be helpful? For a secure network where you are not able to expose ports, the StrongDM relay is the answer. The relay dials out to connect to your gateways, preserving the egress-only nature of your firewall, but allowing your StrongDM clients to reach any configured resources in the network via those connections.

Gateways

Gateways serve as the primary entry point to a StrongDM network. Therefore, each gateway must be assigned an address that is accessible to your users. They can be deployed with a Domain Name System (DNS) entry or sit privately on the corporate network behind a Virtual Private Network (VPN). You can also assign an IP address directly if you prefer not to use DNS or a VPN. You need at least one gateway to connect to resources, but we recommend running them in pairs.

StrongDM gateways are usually exposed directly to the internet. In the case of a flat network, the gateway talks to the target systems on the corporate network. On a segmented network with no ingress, however, resources such as databases and servers may not be publicly accessible. If you wish to extend your StrongDM network into a more secure network or subnet, you may deploy a relay behind your firewall to route traffic and allow egress-only connections to secured resources.

Gateways are essentially relays with an assigned IP address and optional DNS entry. Both gateways and relays also decrypt end-user credentials and deconstruct requests for auditing purposes.

When clients connect to the StrongDM network, they request a list of available gateways. StrongDM determines the most suitable route and sends all connections through one or more of these gateways. From the point of view of a resource, such as a database or server, all traffic originates from any relay or gateway with access to the resource.

Gateways can be deployed as a native Linux service, Docker container, or Kubernetes container. For more, check the Download & Install page in the Admin UI.

Gateway settings and configurations can be managed in the Admin UI from Networking > Gateways. On the Gateways page, you can add new gateways and view the status and details of existing gateways.

Add a gateway

1. Log in to the Admin UI.

2. Go to Networking > Gateways.

3. Click Add gateway. You can rename the gateway here or modify it later. Advertised host is the IP address or host that the gateway listens on. The Advertised port (default 5000) is the port that the service listens on.

   
4. Click Advanced to add a Bind IP or a Bind Port.

5. Click Create gateway and the gateway token appears in a modal. Copy the gateway token and save it for use in a later step.

   
6. Set up a 64-bit Linux instance to run the gateway. Machines should have at least 2 CPUs and 4 GB of memory. If the instance is using SELinux, you need to disable SELinux to install the gateway.

1. Log in to the gateway instance. Then download the StrongDM binary:

curl -J -O -L https://app.strongdm.com/releases/cli/linux

curl -J -O -L https://app.uk.strongdm.com/releases/cli/linux

curl -J -O -L https://app.eu.strongdm.com/releases/cli/linux

1. Unzip the binary:

   Copy

   unzip sdmcli_VERSION_NUMBER_linux_amd64.zip

2. Run the installer:

sudo ./sdm install --node

sudo ./sdm install --app-domain app.uk.strongdm.com --node

sudo ./sdm install --app-domain app.eu.strongdm.com --node

The installer must be run by a user that exists in the /etc/passwd file. Any users remotely authenticated, such as with LDAP or an SSO service, will fail to complete the installation.

1. When you are prompted for the gateway token you created in Step 5, paste it into the terminal. Press enter. For security purposes, the token does not display in the terminal.

2. Log in to the Admin UI and go to Networking > Gateways. The gateway you created appears online and healthy. You may need to hard refresh the page.

3. Confirm your gateway creation was successful by verifying that the LISTENADDR is accessible from the appropriate end user network, as in the following example.

telnet 10.0.50.17 5000
Trying 10.0.50.17...
Connected to 10.0.50.17
Escape character is '^]'

1. Repeat this process to create a second gateway if you wish.

Relays

As with gateways, StrongDM uses relays to connect with network resources such as databases and servers. However, relays do not listen for client connections. They can be deployed behind your firewall when internal subnets do not allow ingress, and you are not able to expose ports publicly.

Relays create a reverse tunnel to form connections to the gateway. With this action, they preserve the egress-only nature of your firewall and allow your users to reach any configured resources in the network via their https://app.gitbook.com/s/HaY8OFbXUreWEF61MhKm/users/client.

When clients connect to the StrongDM network, they request a list of available gateways. StrongDM determines the most suitable route and sends all connections through one or more of these gateways. From the point of view of a resource, such as a database or server, all traffic originates from any relay or gateway with access to the resource.

The relay component can be deployed as a native Linux service, Docker container, or Kubernetes container. For more, check the Download & Install page in the Admin UI.

Relay settings and configurations can be managed in the Admin UI from Networking > Relays. On the Relays page, you can add new relays and view the status and details of existing relays.

Relay use cases

How do you know when to deploy a relay instead of a gateway? You may wish to use a relay if your organization has sensitive resources or if you want to isolate certain parts of the network in order to further protect them.

Relays are typically used if the organization has any of the following:

• Sensitive internal website resources (data science tools, CI/CD, internal repositories, and so forth)

• Sensitive databases with network compliance requirements

• Sensitive servers with network compliance requirements

• Segmented networks for Protected Health Information (PHI), Personally Identifiable Information (PII), or other sensitive data, with separate VPCs with additional compliance requirements

Add a relay

Add a relay to generate a relay token.

1. Log into the Admin UI.

2. Go to Networking > Relays.

3. Click the Add relay button.

4. In the modal that appears, you can rename the relay, or you can do it later.

5. Click Create relay and the relay token appears.

6. Copy the relay token and save it for use in a later step.

7. Set up a 64-bit Linux instance to run the relay. Machines should have at least 2 CPUs and 4 GB of memory. If the instance is using SELinux you need to disable SELinux to install the relay.

8. Log in to the relay instance and download the StrongDM binary:

curl -J -O -L https://app.strongdm.com/releases/cli/linux

curl -J -O -L https://app.uk.strongdm.com/releases/cli/linux

curl -J -O -L https://app.eu.strongdm.com/releases/cli/linux

1. Unzip it:

   Copy

   unzip sdmcli_*_linux_amd64.zip

2. Run the installer:

sudo ./sdm install --node

sudo ./sdm install --app-domain app.uk.strongdm.com --node

sudo ./sdm install --app-domain app.eu.strongdm.com --node

1. When prompted for the relay token you created in Step 5, paste it into the terminal and press enter. For security purposes you will not see the token on the screen.

2. Log in to the Admin UI and the relay you created should now appear as online, with a heartbeat. You may need to hard refresh the page.

3. Repeat this process to create a second relay if you wish. We recommend running them in pairs for high availability.

4. To allow access to and from resources and StrongDM, make sure that relay egress requirements are met.

Egress Requirements

Although relays do not allow ingress, both gateways and relays do have some egress requirements. Gateways and relays must be able to successfully send traffic to several destinations in order to function correctly. Specifically, they must meet the following minimal egress requirements:

For more information, please see the Ports Guide.

Additionally, if your organization requires outbound traffic from your infrastructure to pass through your own corporate proxy, you must set either or both of the SDM_HTTP_PROXY/SDM_HTTPS_PROXY environment variables. Please see the Enviroment Variables for a list of available environment variables for use with StrongDM.

Gateway and Relay Management in the Admin UI

The Gateways and Relays pages of the Admin UI list the gateways and relays that have been configured for your organization. On these pages, you may search and filter on gateways and relays, view status, view the last heartbeat, and get more details about each node.

A list (in table format) of existing gateways or relays is displayed on the Gateways and Relays pages in the Admin UI. You can sort the table of gateways or relays in your organization by clicking on column headers. Clicking a column header sorts the table by the values in that column, in ascending order. Clicking again on the same header reverses the sorting direction.

Search filters

You can use search filters to search for specific gateways and relays and display them according to their name, status, listen address, or bind address.

To use filters, type or copy/paste the following filters into the Search field, with or without other text. Do not use quotes or tick marks.

View status

In addition to the gateway or relay name and heartbeat, you can see its current status (for example, "online").

The possible statuses for gateways and relays are shown in the following table.

Maintenance and Monitoring

There are several features that enable administrators to maintain and monitor the status of the gateways and relays in their organization.

Maintenance Windows

See the Maintenance Windows for information about how to schedule a maintenance window for gateways and relays.

If a gateway or relay has been active (had a heartbeat at least once) and then remains completely inactive (no heartbeat) for 30 days, it is automatically removed from the StrongDM organization due to its inactivity.

Liveness Check

The StrongDM binary includes a configurable 'liveness' URL that you can use to verify that the relay/gateway is alive and functioning properly. To enable this URL:

• Docker: Add -e SDM_ORCHESTRATOR_PROBES=:9090 to the invocation. 9090 is the default port; you can replace it with any port.

• Kubernetes: Liveness check is already enabled in the Kubernetes configuration.

• Direct configuration: Add the SDM_ORCHESTRATOR_PROBES environment variable when starting the relay/gateway process, setting it to :9090 or whichever port you prefer.

Once configured, you can check http://ip-of-relay:9090/liveness, replacing 9090 with the port you configured in the environment variable. If it returns HTTP status 200, then the relay/gateway is in good health.

Relay/Gateway Capacity

The StrongDM binary is carefully designed to use a relatively constant amount of RAM, so its memory utilization should not change significantly through the process lifecycle. Because of this, StrongDM recommends watching the CPU load of the underlying machine to assess the need for additional capacity.

Load Average

The StrongDM binary will use all available CPUs. If you note that more than 50% of your CPU cores are constantly saturated, then this is a good measure that it is time to scale up.

CPU Time of sdm Process

If you notice that the CPU time of the sdm process is increasing faster than real time (for instance, if it uses 30 hours of CPU time in 15 hours of real time) then this is another indication that it is time to scale up capacity.

Install Your Gateway or Relay

The first step to deploy StrongDM is to decide where to host your StrongDM gateways and relays. This is not a final decision; you can change them, or add additional gateways and relays at any time. Check out the following guides to learn how to install a node on various tech stacks: