0

Goal

I would like to make use of an API by a 3rd party. This 3rd party requires that I establish a VPN connection to their network. As such, they need a remote peer IP address to establish the VPN, then an internal IP address that they can whitelist.

My application is hosted on Google Cloud Platform, so I would like to set up a VPN tunnel & gateway using Google Cloud VPN. I intend to use a GCE VM to query the 3rd party API via the VPN.

Attempt at solution

I set up a VPN gateway & route-based tunnel (with only a single route) to the 3rd party using Cloud VPN. The GCP console confirmed that the connection was successfully established.

I also set up a GCE VM and assigned it both a static internal IP address and a static external IP address.

The 3rd party whitelisted the static external IP address assigned to my VM.

Problem

My solution did not work. Although the VPN successfully connected, I was unable to ping the internal IP address provided by the 3rd party from my GCE VM.

The problem is that the 3rd party claims it has reserved all possible internal IP addresses in its own network: 172.*, 192.*, 10.*, as weird as that seems... So, it is not possible for them to whitelist the internal IP for my VM, which clashes with their internal address range. Instead, they whitelisted the external IP address assigned to my VM.

This approach did not work, as I could not ping their internal IP from my VM.

Question

How do we get around this? I think the problem is that when I use my VM to query their API via VPN, traffic originates from the internal IP (but they have whitelisted my external IP only). So is there a way to force traffic to originate from my VM's external IP when using Cloud VPN?

I looked into setting up my own VPN on a VM instance, using these instructions: Set up an instance as a VPN gateway. However, it seems that even here I run into the same problem of internal IP address range clashes.

Any help would be greatly appreciated!

  • The third party is out of their mind. Ask them to start being reasonable. – Michael Hampton Sep 25 '18 at 23:08
  • @MichaelHampton, is it really that unreasonable? Suppose they release an IP address, but that clashes with a used IP in my own range... then I would have to reassign IPs in my own network to be able to connect... All that seems weird and convoluted, so I assumed it should be simple enough to have traffic originate from an external IP address. But as a novice I don't know enough about this... – Ismail Khan Sep 26 '18 at 10:14
  • They ask you to give them an internal IP address to whitelist, but tell you that they won't accept any internal IP addresses for that purpose? That's utterly absurd. Of course, it's also ridiculous that you can't use IPv6 (where this problem simply could not exist) but that's Google's fault more than yours. – Michael Hampton Sep 26 '18 at 16:23
  • They seem to think they should be able to whitelist a public IP just fine. They suggested I could source NAT the internal IP to an external IP, but I don’t know how to do that. They do have other customers (none on GCP/AWS/Azure), so must have worked with them somehow... or maybe this is a limitation of using a cloud provider? – Ismail Khan Sep 26 '18 at 16:49
2

As per GCP documentation, the Cloud VPN can be used with VPC networks and legacy networks. For VPC, the custom mode is recommended, so you have full control over the ranges of IP addresses used by the subnets in the network. As per my understanding, it would not be possible to use external IP with Cloud VPN.

As you have mentioned, it not possible to use 172., 192., 10.X IP range, could you try using some other IP range, which is a valid RFC 1918 CIDR block.

10.0.0.0 - 10.255.255.255 (10/8 prefix)
172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
192.168.0.0 - 192.168.255.255 (192.168/16 prefix)

Hopefully, not all these CIDR blocks have been reserved. Using a VM instance in GCP as VPN gateway will create the same issue as its getting the IP from the same IP block. What you could do is request the the 3rd party to release a small segments of the IP block and use that IP block to create custom mode network, and use it in this VPN senario.

However,if you would like to use Cloud VPN, you would have to use one of these CIDR blocks.

For this if you want you can create a feature request for using external IP with Cloud VPN,to do so follow this feature request link.

  • There really is no other way? I don’t have much sway over the 3rd party, I doubt I can get them to release IP ranges. – Ismail Khan Sep 26 '18 at 8:30
  • Unfortunately, I couldn't find any other alternatives or workaround for this issue, at the moment. – Nur Sep 26 '18 at 23:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.