We are trying to set up an OpenVPN remote access server within a Kubernetes cluster, to replace a service previously hosted on an on-prem firewall.

Our wider network is partly on GCP/GCE, with dynamic BGP routing to our on-prem sites over IPsec.

Currently on the existing OpenVPN server on-prem, the IP addresses allocated to connected clients are routable from the rest of the network, so we can communicate inbound & outbound to them without NAT.

We'd like to move the service to Kubernetes Engine, as that is were all our other Linux workloads are migrating to and we prefer the DevOps style workflow, with it managing availability and recovery.

So, say our OpenVPN container has clients connected on range, with a Pod IP dynamically allocated in, how would we tell GCP to route that range towards to OpenVPN service in the Pod? And is it even possible?

One thought was to call the GCE APIs on Pod startup to add in a static route directed towards the Pod IP, but I'm unsure if the traffic will transit the cluster and reach OpenVPN in the Pod.


There is not possible to create a route in GCP to route the subnet from the secondary IP range to use the OpenVPN. So there are 2 possible solutions to achieve what you want:

1.- You can create a VM instance in GCP to setup your OpenVPN tunnel. Then you can add an static route in GCP with nexthop this VM instance. The GKE cluster within the same VPC network as OpenVPN instance will use it as nexthop so all the traffic from Nodes will use the OpenVPN tunnel. If you don't want to redirect all the traffic from all the node in the cluster through the VPN instance, you can specify a tag and attach that during cluster or node-pool creation.

  1. You can create a VM instace as the previous example and instead of configuring a default route with next-hop "Open VPN" instance, you will need to configure iptables within the nodes of the GKE cluster. For example configuring an iptable that all the traffic to destination IP address and source IP address use the next-hop "IP address of OpenVPN instance".

Remember that with both solution, you must enable Alias IP in each GKE cluster to allow communication from your on-prem to the pods.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.