Add a Network for secure internet access⁠

Define Network⁠

1. Enter a Network Name.

2. (Optional) Enter a Description.

3. Choose either OpenVPN or IPsec as the tunneling protocol from the Connector Tunneling Protocol.

4. In the Connector section, edit the default Name and Region if needed and optionally add a description.

5. Click Add Additional Connector to configure more Connectors.

6. Click Next to move to the next step of the Wizard.

Deploy OpenVPN Network Connector⁠

If the OpenVPN tunneling protocol was chosen in the earlier step, follow the steps below:

1. Select the Operating System, Virtual Private Server (VPS) provider, OpenVPN-compatible router, or the IaaS provider where you will install the Connector from the Provider Type drop-down menu. Refer to About Connectors and About Network Connectors.

2. Follow the displayed steps to install the Connector.

3. Click Next to move to the next step of the Wizard.

4. A test is run to check if the Connector is online. Click Next if it passes. If it fails, click Back to Instructions to see the installation steps or click Proceed Without Testing to continue with the configuration.

Deploy IPsec Network Connector⁠

If the IPsec tunneling protocol was chosen, follow the steps below:

1. Select the IPsec-compatible router or an IaaS provider for the IPsec connection from the Platform to Connect drop-down menu. Refer to About Connectors, and About Network Connectors.

2. Follow the displayed steps and provide the needed configuration information.

3. Test the connectivity and view logs if needed.

4. Click Next to move to the next step of the Wizard.

Configure Internet Access⁠

To use this network as an Internet Gateway for all internet traffic entering your WPC, two things need to happen: the Internet Access settings for entities that need to channel all their internet traffic to CloudConnexa needs to be set to 'Split tunnel OFF', and the network that is being configured needs to be set as an Internet Gateway to provide a default route to your WPC for the incoming internet traffic.

The Configure Internet Access section allows you to do both by following the steps below:

1. Click the All Internet Traffic tab (default).

2. From the provided list of User Groups, Networks, and Hosts, select the ones for which internet traffic needs to be routed to CloudConnexa.

3. Click Next.

Add Application (Optional)⁠

In addition to acting as an Internet Gateway, if this Network will provide access to any applications, you must add Applications. Applications that are reachable by this network are identified by their domain names and act as routes to this network. Refer to About Network Applications.

1. Click Next to skip adding an Application, or click Add Application and continue.

2. Provide a Name for the Application.

3. Add an optional Description.

4. Change the All for Application Type (Network) protocols to select specific application protocols to permit while restricting all others.

5. Provide a domain name for the Application in the Domain field.

6. Enable Allow Embedded IP if you will use the above domain to create domain names with IP addresses.

   Embedded IP enables you to append an IP address to a domain and resolve such domains without adding a DNS record. This is useful for IoT networks. For example, ssh root@192-168-1-1.server.example.com can be used to SSH into the computer with a private IP address of 192.168.1.1 on the Network that has the domain name of server.example.com configured as an Application with Allow Embedded IP ON.

7. Additional Domain names with the corresponding Allow Embedded IP setting can be added as desired. For example, for a web application, you could add two domain names: cnn.com and www.cnn.com

8. Click Add Application.

   The newly added Application will be listed. Click Add Application to add additional Applications.

9. Click Next to move to the next step of the Wizard.

Add IP Service (Optional)⁠

If you need to provide access to any applications explicitly using IP addresses, you must create IP Services. An IP Service defines public or private IP address subnets and optional protocols that should be accessible through this Network. For IP Services to be accessible, Routes are pushed to the routing table of those clients for whom an Access Group is defined, allowing access to an IP Service. If the Routes Configuration is enabled and custom Routes are added, only those Routes will be pushed that provide access to allowed IP Services, not all Routes added under a Network. If an Access Group defines access to the entire Network, all Routes related to this Network will be pushed to the corresponding client. Refer to About Network Routes and IP Services.

It is recommended to use Applications whenever possible instead of IP Services because with Application Domain-Based Routing, you can:

• Hide the routes to your private networks, even from clients connected to CloudConnexa

• Hide the IP address of the actual application server because the client receives an intermediary IP address from the WPC domain routing range.

• Reduce the possibility of lateral movement because private network routes are not exposed.

• Enforce least privilege policies and use zero trust principles, as all Applications need to be identified.

You would want to configure IP Services to:

• Create an implicit IP subnet route for the network

• Designate an IP subnet as a source of traffic to be used later in Access Groups.

• Restrict the protocols that will be used to access the service.

• Define who can access the IP service using Access Groups.

• Easily identify the traffic destined to the IP service by using a named IP Service when viewing statistics in Access Visibility.

1. Click Next to skip adding an IP Service, or click Add IP Service to continue.

2. Provide a Name for the IP Service.

3. Add an optional Description.

4. Change All for Service Type (Network protocols) to select specific application protocols to permit while restricting all others.

5. Toggle Use as Source if you want to use the IP address or subnets you will provide as a traffic source and as a traffic destination. For example, if the IP service is a software update application, and you want to restrict which destination subnets that software update application can communicate with using Access Groups.

6. Add one or more Subnet.

7. Click Add IP Service.

   The newly added IP Service will be listed. Click Add IP Service to add additional IP Services.

8. Click Next to move to the next step of the Wizard.

Configure Access Group (Optional)⁠

Refer to About Access Groups.

1. Click Finish to conclude the configuration wizard, or click Add Access Group and continue.

2. Provide a Name and, optionally, a Description.

3. Expand/Collapse and search the Hosts, Networks, and User Groups sections in the Source column to find the entity that you want to give access to.

4. Click on the check boxes of the source entities to select.

5. Expand/Collapse and search the Hosts, Networks, and User Groups sections in the Destination column to find the resources you want access to be granted. You will see an Applications shared with you section as a Destination if you have accepted access to shared applications using AppHub. Refer to Access control

6. Click on the check boxes of destination resources to select.

7. Click Add Access Group.

   The newly added Access Group will be listed. Click Add Access Group to add additional Access Groups.

8. Click Finish to complete the configuration wizard.

You will see a detailed view of the newly configured Network. Refer to View, make changes, and delete a Network