Deploying on Google Cloud Platform (GCP)

To deploy a filter node on the Google Cloud Platform, perform the following steps:

1. Log in to your Google Cloud Platform account.
2. Launch a filter node instance.
3. Configure the filter node instance.
4. Connect to the filter node instance via SSH.
5. Connect the filter node to the Wallarm Cloud.
6. Set up the filter node for using a proxy server.
7. Set up filtering and proxying rules
8. Allocate more memory for the Wallarm Node.
9. Restart NGINX.

1. Log In to Your Google Cloud Platform Account

Log in to console.cloud.google.com.

2. Launch a Filter Node Instance

Launch your filter node instance using this link, and click LAUNCH ON COMPUTER ENGINE.

The instance will launch with a preinstalled filter node.

To see detailed information on launching instances in the Google Cloud, proceed to this link.

3. Configure the Filter Node Instance

Perform the following actions to configure the launched filter node instance:

1. Navigate to the “VM instances” page in the “Compute Engine” section of the menu.
2. Select the launched filter node instance and click the “Edit” button.
3. Allow the required types of incoming traffic by ticking the corresponding checkboxes in the “Firewalls” setting.

4. If necessary, you can restrict connecting to the instance with the project SSH keys and use a custom SSH key pair for connecting to this instance. To do this, perform the following actions:

   1. Tick the “Block project-wide” checkbox in the “SSH Keys” setting.
   2. Click the “Show and edit” button in the “SSH Keys” setting to expand the field for entering an SSH key.

   3. Generate a pair of public and private SSH keys. For example, you can use the ssh-keygen and PuTTYgen utilities.

      

   4. Copy an open key in OpenSSH format from the interface of the used key generator (in the current example, the generated public key should be copied from the “Public key for pasting into OpenSSH authorized_keys file” area of the PuTTYgen interface) and paste it into the field containing the “Enter entire key data” hint.

   5. Save the private key. It will be required for connecting to the configured instance in the future.
5. Click the “Save” button at the bottom of the page to apply the changes.

4. Connect to the Filter Node Instance via SSH

To see detailed information about ways of connecting to instances, proceed to this link.

5. Connect the Filter Node to the Wallarm Cloud

The filter node interacts with the Wallarm cloud. There are two ways of connecting the node to the cloud:

• Using the filter node token
• Using your cloud account login and password

Connecting Using the Filter Node Token

To connect the node to the cloud using the token, proceed with the following steps:

1. Create a new node on the Nodes tab of Wallarm web interface.
   1. Click the Create new node button.
   2. In the form that appears, enter the node name into the corresponding field and select the Cloud type of installation from the drop-down list.
   3. Click the Create button.
2. In the window that appears, click the Copy button next to the field with the token to add the token of the newly created filter node to your clipboard.

3. On the virtual machine run the addcloudnode script:

   You have to pick which script to run depending on the Cloud you are using.

   • If you are using https://my.wallarm.com/, run the script from the «EU Cloud» tab below.
   • If you are using https://us1.my.wallarm.com/, run the script from the «US Cloud» tab below.
   EU Cloud

   US Cloud

   sudo /usr/share/wallarm-common/addcloudnode

   sudo /usr/share/wallarm-common/addcloudnode -H us1.api.wallarm.com

4. Paste the filter node token from your clipboard.

Your filter node will now synchronize with the cloud every 5 seconds according to the default synchronization configuration.

Connecting Using Your Cloud Account Login and Password

To connect the node to the cloud using your cloud account requisites, proceed with the following steps:

1. On the virtual machine run the addnode script:

   You have to pick which script to run depending on the Cloud you are using.

   • If you are using https://my.wallarm.com/, run the script from the «EU Cloud» tab below.
   • If you are using https://us1.my.wallarm.com/, run the script from the «US Cloud» tab below.
   EU Cloud

   US Cloud

   sudo /usr/share/wallarm-common/addnode

   sudo /usr/share/wallarm-common/addnode -H us1.api.wallarm.com

2. Provide your Wallarm account’s login and password when prompted.

6. Set up the Filter Node for Using a Proxy Server

You need to assign new values to the environment variables, which define the proxy server used, to configure Wallarm node for using your proxy server.

Add new values of the environment variables to the /etc/environment file:

• Add https_proxy to define a proxy for the https protocol.
• Add http_proxy to define a proxy for the http protocol.
• Add no_proxy to define the list of the resources proxy should not be used for.

Assign the <scheme>://<proxy_user>:<proxy_pass>@<host>:<port> string values to the https_proxy and http_proxy variables.

• <scheme> defines the protocol used. It should match the protocol that the current environment variable sets up proxy for.
• <proxy_user> defines the username for proxy authorization.
• <proxy_pass> defines the password for proxy authorization.
• <host> defines a host of the proxy server.
• <port> defines a port of the proxy server.

Assign a "<res_1>, <res_2>, <res_3>, <res_4>, ..." array value, where <res_1>, <res_2>, <res_3>, and <res_4> are the IP addresses and/or domains, to the no_proxy variable to define a list of the resources which proxy should not be used for. This array should consist of IP addresses and/or domains.

The example of the correct /etc/environment file contents below demonstrates the following configuration:

• The https and http protocols use the 1.2.3.4 host and the 1234 port for request proxying.
• The https and http protocols use the admin username and the 01234 password for proxy authorization.
• Proxying is disabled for the requests sent to 127.0.0.1, 127.0.0.8, 127.0.0.9, and localhost.

https_proxy=http://admin:01234@1.2.3.4:1234
http_proxy=http://admin:01234@1.2.3.4:1234
no_proxy="127.0.0.1, 127.0.0.8, 127.0.0.9, localhost"

7. Set Up Filtering and Proxying Rules

The etc/nginx/conf.d directory contains NGINX and Wallarm filter node configuration files.

By default, this directory contains the following configuration files:

• The default.conf file defines the configuration of NGINX.
• The wallarm.conf file defines the global configuration of Wallarm filter node.
• The wallarm-status.conf file defines the Wallarm monitoring configuration.

You can create your own configuration files to define the operation of NGINX and Wallarm. It is recommended to create a separate configuration file with the server block for each group of the domains that should be processed in the same way.

To see detailed information about working with NGINX configuration files, proceed to the official NGINX documentation.

Wallarm directives define the operation logic of the Wallarm filter node. To see the list of Wallarm directives available, proceed to the Wallarm configuration options page.

A Configuration File Example

Let us suppose that you need to configure the server to work in the following conditions:

• Only HTTP traffic is processed. There are no HTTPS requests processed.
• The following domains receive the requests: example.com and www.example.com.
• All requests must be passed to the server 10.80.0.5.
• All incoming requests are considered less than 1MB in size (default setting).
• The processing of a request takes no more than 60 seconds (default setting).
• Wallarm must operate in the monitor mode.
• Clients access the filter node directly, without an intermediate HTTP load balancer.

To meet the listed conditions, the contents of the configuration file must be the following:

    server {
      listen 80;
      listen [::]:80 ipv6only=on;

      # the domains for which traffic is processed
      server_name example.com; 
      server_name www.example.com;

      # turn on the monitoring mode of traffic processing
      wallarm_mode monitoring; 
      # wallarm_instance 1;

      location / {
        # setting the address for request forwarding
        proxy_pass http://10.80.0.5; 
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      }
    }

8. Allocate More Memory for the Wallarm Node

The Wallarm Node uses Tarantool, an open-source in-memory database, to calculate traffic metrics required for automated adjusting of security rules.

By default, the amount of RAM allocated to Tarantool is 75% of the total instance memory.

You can change the amount of RAM allocated for Tarantool

To allocate the instance RAM to Tarantool:

1. Open the Tarantool configuration file:

   vi /etc/default/wallarm-tarantool

2. Set the amount of allocated RAM in the SLAB_ALLOC_ARENA in GB. For example, to set 24 GB:

   SLAB_ALLOC_ARENA=24

3. To apply changes, restart the Tarantool daemon:

   systemctl restart wallarm-tarantool

9. Restart NGINX

Restart NGINX by running the following command:

systemctl restart nginx

The Installation Is Complete

The installation is now complete.

Check that the filter node runs and filters the traffic. See Check the filter node operation.