TLS termination at Application Gateway level

[zanozbot]

Hello NATS community,

I'm encountering issues with TLS termination at the gateway level in our Azure environment and would appreciate some guidance.

Current setup:

• 3 NATS instances deployed on Azure Kubernetes Service (AKS) using the official Helm chart.
• Internal cluster communication is unencrypted.
• We want to use Azure Application Gateway's TCP/TLS feature for external access since we already use AGIC.
• Let's Encrypt certificates for TLS/HTTPS.

Issue:

When testing with NATS CLI, both attempts fail when using the following setup
Internet -> Azure Application Gateway TCP/TLS -> Azure Internal Load Balancer -> NATS service

nats --server tls://nats.example.com publish test "{{Time}}"
> nats: error: read tcp xx.xx.xx.xx:52632->xx.xx.xx.xx:4222: i/o timeout

nats --server tls://nats.example.com publish test "{{Time}}" --tlsfirst
> nats: error: nats: secure connection not available

Verification steps:

• Tested Azure Application Gateway TCP/TLS functionality with Redis - works.
• Unencrypted TCP connection through Azure Application Gateway - works.

The configuration on the gateway seems correct based on these tests, but I cannot seem to access the NATS cluster. What additional configuration might I be missing?

Any help would be greatly appreciated.

[pablitovicente]

Have you tried the config mentioned in the section "TLS-Terminating Reverse Proxies" mentioned in https://docs.nats.io/running-a-nats-service/configuration/securing_nats/tls ?

[zanozbot]

Thanks. It works. I don't know how I missed that part of the docs.

[vidal777]

@zanozbot could you tell more about the Application Gateway version and configuration?

I'm still receiving timeout with the TLS-Terminanting Reverse Proxies

[zanozbot]

@vidal777, we moved away from using Application Gateway because it didn’t offer the level of customization we needed. Instead, we now terminate TLS at the NATS level and expose it via a Service of type LoadBalancer.