This ties the pieces together: how a workload on the private network reaches the internet, and how the internet reaches it, all through the firewall.
The shape
A workload, a LayerOne application, a managed database, or one of your own servers, sits on the same private network as the firewall. The firewall is that network's gateway. From there:
- Addressing. If you run DHCP on the network, the workload gets its address, gateway and DNS from the firewall. Otherwise give it a static address on the network and set the firewall's address as its gateway.
- Outbound. With NAT masquerade on (the default), the workload reaches the internet through the firewall, with no public address of its own.
- Inbound. Reach it from the internet in one of two ways: - a port forward for a raw TCP or UDP port, or - a load-balancer route for a domain with HTTPS.
- Rules. Inbound is blocked by default, so add the matching Allow rule for whatever you expose.
Nothing behind the firewall holds a public address. Only the firewall does.
Putting an application behind the firewall
A LayerOne application that is running privately shows its private address on its page, with a prompt to put it behind a Cloud Firewall to reach it from the internet. To do that:
- Attach the application to a private network the firewall also serves.
- On the firewall's load balancer tab, add a route for your domain.
- Add a backend and pick the application from the Application list; the firewall tracks its private address for you.
You drive this from the firewall's load-balancer tab, not from the application page.