UTM9 in AWS- multiple subnets

Question

Basically I want to use UTM9 in place of a NAT for some basic traffic filtering (maybe overkill for now, but I might use it more later).

I was able to spin up the 2 subnet system as described in the tutorial and see the traffic filtering work (great!).

My problem is that I want something like 10 subnets for sectioning off different stuff at the network level, and only the subnet that contains the private side NIC/ENI seems to work. I can see traffic from other subnets hitting UTM, but getting DROPPED instead of ALLOWED.

Help?? [:S]

More detail:
VPC: 10.0.0.0/16
Public subnet: 10.0.151.0/24
Private subnet: 10.0.101.0/24
OtherPrivate subnet: 10.0.1.0/24

The UTM server lives in the public, with a second ENI in the Private. The route tables for both privates point traffic to this ENI. All security groups are wide open. (Again, the traffic is hitting UTM)

The instance in the PrivateSubnet works, but from the OtherPrivate does not.

TBC- I think I understand that I could add an EMI for each subnet, but that's not practical for as many subnets as I need, and I don't think it should be necessary.

This thread was automatically locked due to age.

AlanT · Answer

Hi lprikockis, 
 You raise two questions in your message, and I'll try to answer them both. 
 First,regarding multiple ENIs. We only support a single interface for HA and autoscaling. There's no need for more, and worse, using more makes for a more fragile AWS environment. UTM doesn't need an interface in every subnet for it to act as the outbound gateway for each subnet. AWS strongly prefers your instances to use the default gateway IP within each subnet, which allows the AWS routing table to work effectively. If you want a stable and reproducible environment, that's the best way to do it. 
 Second, you mentioned outbound routing failover. Currently, HA and autoscaling are only able to failover inbound traffic. We are working on an outbound gateway feature at the moment, which will allow you to balance outbound traffic across an autoscaling group of firewalls, with full failover redundancy. Keep an eye out for this, later this summer.

lprikockis · Answer

thanks! I can't speak for the original poster, but your explanation completely clears up the concepts I was struggling with. This should probably go into an FAQ or some other documentation bundled with the UTM AMI.