Networking

A Teleport cluster is a distributed system that may comprise a number of networks. On Teleport Enterprise (Cloud), for example, the Auth Service and Proxy Service run in Teleport-managed infrastructure, while Teleport users manage Agents and tbot instances.

This reference guide describes the networking requirements of a Teleport cluster.

Public address

public_addr: ["service1.example.com", "service2.example.com"]

HTTP CONNECT proxies

Some networks funnel all connections through a proxy server where they can be audited and access control rules can be applied. For these scenarios, Teleport supports HTTP CONNECT tunneling. HTTP CONNECT applies to:

• tsh in all cases.
• Teleport services, such as the SSH Service and Database Service, that dial back to the Teleport Proxy Service.

To use HTTP CONNECT tunneling, set the HTTPS_PROXY and HTTP_PROXY environment variables when running Teleport. You can also optionally set the NO_PROXY environment variable to avoid use of the proxy when accessing specified hosts/netmasks/ports.

By default, Teleport installations based on package managers (such as apt and yum) configure the teleport systemd unit to read environment variables from the file /etc/default/teleport by using the EnvironmentFile field:

[Unit]
Description=Teleport Service
After=network.target

[Service]
Type=simple
Restart=always
RestartSec=5
EnvironmentFile=-/etc/default/teleport
ExecStart=/usr/local/bin/teleport start --config /etc/teleport.yaml --pid-file=/run/teleport.pid
# systemd before 239 needs an absolute path
ExecReload=/bin/sh -c "exec pkill -HUP -L -F /run/teleport.pid"
PIDFile=/run/teleport.pid
LimitNOFILE=524288

[Install]
WantedBy=multi-user.target

To configure HTTP CONNECT tunneling, you can assign these environment variables within /etc/default/teleport on machines that run Teleport binaries. Use the following example, replacing proxy.example.com with the address of your proxy:

HTTP_PROXY=http://proxy.example.com:8080/
HTTPS_PROXY=http://proxy.example.com:8080/
NO_PROXY=localhost,127.0.0.1,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8

When Teleport builds and establishes the reverse tunnel to the main cluster, it will funnel all traffic through the proxy. Specifically, if using the default configuration, Teleport will tunnel ports 3024 (SSH, reverse tunnel) and 3080 (HTTPS, establishing trust) through the proxy. If you don't want to proxy some of this traffic (for example, proxying HTTPS but not SSH), assign NO_PROXY to the address of the Teleport Proxy Service endpoint you want to exclude from HTTP_CONNECT tunneling in host:port format.

For example, you can modify the environment file at /etc/default/teleport on each machine that runs a Teleport binary to resemble the following:

HTTP_PROXY=http://httpproxy.example.com:8080/
HTTPS_PROXY=http://httpproxy.example.com:8080/
NO_PROXY=teleportproxy.example.com:3024

The value of HTTPS_PROXY or HTTP_PROXY should be in the format scheme://[user[:password]@]host:port where scheme is either https or http . If the value is host:port , Teleport will prepend http .

Ports

This section describes the ports you should open on your Teleport instances.

curl https://teleport.example.com:443/webapi/ping | jq

curl https://example.teleport.sh/webapi/ping | jq '.proxy'

{
  "kube": {
    "enabled": true,
    "listen_addr": "0.0.0.0:3080"
  },
  "ssh": {
    "listen_addr": "0.0.0.0:3080",
    "tunnel_listen_addr": "0.0.0.0:3080",
    "web_listen_addr": "0.0.0.0:3080",
    "public_addr": "example.teleport.sh:443",
    "dial_timeout": 30000000000
  },
  "db": {
    "postgres_listen_addr": "0.0.0.0:3080",
    "mysql_listen_addr": "0.0.0.0:3080"
  },
  "tls_routing_enabled": true
}

Agent ports

Teleport agents dial the Teleport Proxy Service to establish a reverse tunnel. Client traffic flows via the Proxy Service to the agent, and the agent forwards traffic to resources in your infrastructure.

As a result, for Teleport processes running agents, e.g., instances of the SSH Service, Kubernetes Service, and other services that protect resources in your infrastructure, there is no need to open ports on the machines running the agents to the public internet.