DigitalOcean Gateway, internal droplet not accessible

Question

I am very new to VPC and am trying to setup one inside DigitalOcean. I followed the tutorial here: https://docs.digitalocean.com/products/networking/vpc/how-to/configure-droplet-as-gateway/ , and succeeded in isolating the internal droplet from the rest of the world. However I am unable to reach it from the internet i.e http://mydroplet.com.

My gateway internal IP is 10.103.16.2

My gateway route -n looks like this:

Destination	Gateway	Genmask	Flags	Use Iface
0.0.0.0	143.62.0.1	0.0.0.0	UG	eth0
10.12.0.0	0.0.0.0	255.255.0.0	U	eth0
10.103.16.0	0.0.0.0	255.255.240.0	U	eth1
143.62.0.1	0.0.0.0	255.255.192.0	U	eth0

and my droplet route -n like this:

Destination	Gateway	Genmask	Flags	Use Iface
0.0.0.0	10.103.16.2	0.0.0.0	UG	eth1
10.12.0.0	0.0.0.0	255.255.0.0	U	eth0
10.103.16.0	0.0.0.0	255.255.240.0	U	eth1
132.85.28.0	0.0.0.0	255.255.240.0	U	eth0
169.254.169.254	132.85.28.0	255.255.255.255	UGH	eth0

So from any server outside the internal network I cannot ping or ssh the internal droplet. From the gateway I am able to ping/ssh and telnet internal_drop_pub_ip 80 However if i go to http://internal_drop_pub_ip i am unable to reach it, also tried with curl internal_drop_pub_ip.

From internal droplet I am able to ping outside and also if i run curl ifconfig.me I get the gateway public ip address.

On the internal droplet I have an nginx server running with the standard conf file:

server {
  listen 80;
  listen [::]:80;
  server_name mydroplet.om ipv6only=on;
  root /usr/share/nginx/html/;
  index index.php index.html index.htm index.nginx-debian.html;

  location / {
    try_files $uri $uri/ /index.php;
  }

  location ~ \.php$ {
    fastcgi_pass unix:/run/php/php8.1-fpm.sock;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
    include snippets/fastcgi-php.conf;
  }

 # A long browser cache lifetime can speed up repeat visits to your page
  location ~* \.(jpg|jpeg|gif|png|webp|svg|woff|woff2|ttf|css|js|ico|xml)$ {
       access_log        off;
       log_not_found     off;
       expires           360d;
  }

  # disable access to hidden files
  location ~ /\.ht {
      access_log off;
      log_not_found off;
      deny all;
  }
}

I checked ip -br a and both eth0 and eth1 are UP.

The results of ip route get 8.8.8.8 are:

8.8.8.8 via 10.103.16.2 dev eth1 src 10.103.16.5 uid 0

I am not sure what other information to put in here in able to help trouble shoot this.

DigitalOcean Gateway, internal droplet not accessible

0 Answers