How to set-up NoMachine on Google Cloud Platform behind a HTTPS Load balancer
The following steps illustrate how to setup NoMachine on Google Cloud Platform (GCP) behind a HTTPS Load Balancer and allow users to connect by the web by NoMachine. (the free edition of NoMachine doesn't support web sessions, please use any of the other servers, e.g. the Enterprise Desktop).
In this example the HTTPS Load Balancer Cloud is not configured for load-balancing access. It is set-up as a pre-requisite for using the Identity-Aware Proxy (Cloud IAP) on Google Cloud. Configuring the Cloud IAP, however, is beyond the scope of this article.
Step 1 - Create the Virtual Machine (VM) on GCP
In the GCP console, access the VM instances panel and Create instance.
As an example, we created a VM with:
2 vCPUs and 7,5 GB RAM
Ubuntu 18.04
In 'Firewall' section on the GCP console, set both 'Allow HTTP traffic' and 'Allow HTTPS traffic' .
Step 2 - Install the desktop environment and NoMachine
Connect to the VM via ssh.
Install a desktop
environment.
Configure SSHD for password-based authentication (“PasswordAuthentication yes" in /etc/ssh/sshd_config).
Upload the NoMachine server package to the VM.
Install the NoMachine package.
NoMachine comes with a built-in HTTP server, nxhtd which by default listens on port 4080 and 4443 for HTTP and HTTPS connections respectively. Change the list port for HTTPS to 443 to be compliant with the port that will be used by the HTTP(s) Load Balancer. Increase also the Keep Alive Timeout.
To do that, change the following lines in /usr/NX/etc/htd.cfg :
KeepAliveTimeout 60 -> KeepAliveTimeout 620
Listen 0.0.0.0:4443 https -> Listen 0.0.0.0:443
https
<VirtualHost 0.0.0.0:4443> -> <VirtualHost 0.0.0.0:443>
ReWriteCond %SERVER_PORT !^4443$ -> ReWriteCond %SERVER_PORT !^443$
Reboot the VM to make all the previous changes effective or restart NoMachine server and SSHD.
Step 3 - Create the Instance group for using the HTTP(s) Load balancer
In order to use the Load Balancer, it's necessary to create an Instance group to hold the VM.
In the GCP console, access the 'Instance Groups' page and choose to 'Create an instance group'. Set:
Location 'Single zone
Group type 'Unmanaged instance group'
From the 'VM instances' panel, select your VM and add it to the new "Instance Group
".
Step 4 - Create the HTTP(s) Load Balancer
In the GCP console, choose 'Network services' -> 'Load balancing' and' Create the new HTTP(s) load balancer' and 'Start configuration'.
Configure the Backend service to route all the traffic to the VM. Access' Backend configuration' ->'Backend services' -> 'Create backend service'
and set:
Protocol HTTPS
Port 443 (this is the named port, where the Load Balancer will direct all traffic to the VM)
Timeout 3600
.
Add the Health check
.
Then configure the Frontend from the 'Frontend configuration' panel:
Protocol HTTPS
Port 443
Retrieve the SSL certificates for the NoMachine HTTP server from the VM. They are:
/usr/NX/etc/keys/host/ht_host_rsa_key.crt
/usr/NX/etc/keys/host/ht_host_rsa_key
In the GCP console, press 'Create new certificate' . In the 'Create new certificate' panel, Choose 'Upload my certificate' as 'Create mode'. Past content of ht_host_rsa_key.crt in the 'Public key certificate' text area and content of ht_host_rsa_key into the 'Private key' text area.
'Frontend configuration' panel, choose 'Upload my certificate' and save.
Note: NoMachine installation comes with a self-signed a SSL Certificate File and SSL Certificate Key file intended to be just a sample. Administrators can replace the sample SSL Certificate File and Key File with their own certificate self-signed or acquired from a CA.
Review and finalize and create the HTTP(S) load balancer.
Now you can connect to the desktop of your VM via NoMachine. Point your browser to:
https://x.x.x.x
where x.x.x.x is the IP of your Load Balancer.
Ref.
- Step-by-step guide to create a VM on GCP and access it via NoMachine
https://www.nomachine.com/accessing-your-remote-desktop-on-google-cloud-platform-via-nomachine
