Skip to main content

Configure NAT for Kafka

To reach a Kafka cluster from outside the VPC over a public IP, you need three things in place: an open port, DNAT rules for every node, and the cluster's public_endpoint parameter pointing at that public IP.

warning

public_endpoint is a Static parameter, so saving it restarts the cluster and briefly interrupts producers and consumers. Do this work during off-peak hours.

Open the required port​

Configure the Security Group to allow inbound traffic on port 9093 for every Kafka node. See Connect to database with Floating IP for how to create and apply one.

Configure DNAT rules​

Map one public port per node, all pointing at internal port 9093. Substitute your own public address for IP_PUBLIC and your node addresses for IP_NODE_n.

For a single-node cluster:

PublicDestination
IP_PUBLIC:9092IP_NODE_1:9093

For a three-node cluster:

PublicDestination
IP_PUBLIC:9092IP_NODE_1:9093
IP_PUBLIC:9093IP_NODE_2:9093
IP_PUBLIC:9094IP_NODE_3:9093

Each node needs its own public port. Kafka clients are redirected to individual brokers after the initial connection, so a single mapping leaves two thirds of a three-node cluster unreachable.

Set the public endpoint​

  1. Open the Configure Params page for the Kafka cluster. See Configure parameters.
  2. Select parameter type Static.
  3. Set public_endpoint to your IP_PUBLIC value.
  4. Click Save.

The cluster restarts to apply the change. Once it returns to Running, external clients can connect through the public IP.

Next steps​