825071750290210916 #general

straight-lock-3524

09/18/2021, 11:08 AM

it provides access to the nodes and what you throw at the egress except 0.0.0/0

rich-addition-44259

09/18/2021, 11:27 AM

huh, wait, so if I want to take all the traffic from my mobile device, and route it into netmaker mesh, then out into the world, how do I handle egress?

rich-addition-44259

09/18/2021, 11:28 AM

As I said before, I never had too much applied experience with networks beyond simple things

incalculable-musician-80046

09/18/2021, 11:30 AM

@User Ingress is vpn access to the local environment, egress adds vpn like 0.0.0.0/0 internet capabilities

rich-addition-44259

09/18/2021, 11:55 AM

ok, so i drew my core concept (and also show off my insane draw io skills, i know. Almost ms paint like) What do I slap in egress to achieve roughly what I want. I don't know what sites country A will block tomorrow.

rich-addition-44259

09/18/2021, 11:55 AM

Arrows indicate what I want to access from within my mobile machines

rich-addition-44259

09/18/2021, 12:01 PM

As a quick workaround I set up a single instance of dockerized Wireguard at potato-0 routing all traffic through itself. From it netmaker subnet is visible as well as external server from potato-0 ip address

straight-lock-3524

09/18/2021, 12:03 PM

i'm probably going to guess that we probably know what country A is going to be? lol

rich-addition-44259

09/18/2021, 12:05 PM

Russia in this instance. I have some bare metal machines there locally (most powerful ones at that), and I want to keep them accessible.

straight-lock-3524

09/18/2021, 12:05 PM

in this case the egress arrow should be reversed as the server in B would be the one giving your network it's routes

rich-addition-44259

09/18/2021, 12:06 PM

Last time they tried to ban twitter, including

*t.co*

they killed national internet provider rostelekom, as well as rt.com, and many-many other sites. Twitter survived

rich-addition-44259

09/18/2021, 12:07 PM

Recently they attempt to block DNS over at 8.8.8.8, 8.8.4.4 and 1.1.1.1, 1.0.0.1

rich-addition-44259

09/18/2021, 12:08 PM

Again, half of central bank became inoperable and had to take receipts from private banks in paper

rich-addition-44259

09/18/2021, 12:11 PM

By the way, are ingressed clients uspposed to see internal dns from coredns? Because mine don't seem to be able to

straight-lock-3524

09/18/2021, 12:25 PM

I don't think so yet

rich-addition-44259

09/18/2021, 12:26 PM

No problem, I have a fairly simple homelab so far

jolly-london-20127

09/18/2021, 6:30 PM

@User did you have a functioning setup with rqlite, which then stopped working after some period of time and started producing the error you posted?

jolly-london-20127

09/18/2021, 6:30 PM

This must be related to the Ubuntu DNS issue

jolly-london-20127

09/18/2021, 6:30 PM

I wonder if running those same steps for fixing dns would fix rqlite as well...or maybe those steps are what is breaking rqlite...

rich-addition-44259

09/18/2021, 8:07 PM

I did

iptables --flush

and

systemctl disable systemd-resolved --now

on Ubuntu to make it all work rqlite works ok

jolly-london-20127

09/18/2021, 8:07 PM

was rqlite broken before you did that?

rich-addition-44259

09/18/2021, 8:08 PM

It gave error 500 one time, then I did all that and restarted compose

jolly-london-20127

09/18/2021, 8:09 PM

ok, sounds like it's related then...we'll need to figure out the fix. My best guess is that rqlite will try to hit localhost by default, and when dns is broken it cannot resolve 'localhost'

jolly-london-20127

09/18/2021, 8:09 PM

but setting the connection string to 127.0.0.1 does not appear to fix the issue either

rich-addition-44259

09/18/2021, 8:09 PM

Now I have both those commands on crontab once a day, have not had an issue since

strong-father-52987

09/18/2021, 9:25 PM

I had that issue when trying to connect the nodes of a k8s cluster to nm network as external clients. As soon as I turned wireguard on with wg-quick it would break internet connection. I was using calico which was also making changes to network and iptables. I could not figure out the issue but after changing from calico to cilium my issue was gone. So maybe it could be related with your network config or some other tool that is making changes to it.

straight-lock-3524

09/18/2021, 9:27 PM

hmm no it's just a default ubuntu vm with netclient, nothing more. I can set 0.0.0.0/0 and it show that doing a wg show but it won't set it as default route

strong-father-52987

09/18/2021, 9:57 PM

ok so something else, in any case this is how wg show looks to me on an external client

interface: office
  public key: u5kcUMv4wVrEK5kqOYY1PDMZH8l4hIrLuPRJme+87mc=
  private key: (hidden)
  listening port: 35248
  fwmark: 0xca6c

peer: nDt2M4qgaup06j1oOvnAxYowtIQacW9XEqmTJYUtGjs=
  endpoint: (hidden):51821
  allowed ips: 0.0.0.0/0
  latest handshake: 4 seconds ago
  transfer: 115.99 KiB received, 78.96 KiB sent
  persistent keepalive: every 20 seconds

strong-father-52987

09/18/2021, 9:59 PM

I am not using netclient though and I have also added

DNS = 1.1.1.1,1.0.0.1,2606:4700:4700::1111,2606:4700:4700::1001

to the wireguard conf on the interface section

straight-lock-3524

09/18/2021, 11:11 PM

oh wait