don't think so, none of the hosts has it enabled

You need to configure the mesh node sitting in your external lan, as egress gw with your network

yepp, that works allready, have conectivity from my a phone and all the hosts in the mesh into my "external/home network"

Great

ye, removed the postup/postdown lines, and flushed all the iptables rules on the "egress gw" and now it routes traffic both ways 😄

No, the trick is not to delete the complete post up down command, I kept the forward command. If you delete all, the commands will be rebuild from netmaker, due it is a egress gw. At least version 0.9.1 did that

right

you need the forward stuff (net.ipv4.ip_forward) to make the server route the traffic, so that should be there

btw, any reason why the coredns is lissening on the external interface, instead of the one inside the mesh ?

make no sense to me having it exposed externally

My core dns is in docker network mode host. So docker does not open iptables for the world to reach my dns. It listen to all interfaces.

ye, one way of doing it, but is it a reason for it to be public by default?

wouldn't it make more sense having it "available" on the ip's in the mesh? as only mesh nodes that is suppose to talk to it anyway?

If I got the idea behind, having it open to world, was, if you configure a net without netmaker server as auto mesh member, the mesh nodes can reach the dns without having a vpn connection to netmaker host

guess you would have to have some logic if you bind it to all new networks when you make them

hmm

just the infosec part of my brain is having small ticks 😛 lol

well, as I use dnsmasq it does it automatically I think. And on the other hand you can set systemctl reload dnsmasq in post up

ye, but if you don't include the netmaker server as a part of the network it wouldn't work, but ye, not a very common setup I guess

Well there are use cases for that out there. Alex wouldn’t code it like that, if he has never ever seen a setup like that 😉

hehe

I am having trouble setting up a working network with external devices. So I have a couple of nodes (all of those are running UFW):

10.154.241.1 - my netmaker instance (physically not close to my location)
10.154.241.2 - a public server near me
10.154.241.3 - a raspberry in a local network
... - other

and 2 external devices:

10.154.241.10 - my Windows PC
10.154.241.11 - my notebook
10.154.241.12 - my phone

Now I have configured

.2

as my ingress server - however I can't reach any nodes except

.2

from my Windows PC (or other external devices). My thought process was that

.2

UFW interferes somehow, so I disabled it for testing but still no connection to other nodes possible. From the node itself I can ping other nodes without an issue. What is going on?

Also I can't seem to find any documentation on a egress gateway: Could I redirect (mostly web-)traffic from my phone/notebook over one of my servers to e.g. secure a connection on a public WiFi? If so how?

The first thing to check is that ip forwarding is enabled on your ingress client,

sysctl net.ipv4.ip_forward

, (sometimes if mine is on and still not forwarding and I do a reboot, it will start working) So for egress, you you can accomplish that by referring to this thread: https://discord.com/channels/825071750290210916/825071821594034196/916709694255530015 pretty much just use those as your gateway addresses and then set it to a internet accessible network interface on your node, like eth0 or whatever comes up when you

ip a

or

ip link show

. If you only want your ext clients to use it as a gateway then set your default ext client dns in the network settings to

8.8.8.8

or

1.1.1.1

or whatever dns you'd like and then you can just use 0.0.0.0/0 as your gateway range, but your meshed nodes won't be able to access internet with that. Hope that helps

sysctl net.ipv4.ip_forward

returns 1, so that shouldn't be the issue.

firewall maybe?

When I disable UFW it still doesn't work and my provider doesn't have an external firewall.

i v got the same strange thing. Only flushing the iptables ON the webadmin page of my vps would work. But after a reboot its back.

its definitely something fishy with my VPS

It’s not oracle is it?