825071750290210916 #general

wonderful-family-13113

01/24/2022, 1:34 AM

thanks i think something with resolvectl is misconfigured, i can figure it out from here 🙂

jolly-london-20127

01/24/2022, 1:35 AM

I just tested on my dev system and am noticing it's also not set

jolly-london-20127

01/24/2022, 1:35 AM

there is likely a bug

jolly-london-20127

01/24/2022, 1:36 AM

resolvectl domain nm-<network name> ~<network name>
resolvectl default-route nm-<network name> false
resolvectl dns nm-<network name> <server ip>

jolly-london-20127

01/24/2022, 1:36 AM

I'll look into it some more, in the meantime, the above commands are what the client runs to set DNS

wonderful-family-13113

01/24/2022, 1:37 AM

i found one host that is able to

ping otherhost.networkname

wonderful-family-13113

01/24/2022, 1:37 AM

i've had wireguard configured on most of these before, and i think maybe i changed some of the default resolvectl stuff on the hosts that aren't working

wonderful-family-13113

01/24/2022, 1:38 AM

thanks for the commands, i'll try those out!

jolly-london-20127

01/24/2022, 1:38 AM

nm, will post back if we determine there's a bug on our end

billowy-petabyte-63970

01/24/2022, 2:38 PM

Hi, just to check, are we expecting Netmaker nodes on the same LAN to be able to ping each other at the moment? Because in my experience they can't. It also seems like the wg endpoints are using the external port of the network's NAT, i.e. the port seen by the Netmaker server, but the local IP address, a combination that obviously won't work.

billowy-petabyte-63970

01/24/2022, 2:38 PM

When I say "ping each other", I mean via their wg p2p tunnels, using their Netmaker IPs

straight-lock-3524

01/24/2022, 4:21 PM

I think you have hole punching disabled?

billowy-petabyte-63970

01/24/2022, 4:46 PM

No, UDP hole punching is enabled.

bored-island-21407

01/24/2022, 5:36 PM

Turn off hole punching for the nodes on the same lan

bored-island-21407

01/24/2022, 5:37 PM

For nodes on the same lan the endpoint of a peer will be the local address. Traffic will go over wireguard but on the lan and not the internet

delightful-mouse-25351

01/25/2022, 2:16 AM

Hello! I wasn't able to install on my Mac, so I'm assuming I'm supposed to use the external clients feature for now? I tried running the netclient binary and the script, but neither worked.

delightful-mouse-25351

01/25/2022, 2:53 AM

Also, is there a way to prevent some machines from communicating with each other? I have some remote machines I want to communicate to from my home server and my laptop, but I don't want those machines accessing my home server back.

bored-island-21407

01/25/2022, 2:55 AM

Not right now, but that functionality is on the roadmap.

delightful-mouse-25351

01/25/2022, 2:56 AM

Hmm, I see. This is a dealbreaker for me. I guess I could configure a firewall on the linux machines.

delightful-mouse-25351

01/25/2022, 2:57 AM

If and only if, I have an option to forward a port for my home server (which is behind a NAT) instead of relying on UDP hole punching, this should make so that I will always be able to connect to it, correct?

bored-island-21407

01/25/2022, 3:00 AM

Short answer yes.

delightful-mouse-25351

01/25/2022, 3:02 AM

Thank you. I'm running some tests around here and I noticed that I wasn't having the best time relying on UDP hole punching.

bored-island-21407

01/25/2022, 3:05 AM

There are some developments in work for future versions that should speed up updates and thus improve UDP hole punch functionality

delightful-mouse-25351

01/25/2022, 3:08 AM

That's great to hear! I don't rely on it so much as I have control over the networks that are behind NAT

delightful-mouse-25351

01/25/2022, 3:27 AM

The firewall rules work to isolate the remote servers, but unfortunately they can still communicate if you are using an egress gateway (probably because the server thinks the traffic is coming from inside), I will try to work something out.

white-spring-73989

01/25/2022, 9:07 AM

Hello! I am having trouble determining what the

MASTER_KEY

environment variable is for. When I start the UI I am prompted to create a new admin user that doesn't seem to have anything to do with the value specified in that variable. What is it for?

billowy-petabyte-63970

01/25/2022, 11:50 AM

Won't that mean that nodes outside of the LAN (i.e. on the other side of NAT) won't know where to reach the nodes with UDP hole punching turned off?

bored-island-21407

01/25/2022, 12:25 PM

not if you have forwarded the ports on the router

jolly-london-20127

01/25/2022, 12:30 PM

MASTER_KEY allows you to interact with the API directly, without needing an admin user. This can be useful if, for instance, you lose your login information and need to reset the account.

white-spring-73989

01/25/2022, 12:32 PM

Alright, thanks. So it would be prudent to store this in e.g a Kubernetes secret or something like Vault?