825071750290210916 #general

white-spring-73989

01/26/2022, 2:20 PM

And that endpoint would be a load balancer

white-spring-73989

01/26/2022, 2:20 PM

Or at least that's my idea

white-spring-73989

01/26/2022, 2:21 PM

So the 3 nodes would have identical configurations, end the external client would have the [Peer] endpoint set to the loadbalancer IP address

jolly-london-20127

01/26/2022, 2:22 PM

that gets closer to the solution, but I think there is still a limitation. All the ingress gateways would need to have the same public key

white-spring-73989

01/26/2022, 2:22 PM

Yes

white-spring-73989

01/26/2022, 2:22 PM

For this to work all nodes behind that loadbalancer would have the same keys

white-spring-73989

01/26/2022, 2:23 PM

So they would functionally be the same WireGuard peer

jolly-london-20127

01/26/2022, 2:24 PM

this may not work on the other side, unless the load balancer is also acting as a NAT

jolly-london-20127

01/26/2022, 2:24 PM

the ingress gateways would have to all be a part of the mesh network. If they have identical keys, they wont be able to connect to the other nodes

white-spring-73989

01/26/2022, 2:25 PM

Yeah, the configuration of the load balancer makes or breaks this little scheme. As I mentioned this is a little finicky/involved 😅

white-spring-73989

01/26/2022, 2:26 PM

That's something I didn't consider 🤔 I was mainly thinking about having these nodes acting as both ingress and egress.

white-spring-73989

01/26/2022, 2:27 PM

So we can use Netmaker to manage e.g a Kubernetes mesh as well as a remote access "corporate VPN" to both that mesh (running in the same VPC) as well as something like AWS-managed database instances

white-spring-73989

01/26/2022, 2:29 PM

Which seems to be doable (and fairly easy) as long as there's only one node acting as the ingress&egress gateway. At the moment that's not a problem for our adoption but in the future it might be

jolly-london-20127

01/26/2022, 2:30 PM

It sounds like what we would really need in this scenario is a "clone node" option

white-spring-73989

01/26/2022, 2:30 PM

Yeah that would do it as well

jolly-london-20127

01/26/2022, 2:31 PM

then you could just clone an ingress gateway

white-spring-73989

01/26/2022, 2:31 PM

If it also means that it keeps all of the nodes up-to-date as clients are added/removed etc

jolly-london-20127

01/26/2022, 2:31 PM

yeah. The "clones" can be pull only, meaning the will only ever pull their config from the DB

jolly-london-20127

01/26/2022, 2:32 PM

one issue there is...we do not store private keys in the database since that would be a security issue

jolly-london-20127

01/26/2022, 2:32 PM

so we have no way to distribute a "cloned" key to the other machines

white-spring-73989

01/26/2022, 2:33 PM

So Netmaker would essentially somehow have to instruct the existing Netclient node to share the key with the new one? Or something like that?

jolly-london-20127

01/26/2022, 2:34 PM

I think this would have to be a manual setup for installation

jolly-london-20127

01/26/2022, 2:34 PM

you'd have to copy the private key over to the machine manually

white-spring-73989

01/26/2022, 2:34 PM

Yeah that's probably the easiest way to go about it

white-spring-73989

01/26/2022, 2:35 PM

At least from the perspective of Netmaker

jolly-london-20127

01/26/2022, 2:36 PM

so im thinking the feature would probably be a button in the UI to clone the node, which would generate a special "join" key, that allows a node to join as an existing node. There would be a function locally to check for the pub/priv key pair before it registers. When it registers with the server, it would check to make sure the pub key matches

jolly-london-20127

01/26/2022, 2:36 PM

after that, it would be "read only"

jolly-london-20127

01/26/2022, 2:37 PM

this would also require the endpoint and the keys on the primary node to remain static

white-spring-73989

01/26/2022, 2:38 PM

You mean if you'd update the endpoint on the original node it wouldn't propagate to the cloned one? How about if you update the set of external clients?

jolly-london-20127

01/26/2022, 3:30 PM

hmmm you're right, i guess the endpoint could change, for instance if you change it on the LB