the out-interface is missing

so, it should be this

PostUp     = `iptables -A FORWARD -i <INTERFACE> -j ACCEPT; iptables -A FORWARD -o <INTERFACE> -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE`
PostDown   = `iptables -D FORWARD -i <INTERFACE> -j ACCEPT; iptables -A FORWARD -o <INTERFACE> -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE`

I opened a ticket and added the rule manually on my server for now :) https://github.com/gravitl/netmaker/issues/852

working on a PR....

Don't forget: "license/cla Pending — Contributor License Agreement is not signed yet." "Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution."

Yeah I saw, it was broken for a while, I can accept now

ah wait, no wit's broken again, the agreement does not seem to load :D

ah, just takes forever to load, nevermind :)

Hi guys, I have another question. I am pulling my hair out, since I am not able to figure it out. I attached a screenshot of my current setup. * netmaker-1 public / ingress and relay * intern-pihole internal / egress From netmaker-1 everything works but from my iPhone which is connected as an external client, I can only do the following: What works: * ping internal IPs * call internal webservices using ip / port 80 and 443 What does not work: * ssh on port 22 * dns on port 53 Any idea why? Shouldn't other ports like 22 and 53 also be relayed?

Which version are you running? v0.11?

yes

v0.11

Oh, I am sorry. I missed to say that "mobil-gehirn" is an external wireguard client (iPhone). There is no issue opening the ports using netmaker-1. It can reach dns and ssh on intern-pihole.

DNS do not work in v0.11 and for exemple when you create a egress to certains sub network it can be destroy DNS inside, for me in my subnet docker in need to specify to my container DNS to make it work (for me i choice cloudflare 1.1.1.1 and 1.0.0.1) For SSH i do not try

Hmm, I guess currently my problem is that my external wireguard client is not allowed to open ports besides 80 and 443. If I am able to open other ports dns would work for me.

This might be the issue I am facing -> https://github.com/gravitl/netmaker/pull/853. Maybe I just need to wait for a new release.

Hey guys! Trying to get Netmaker up and running but currently I'm not having any success with adding nodes (tried on both a Windows and Linux machine), and I'm currently at a loss... So Netmaker is running on a Ubuntu 20.04 VM on my local server. The install is based on the nm-quick.sh script with the additional -d and -e parameters for domain and email, but modified to use the nocaddy container as I have nginx reverse proxy. I think I managed to get the proxy conf working (but I'm not sure how to verify that it all works...the dashboard works, netclient can install and join. Is this a sign that the api and/or grpc is working?). In opnsense I've opened port 51821-51830 to the VM, and I guess the others go through the reverse proxy? ufw on the Netmaker machine is disabled so I guess nothing there should block... So... Netmaker installs and runs the default settings from the nm-quick script. Installing the netclient on either Windows or Linux (using the access key script) goes without apparent errors, the nodes show up, but the status soon changes to Warning (and later Error) unless I manually run the netclient pull command. I can't ping the other nodes, and looking at the wireguard logs, it retries handshake to the other peers every 5 seconds without ever succeeding. The one thing that I've seen working is setting the netmaker-1 node to egress gateway to my LAN and then creating an external client (for my android phone). Connecting through the 4g connection and I can access the LAN.. But as said, netclient nodes are a no go...What am I missing? Any clues on which end I need to dig deeper? Is it my proxy, something in opnsense, some bad confguration in Netmaker or possibly a bug somwhere? 😮‍💨

Hello men have you try to setup on aws or other provider just to verify if you can ?

dashboard working means the proxy for api is working... a successful join indicates grpc is proxied correctly

And don't left do disable cloudflare proxy protection

Sorry i can't help you 🥲

where are your server and nodes? are they all on the same lan?

@User , tried both...the windows machine was on the same lan as the netmaker VM, the linux machine was a laptop which I used 4g hotspot to try coming in from the outside.

the server in on a LAN behind NAT?

The Netmaker server VM is running on a machine on my LAN (192.168.0/24) which is behind NAT (opnsense)

did you set IsLocal when you created your network?

I've tried both IIRC

Just to be sure, setting the isLocal, the range should be the LAN? i.e 192.168.3.0/24? (I see now my typo two comments earlier 🙂

Hi, I'd like to know if there's any way to exclude the netmaker server itself from going through an egress gateway