...thats strange. i made the netmaker-1 node on the comms network static (172.22.255.254), and everything started working I think

what does

Is Static

do?

is static removes the check to see if a node's public IP has changed

i see - sounds like a red herring

let me try adding some additional nodes and see if that has the same problem

hmm.. ok. so i added an extra node, and i can ping the k3s

10.70.0.0/20

subnet, but not the comms

172.22.0.0/16

subnet

so i must have done something to my previous node to make the comms network reachable

aha! i think i might be onto something

so... after adding my additional node, I cant ping the netmaker-1 node (

172.22.255.254

)

but, if i go to the UI and toggle

Is Static

and save changes, i can ping the netmaker-1 node

let me confirm that by adding another node...

...ok, added the extra node and i can ping all k3s nodes on

10.70.0.0/20

. I cant ping the netmaker-1 node on the comms network

172.22.255.254

.

then i went to the netmaker UI, edit the netmaker-1 node on the comms network, didnt make any changes, and clicked save. (so

Is Static

was a red herring)

immediately after, I could ping the netmaker-1 node via the comms network from the newly added node

all nodes have stayed in HEALTHY status

one unusual thing I might be doing is, after pasting the join command in a shell on the new node, I go into the UI, and change the ip addresses and UDP ports for that node in the the comms and k3s networks (since I have opened specific UDP ports on my home router).

i verify the wg handshakes are fine - but it looks like the new node has trouble reaching the netmaker-1 node via the comms network.

(also verified new nodes have no issues after reboot)

Hey, I’m wondering if it is possible for the client to choose which egress gateway to use? In Tailscale, there’s an exit node feature where the client can optionally choose a node to use as exit node, routing all traffic through that node. Is this possible with Netmaker?

You can choose which egress gateway is reachable using ACLs

Hmm thanks for the answer, but I think that doesn’t fit my use case. ACLs would prevent a client from communicating with the node entirely, right? However, I still want my client to be able to communicate, just optionally use that node as egress gateway

Yeah that's not really an option today. One alternative would be to have separate networks for egress, and add the clients to those networks.

Hi everybody! I was trying to play with Netmaker 0.12.2 (which looks like an awesome tool btw!) to see if it could work for our setup and I ran into some issues. Some details on our setup: We have N proxmox hosts (2 in the above simplified example) with a public IP. Each proxmox host has a VM that can access the internet through a masqueraded bridge network (each bridge network has the same IP range, but they are different networks). My goal was to create a wireguard mesh so that I could let nodes talk to each other and also let external clients SSH into the machines. Since each VM is behind NAT, I wanted to use UDP hole punching, so I set up a netmaker server on a standard VPS and created the network with 2 nodes and an external client, but it's not fully working. More specifically: - The external client can ping and ssh towards both VM 1 and VM2 - VM1 cannot ping VM2 and vice versa - Running wg show shows me that the VMs can handshake with the netmaker server (it's in client mode) but they cannot handshake between each other If I run tcpdump in the VMs, I see some logs like

IP <proxmox host of the other VM> > <hostname of VM>: ICMP <proxmox host of the other VM> udp port XXXXX unreachable, length 184

(where the port corresponds to the random port chosen by the client for the UDP hole punch I guess). It's not a show stopper because the real need I had at the moment was to ssh towards the machines from the external client, and this is working, however I wanted to double check with you if I did something wrong in the setup or not, as my networking knowledge is super limited. Thanks!!

Sorry for bringing up an "old" discussion, but I just got to think about running the netclient in a docker container instead...wouldn't it be possible to run netclient in a container based on a linux distro that has systemd? Or is that not possible? I'm quite used to run stuff in docker containers on unraid, but I have never built one myself, so not really know how it works 😅

containers are not VMs..... container run one program at startup

Ok, then I've misunderstood that 😄

Upon further reading, I think that the 2 VMs cannot communicate because they both sit behind a Port Restricted Cone NAT, which means it's not possible to punch between both NATs? I would need to change the two VM networks to use a simpler full cone NAT, assuming that's possible with iptables

Hi guys. I have just installed this and set up a seemingly simple network with 3 nodes - my VPS, my RPi, and my laptop. When I ping between any of these devices I get this error:

From 10.72.121.2 icmp_seq=2 Destination Host Unreachable
ping: sendmsg: Required key not available

I have no idea why it is doing this, never seen an error on a ping like this before.

you don't have a wireguard public key for 10.72.121.2