@jolly-london-20127 what ports should I open now to the outside world? Still the same now that it goes only over mq?

80, 443, 8883

so less ports, nice

that is for tcp ; upd 58021-51830 needed as well

ah right

or more with more clients I would assume

more clients don't change the number of ports required

the number of udp ports is dependent upon the number of networks

the above is sufficient for 10 networks

Each time a new network is created, it still occupies 51821 by default. It needs to be changed manually. Does each network occupy a different port?

on the server, yes, each network requires its own port

If there are more than 10 networks, can you add ports to realize it?

yes

Whether the port allocation corresponding to each network can be realized automatically, because after there are many networks, you don't know which ports have been occupied. You need to check the occupation of all network ports, which will be a great workload

Automatic and unique

nodes on each new network automatically get allocated a free port

you don't have to change anything manually

Permission issues, if a non-administrator user uses the server's netmaker-1 node as an Ingress Status, it will consume the bandwidth of the server, can it be limited?

did the non administrator create the ingress?

The administrator creates a new network. Ordinary users who are not administrators can create an entry gateway, and the entry gateway is on the netmaker server, so ordinary users can surf the Internet through the server agent,

Hmm. So I took the easy way yesterday and removed the netmaker install instead of upgrading to 0.13.0. I installed using the nm-quick script, and didn't specify domain, thus using the nm-.nip.io domain. Everything worked fine so I wiped again (docker-compose down -v --rmi all) and ran nm-quick again but with my domain (using cloudflare (*.netmaker.mydomain.com) which points to the public IP of the netmaker server). All seemed fine, but when nodes try to join it just hangs during the process. comparing the docker logs for caddy between my domain and the nm.nip.io domain, I can see that

{"level":"info","ts":1651089317.0613978,"logger":"tls.obtain","msg":"acquiring lock","identifier":"api.nm.<ip>.nip.io"}

never shows up when using my domain. Am I missing some setting or similar? :/

are you also using the cloudflare proxy service?

Nope, DNS only

after a little while this shows up as well when using my domain

{"level":"error","ts":1651011780.8903565,"logger":"tls.issuance.acme","msg":"looking up info for HTTP challenge","host":"api.netmaker.mydomain.se","error":"no information found to solve challenge for identifier: api.netmaker.mydomain.se"}

this can happen with caddy if you do docker-compose down --volumes and retry too many times

the easiest solution would be to use a different subdomain if that doesn't matter, otherwise, im not sure exactly, though I think if you wait long enough it'll work again

Alright, I'll wait a bit and retry 🙂

waited a bit and retried and the caddy logs looked better...but still having issues with nodes hanging during join. Saw this in the docker mq logs

1651096784: New connection from 129.151.216.73:59798 on port 8883.
1651096784: OpenSSL Error[0]: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate
1651096784: Client <unknown> disconnected: Protocol error.
1651096788: New connection from 129.151.216.73:59800 on port 8883.
1651096788: OpenSSL Error[0]: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate
1651096788: Client <unknown> disconnected: Protocol error.
1651096792: New connection from 129.151.216.73:59802 on port 8883.
1651096792: OpenSSL Error[0]: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate
1651096792: Client <unknown> disconnected: Protocol error.