what do you get for

ip route show dev nm-Arbumasa

10.107.204.0/24 scope link 10.107.204.2 scope link 10.107.204.254 scope link

ok so that is correct

if you run just "ip route", does it show the same routes on any other interfaces?

default via 192.168.3.3 dev eth0 proto dhcp src 192.168.3.143 metric 100 10.107.204.0/24 dev nm-Arbumasa scope link 10.107.204.2 dev nm-Arbumasa scope link 10.107.204.254 dev nm-Arbumasa scope link 192.168.3.0/24 dev eth0 proto kernel scope link src 192.168.3.143 192.168.3.3 dev eth0 proto dhcp scope link src 192.168.3.143 metric 100

ok, nothing strange there

one other possibility is MTU. You can try lowering the MTU on the nodes via the UI and see if that allows transfer

or firewall more likely

can you please show "wg show" from the server node as well (docker exec -it netmaker wg)

i disables ufw on the node, still cant ping

maybe the mktk is blocking something

interface: nm-default public key: EyytYCLRqzZv29usGdAALwYM5JrnHjhzXTOgGKNnFGI= private key: (hidden) listening port: 51821 interface: nm-private public key: pmLG2wo9odS10VBI57ghhUp8Rk+RMoF9xbkWusS6ylY= private key: (hidden) listening port: 51823 peer: bqN360vKLo70A2W/E47mbWyQe/K9ySofKAC79fttu0w= endpoint: 186.143.163.235:31868 allowed ips: 10.246.90.2/32 latest handshake: 41 minutes, 44 seconds ago transfer: 20.18 KiB received, 59.35 KiB sent persistent keepalive: every 20 seconds interface: nm-Arbumasa public key: UydWi5ik/Qn9ckBlIwq67h3N9Qm8Rg6/l2Wu9dv1Ng0= private key: (hidden) listening port: 51824 peer: vHoT4VN5nuxcTHjhBcwnQRihMqumTW+POpVEzJUMdj8= endpoint: 200.32.44.56:54898 allowed ips: 10.107.204.1/32 latest handshake: 1 minute, 23 seconds ago transfer: 5.55 KiB received, 12.91 KiB sent persistent keepalive: every 20 seconds peer: Rq9ZSqBxGcpGgq3cxG836C3TnINO6JxjaX9uhhahujQ= endpoint: 190.177.255.204:43565 allowed ips: 10.107.204.2/32 latest handshake: 1 minute, 34 seconds ago transfer: 8.84 KiB received, 4.78 KiB sent persistent keepalive: every 20 seconds

yeah that interface looks correct...what is mktk?

mikrotik?

yep

i had no isues using tailscale in the same network

Yeah if wireguard says there’s transfer but you still can’t ping, is likely an issue with firewall. Is it possible ICMP is blocked?

oh also, is the route on the server? (docker exec -it netmaker ip route)

assuming the route is there, I would try changing MTU as one last test. Then if that is not working, firewall is the only possibility left

default via 172.21.0.1 dev eth0 10.101.0.0/16 dev nm-default proto kernel scope link src 10.101.255.254 10.107.204.0/24 dev nm-Arbumasa proto kernel scope link src 10.107.204.254 10.246.90.0/24 dev nm-private proto kernel scope link src 10.246.90.254 172.21.0.0/16 dev eth0 proto kernel scope link src 172.21.0.2

yup so it has it there as well...

try editing both the netmaker-1 node and your local node in the UI, and change MTU to 1024 on both

done, didn't worked

hmmm ok, i am not sure then, but my best guess is firewall. WireGuard is able to establish a connection and transfer packets, and routing is correct. The only other possibilities are firewall settings or MTU

i'll try making another node outside the mikrotik network to see if it works

Another scenario I was playing with last night where things got wired is this one: Having an egress behind a relay. The normal nodes as well as the ext client have routes to the egress subnet, however the relay node has no clue. It doesn't get the route and the traceroute dies. Anyone run into this before?

is there an example docker compose/k8s deployment of a netmaker server with client mode disabled? I'm trying to figure out what permissions/capabilities can be dropped when client mode is disabled.

I looked into this once. Turns out, when you run without the client you can't create access keys (among other things) so basically it becomes useless

hmmm

so client mode should always be enabled