825071750290210916 #linux

acoustic-petabyte-50388

05/14/2022, 10:55 PM

I think DNS have a "little" problem in latest version XD My /etc/hosts is now so huge :)

white-piano-73111

05/15/2022, 9:23 PM

Has anyone tried to use netclient with boringtun by chance? https://github.com/cloudflare/boringtun Looks like it might be an easy way to use it in lxc containers without giving them more permissions on the host.

white-piano-73111

05/16/2022, 2:08 AM

well nevermind. On proxmox 7.2 with nesting enabled, an unprivileged container just works using wireguard. That is awesome.

glamorous-crowd-4515

05/16/2022, 8:50 AM

hm it appears that my issue is also existing w/ sqlite

glamorous-crowd-4515

05/16/2022, 9:28 AM

https://github.com/gravitl/netmaker/issues/1082 I added some new info

glamorous-crowd-4515

05/16/2022, 9:28 AM

e.g. I identified that the bug is triggered only when the first client has joined netmaker's network

glamorous-crowd-4515

05/16/2022, 9:29 AM

so the pattern is: - create admin - create network - create keys - join the first node - rm netmaker's container -

docker-compose up -d netmaker

- $$$

glamorous-crowd-4515

05/16/2022, 9:31 AM

I also tried and exposed MQTT to the internet w/o haproxy, to make sure that there is absolutely no issue on this side, as I expected: no issue there

jolly-london-20127

05/16/2022, 11:47 AM

Have you tried just running the normal docker compose on the server from a fresh start? I saw several changes in yours that were different from a typical one. It would be good to see if the simplest install has the same issue. I still haven't heard anyone else encountering this issue yet.

glamorous-crowd-4515

05/16/2022, 12:26 PM

I figured it out!!

glamorous-crowd-4515

05/16/2022, 12:27 PM

it was a mq designation issue on the environment variables on docker-compose.yml @jolly-london-20127 → I described my workaround in the issue's comments

glamorous-crowd-4515

05/16/2022, 12:27 PM

i'm kind of a black cat when it comes to doing things like this x)

glamorous-crowd-4515

05/16/2022, 1:44 PM

egress IP range of  192.168.1.27/32  overlaps with  90.foo.bar.171 , omitting

🤔 not sure about this logline

jolly-london-20127

05/18/2022, 11:40 AM

that's a weird one...it literally says "90.foo.bar.171"?

glamorous-crowd-4515

05/18/2022, 11:57 AM

nah, I redacted my public ip 🙂

glamorous-crowd-4515

05/18/2022, 11:58 AM

but there is no obvious overlap even with letters

jolly-london-20127

05/18/2022, 12:00 PM

hmmm that is a bit strange, if you open a ticket we'll investigate. How it works currently is it detects if an egress range overlaps with a local subnet. If it overlaps, it will not add the route since that could screw up your local routing.

glamorous-crowd-4515

05/18/2022, 12:35 PM

imho it's because I pushed 0.0.0.0/0 as an egress network on 2 nodes

jolly-london-20127

05/18/2022, 12:35 PM

ahhh yes, in the docs we note that 0.0.0.0/0 does not work

jolly-london-20127

05/18/2022, 12:36 PM

since we check for overlapping subnets, and 0.0.0.0/0 overlaps with everything

bored-island-21407

05/18/2022, 12:36 PM

but that doesn't explain 90,foo.bar.171

glamorous-crowd-4515

05/18/2022, 12:36 PM

hm how would you redirect a gateway then? (as openvpn does

redirect-gateway def1

)

bored-island-21407

05/18/2022, 12:38 PM

maybe RFC 3092

glamorous-crowd-4515

05/18/2022, 1:09 PM

TIL this RFC 🤣

jolly-london-20127

05/18/2022, 1:19 PM

In the future we would like to add some logic to change the default gateway when 0.0.0.0/0 is entered, but this is a little complicated. So for the time being, we instead recommend putting in the following routes to route web traffic via the vpn: https://docs.netmaker.org/egress-gateway.html#vpn-nat-gateway

glamorous-crowd-4515

05/18/2022, 2:00 PM

interesting, you redirect everything but RFC1918

jolly-london-20127

05/18/2022, 2:01 PM

yeah that's pretty much the idea, act as a de-facto gateway for internet traffic while avoiding redirects of the private address space

jolly-london-20127

05/18/2022, 2:02 PM

the issue with 0.0.0.0/0 is that if you do that with wg-quick, it will just change your default gateway to the new interface, and private address space is still fine

jolly-london-20127

05/18/2022, 2:02 PM

but if we allowed it with netmaker, as written, all traffic, including private address space, would go through the iface, and everything pretty much breaks

hallowed-finland-99691

05/22/2022, 2:37 PM

Installing netclient on Ubuntu 22.04_ 0.14.0_ amd64. Deb will kill the Internet in a few minutes and can't visit any websites. However, installation in docker is good