netmaker
- a
agreeable-apartment-18181
12/28/2022, 6:39 PMHow do you tell from a VPS perspective if it will meet the performance requirements for a home user? Anyway to run a test on the netmaker side to give a yeah this might be enough. Just cause i don't know for sure if I can trust that the host is providing what maybe they say. - a
agreeable-apartment-18181
12/28/2022, 6:39 PMAlso don't want to get down the line with this config and figure that out. - c
cuddly-oyster-84490
12/28/2022, 10:26 PMStill wondering this myself honestly. I'm still on v0.14 on my setup and I'm guessing when I finally upgrade it's going to force me to make a choice. I probably can live within the limits of EE free tier if I stay relying on relays but I could see if I moved to a more mesh approach later, 50 nodes isn't all that hard to hit. I don't need multi users/user management or any more ACLs then what I already have, so I'm leaning towards staying in the community edition unless I see a reason to go EE. I wish there were more in depth docs on the full feature differences between CE, EE Free, EE Paid. - a
agreeable-apartment-18181
12/28/2022, 10:28 PMI wonder how easy it is to downgrade if needed. - a
agreeable-apartment-18181
12/28/2022, 10:29 PMI also don't know if this is an issue but im on a slower connection and when the site loaded I saw the setup admin prompt but it then went away when sight fully loaded. Could this be exploited was my only concern. - a
agreeable-apartment-18181
12/28/2022, 10:34 PMso i wanted to limit access to the dashboard from my ip and it looks like potentially the way the docker rules are applied it allows connections from anywhere. Because my deny all rule but what is allowed inbound to port 80 is not working. - a
agreeable-apartment-18181
12/28/2022, 10:36 PM - c
cuddly-oyster-84490
12/28/2022, 11:11 PMI actually just noticed this behavior too when logging into my dashboard to check version number. - a
agreeable-apartment-18181
12/28/2022, 11:16 PMyeah im hoping its not an overall but wanted to just make them aware that seems to still be loading to some degree. - a
agreeable-apartment-18181
12/28/2022, 11:17 PMhttps://www.reddit.com/r/selfhosted/comments/ocqg1j/psa_docker_bypasses_ufw/ - notice this also when researching using docer and ufw to configure firewall rules - "You can avoid all this trouble by simply mapping to 127.0.0.1:[port]. You should always do this in general, don't expect ufw to handle all of your defense. Keep stuff that should be private listening only on localhost." - a
agreeable-apartment-18181
12/28/2022, 11:18 PMWhen these are created by netmaker install/script can they be set to localhost as best practice? - a
agreeable-apartment-18181
12/28/2022, 11:25 PMlooks like I might switch to using firewalld instead - "Just use firewalld. It's way better than UFW and latest docker versions integrate with it, instead of modifying iptables directly." - a
agreeable-apartment-18181
12/28/2022, 11:29 PMOverall thought it looks like from my limited knowledge and how I am translating this is that the go to rule is to secure your bridge ports by binding to 127.0.0.1. Not sure if that would impact the function of netmaker. - a
agreeable-apartment-18181
12/29/2022, 6:45 AMi was able to stop it on this page before i loaded the login looks like it doesn't let me create an admin once one has already been created. - c
cold-rocket-49569
12/29/2022, 9:04 AMcan vouch for firewalld - c
cold-rocket-49569
12/29/2022, 9:04 AMi use it on all my cluster nodes since k3s resets iptables - c
cold-rocket-49569
12/29/2022, 9:08 AMand netclient seems to go through it just fine even without manually adding ports - b
bitter-engine-4273
12/29/2022, 10:08 AMAnybody use netclient on a laptop sucessfully? - a
agreeable-apartment-18181
12/29/2022, 1:41 PMIts not completely clicking for me. like the public zone if I add an ip there then it will be allowed any services that I add to that zone. - a
agreeable-apartment-18181
12/29/2022, 2:00 PMwell i reinstalled everything from scratch and looks like with firewalld installed first the installation script fails at the iptables creation. - a
agreeable-apartment-18181
12/29/2022, 2:13 PManyone around? - a
agreeable-apartment-18181
12/29/2022, 2:14 PMERROR: Failed to Setup IP tables: Unable to enable SKIP DNAT rule: (iptables failed: iptables --wait -t nat -I DOCKER -i br-0ca7e1a78739 -j RETURN: iptables: No chain/target/match by that name. (exit status 1)) - a
agreeable-apartment-18181
12/29/2022, 2:35 PMfrom reading as well if going to use docker its best to not use UFW or install the additional package with it because it doesn't allow the full control needed. Looks like with firewalld install the installation script won't work. I also read that podman is a better alternative to docker when using UFW. - c
cold-rocket-49569
12/29/2022, 3:12 PMthe way I do it is set the default zone to internal with default path ALLOW so everything is allowed by default then set eth0 to public, with block by default, and my whitelist rules in there (22, 80, 443) - a
agreeable-apartment-18181
12/29/2022, 3:21 PMI found that what you may not want is that some ip's added to public may not need access to services on public. - a
agreeable-apartment-18181
12/29/2022, 3:22 PMBTW how did you install netmaker with firewalld - c
cold-rocket-49569
12/29/2022, 4:24 PMnetmaker pokes through the firewall on its own - c
cold-rocket-49569
12/29/2022, 4:25 PMim not filtering by IP, just ports - c
cold-rocket-49569
12/29/2022, 4:25 PMso that all the internal kubernetes stuff is hidden and public only lets through http