825071750290210916 #netmaker

cool-summer-33659

11/12/2021, 3:26 PM

Ah i meant this. Sorry for the unclear question

user

11/16/2021, 10:28 PM

I've just come across Netmaker (& WireGuard), so bare with me regarding my minimal knowledge regarding the software architecture, but am I right in thinking that you can configure Netmaker to essentially be a fault tolerant / meshed VPN, so you'd be able to connect a PC / client to a VPN node, and it can then internalise that traffic for the shortest path to it's destination network? or is this purely for meshed internal networking via the connected clients/nodes? Thanks.

jolly-london-20127

11/16/2021, 10:31 PM

Yes, Netmaker by default creates a p2p mesh, meaning every machine in the network connects directly to the other machines in the network, rather than going through some gateway or relay.

jolly-london-20127

11/16/2021, 10:31 PM

However, it doesn't do any additional complex routing for fastest path beyond just forging a p2p connection using the ip of the other machine.

user

11/16/2021, 10:33 PM

Thanks for the clarification, much appreciated.

brash-tomato-28082

11/18/2021, 4:46 PM

Hey, I noticed there's now freebsd support, any chance of netclient working on truenas?

jolly-london-20127

11/18/2021, 5:14 PM

Have not tried it, but would love to get some feedback and need users to do some testing

jolly-london-20127

11/18/2021, 5:14 PM

if you can try it out, I can help with support

jolly-london-20127

11/18/2021, 5:14 PM

should be able to run the netclient-install script on it

cool-summer-33659

11/18/2021, 6:36 PM

Hi, due the fact that some of us may run netmaker docker stack on an internet facing virtual server as available node for clients, I wonder, if there is something like fail2ban mechanism to block password attracts towards api, grpc, ui . Dealing with iptables and docker on the same host is a mess if you want to block access for a docker exposed host. Maybe I’m doing it wrong on my virtual server but I do not want to run a virtual machine inside the virtual server for running docker stuff

straight-lock-3524

11/18/2021, 8:39 PM

you mean like almost everyone I guess? 🙂

cool-summer-33659

11/18/2021, 8:44 PM

Probably yes

jolly-london-20127

11/18/2021, 8:51 PM

I think we can just put something in front of the caddy proxy to handle this, might be a better solution than building something into the server

cool-summer-33659

11/18/2021, 8:56 PM

I’m thinking of running the caddy server on the native host, so I can manipulate iptables with fail2ban. But on the other side this might catch normal requests also, if they are too often. @jolly-london-20127 do netmaker write some logs with failed logins? Then fail2ban could use them in filter and blocks ips from accessing caddy server (not running in docker)

jolly-london-20127

11/18/2021, 10:52 PM

Yes actually it does

creamy-baker-24352

11/20/2021, 1:20 AM

what are the ENV variables

SERVER_GRPC_CONN_STRING: "grpc.NETMAKER_BASE_DOMAIN:443"

and

SERVER_API_CONN_STRING: "api.NETMAKER_BASE_DOMAIN:443"

used for if ports 8081 and 50051 still need to be opened? front end reverse proxy (nginx/caddy/traefik) connects those urls to those ports on port 443

creamy-baker-24352

11/20/2021, 1:21 AM

if I put the api/grpc addresses behind cloudflare it stops working, those ports are still being used and non-standard ports dont work through cloudflare

creamy-baker-24352

11/20/2021, 1:22 AM

just curious what those are for, what the reverse proxy does on port 443 is the raw ports still need to be exposed

cool-summer-33659

11/20/2021, 10:51 AM

Well I had some misleading ideas. If external available ports are configured with network mode host normal iptables are working

creamy-baker-24352

11/20/2021, 3:50 PM

FYI - I figured out my issue - with cloudflare there is an option to enable gRPC traffic for your domain. I unset

SERVER_HOST

SERVER_HTTP_HOST

and

SERVER_GRPC_HOST

in my environment variables and once gRPC was enabled on the domain api/grpc traffic worked through cloudflare.

cool-summer-33659

11/20/2021, 4:17 PM

Is there a way to configure via gui a normal route add for allowed ip without of having masquerading on every outgoing (from vpn node) connection. I know I can delete command in postup, but wondered if this can be done natively in gui. Just mentioned I cannot delete the postup/down ipmasquerade rules. They will be recreated instantly, either delete via gui nor deletion via cmdline and push.

jolly-london-20127

11/20/2021, 11:27 PM

@User good to hear. There's probably more variables than needed on server side. SERVER_HOST_SERVER_HTTP_HOST, and SERVER_GRPC host can probably go away.

jolly-london-20127

11/20/2021, 11:29 PM

@User not quite sure what you mean. Is this on an egress gateway? In general the solution would be to add a postup rule.

cool-summer-33659

11/20/2021, 11:50 PM

I would like to configure a egress gw without masquerading postup to see the real src ips in na home network in access logs. I know that I need to configure routes on my default gw to get it working.

jolly-london-20127

11/21/2021, 12:09 AM

ah! ok, i see

jolly-london-20127

11/21/2021, 12:10 AM

editing the postup rules created by netmaker get overwritten automatically?

jolly-london-20127

11/21/2021, 12:10 AM

i think you should just be able to change those rules...

cool-summer-33659

11/21/2021, 12:13 AM

Well I changed them in ui and I changed them in netclient config and pushed them. But in both situations the deleted postup/down rules get reinitialized via netmaker server to the the default. I configured the node as egress gw with my local net.

jolly-london-20127

11/21/2021, 12:14 AM

huh ok, I didn't realize we would rewrite those rules, it should just be a 1-time config change, but will look into it.

cool-summer-33659

11/21/2021, 1:42 PM

It looks like that the rules will be rewritten when you delete all of the postup/down commands. If you leave for example ipforeward in the field and just delete the masquerade command it works.