Hello! I'm currently using Netmaker primarily as a way to handle remote access to a VPC ("corporate VPN"). I.e. running a node that acts as both an ingress and egress gateway and using Netmaker to manage the external clients (and manage who can manage the external clients). It's been splendid for our current setup, which is relatively simple. However, moving forward the idea is to both utilize Netmaker for more as well as try to set up a HA remote access. I'm just gonna go ahead and describe how I imagine this kind of management would look/work without regards to the actual complexity of implementation. So this is kind of a preface of "I realize this might be ridiculous" but it could be a good jumping-off point. So my idea would entail some key steps 1. Ingress gateway would be its own concept and consist of an

endpoint

, a collection of

external clients

and a collection of

nodes

and an optional

egress

2. An external client would be tied to both an ingress gateway and a user. A user would be able to have several external clients within an ingress. The workflow here (for me) would be that I (as an admin) would create an ingress gateway and set the endpoint to a loadbalancer I have configured ahead of time. I would then register a collection of nodes to this ingress and Netmaker would ensure that they have exactly equal configurations (so that they essentially "act as the same node" but with different private IPs). I would then grant access to the users I administer so that each user can log in (preferably with OAuth) and create and manage their own external clients within this Network & Ingress. So e.g if one of my users wants one configuration for the office and one for the home computer they can do that, and I can still both see and manage those (and revoke them). Obviously, they wouldn't be able to see each other's configuration and secrets.

I think the biggest pain point of the current setup is that everything is intimately tied to a single node (which makes sense in the current architecture). So if I (for whatever reason) want to move my external clients to another node there is no obvious way to do that (that I could find).

Allowing users to manage their own secrets would also greatly simplify the process of distributing them. Right now if I grant access to the network every user gets access to all external clients, which is less than ideal.

Hi @User , thanks for all these details. We had a thought about an implementation for the current state that might be acceptable. It assumes the LB is in a machine you control (not a cloud LB). In this case, you could deploy an ingress gateway on this node in front of your LB, so that you would actually route to the LB via the private IP provided by Netmaker. Then, the LB would distribute traffic to multiple nodes on the others side. Would this potentially be a workaround for your scenario?

Honestly, there is really no need to find a quick solution to this. There is no hurry from our side. If anything the bigger issue right now is the user & external client handling.

I was more interested in bringing this up and hearing what you think about it. Does it make sense? Is it something desirable for Netmaker in the first place?

Yes I agree that long term, we need to be able to allow HA configurations for gateways, in one way or another. This is a good potential way of achieving that, though it's also good to have it posted here in case others have input.

And how do you feel about the proposed external client and user management?

Tying to a user will be more difficult, but our current plan is to have a lower level user role of "network user" who will be able to create ext clients and nodes, subject to settings set by the network admin. I think that generally falls in line with the user management you're expecting.

The ingress gateway concept is still potentially problematic, though actually, we might be able to solve this similarly to how we do "relay servers"

the problem with having multiple nodes behind a single ingress is that the keys all have to match

however this is not the case with a relay server. If we had a relay which also acted as an ingress, we could potentially route to multiple gateways with it

Should I create an issue about this?

Hey guys! Is a dark mode for the interface planned?

It is in the backlog but low priority for now

Oki thank you!

Hi! Could you implement Rocky Linux for https://raw.githubusercontent.com/gravitl/netmaker/master/scripts/netclient-install.sh It is compatible with CentOS, file you could check for is /etc/redhat-release

sure thing, have you tried running the client manually? would be good to know it's compatible first

yup, we got it running with touch /etc/centos-release what doesn't work atm is checking the wireguard repo though, at least in our case when it was already installed

log on Rocky, with WG already installed: checking dependencies... wireguard sh: line 75: dpkg-query: command not found wireguard is not installed. Attempting install. Last metadata expiration check: 3:36:37 ago on Wed 23 Feb 2022 11:12:49 EET. No match for argument: wireguard Error: Unable to find a match: wireguard sh: line 86: dpkg-query: command not found FAILED TO INSTALL wireguard This may break functionality. OS Version = Linux Netclient Version = v0.11.0 Binary = netclient Downloading netclient v0.11.0

but then it just works afterwards

Try:

sudo dnf install epel-release elrepo-release
sudo dnf update
sudo dnf install wireguard-tools kmod-wireguard

Or similar manual installation for wireguard package

Is there a way we can make a page where you can see what clients are connected (external ones), as now I would need to check the server I guess, for compliancy I would need to be able to see who is connected and "kill" the connection when needed 🙂

I would second this request, and add a request for control of external client IP address assignation via the UI before configs are deployed to users

@jolly-london-20127 how hard would it be to add TOTP 2fa to the dashboard login?

That is something planned for the not too distant future

I was looking over the go code for TOTP, but I'm not that familiar with golang yet since I was going to try my hand at stuffing it in myself. Is this something you'd start with @User ? https://github.com/pquerna/otp/blob/v1.3.0/totp/totp.go

we'd probably find some open source library to use yeah, but not sure about that one specifically since it hasn't been updated in some time

Feature request: In powershell you can use commands to set an dns server and a domain suffix within netmaker interface.

Set-DnsClientServerAddress -InterfaceAlias "nm-MyNet" -ServerAddresses ("192.168.200.254") Set-DnsClient -InterfaceAlias "nm-MyNet" -ConnectionSpecificSuffix "MyNet"