https://netmaker.org logo
Powered by
Okay new update I have tracked the
# server
b
Okay new update, I have tracked the messages through the following: External client pings 
192.168.12.20
-> Linode Node(
10.120.0.2
) farwards packets to -> Proxmox node(
10.120.0.1
- Netmaker Interface) and masqueraded and and sents packet to -> Host on private subnet 
192.168.12.20
which sends response to -> Proxmox node(
192.168.12.55
- ens18 Interface) <----------- This is as fare as the packet goes When doing a tcpdump looking for packets with the target host from the private subnet nothing comes up. So it seems like the egress not never sents back the responds packets. Used the following command to test that: 
tcpdump -i netmaker 'dst net 10.120.0.0/24'
j
@bored-island-21407 @bored-solstice-58967 this means packets are not getting masqueraded properly on the egress, correct?
b
I would assume, but I just learned about masquerading today
Is there a way to check if the packages received from the ping target, is "de-masqueraded" correctly?
Not sure if that's a word
b
@brash-kilobyte-81516 is your machine using nftables or iptables?
b
I'm using 
iptables
b
can you send output of following commands from your egress machine... 1. 
iptables -L -v
2. 
iptables -t nat -L -v
b
iptables -L -v
Copy code
sudo iptables -L -v
Chain INPUT (policy ACCEPT 269K packets, 34M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy DROP 102 packets, 12954 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  102 12954 netmakerfilter  all  --  netmaker any     anywhere             192.168.12.0/24      /* NETMAKER */
    0     0            icmp --  any    any     192.168.1.190        anywhere            
    0     0            icmp --  any    any     192.168.1.190        anywhere            
    0     0 netmakerfilter  all  --  netmaker any     anywhere             anywhere            
  102 12954 DOCKER-USER  all  --  any    any     anywhere             anywhere            
  102 12954 DOCKER-ISOLATION-STAGE-1  all  --  any    any     anywhere             anywhere            
    0     0 ACCEPT     all  --  any    docker0  anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  any    docker0  anywhere             anywhere            
    0     0 ACCEPT     all  --  docker0 !docker0  anywhere             anywhere            
    0     0 ACCEPT     all  --  docker0 docker0  anywhere             anywhere            
    0     0 ACCEPT     all  --  any    br-6d0659f686c9  anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  any    br-6d0659f686c9  anywhere             anywhere            
    0     0 ACCEPT     all  --  br-6d0659f686c9 !br-6d0659f686c9  anywhere             anywhere            
    0     0 ACCEPT     all  --  br-6d0659f686c9 br-6d0659f686c9  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT 273K packets, 28M bytes)
 pkts bytes target     prot opt in     out     source               

......
iptables -L -v
(Continuation)
Copy code
Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DOCKER-ISOLATION-STAGE-2  all  --  docker0 !docker0  anywhere             anywhere            
    0     0 DOCKER-ISOLATION-STAGE-2  all  --  br-6d0659f686c9 !br-6d0659f686c9  anywhere             anywhere            
  102 12954 RETURN     all  --  any    any     anywhere             anywhere            

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  any    docker0  anywhere             anywhere            
    0     0 DROP       all  --  any    br-6d0659f686c9  anywhere             anywhere            
    0     0 RETURN     all  --  any    any     anywhere             anywhere            

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  102 12954 RETURN     all  --  any    any     anywhere             anywhere            

Chain netmakerfilter (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     rasmus-phone.ext-admin  192.168.12.0/24     
  102 12954 ACCEPT     all  --  any    any     netmaker-server-client.ext-admin  192.168.12.0/24     
    0     0 DROP       all  --  any    any     anywhere             anywhere            
    0     0 RETURN     all  --  any    any     anywhere             anywhere
iptables -t nat -L -v
:
Copy code
Chain PREROUTING (policy ACCEPT 11062 packets, 2641K bytes)
 pkts bytes target     prot opt in     out     source               destination         
   36  2160 DOCKER     all  --  any    any     anywhere             anywhere             ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 160K packets, 13M bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DOCKER     all  --  any    any     anywhere            !localhost/8          ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT 160K packets, 13M bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  any    ens18   anywhere             10.120.0.0/24        /* NETMAKER */
  498 63246 MASQUERADE  all  --  any    ens18   10.120.0.0/24        anywhere             /* NETMAKER */
    0     0 MASQUERADE  all  --  any    !docker0  172.17.0.0/16        anywhere            
    0     0 MASQUERADE  all  --  any    !br-6d0659f686c9  172.24.0.0/16        anywhere            
    0     0 netmakernat  all  --  any    netmaker  anywhere             anywhere             /* NETMAKER */

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     all  --  docker0 any     anywhere             anywhere            
    0     0 RETURN     all  --  br-6d0659f686c9 any     anywhere             anywhere            

Chain netmakernat (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     all  --  any    any     anywhere             anywhere
I have gone through this with @bored-island-21407 and neither of us could spot anything wrong.
b
and netclient on egress host is running inside docker container?
b
No I'm running it straight on the host. Using 
netclient join -t <TOKEN>
b
is this the right interface (
ens18
) for your egress range?
Copy code
0     0 MASQUERADE  all  --  any    ens18   anywhere             10.120.0.0/24        /* NETMAKER */
  498 63246 MASQUERADE  all  --  any    ens18   10.120.0.0/24
b
Yes
Again if I try to ping a host on from another device on the netmaker network, there is indeed ping requests being sent on the 
ens18
interface to the correct host
The host being pinged also responds correctly. However those response packets, gets stuck somewhere in the egress node
b
is there a firewall somewhere that is blocking ICMP replies
@bored-solstice-58967 is a forwarding rule from egress interface to netmaker interface required. I think not with the NAT rules
b
That I have no idea about and I don't know how to check that
b
are you referring to rules under 
POSTROUTING
section?
b
no, I was thinking 
iptables -I FORWARD -i ens18 -j  ACCEPT
but that should not be required with the NAT rule
b
In what order would received response packets, be processed? Obviously one of the tasks is to do the connection tracking and find out, who initially sent the packet, so who need to receive it. However does that happen before or after it is processed in the iptables?, if that makes sense.
I tried a different approach which were to create a whole new VM in proxmox using Alpine Linux instead of Ubuntu(Just to try something different non related to Netmaker). Which did seem to work just fine. However it did require me to install iptables in which I did following this guide: https://wiki.alpinelinux.org/wiki/Configure_Networking
3 Views
PreviousNext
Powered by