https://netmaker.org logo
Powered by
Hey there, so I setup Netmaker on a AWS Lightsail ...
# client
g
Hey there, so I setup Netmaker on a AWS Lightsail (Ubuntu) machine to test. All ports are open and I am able to successfully connect clients. However, I cannot connect from my home network (Windows client) to a machine in a different network (it works with Tailscale though). The dashboard just shows the yellow warning badge and the Wireguard logs show the following error repeatedly:
b
from command line, run netclient pull -n
g
I did a pull it multiple times using the UI but I can try it with the CLI too.
@bored-island-21407 the command opens this window. still no connection to the other node (which shows green in the dashboard)
b
try running with -vvvv flag to get more detailed logs
g
and the beginning it shows the same output as before but than it outputs a huge wall of text that I cant read because the window closes shortly after
is there a logfile somewhere?
b
yes but off top of my head, don't recall where it is on windows
g
A bit annoying that the client always opens a separate window instead of printing directly to the stdout
I'll try connecting from the WSL
Nvm. Seems like Netmaker is not compatible with WSL
Netmaker uses STUN, right?
b
a variant of STUN if the network has udp holepunching enabled
g
Is there a scenario where Tailscale would work but Netmaker not? I guess if STUN fails, Netmaker just cannot connect while Tailscale the automatically uses a relay and succeeds.
However, I have no reason to believe that STUN would fail in my home network, since it uses a fairly common router with the default settings. However I only have a shared IPv4 (DSLite) but a fixed IPv6. Maybe that's the issue? Is there a way to force a connection over IPv6?
It also does not work when using a mobile LTE network, where the IPv4 would also be shared.
b
we have tested with LTE networks, no issues connecting
i have an LTE modem at home and it works fine with netmaker/netclient
g
It would be really great if there was some way to see what exactly the issue is (like STUN failed etc)
b
C:\Program Files (x86)\Netclient\winsw.out --- windows log file
g
Oh I just did a screen recording and using that I could capture that
I dont have that file
so it looks like netclient is not installed correctly
since the service wrapper thing is missing
so after reinstalling netmaker (seems like the script from the docs did work correctly) using the installer (which installs the 'dev' version), i now have the winsw.exe
I sill dont have the log file you mentioned, but there is "C:\Program Files (x86)\Netclient\winsw.wrapper.log"
However the only content ist
Copy code
2022-08-26 15:38:14,152 DEBUG - Starting WinSW in console mode
2022-08-26 15:38:14,175 INFO  - Installing service 'Netclient (netclient)'...
2022-08-26 15:38:14,204 INFO  - Service 'Netclient (netclient)' was installed successfully.
Still cannot ping the other node, wireguard still fails at handshake
b
what does 
wg show
display
can you ping 12.12.12.254
g
searched the whole fs, there is not winsw.out file
yes
b
this windows machine is at home? What kind of internet ?? CGNAT?
g
I test with one that is connected from LTE and one that is behind a private home network.
the other machine I am trying to connect to is at a totally different location (different ISP) behind a UniFi Security Gateway.
b
firewall?
g
We have no explicit firewall than the one built into the router. i think even UPNP is enabled.
But looks to me like a problem with my local setup, since the server (hosted on AWS Lightsail) seems to think there is a problem with my machine?
b
looks like a connectivity issue with machine at 12.12.12.3
g
yep, thats the one at my home
where i am also having the handshake failures in the wireguard log
b
betting firewall issue
g
on my home networks side?
but then again, why does it not work from LTE too?
oh you mean on the server
If you are referring to the comments. I actually didn't allow port 8883, since that was not mentioned in the documentation
b
port 8883 is required
g
https://docs.netmaker.org/quick-start.html Shoulnd't it be mentioned here, then?
b
are you using traefix with forwarding of mq traffic? then no... traefix takes care of it
g
I followed the quick start guide - the docker compose file there uses traefik afaik
I opened the port however, same issue as before
this is the log of the netmaker server btw
some error with retrieving records
I opened all the ports for UDP and TCP, still does not work
b
mq logs?
no connections from your windows machine
New client connected from 172.22.0.2:35234 as xhY2DbgTnYN2cghoTopVOOT (p2, c1, k30, u'stabl-beast').
g
Setup currently looks like this
b
you need to fix the mq connectivity .. use the gist I posted earlier
g
Will go through it, thanks for the hint!
Just to be sure: the quick start setup uses a dockercompose file that proxies the MQ through traefik, right?
Checklist: - mq config like in the gist ✅ - ensure docker mounts are correct: ✅ - netmaker: - /data/netmaker/dnsconfig:/root/config/dnsconfig - /data/netmaker/sqldata:/root/data - /data/netmaker/shared_certs:/etc/netmaker - mq: -/data/netmaker/mq/mosquitto.conf:/mosquitto/config/mosquitto.conf - /data/netmaker/mq/data:/mosquitto/data - /data/netmaker/mq/logs:/mosquitto/log - /data/netmaker/shared_certs:/mosquitto/certs - broker reachable: ✅ - ping broker.vpn.stabl.tech succeded - ensure MQ start correctly: ✅
Copy code
ubuntu@ip-172-26-2-105:~$ docker logs mq
1661510772: mosquitto version 2.0.11 starting
1661510772: Config loaded from /mosquitto/config/mosquitto.conf.
1661510772: Opening ipv4 listen socket on port 8883.
1661510772: Opening ipv6 listen socket on port 8883.
1661510772: Opening ipv4 listen socket on port 1883.
1661510772: Opening ipv6 listen socket on port 1883.
1661510772: mosquitto version 2.0.11 running
So next step would be to regenerate the certs?
b
I would try the mosquitto_pub/sub tests first
g
deleting the certs does not work
b
use sudo
g
connecting locally does not seem to work
my bad, tying subpub test before anyways now
Why can stabl-beast connect but not the local mq client 🤔
b
firewall on windows machine?
g
no, I executed the command on the same ubuntu machine that also runs the netmaker server
so no windows involved
b
because the certs don't have the same path on the server as on nodes
g
"connection refused", so I guess the connection work but authentication fails
but in this test there are no nodes involved
b
the tests are intended to be run from nodes that are having connection issues
g
i see, I was thinking that if it should also work from the server
where are the certificates stored on windows?
Maybe it's easier if I give you an access key and you may be try it?
b
programsfiles/netclient/broker.xxxxx/
g
i dont see them tbh
b
it was there in the earlier screenshot you sent
g
yep, and now it isn't anymore
b
rejoin the network
g
I noticed it also always says that it failed to join the network, but after restarting the client I am connected
rejoined, still no broker files there
b
Do a netclient pull
g
did about 5 now
still no broker files
b
I don't use windows, so not sure I can help you
g
I have to add, this is a brand new Windows 11 machine I have received three days ago. Only setup devtools like WSL, docker and vscode
I think we are going to use Tailscale for now and maybe use Netmaker when it's a bit more stable.
But thank you for your help anyways!
b
Install netmaker on Linux machine inside your lan and make it an egress gateway to your lan
g
I thought about that, but I cannot do this from LTE when being mobile
also most of our employees have Windows so this does not really scale
b
Use ext clients
g
Kind of defeats the purpose
6 Views
PreviousNext
Powered by