https://netmaker.org logo
Powered by
I know netmaker cannot be run behind CGNAT, as it ...
# netmaker
l
I know netmaker cannot be run behind CGNAT, as it requires inbound connections. However, I have a VPS used for web traffic only. It's a pretty low-spec cloud instance. Can I run netmaker on the nat'd device and use the VPS to front all the various connections?
b
netmaker doesn't need heavy resources for a small network. Why not run netmaker on the VPS
l
The VPS struggles as it is. It's a 1gb of ram instance.
b
netmaker runs on a $6 Digital Ocean droplet with no issues
l
So that's a solution to another question. I'm trying to make use of the infrastructure I have, Just transparently using my vps as the ingress.
I feel like I can with some crafty iptable routes.
I need to read up on the structure a bit more.
b
how to you intend to have your vps forward request's to your nat'd device without a tunel between the vps and the nat'd device. You have a chicken and egg problem
l
I already have a tunnel established between the two. And for a long time, that's all i needed. Now I want a more robust solution, external devices, mesh networking, etc.
So instead of trying to build a diy wireguard server, I want to use netmaker to do all that.
Somewhat related question, can this be run on a host that already uses 443? I use nginx, so I'm assuming adopting nginx as the proxy would just be a matter of configuration.
b
it is recommended to run netmaker on a host with a static public ip
yes, it would just require the proper nginx configuration
l
so based on the nginx configuration examples, I could theoretically run netmaker on a separate machine than the web server proxying all the requests. api, dashboard, and grpc are the three I'd need to proxy, right?
b
grpc is no longer used by netmaker -- what version are you using?
need proxy for api, dashboard , and mq
l
ok, I can search for those three and figure it out.
b
mq is tricky as it is not http
l
where is the nginx config for mq if running on a droplet? I'll start there.
I see this, but it's just dashboard and api.
b
our recommendation with nginx is to use nginx to proxy api and dashboard and connect to mq directly. only supported configuration with mq proxied is with traefik
l
That makes sense. I'm trying to find docs on mq setup
MQ broker listens on 8883?
b
externally yes.... it also listens on 1883 but only on localhost
l
From personal experience with mq and nginx, you can conditionally proxy the traffix with nginx based on SNI, but it's inconvenient since nginx forces you to run your mq and http listeners on a different port from the ingress 443. traefik can ingress on 433 and route to mq or http even if they also listen on 443
if this limitation does not bother you, it's doable. alternatively, you can run three nginx instances in docker containers, each on port 443, and have the ingress container route to either mq or http container based on SNI
or of course, just use a custom port and bypass all this crap :)
31 Views
PreviousNext
Powered by