Egress Routing without masqerading
# server
b
Hello everyone, I am currently working on integrating dynamically created vps' into my static network to give them access to my ids, internal acme ca, monitoring tools and so on. Therefore, I configured my netmaker server as an egress gateway into my network. I gave the egress gateway the corresponding ip-routes and interface and provided my internal firewall with gateway entries and static routes for the netmaker network pointing to the netmaker host. Connectivity fails though, since I don't masquerade the incoming packets and retain the original IP. The netmaker server does not update it's own ip routes and so tries to forward all incoming packets for his clients back to my firewall with an icmp redirect. @bored-island-21407 mentioned, that i'd have to update the ip routes of the netmaker host manually. Could you tell me: a) Is it planned to update the ip routes of the netmaker server to enable egress without masquerading and manual intervention? b) To which IP of the containers should the manual route point to? I tried the corresponding bridge gw, but that did not to work. c) As far as I can tell, this manual routing could break, if my compose file gets updated (e.g. netmaker 0.18) and the containers are recreated - is this correct? The only safenet would possibly be a preconfigured static-network I guess?
Does anybody have an idea in this matter? Otherwise it would still be helpful to know, that I will not get help 😄
If anybody ever reads this: use
ip route add $netmaker_network via $netmaker_ip
did the trick for me. This might fail in case of a new container, maybe a manually generated network will prevent changing ip-addresses and routes for that
or a simple cronjob could do the trick 🤷‍♂️