Open jonasasx opened 1 year ago
Exact same issue here since upgrade to v0.18.5. I have 4 egress nodes with non of them routing/nating between endpoint networks. However ping inside netmaker network is working fine. Static routes on routers are set.
[OK] Ping from netmaker server to any netclient [OK] Ping from netclient A to netclient B/C/D [OK] Ping from netclient A to egress IP of netclient B/C/D [OK] Ping from netclient A to local router on site B/C/D [OK] Ping from netclient A to any LAN device on site B/C/D [FAIL] Ping from any device on LAN A fails to reach netclient egress IP of remote site B/C/D or any device on LAN B/C/D -- same effect vice versa --
Checked with traceroute
and wireshark
.
Problem description: Ping request reaches remote point but reply gets blocked.
Temporary solution: Flushing iptables rules/chains via sudo iptables -F
makes endpoints reachable.
Netmaker + Netclient on v0.18.6
same issue here, removing only drop rule solved for me:
iptables -D netmakerfilter -j DROP
is there any way to edit the firewall rules for nodes on netmaker?
i posted similar question in netmaker git here
I am wondering why this iptables DROP
rule is added automatically while NAT for egress traffic is enabled. Actually it is blocking site-to-site communication.
Hopefully the Netmaker team will keep an eye on it soon.
Having similar issues with 0.19 and docker.
[docker host1] -> [docker netclient1] -> [docker netclient2] -> [docker host2] -> [lan]
The docker host2 has egress to the lan configured with NAT.
In my case I was able to ping the host lan ip of the docker host2 running the netclient2 docker container. I also was able to connect to services on the host lan ip of the docker host2. But I could NOT connect to docker services/ports exposed to the host lan ip of the docker host2. After running this command on docker host2, I was able to connect to docker ports exposed to the host lan ip of the docker host2.
iptables -D netmakerfilter -j DROP
After that I was still not able to ping or connected to services on the egress lan.
Docker sets
-P FORWARD DROP
After following the suggestion at https://docs.docker.com/network/iptables/#docker-on-a-router, running this command on docker host2 made that work too.
iptables -I DOCKER-USER -j ACCEPT
Not saying this is a solution. But for some reason the general Docker forward deny rule seems to byte the netclient forwarding needs.
ps. the netclient docker image is using legacy iptables. If your host uses the newer nf based iptables, you will need to call to do above
iptables-legacy
Netmaker and Netclient are v0.18.5.
I have a netmaker network 10.1.0.0/24 and two nodes: 10.1.0.1/24 (test1) and 10.1.0.2/24 (test2). Both of the nodes are egress gateways with networks:
Netclient sets iptables rules for 10.1.0.1/24 (test1):
These rules reject all packets from 10.1.6.0/24 network. For example packet from 10.1.6.10 to 10.1.5.10 is forbidden.![image](https://user-images.githubusercontent.com/5870405/229487164-8de6a1e9-fd1a-4250-960f-392d5b9af616.png)