search

utmstack / UTMStack

Customizable SIEM and XDR powered by Real-Time correlation and Threat Intelligence
https://utmstack.com
GNU Affero General Public License v3.0
196 stars 18 forks source link

[BUG] UTMStack does not function in 10.0.0.0/24 network #691

Open bastionbot opened 1 month ago

bastionbot commented 1 month ago

Describe the bug

Attempting to install the utmstack agent on Fedora 40, Ubuntu 20.04 LTS, and Windows 10 all fail with "UTMStack: error: one or more of the requiered ports are closed. Please open ports 9000 and 50051."

To Reproduce

Steps to reproduce the behavior:

  1. Deploy UTMStack in a 10.0.0.0/24 network
  2. Go to 'Integrations'
  3. Click on an agent
  4. Copy install command and execute on host
  5. See error

Expected behavior

The agent to install successfully

Environment

Additional context

Docker swarm ingress network sets up 10.0.0.0/24 which conflicts with external routing.

bastionbot commented 1 month ago

Moving it to 192.168.10.0/24 allows me to connect an agent from 192.168.10.0/24, but 10.0.0.0/24 still fails with the same error.

bastionbot commented 1 month ago

for i in $(docker network inspect -f '{{range .Containers}}{{.Name}} {{end}}' ingress); do docker network disconnect -f ingress $i; done; Remove all containers from the ingress network docker service rm $(docker service ls -q) Remove all services docker network rm ingress Delete ingress network docker network create --driver overlay --ingress --subnet=10.100.0.0/16 --gateway=10.100.0.2 ingress Recreate ingress network with a different subnet that doesn't conflict /home/utmstack/installer Re-run installer to initialize the swarm

https://UTMStackServer/app-management/settings/connection-key Generate new connection key (maybe needed?)

This should probably be a configurable option during initial setup.

lacak-sk commented 1 month ago

Same issue in discussions: https://github.com/orgs/utmstack/discussions/599#discussioncomment-9260240