Rancher host behind a dynamic ip address?

Rancher 1.x
1

Would it be a problem with Rancher / IPSec between Rancher Hosts if there is one behind a NAT router with dynamic ip address? Or should it work fine?

Because networking fails after Rancher Server reboot (because of connection problems I restartet the host too), but networking doesn’t work.

08:13:11.417531 IP 10.42.134.100.35548 > 10.42.5.244.3306: Flags [S], seq 551169310, win 29200, options [mss 1460,sackOK,TS val 824315 ecr 0,nop,wscale 7], length 0
08:13:11.417656 IP 10.42.134.100.35548 > 10.42.5.244.3306: Flags [S], seq 551169310, win 29200, options [mss 1460,sackOK,TS val 824315 ecr 0,nop,wscale 7], length 0
08:13:12.418232 IP 10.42.134.100.35548 > 10.42.5.244.3306: Flags [S], seq 551169310, win 29200, options [mss 1460,sackOK,TS val 825316 ecr 0,nop,wscale 7], length 0
08:13:12.418428 IP 10.42.134.100.35548 > 10.42.5.244.3306: Flags [S], seq 551169310, win 29200, options [mss 1460,sackOK,TS val 825316 ecr 0,nop,wscale 7], length 0
2

Changing IP address will be problem. If the Network agent running on a host is not able to communicate to the server with the IP address specified during start, networking will fail. You might want to try to delete and add the hosts with the changed IP information.

3

It’s running fine :wink:

Rancher Server have static ip address and a host is behind a home nat router (dsl with dynamic ip address).

To be sure the host communication works fine I created openvpn tunnels from the hosts to the rancher server. Communication isn’t public and works without problems.

4

That’s cool. Can you share a summary of your topology? It might be useful for others who want to deploy something similar.

5

It also works without the openvpn, but it makes the api communication secure :wink:

All machines are KVM VMs running with RancherOS 0.4.5

First is the Rancher Server with a OpenSVPN server running as RancherOS os-service (system-docker). Rancher Server is listening at the tun device ip address.

Second host have also an static ip address and a openvpn-client as os-service.
Third host running at home (dyn ip, also with openvpn-client as os-service).
API communication only tunneled by openvpn.

The Rancher UI is published by an caddy webserver / reverse proxy with tls out of the box :slight_smile:

OpenVPN server setup is forked and updated version from kylemanna/openvpn. OpenVPN Client ins a simple alpine openvpn image.

But there is a rancher server bug with load balancers running at the Rancher Server Host (stucks in “Initializing” state at that host only, but works since the last rancher server update anyway).

6

@pwFoo Could you explain a little more of exactly how you did that? I’m running a OpenVPN server container from kylemanna/openvpn, but I can’t get any clients to connect to it using .ovpn file other than TunnelBlick on my Mac, and that’s exclusively if I use the TCP option in the openvpn server container. What options did you use? Did you use dperson/openvpn-client as your client container and how did you get that working? I’m having a lot of trouble right now.