This message was deleted.
# generala
adamant-kite-43734
10/10/2023, 1:19 PMThis message was deleted.
r
red-waitress-37932
10/10/2023, 1:29 PMI just retried the same SSH forward test from the machine that hosts rancher and it works equally well.
That rules out firewall issues etc.
red-waitress-37932
10/10/2023, 6:02 PMaccording to tcpdump on both the node and the host that rancher runs on, nothing is sent towards the node from rancher when it shows the "Failed to set up SSH tunneling for host" error
r
rough-farmer-49135
10/10/2023, 6:07 PMI think Rancher does some things via triggering from an encrypted, preexisting channel that it sets up with its agent on the cluster. I think general network rules are client clusters can get to Rancher but Rancher is not guaranteed to get to client clusters. So it probably does trigger that way.
rough-farmer-49135
10/10/2023, 6:07 PM(primarily saying for which direction to try wireshark)
r
red-waitress-37932
10/10/2023, 6:07 PMthere is no traffic either direction
🤷 1
r
rough-farmer-49135
10/10/2023, 6:09 PMNo clue then, that's the only guess I had.
r
red-waitress-37932
10/10/2023, 6:10 PMI'm capturing on "any" using these filter expressions:
Copy code
rancher side: '( tcp port 22 and host not <my workstation IP> ) or host <node IP>'
node side: '( tcp port 22 and host not <my workstation IP> ) or host <rancher IP>'red-waitress-37932
10/10/2023, 6:11 PMso basically i should get any SSH traffic going anywhere from/to rancher or the node except my workstation, as well as any traffic between rancher and the node
r
rough-farmer-49135
10/10/2023, 6:13 PMOnly other guess I have is if the rancher & node are VMs on the same hypervisor, the traffic might not get to where libpcap is watching.
r
red-waitress-37932
10/10/2023, 6:13 PMdifferent ESXes
r
rough-farmer-49135
10/10/2023, 6:14 PMYou can miss the occasional packet from paging when trying to capture on one of the machines involved in traffic, but all of them consistently seems unlikely.
I'm assuming you get enough other traffic to know that libpcap is working and it's not something getting confused with network virtualization.
r
red-waitress-37932
10/10/2023, 6:15 PMif i establish an SSH connection between the two hosts myself, I see that in both wiresharks
red-waitress-37932
10/10/2023, 6:31 PMwhat manages rancher's encrypted tunnel on the node side? is that the kube-proxy container I see on the node?
How do I tell if the tunnel is set up and working?
red-waitress-37932
10/10/2023, 6:36 PMhttps://github.com/rancher/rke/issues/3160 oh this looks familiar
red-waitress-37932
10/10/2023, 6:46 PMalright, made a post there, and I'm calling it a day
5 Views