relays

[tekkisse]

testing and want to confirm my understanding that relay ONLY works if the server using another server to relay can register itself with lighthouse and therefore need outbound access to lighthouse server ? you can not have a server using a relay to another nebula server and ONLY have the relaying server be able to speak to lighthouse ?
version 1.9
my testing : corporate firewall (no punching)
server 1 - outbound UDP to lighthouse only - relay set to server 2
server 2 - outbound and inbound to lighthouse
server 3 - no in or out traffic - relay set to server 2

Both server 1 and 2 can be reached from outside the firewall but server 3 - seems to hang on trying to register with the lighthouse.

Is it possible to use the relay server to get to the lighthouse - or do you need some linux voodoo to do that

[johnmaguire]

@tekkisse I'm afraid you are correct that every host in your Nebula network needs to be able to talk to the Lighthouse directly. For this reason we recommend assigning it a static IPv4 address and port on the Internet (this also gives it the ability to learn the public IPv4 address of any host behind a NAT that checks in with it.)

The Lighthouse is the primary orchestrator of your Nebula network. You can think of it a bit like a phone book. Without it, your hosts don't know where on the Internet (or other underlay networks, such as your LAN) your other hosts live. It essentially converts Nebula IP addresses to underlay IP addresses.

While you can also use that static_host_map to point to other hosts in the network instead, and you could specify the relay host in this map, there is a secondary problem which is that eligible relays are also discovered through the Lighthouse. To configure an eligible relay, a host must specify a relay in its own config. This list of eligible relays is reported to the Lighthouse - and when other hosts query for the host, the list of eligible relays is included along with the host's own underlay IPs. This allows hosts to advertise the "best" relay for them (e.g. a relay that is in their own datacenter.) You can read more about the design decisions for relays here: https://www.defined.net/blog/announcing-relay-support-in-nebula/

Unfortunately, as a result of this configuration, Lighthouses are required in order to connect to a host using a relay.

Can you describe more about your use case and why you're wishing to use a relay to connect to the Lighthouse? There may be other challenges involved here, such as discovering the public IPv4 address for a host, when relaying to a Lighthouse. If this is indeed a hard requirement, I suggest opening a feature request issue under the Issues tab.

Thanks!