Storage node behind NAT

[tomhtil]

I’ve got a bit of an unusual problem in my setup.

I need to run a master node and storage nodes for different segments of the network, in order to keep images in sync but be able to deploy them in any of three locations. Location 1 sits above Location 2 and 3 in the network architecture. 2 and 3 NAT up to 1.

Location 1: 10.11.12.0/24 (WAN network)
Location 2: 10.1.2.0/24 (LAN 1)
Location 3: 10.1.2.0/24 (LAN 2)

I managed to get the master running on 10.11.12.100, then set up a storage node in Location 2 on 10.1.2.100.
I added TCP ports 20,21,22,80 to forward from the WAN address (10.11.12.1) of the Location 2 firewall to the storage node on 10.1.2.100.

This allowed me to boot a machine in Location 2 from the storage node and register it with the master server.

However when I try to capture an image the client tries to upload to the WAN address of the storage node as this is what is stored on the master, not the IP behind NAT on the LAN.

I am limited in what else I can open on the firewall.

Any suggestions on how best to manage this?

[Wayne Workman]

@tomhtil said in Storage node behind NAT:

@Sebastian-Roth is there an easy way to sync the database as well? I’d be happy with multi master setup if i could sync the images folder and the relevant config for just the images.

Galera

[Sebastian Roth]

@tomhtil Sure you could come up with a script using mysqldump and ssh I suppose.

[tomhtil]

@Sebastian-Roth is there an easy way to sync the database as well? I’d be happy with multi master setup if i could sync the images folder and the relevant config for just the images.

[Sebastian Roth]

@tomhtil FOG was never designed to work in a complex network setup like NAT and the protocols used make it very hard, if not impossible. The suggestion on routing might now work.

My suggestion is you disable the official FOG image syncing and use other means of manual sync like rsync over SSH.

[tomhtil]

@Sebastian-Roth thanks - I had come across that one while searching for a solution and the hairpin NAT is unlikely to be a workable option for my network as there would be too many ports to forward.

I’ll try the static route idea on the server but given that its going the ‘wrong’ way through NAT (WAN to LAN) I don’t think the traffic will get passed.

[Sebastian Roth]

@tomhtil You definitely want to read through this: https://forums.fogproject.org/topic/13385/replication-and-imaging-with-location-plugin