Hey,
I have this setup consisting two VPS on two separate cloud providers :
-
Host 1 → has a controller + the usual edge router. (Configured this manually and not using the quickstart)
-
Host 2 → private edge router with tunneler enabled + a docker container running a http server which prints helloworld (on port 6980)
I’m trying to reach the http server on host 2 from host 1 without opening any port.
Here’s what I’ve done so far :
Host 1 -> Controller Configuration
---
v: 3
db: "/home/ubuntu/test_openziti/controller/controller.db"
identity:
cert: "/home/ubuntu/test_openziti/pki/overlay_network_intermediate_ca/certs/overlay_network_intermediate_ca_client.cert"
server_cert: "/home/ubuntu/test_openziti/pki/overlay_network_intermediate_ca/certs/overlay_network_intermediate_ca_server.chain.pem"
key: "/home/ubuntu/test_openziti/pki/overlay_network_intermediate_ca/keys/overlay_network_intermediate_ca_server.key"
ca: "/home/ubuntu/test_openziti/pki/cas.pem"
network:
routeTimeoutSeconds: 10
createCircuitRetries: 2
pendingLinkTimeoutSeconds: 10
cycleSeconds: 15
minRouterCost: 10
routerConnectChurnLimit: 1m
initialLinkLatency: 65s
smart:
rerouteFraction: 0.02
rerouteCap: 4
ctrl:
maxQueuedConnects: 1
maxOutstandingConnects: 16
connectTimeoutMs: 5000
listener: tls:0.0.0.0:8440
healthChecks:
boltCheck:
interval: 30s
timeout: 20s
initialDelay: 30s
edge:
api:
activityUpdateInterval: 90s
activityUpdateBatchSize: 250
sessionTimeout: 30m
address: 129.151.227.134:8441
enrollment:
signingCert:
cert: "/home/ubuntu/test_openziti/pki/overlay_network_signing_intermediate_ca/certs/overlay_network_signing_intermediate_ca.cert"
key: "/home/ubuntu/test_openziti/pki/overlay_network_signing_intermediate_ca/keys/overlay_network_signing_intermediate_ca.key"
edgeIdentity:
duration: 180m
edgeRouter:
duration: 180m
web:
- name: management_api
bindPoints:
- interface: 127.0.0.1:5309
address: 127.0.0.1:5309
identity:
ca: "/home/ubuntu/test_openziti/pki/overlay_network_intermediate_ca/certs/overlay_network_intermediate_ca.cert"
key: "/home/ubuntu/test_openziti/pki/overlay_network_intermediate_ca/keys/overlay_network_intermediate_ca_server.key"
server_cert: "/home/ubuntu/test_openziti/pki/overlay_network_intermediate_ca/certs/overlay_network_intermediate_ca_server.chain.pem"
cert: "/home/ubuntu/test_openziti/pki/overlay_network_intermediate_ca/certs/overlay_network_intermediate_ca_client.cert"
options:
idleTimeout: 5000ms
readTimeout: 5000ms
writeTimeout: 100000ms
minTLSVersion: TLS1.2
maxTLSVersion: TLS1.3
apis:
- binding: fabric
options: {}
- binding: health-checks
options: {}
- binding: edge-management
options: {}
- name: client_api
bindPoints:
- interface: 0.0.0.0:8441
address: 129.151.227.134:8441
identity:
ca: "/home/ubuntu/test_openziti/pki/overlay_network_intermediate_ca/certs/overlay_network_intermediate_ca.cert"
key: "/home/ubuntu/test_openziti/pki/overlay_network_intermediate_ca/keys/overlay_network_intermediate_ca_server.key"
server_cert: "/home/ubuntu/test_openziti/pki/overlay_network_intermediate_ca/certs/overlay_network_intermediate_ca_server.chain.pem"
cert: "/home/ubuntu/test_openziti/pki/overlay_network_intermediate_ca/certs/overlay_network_intermediate_ca_client.cert"
options:
idleTimeout: 5000ms
readTimeout: 5000ms
writeTimeout: 100000ms
minTLSVersion: TLS1.2
maxTLSVersion: TLS1.3
apis:
- binding: edge-client
options: {}
Host 1 -> Public Edge Router Config
---
v: 3
identity:
cert: "/home/ubuntu/test_openziti/pki/instance-20230806-1503_public_router/client.cert"
server_cert: "/home/ubuntu/test_openziti/pki/instance-20230806-1503_public_router/server.cert"
key: "/home/ubuntu/test_openziti/pki/instance-20230806-1503_public_router/server.key"
ca: "/home/ubuntu/test_openziti/pki/instance-20230806-1503_public_router/cas.cert"
ctrl:
endpoint: tls:129.151.227.134:8440
link:
dialers:
- binding: transport
listeners:
- binding: transport
bind: tls:0.0.0.0:10080
advertise: tls:129.151.227.134:10080
options:
outQueueSize: 4
listeners:
- binding: edge
address: tls:0.0.0.0:8442
options:
advertise: 129.151.227.134:8442
connectTimeoutMs: 5000
getSessionTimeout: 60
- binding: tunnel
options:
mode: host
edge:
csr:
country: US
province: NC
locality: Charlotte
organization: NetFoundry
organizationalUnit: Ziti
sans:
dns: ['129.151.227.134', 'localhost']
ip: ['127.0.0.1', '129.151.227.134']
forwarder:
latencyProbeInterval: 10
xgressDialQueueLength: 1000
xgressDialWorkerCount: 128
linkDialQueueLength: 1000
linkDialWorkerCount: 32
Host 2 -> Private Edge Router Config
---
v: 3
identity:
cert: "/home/ubuntu/test_openziti/pki/instance-20230806-1758_private_router/client.cert"
server_cert: "/home/ubuntu/test_openziti/pki/instance-20230806-1758_private_router/server.cert"
key: "/home/ubuntu/test_openziti/pki/instance-20230806-1758_private_router/server.key"
ca: "/home/ubuntu/test_openziti/pki/instance-20230806-1758_private_router/cas.cert"
ctrl:
endpoint: tls:129.151.227.134:8440
link:
dialers:
- binding: transport
listeners:
- binding: edge
address: tls:0.0.0.0:8442
options:
advertise: 144.24.200.145:8442
connectTimeoutMs: 5000
getSessionTimeout: 60
- binding: tunnel
options:
mode: host
edge:
csr:
country: US
province: NC
locality: Charlotte
organization: NetFoundry
organizationalUnit: Ziti
sans:
dns: ['144.24.200.145', 'localhost']
ip: ['127.0.0.1', '129.151.227.134']
forwarder:
latencyProbeInterval: 10
xgressDialQueueLength: 1000
xgressDialWorkerCount: 128
linkDialQueueLength: 1000
linkDialWorkerCount: 32
Edge Routers Listing
╭────────────┬───────────────────────────────────────┬────────┬───────────────┬──────┬────────────╮
│ ID │ NAME │ ONLINE │ ALLOW TRANSIT │ COST │ ATTRIBUTES │
├────────────┼───────────────────────────────────────┼────────┼───────────────┼──────┼────────────┤
│ 1yYwOs-H6R │ instance-20230806-1758_private_router │ true │ true │ 0 │ all │
│ hPYwgiSqDR │ instance-20230806-1503_public_router │ true │ true │ 0 │ all │
│ │ │ │ │ │ public │
╰────────────┴───────────────────────────────────────┴────────┴───────────────┴──────┴────────────╯
Fabric Links Listing
╭───────────────────────┬───────────────────────────────────────┬──────────────────────────────────────┬─────────────┬─────────────┬─────────────┬───────────┬────────┬───────────╮
│ ID │ DIALER │ ACCEPTOR │ STATIC COST │ SRC LATENCY │ DST LATENCY │ STATE │ STATUS │ FULL COST │
├───────────────────────┼───────────────────────────────────────┼──────────────────────────────────────┼─────────────┼─────────────┼─────────────┼───────────┼────────┼───────────┤
│ nLdfvFGl1ibYaJfe0sU30 │ instance-20230806-1758_private_router │ instance-20230806-1503_public_router │ 1 │ 2.7ms │ 2.7ms │ Connected │ up │ 5 │
╰───────────────────────┴───────────────────────────────────────┴──────────────────────────────────────┴─────────────┴─────────────┴─────────────┴───────────┴────────┴───────────╯
Edge Router Policies
╭────────────────────────┬───────────────────────────────┬────────────────────────────────────────┬────────────────────────────────────────╮
│ ID │ NAME │ EDGE ROUTER ROLES │ IDENTITY ROLES │
├────────────────────────┼───────────────────────────────┼────────────────────────────────────────┼────────────────────────────────────────┤
│ 78ERqdmXDSXTq1zUnceYIb │ all │ #all │ #all │
│ 7b1McM4q79XCVGCvHAqPAn │ all_endpoints_public_routers │ #public │ #all │
│ P2SM6fC7T │ edge-router-P2SM6fC7T-system │ @instance-20230806-1758_private_router │ @instance-20230806-1758_private_router │
│ g7Sp6hCXTg │ edge-router-g7Sp6hCXTg-system │ @instance-20230806-1503_public_router │ @instance-20230806-1503_public_router │
╰────────────────────────┴───────────────────────────────┴────────────────────────────────────────┴────────────────────────────────────────╯
Service edge router policies
╭────────────────────────┬──────────────────────────┬───────────────┬───────────────────╮
│ ID │ NAME │ SERVICE ROLES │ EDGE ROUTER ROLES │
├────────────────────────┼──────────────────────────┼───────────────┼───────────────────┤
│ 1JZERkBxxniwabTj5NRzHy │ all_routers_all_services │ #all │ #all │
╰────────────────────────┴──────────────────────────┴───────────────┴───────────────────╯
Intercept Config
ziti edge create config hello.http.cfg.intercept intercept.v1 '{
"addresses": ["hello.http.ziti"],
"protocols": ["tcp"],
"portRanges": [ {"low":80,"high":80} ]
}'
Host Config
ziti edge create config hello.http.cfg.host host.v1 '{
"address": "127.0.0.1",
"protocol": "tcp",
"port": 6980
}'
Service
ziti edge create service hello.http \
--configs hello.http.cfg.intercept,hello.http.cfg.host \
--role-attributes all
Dial & Bind Service Policies
ziti edge create service-policy hello.http.dial Dial --identity-roles "#all" --service-roles "@hello.http"
ziti edge create service-policy hello.http.bind Bind --identity-roles "#all" --service-roles "@hello.http"
When I try to curl hello.http.ziti It seems like it cannot resolve the host, Im I doing something wrong ?
