# Docker Deployment Router

**URL:** <https://openziti.discourse.group/t/docker-deployment-router/3703>\
**Category:** Support\
**Created:** [December 31, 2024, 12:04pm UTC](https://openziti.discourse.group/t/docker-deployment-router/3703 "2024-12-31T12:04:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Viktor](https://avatars.discourse-cdn.com/v4/letter/v/d6d6ee/32.png) [@Viktor](https://openziti.discourse.group/u/Viktor)\
**Post date:** [December 31, 2024, 12:04pm UTC](https://openziti.discourse.group/t/docker-deployment-router/3703/1 "2024-12-31T12:04:27Z")

</div>

Hello,  
Today I deploy a small test infrastructure.  
I use a server that hosts the controller and the router in containers, this server will have an identity.  
I also have my workstation.

When I deploy the Controller with ZAC it works smoothly, but when deploying the router, errors start occurring...

First following the official doc, I deploy my router container as a "host" router, but the container keeps restarting. In the logs I found :

```auto
{"error":"tunneling not enabled","file":"github.com/openziti/ziti/router/xgress_edge_tunnel/servicepoll.go:105","func":"github.com/openziti/ziti/router/xgress_edge_tunnel.(*servicePoller).pollServices","level":"fatal","msg":"xgress_edge_tunnel unable to authenticate to controller. ensure tunneler mode is enabled for this router or disable tunnel listener. exiting ","time":"2024-12-30T20:05:50.377Z"}

```

So basically I had to redeploy it as tproxy.

Then I was thinking I'm done but there was no documentation explaining that after installing the RTR and CTRL I should create an EDGE ROUTER POLICIES and an SERVICE EDGE ROUTER POLICIES in order to use my router properly.

Maybe the documentation for deploying the router could be reworked ?

---

<div class="post-metadata">

**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\
**Post date:** [January 4, 2025, 5:13pm UTC](https://openziti.discourse.group/t/docker-deployment-router/3703/2 "2025-01-04T17:13:55Z")

</div>

The error means the router's tunneling features are not administratively enabled. You can update the settings like this.

```bash
ziti edge update edge-router "router1" --tunneler-enabled

```

The router process will exit with an error if tunneling is not administratively enabled and the router's configuration YAML file has a tunnel binding mode other than `none`. I expect you encountered the same issue with modes `host` and `tproxy`.

* * *

I see what you mean about next steps. [The concept docs about authZ](https://openziti.io/docs/learn/core-concepts/security/authorization/auth) are expansive, and you're looking for a step-by-step guide that's suitable for most cases, right?

Here's an overview of my habitual deployment procedure.

1. Deploy controller(s) - includes generating a PKI
2. Create router(s)
3. Deploy router(s) - includes enrollment
4. Create a default router policy (ERP) like `#all`/`#public`. This allows me to identify routers that listen on a public IP with the `#public` role.
5. Create a default service router policy (SERP) like `#all`/`#all`.

Now that the OpenZiti network is set up, I'll create and authorize identities and services.

---

<div class="post-metadata">

**Author:** ![Viktor](https://avatars.discourse-cdn.com/v4/letter/v/d6d6ee/32.png) [@Viktor](https://openziti.discourse.group/u/Viktor)\
**Post date:** [January 4, 2025, 5:36pm UTC](https://openziti.discourse.group/t/docker-deployment-router/3703/3 "2025-01-04T17:36:04Z")

</div>

Exactly, a step-by-step guide that's suitable for most cases could be interesting to link somewhere in each deployment documentation. In my make case it would have saved me a lot of time.

Your five steps are great and enough for basic deployment, but I never saw something like that in any deployment documentation, I was thinking it could be interesting to mention it in docs ...