Hey all,
we are currently evaluating Balena. The devices (RPi4s) will be rolled out in a very (network) controlled environment.
Since we need to allow specific IPs and have no option to allow wildcard-domains, we are considering the proxy setup as recommended here: Firewall configuration incorrect
Here is what we did to test:
- On my MacBook I configured one ethernet port to have a static IP. I then started glider:
glider -listen socks5://user1:pass1@:1080 -verbose - On the Balena image we are flashing to the RPi 4 we added two files (see below) to configure static IP, DNS resolution and redsocks. The device is connected via ethernet to my MacBook.
Thus the RPi4 does not have a direct connection to the Internet (on my MacBook I have no forwarding enabled). It can however connect to the proxy.
Connectivity seems to work (running curl icanhazip.com from the Pi is successful).
However we don’t see the device in the dashboard so the OpenVPN connection does not seem to work.
In journalctl I see the following log messages:
Aug 29 10:11:13 be452ad resin-supervisor[1235]: [event] Event: Device bootstrap {}
Aug 29 10:11:13 be452ad ba6ec9d3d967[791]: [info] New device detected. Provisioning...
Aug 29 10:11:13 be452ad resin-supervisor[1235]: [info] New device detected. Provisioning...
Aug 29 10:11:13 be452ad resin-supervisor[1235]: [event] Event: Device bootstrap failed, retrying {"delay":30000,"error":{"message":""}}
Aug 29 10:11:13 be452ad ba6ec9d3d967[791]: [event] Event: Device bootstrap failed, retrying {"delay":30000,"error":{"message":""}}
Aug 29 10:11:19 be452ad os-config[786]: Awaiting service configuration...
Aug 29 10:11:29 be452ad os-config[786]: Awaiting service configuration...
Aug 29 10:11:40 be452ad os-config[786]: Awaiting service configuration...
Aug 29 10:11:42 be452ad systemd[1]: Created slice system-sshd.slice.
Aug 29 10:11:42 be452ad systemd[1]: Starting OpenSSH Per-Connection Daemon (192.168.1.1:64200)...
Aug 29 10:11:42 be452ad systemd[1]: Started OpenSSH Per-Connection Daemon (192.168.1.1:64200).
Aug 29 10:11:43 be452ad ba6ec9d3d967[791]: [event] Event: Device bootstrap {}
Aug 29 10:11:43 be452ad resin-supervisor[1235]: [event] Event: Device bootstrap {}
Aug 29 10:11:43 be452ad ba6ec9d3d967[791]: [info] New device detected. Provisioning...
Aug 29 10:11:43 be452ad resin-supervisor[1235]: [info] New device detected. Provisioning...
Aug 29 10:11:44 be452ad ba6ec9d3d967[791]: [event] Event: Device bootstrap failed, retrying {"delay":30000,"error":{"message":""}}
Aug 29 10:11:44 be452ad resin-supervisor[1235]: [event] Event: Device bootstrap failed, retrying {"delay":30000,"error":{"message":""}}
In the proxy log, I see that it is trying to connect:
2019/10/29 11:47:47 socks5.go:145: [socks5] 192.168.1.2:42302 <-> 8.8.8.8:53 via DIRECT
2019/10/29 11:47:47 socks5.go:145: [socks5] 192.168.1.2:42306 <-> 3.215.161.68:443 via DIRECT
2019/10/29 11:47:57 socks5.go:145: [socks5] 192.168.1.2:42310 <-> 8.8.8.8:53 via DIRECT
2019/10/29 11:47:57 socks5.go:145: [socks5] 192.168.1.2:42314 <-> 34.200.210.179:443 via DIRECT
2019/10/29 11:48:07 socks5.go:145: [socks5] 192.168.1.2:42318 <-> 8.8.8.8:53 via DIRECT
2019/10/29 11:48:07 socks5.go:145: [socks5] 192.168.1.2:42322 <-> 3.215.161.68:443 via DIRECT
2019/10/29 11:48:10 socks5.go:145: [socks5] 192.168.1.2:42326 <-> 8.8.8.8:53 via DIRECT
2019/10/29 11:48:10 socks5.go:145: [socks5] 192.168.1.2:42330 <-> 34.200.210.179:443 via DIRECT
2019/10/29 11:48:18 socks5.go:145: [socks5] 192.168.1.2:42334 <-> 8.8.8.8:53 via DIRECT
2019/10/29 11:48:18 socks5.go:145: [socks5] 192.168.1.2:42338 <-> 34.200.210.179:443 via DIRECT
The content of /system-connections/test
[connection]
id=test
type=ethernet
interface-name=eth0
permissions=
secondaries=
[ethernet]
mac-address-blacklist=
[ipv4]
address1=192.168.1.2/24,192.168.1.1
dns="127.0.0.1#5313"
dns-search=
method=manual
[ipv6]
addr-gen-mode=stable-privacy
dns-search=
method=auto
The content of /system-proxy/redsocks.conf:
base {
log_debug = off;
log_info = on;
log = "syslog:local7";
daemon = off;
redirector = iptables;
}
redsocks {
type = socks5;
ip = 192.168.1.1;
login = user1;
password = pass1;
port = 1080;
local_ip = 127.0.0.1;
local_port = 12345;
}
dnsu2t {
local_ip = 127.0.0.1;
local_port = 5313;
remote_ip = 8.8.8.8;
remote_port = 53;
}
Where do we go wrong?
Thanks
Michael