Maximo

Maximo

Come for answers, stay for best practices. All we're missing is you.

 View Only
Expand all | Collapse all

MAS9 SNO and how to setup Port Forwarding on Router to make accessible from Internet?

  • 1.  MAS9 SNO and how to setup Port Forwarding on Router to make accessible from Internet?

    Posted Sun September 01, 2024 06:04 PM
    Edited by David Miller Sun September 01, 2024 06:15 PM

    So, I have a MAS9 SNO setup running on a server in my home office and I am trying to figure how to make it accessible from the internet. I bought a domain that it was all setup through. So my login goes to  (https://auth.inst1.apps.eipdemo.mydomain.com/) I am bit confused as my Cloudflare settings have the 192.168.1.x for the following:

    A api.eipdemo         - 192.168.1.x

    A api-int.eipdemo  - 192.168.1.x

    A *.apps.eipdemo  - 192.168.1.x

    A mydomain.com  - my external ip

    CNAME   do             - mydomain.com

    CNAME    www       - mydomain.com

    And then my router is already doing Port Forwarding

    HTTPS                                        443     443   192.168.1.x

    HTTP                                          80        80      192.168.1.x

    OCP API Management port  6443  6443  192.168.1.x

    OCP Management                   8443   8443 192.168.1.x

    OCP Management HTTPS     8080   8080 192.168.1.x

    Totally lost what I need to do to my DNS registration to start tying it to my external IP and make the Port Forwarding work when I come in from outside. I have a DDNS registration with NO-IP (myddns.mynetgear.com) some how I am assuming I would come in through that but that then confuses me on what to do with my domain name that I own and can I use that on the web instead of the DDNS?

    Can I bypass the DDNS and simply make my DNS entries use my real IP Address for all the 192.168.1.x values above and the Port Forwarding will take over to route me through the subdomains that the MAS uses once I log in and start navigating around? My ISP has given me the same IP address for years so I am not sure it changes much if at all. My thoughts are changing it on Cloudflare would be no big deal if it changed on me again if that is only place I need to make the changes.

    If I change the IP address on the DNS entries will my internal router do forwarding to the 192.168.1.x and make this all work?

    Very confused what to change and how best to do this. Google leads me into all kinds of pages about changing routing tables in OpenShift and setting up port forwarding in OpenShift as to get to Pods and such and seems way more involved then I hope it needs to be when I have a Router that should be able to do this for me.

    Please help if you can. Totally Confused

    Thanks,



    ------------------------------
    David Miller
    Managing Partner - Maximo Consultant
    Enterprise Integration Partners LLC
    ------------------------------



  • 2.  RE: MAS9 SNO and how to setup Port Forwarding on Router to make accessible from Internet?

    Posted Sun September 01, 2024 06:21 PM

    So I tried to change the DNS Entries only to my public IP address values and that broke all as my LetsEncrypt is tied to those values. So, I am guessing I would need to redo all my LetsEncrypt stuff if I make that change? I was luck y to be able to put it all back and I went back to working. So, I do not want to go through all the LetsEncrypt setup with my public IP address if is not going to work. Hoping someone can tell me if that is the solution or not. Anyone else deal with this or try this yet?



    ------------------------------
    David Miller
    Managing Partner - Maximo Consultant
    Enterprise Integration Partners LLC
    ------------------------------



  • 3.  RE: MAS9 SNO and how to setup Port Forwarding on Router to make accessible from Internet?

    Posted Sun September 01, 2024 07:37 PM

    Hi David,

    You can use Zero Trust from Cloudflare.

    https://www.cloudflare.com/products/zero-trust/vpn-replacement/

    https://www.youtube.com/watch?v=yMmxw-DZ5Ec



    ------------------------------
    If this post helps, please consider accepting it as a solution to help other members find it more quickly.

    Maycon Belfort
    Consultant
    BPD Zenith
    Melbourne
    ------------------------------



  • 4.  RE: MAS9 SNO and how to setup Port Forwarding on Router to make accessible from Internet?

    Posted Mon September 02, 2024 11:04 AM

    This is not as easy as you seem to make it. The documentation is terrible for understanding how to set this up with all the subdomains that MAS is using. What level of the MAS URL do I do on the first setup screen "Add public hostname for my-tunnel" This wants a subdomain/domain/path do I make it instanceid/mydomain.com/null  ???

    Then what do we do with the service. If I already have SSL installed I pick the HTTPS option but where do I start the URL for the service ? 
    auth.inst1.apps.eipdemo.mydomain.com  or do I go back to eipdemo.mydomain.com   again no documentation on what to make this stuff?

    Once I have that defined on the tunnel I assume I then go to the Public Hostname Tab and is this where I will need to create an entry for each of the :
    admin mydomain.com
    api       mydomain.com
    auth    mydomain.com
    home  mydomain.com

    Again, totally lost what to do with all the subdomains that MAS is using. Please help if you could. I have started working with the reverse proxy approach and got that pretty easily to point that I can see the MAS Login screen through the proxy but cant actually do anything. But I understand it is due to the Server.conf file needs to be setup. I kinda like the cloudflare option as I rather not use a nginx server in my network to make that work and rather just the cloudflare app ( i get it that is is basically same) but right now I am just looking for the path of least resistance.

    Thanks in advance,



    ------------------------------
    David Miller
    Managing Partner - Maximo Consultant
    Enterprise Integration Partners LLC
    ------------------------------



  • 5.  RE: MAS9 SNO and how to setup Port Forwarding on Router to make accessible from Internet?

    Posted Mon September 02, 2024 01:37 AM

    One simple way of addressing this need is to put a reverse proxy in front of the cluster to change the base domain.

    You can find details here: https://community.ibm.com/community/user/asset-facilities/blogs/craig-davis/2023/09/27/public-facing-sno-environment-for-mas-8



    ------------------------------
    Alex Donatelli
    IBM
    ------------------------------



  • 6.  RE: MAS9 SNO and how to setup Port Forwarding on Router to make accessible from Internet?

    Posted Mon September 02, 2024 07:04 AM

    Hi David

    I had installed mange SNO in my home lab as well, may share some experience on my network and MAS configure, and I am using 2 difference domain name for my OpenShift and MAS

    1. I am using Cloudflare to hold my domain name, let say mymas.com and I added 2 A record 1 is *,  another is the domain name mymas.com, the IP address is my internet IP
    2. In my router configure port forwarding 443 to my SNO server
    3. When install MAS, do not configure domain and certificate management
    4. Change MAS domain and using Let's Encrypt for my MAS domain mymas.com

    Regards,



    ------------------------------
    Jason Pun
    Technical Consulant
    ------------------------------



  • 7.  RE: MAS9 SNO and how to setup Port Forwarding on Router to make accessible from Internet?

    Posted Tue September 03, 2024 10:07 AM

    I really appreciate your help on me getting my MAS environment accessible to the internet. I am trying your suggestion with Port Forwarding and I am breaking things left and right.

    We seemed to have overlooked the RHOCP Control Panel access in your suggestions and more important is my LetsEncrypt SSL Cert that are also in place for the internal network. As soon as I made your suggestions I lost access to the Control Panel and in fact could not even log in any longer with the oc login command line. So, I added an entry back for 192.1.1.x to my DNS for the api.eipdemo.mydomain.com and that got my control panel access back and oc login. But I could not get into MAS as a SSL error. So I am trying to redo my certbot setting with the new DNS entries out on Cloudflare. I am not clear what I need to do with the api.eipdemo.mydomain.com entry should it be my 192. addy or should I make that my internet address? Also, should I not have an A entry for mydomain.com set to my internet addy as well?

    I also think we overlooked the 80,6443,8443,8080 in my port forwarding of my router and I am not sure if I need those or not? I have added them thinking they would be needed.

    Also once I do get my SSL certs resolved I am assuming I will need to get into the console and change my secrets to Maximo before i will ever be able to get in? Would you not agree?

    Again, very appreciative of help but feel we left a lot of unknowns out there. Not quite as simple as you made it sound when I have SSL at play and the console access seems to have been forgotten?

    I am totally hosed again now with no access to even my console due to the letsencrypt stuff. I am trying to give it some time and see if it comes back around but worried I may have really broke stuff now. But it may be a cascade of errors starting at SSL but then at my DNS entries and my port forwarding rules.

    My api.eipdemo.mydomain.com right now is pinging to a 104.21.1.x address right now so I assume that is huge problem... I have no idea where that addy is coming from



    ------------------------------
    David Miller
    Managing Partner - Maximo Consultant
    Enterprise Integration Partners LLC
    ------------------------------



  • 8.  RE: MAS9 SNO and how to setup Port Forwarding on Router to make accessible from Internet?

    Posted Tue September 03, 2024 11:02 AM

    You may want to check out my blog post here: https://www.sharptree.io/blog/2023/2023-01-24-mas-reverse-proxy/

     

    It handles the body replacements necessary for a reverse proxy and I used it to expose my SNO instance to my public IP.

     

    Regards,

    Jason






  • 9.  RE: MAS9 SNO and how to setup Port Forwarding on Router to make accessible from Internet?

    Posted Tue September 03, 2024 02:13 PM

    As mentioned a couple of times now, the right way of doing this is to use a reverse proxy. Playing with DNS is not a good idea. The OCP ingress uses the domain in the url it receives to dispatch internally, and that was set at OCP install time, so to change the domain or subdomains, you need a "translator", which is the reverse proxy job.



    ------------------------------
    Alex Donatelli
    IBM
    ------------------------------



  • 10.  RE: MAS9 SNO and how to setup Port Forwarding on Router to make accessible from Internet?

    Posted Wed September 04, 2024 10:17 AM
    Edited by David Miller Wed September 04, 2024 09:08 PM

    delete



  • 11.  RE: MAS9 SNO and how to setup Port Forwarding on Router to make accessible from Internet?

    Posted Tue September 03, 2024 01:58 AM

    Hi David,

    the easiest, but also the least secure, way is to configure port forwarding on Your router. External port 443 to internal address of Your SNO (192.168.1.x) and port 443. This will allow external connections to reach Your SNO instance.
    Second thing is to setup the DNS resolution. Do You have static public IP? If yes, then all You need to do is one A type DNS entry which will be *.apps.eipdemo.mydomain.com pointing to Your public IP.

    Regards,



    ------------------------------
    Witold Wierzchowski
    ------------------------------



  • 12.  RE: MAS9 SNO and how to setup Port Forwarding on Router to make accessible from Internet?

    Posted Tue September 03, 2024 10:10 AM

    Witold,  I just posted a reply that was meant for you but appears to have gone to Jason instead.. Sorry about that...



    ------------------------------
    David Miller
    Managing Partner - Maximo Consultant
    Enterprise Integration Partners LLC
    ------------------------------