The cluster has no certificate since it is a local domain.
Leader node and second node belong to the same local domain.
If I tick the option ‘uncheck tls certificate’, joining node 2 to the cluster is rejected.
The error message is ‘Worker version 3.20.0 must be compatible with 3.21.0.’
There was a core update of the leader node immediately after the installation.
The worker node starts the cluster options at once.
How can I make the Worker version compatible?
To update the core of the new node to version 3.21.0:
api-cli run update-core --data '{"core_url":"ghcr.io/nethserver/core:3.21.0","nodes":[1]}'
After the update it should be possible to join the new node to the leader.
Thanks, Markus. In fact I could join the worker node to the leader. Unfortunately it is offline.
Scanning the forum did not really provide a solution.
The worker node can connect to port 55820 of the leader. But from there the connection to port 55820 of the worker is refused.
Both VMs are practically identic. Any idea what might block the connection?
1 Like
Thanks for the update, Ralph. Good news on the version part, that one is solved.
One thing before you spend more time on the port test. The cluster VPN is a star network: the worker opens the WireGuard tunnel towards the leader, and the leader learns the worker endpoint from that first handshake. The leader does not need to reach UDP 55820 on the worker. So a refused connection in that direction is not necessarily the fault.
Also, how did you test the port? telnet and nc without -u test TCP, and WireGuard only listens on UDP. If that was the test, the result does not tell us anything.
What we need now is the WireGuard state itself. Please run this as root on both nodes, and tell us which output comes from which node:
wg show wg0
systemctl status wg-quick@wg0 --no-pager
ip -4 addr show wg0
firewall-cmd --list-all
podman images ghcr.io/nethserver/core
wg show wg0 lists the peers and the time of the last handshake. That single line tells us whether the tunnel is alive or was never established.
Then, on the worker node only:
journalctl -u wg-quick@wg0 --since "2 hours ago" --no-pager
journalctl -u agent@node.service -n 100 --no-pager
The first shows whether the wg0 interface came up cleanly, the second shows what the node agent is doing.
Still on the worker, ping the leader over the VPN. Use the wg0 address you got from the leader with the command above (usually 10.5.4.1):
ping -c 3 10.5.4.1
Last question, and it matters: was the second VM cloned from the first one after NethServer 8 was installed? If it was, both nodes carry the same WireGuard key and the same machine ID, and the tunnel can never come up. You can check it yourself, no need to post the output, just tell us if the two nodes give the same values:
cat /etc/nethserver/wg0.pub
cat /etc/machine-id
All of the above is read-only, nothing is changed on the nodes.
When you paste the output, please wrap the long parts in a details block, and remove public IP addresses, domain names, email addresses and anything that looks like a key.
wg show - leader
paste here