-
Notifications
You must be signed in to change notification settings - Fork 285
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Rancher Desktop issues when connected to company VPN #722
Comments
I think it's an issue with WSL2, see: |
That log looks… odd:
…
Attempting to run # iptables -A KUBE-FORWARD -m limit --limit '10/minute' --limit-burst 10
iptables v1.8.3 (legacy): Couldn't load match 'limit':No such file or directory Checking the config: $ zgrep NETFILTER_XT_MATCH_LIMIT /proc/config.gz
# CONFIG_NETFILTER_XT_MATCH_LIMIT is not set I think that means it's not built; I'm not very familiar with reading |
I've got the same problem, including the same error message from iptables on a fresh install of Rancher Desktop 0.6.0 on Windows 10 Enterprise 1909 in a corporate VPN. I have Debian running in WSL 2, too, and after setting the MTU correctly networking between WSL 2 and the host works. My
|
Any updates here? I think in time like these a lot of people are in home office and connected via VPN - without a solution rancher desktop is unfortunately no option ... Can I provide you with more details? Just tell me what you need (which files / commands to execute) Thanks Max |
You can try this tool https://github.com/sakai135/wsl-vpnkit in the Rancher WSL distro. |
Hello, Any updates on this? I am experiencing the same issue. Tried wsl-vpnkit but it never worked... am I the only one not being able to make it work with wsl-vpnkit? Thank you |
I'm having the same issue, basically without the VPN it works fine but with the VPN it gets stuck in the "Starting Kubernetes...." message. As far as I saw, it is nothing to do with ip collisions, but probably with SSL certificates I'm using Zscaler as VPN, but the issue is the same as the ones reported with other VPNs Here is my scenario :
Also, in my case, even when it gets stuck in the "Starting Kubernetes...." message, the k8s cluster is actually up and running, here is how I'm able to confirm that:
|
@psaenz - try the following: changing your /.kube/config entry for Rancher Desktop to 'localhost' instead of the assigned IP. |
@ontec-xrail can you please give #1899 (comment) feature a try? Many thanks |
@Nino-K Here is a procedure how it works for my case (Win 10, Rachner Desktop 1.3, k8s 1.23.6 + dokerd (moby) + Cisco AnyConnect 4.4.x)
and finally test connection to local k8s The only problem witch I have is that the file .kube/config is recreated each time I start again Rachner Desktop... BOHICA ;-) |
Hello, |
well, 1.5.0 seems to have made things worse (at least for me)
|
1.4.1 obviously still working. If wsl-vpnkit is ultimately the answer it needs to be folded into a more permanent solution because a lot of large clients (and small as well) force users to be on a VPN, especially to work with internal docker registries etc... . The second issue is the problem of having to force users to reset the .kube config file to localhost every time before starting Rancher Desktop. [ **This is the cluster server address I am referring to in .kube/config file: |
wsl-vpnkit works for me in 1.5.1. My organization is using Check Point Mobile VPN 98.61.3510 and doesn't use a web proxy. However, twice in 5 days I've been using wsl-vpnkit, Rancher Desktop hasn't been able to start up after logging in Windows, stuck on "Waiting for services". It took 6 minutes before I could see an error dialog, and I could not force Rancher Desktop to quit. I tried resetting Kubernetes, and I tried quitting Rancher Desktop (after getting the error) and re-launching it, but I would get the same result: Rancher Desktop stuck on "Waiting for services..." for 6 minutes. Only rebooting fixed the problem both times. |
Is there any update on this issue? |
@anwesha25 are you able to use our 1.6 release? There is a workaround that mentioned here that should allow you to use RD over Cisco AnyConnect VPN. |
Same problems here using Windscribe VPN. If its enable, I can't reach any container. |
I had to switched back to Rancher desktop 1.4.1. wsl --import wsl-vpnkit $env:USERPROFILE\wsl-vpnkit wsl-vpnkit.tar.gz --version 2 the above steps need to be executed first with VPN disabled and then you connect to VPN. And always check if wsl distributions of rancher and vpnkit is running or not.
Followed the above steps and it's kind of working fine for me now. |
I have had similar challenges and had to revert back to 1.4.1 (along with VPN Toolkit) when using Cisco AnyConnect VPN. Per instructions for running VPN-toolkit, I created some simple script written to change the .kube/config file from the IP address created when Rancher Desktop is started and changing it to localhost. This creates more pain when a user has to run some script to simply be able to run Rancher Desktop alas is the only way it will sucessfully start. |
we have introduced an experimental #3810 in 1.8.1 that should fix your VPN issue. The feature will be fully baked in our next few upcoming releases. As I mentioned it is experimental and the downside is the port forwarding for all the publish ports has to be performed manually as mentioned here: #4096 (comment) |
this appears to have fixed it for me using Cisco AnyConnect VPN :) |
You can now enable the new network using
This should allow Rancher Desktop to function correctly behind a VPN. I'm going to close this issue, feel free to re-open if this suggestion is not solving the issue. |
how about on macos?
|
@Nino-K Step 4/10 : RUN npm install
---> Running in 891528f47122
npm ERR! code UNABLE_TO_GET_ISSUER_CERT_LOCALLY
npm ERR! errno UNABLE_TO_GET_ISSUER_CERT_LOCALLY
npm ERR! request to https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz failed, reason: unable to get local issuer certificate |
@Nino-K |
Hi,
when I am connected to my company vpn (Checkpoint Endpoint Security) the rancher desktop 0.5.0 (Kubernetes) doesn't start up anymore. When not in VPN - everything works.
I also have a second wsl running (Ubuntu 20.04) with docker deamon - this wsl also sets the MTU of the eth0 to 1350 - thats needed that wsl can connect via VPN.
Attached you can find the k3s log file
k3s.log
Here are my network connectors:
On the host:
In the Rancher WSL:
Any clue whats going on in my instance? The logs have several connection failed logs - so I assume its something related to networking - any instructions how I could debug further?
The text was updated successfully, but these errors were encountered: