Can't connect to CortX from outside of home network

[plasterman]

I have a CortX VM running on VMWare Workstation on both Centos7 and Windows hosts. I can access both the management and data connections using the internal IP addresses, but am having issues when I try to connect from the internet.
I set the port forwarding rules for the network firewall to direct to the Management and Data IP/Port addresses, but it is still not getting through. Is there a certain way to access these services that I am not configuring correctly?
I even went as far as to disable both of the host's and the VM's firewalls to remove any possible issues there, but I still cannot get through the network firewall to access CortX.
Has anyone ran into this issue before?

[mukul-seagate11]

@plasterman, can you specify as what virtual network you had configured on VMware Workstation?

[plasterman]

I'm using a bridged network configured as described in the Quick Start Guide here: "https://github.com/Seagate/cortx/blob/main/doc/troubleshoot_virtual_network.rst"

The fact that I can reach the CortX server from another machine locally but not from outside my network leads me to believe it may be an issue with the SSL tunnel through the firewall to the host machine. I can reach the management interface on a browser and I can interface with the data port using s3cmd from another machine in the local network. Neither of those work when I attempt to access using my public IP and the port forwarding rules. Right now I already have a webserver with a rule that uses port 443 to forward to it, so I am using random unregistered ports to forward my traffic to the CortX IP at ports 28100 and 443.

I am not certain the SSL tunneling is the issue so I am going to troubleshoot that more, but I was hoping someone here with more knowledge may be able to point me in the right direction.

[justinzw]

Hi @plasterman, First of all thank you for trying the VM and reporting the issue. I'm sorry you are running into issues when accessing it outside your network.

A couple of questions:

• Which VM are you using? Did you download 1.0.2 or 1.0.3? This will be the name of the zip that you downloaded and the name of the OVA.
• Can you ping the IP address outside of the network?
• If you forward 22 can you SSH into it? From the public.
• I'd like to know more about your setup- Is your setup such that you have a single webserver that forwards traffic to the CORTX server?

One of the issues is that CORTX has three different network interfaces and you can only access the management interface from the management interface and the data from the data one.

Thanks for trying this scenario, this is something we haven't fully tested yet.
FWIW I've set up an AWS instance before that you can access the management interface from the public or the data interface. But because of the routing table I can only expose one of them outwards at a time.

[plasterman]

Hey Justin, thanks for looking into this for me.

• I am using the 1.0.2 OVA on VMWare Workstation on a Windows 10 host and Centos 7 host.
• I can ping the Public IP address from outside the network.
• I cannot SSH into the CortX server from outside the network, the connection times out. I am able to SSH from a local IP. I can also SSH the hosts from outside the network.
• I'm using a Unifi UDM-Pro as the router/security gateway, there is no webserver between the host and the gateway. It's a very simple network with the host connected to a switch, switch to router, router to modem.

Is it possible to change the ports for the management and data interfaces so that the routing tables are simpler and multiple machines can be exposed at a time?

[mukul-seagate11]

HI @plasterman, thanks for providing the details, we had forwarded your Issue reported to the concerned maintainer.

[justinzw]

@plasterman as @ypise mentioned below it looks like it may be a router issue - because you can't SSH into the CORTX server from outside the network.

I hope you can try the steps @ypise mentioned below and let us know how it goes and whether it might help with the issue.

Thank you again for testing CORTX and working through this issue with us.

[mukul-seagate11]

@ypise @sradhanand-pati, can you address the query as asked?

[ypise]

Hey @plasterman,
From the description you've provided, the issue is probably on router.
I'm not an expert with routers so wouldn't ask you about the make of it.
However, for every router there is a firewall settings option. Try to find the one for the make and model of your router.
To start with, disable firewall on router and re-attempt the connection (note this is risky as it could leave your network vulnerable to external attacks).
Is the connection to ssh could be established, the next step would be to re-enable the firewall and add an exception for ssh. Again, adding an exception for ssh could pose another security vulnerability threat, so do consider some network hardening policy.

Hope this helps.

• @ypise