K3S doesn’t wanna connect

[luna-dj]

I have a problem with wire door not being able to reach the port in nginx.default.svc.cluster.local at port 80
Is there some documentation on how to do this

[dmesad]

Hi @luna-dj! Thanks for reaching out.

To better assist you, could you please provide a bit more context about your setup and what you're trying to achieve?

1. Have you created a gateway node for your cluster with the correct subnet, as shown here?
2. Have you installed the Kubernetes gateway in your K3s cluster using the Helm chart, and provided the correct wiredoor.server and wiredoor.token values?
3. You are trying to expose nginx.default.svc.cluster.local:80, Have you configured a service for your nginx pod in the default namespace?

Any additional details about your deployment or the error you're encountering would be really helpful!

[luna-dj]

1. yes it's 10.43.0.0/12
2. it's connected
3. i tried nginx-service.default.svc.cluster.local and port 80

i have this kube manifest file.

deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - containerPort: 80

service.yaml

apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  selector:
    app: nginx
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
  type: ClusterIP

it's running in k3s on 3 master nodes and 2 worker nodes

[dmesad]

Could you please try deleting the current wiredoor-gateway pod and then check the logs from the newly created one?

kubectl -n default logs -f my-wiredoor-gateway-xxxxxxxxx-xxxxx

I’d like to confirm whether the Kubernetes gateway is successfully connecting to the Wiredoor server.

[luna-dj]

 ✔ Connection successful to: 54.37.x.x

🛡️  Gateway: k3s-01 (10.0.0.6) → 🌐 Subnet: 10.43.0.0/12

🔐 Handshake: 0 seconds ago | TX: 3.0 MiB | RX: 4.9 MiB

🌐 No services exposed yet.
👉 Use 'wiredoor http' or 'wiredoor tcp' to expose a service.
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wg0, link-type RAW (Raw IP), snapshot length 262144 bytes
09:54:40.531770 IP 10.0.0.1 > 10.0.0.6: ICMP echo request, id 61308, seq 0, length 16
09:54:40.531793 IP 10.0.0.6 > 10.0.0.1: ICMP echo reply, id 61308, seq 0, length 16
09:54:45.535978 IP 10.0.0.1 > 10.0.0.6: ICMP echo request, id 61314, seq 0, length 16
09:54:45.535998 IP 10.0.0.6 > 10.0.0.1: ICMP echo reply, id 61314, seq 0, length 16
09:54:49.148785 IP 10.0.0.6.39812 > 10.0.0.1.443: Flags [S], seq 2358107592, win 65170, options [mss 1330,sackOK,TS val 1112111626 ecr 0,nop,wscale 7], length 0
09:54:49.171203 IP 10.0.0.1.443 > 10.0.0.6.39812: Flags [S.], seq 900814829, ack 2358107593, win 64296, options [mss 1380,sackOK,TS val 2331396625 ecr 1112111626,nop,wscale 7], length 0
09:54:49.171232 IP 10.0.0.6.39812 > 10.0.0.1.443: Flags [.], ack 1, win 510, options [nop,nop,TS val 1112111649 ecr 2331396625], length 0
09:54:49.171348 IP 10.0.0.6.39812 > 10.0.0.1.443: Flags [F.], seq 1, ack 1, win 510, options [nop,nop,TS val 1112111649 ecr 2331396625], length 0
09:54:49.192991 IP 10.0.0.1.443 > 10.0.0.6.39812: Flags [F.], seq 1, ack 2, win 503, options [nop,nop,TS val 2331396647 ecr 1112111649], length 0
09:54:49.193013 IP 10.0.0.6.39812 > 10.0.0.1.443: Flags [.], ack 2, win 510, options [nop,nop,TS val 1112111670 ecr 2331396647], length 0
09:54:50.538528 IP 10.0.0.1 > 10.0.0.6: ICMP echo request, id 61320, seq 0, length 16
09:54:50.538550 IP 10.0.0.6 > 10.0.0.1: ICMP echo reply, id 61320, seq 0, length 16
09:54:55.209658 IP 10.0.0.6.50892 > 10.0.0.1.443: Flags [S], seq 2464443305, win 65170, options [mss 1330,sackOK,TS val 1112117687 ecr 0,nop,wscale 7], length 0
09:54:59.150378 IP 10.0.0.6.50894 > 10.0.0.1.443: Flags [S], seq 3202313531, win 65170, options [mss 1330,sackOK,TS val 1112121628 ecr 0,nop,wscale 7], length 0
09:55:05.216327 IP 10.0.0.6.56998 > 10.0.0.1.443: Flags [S], seq 1596371816, win 65170, options [mss 1330,sackOK,TS val 1112127694 ecr 0,nop,wscale 7], length 0
09:55:06.256337 IP 10.0.0.1.443 > 10.0.0.6.50894: Flags [S.], seq 2061768081, ack 3202313532, win 64296, options [mss 1380,sackOK,TS val 2331413711 ecr 1112121628,nop,wscale 7], length 0
09:55:06.256356 IP 10.0.0.6.50894 > 10.0.0.1.443: Flags [R], seq 3202313532, win 0, length 0
09:55:06.256363 IP 10.0.0.1.443 > 10.0.0.6.56998: Flags [S.], seq 2938908306, ack 1596371817, win 64296, options [mss 1380,sackOK,TS val 2331413711 ecr 1112127694,nop,wscale 7], length 0
09:55:06.256368 IP 10.0.0.6.56998 > 10.0.0.1.443: Flags [R], seq 1596371817, win 0, length 0
09:55:09.151142 IP 10.0.0.6.57002 > 10.0.0.1.443: Flags [S], seq 1046215160, win 65170, options [mss 1330,sackOK,TS val 1112131628 ecr 0,nop,wscale 7], length 0
09:55:09.172866 IP 10.0.0.1.443 > 10.0.0.6.57002: Flags [S.], seq 379075772, ack 1046215161, win 64296, options [mss 1380,sackOK,TS val 2331416627 ecr 1112131628,nop,wscale 7], length 0
09:55:09.172899 IP 10.0.0.6.57002 > 10.0.0.1.443: Flags [.], ack 1, win 510, options [nop,nop,TS val 1112131650 ecr 2331416627], length 0
09:55:09.173049 IP 10.0.0.6.57002 > 10.0.0.1.443: Flags [F.], seq 1, ack 1, win 510, options [nop,nop,TS val 1112131650 ecr 2331416627], length 0
09:55:09.194636 IP 10.0.0.1.443 > 10.0.0.6.57002: Flags [F.], seq 1, ack 2, win 503, options [nop,nop,TS val 2331416649 ecr 1112131650], length 0
09:55:09.194666 IP 10.0.0.6.57002 > 10.0.0.1.443: Flags [.], ack 2, win 510, options [nop,nop,TS val 1112131672 ecr 2331416649], length 0
09:55:10.544977 IP 10.0.0.1 > 10.0.0.6: ICMP echo request, id 61344, seq 0, length 16
09:55:10.544994 IP 10.0.0.6 > 10.0.0.1: ICMP echo reply, id 61344, seq 0, length 16
09:55:15.208014 IP 10.0.0.6.49278 > 10.0.0.1.443: Flags [S], seq 2880565632, win 65170, options [mss 1330,sackOK,TS val 1112137685 ecr 0,nop,wscale 7], length 0
09:55:15.229788 IP 10.0.0.1.443 > 10.0.0.6.49278: Flags [S.], seq 4017007270, ack 2880565633, win 64296, options [mss 1380,sackOK,TS val 2331422684 ecr 1112137685,nop,wscale 7], length 0
09:55:15.229827 IP 10.0.0.6.49278 > 10.0.0.1.443: Flags [.], ack 1, win 510, options [nop,nop,TS val 1112137707 ecr 2331422684], length 0
09:55:15.229958 IP 10.0.0.6.49278 > 10.0.0.1.443: Flags [F.], seq 1, ack 1, win 510, options [nop,nop,TS val 1112137707 ecr 2331422684], length 0
09:55:15.251636 IP 10.0.0.1.443 > 10.0.0.6.49278: Flags [F.], seq 1, ack 2, win 503, options [nop,nop,TS val 2331422706 ecr 1112137707], length 0
09:55:15.251658 IP 10.0.0.6.49278 > 10.0.0.1.443: Flags [.], ack 2, win 510, options [nop,nop,TS val 1112137729 ecr 2331422706], length 0
09:55:15.545057 IP 10.0.0.1 > 10.0.0.6: ICMP echo request, id 61350, seq 0, length 16
09:55:15.545082 IP 10.0.0.6 > 10.0.0.1: ICMP echo reply, id 61350, seq 0, length 16
09:55:19.150780 IP 10.0.0.6.49292 > 10.0.0.1.443: Flags [S], seq 487543723, win 65170, options [mss 1330,sackOK,TS val 1112141628 ecr 0,nop,wscale 7], length 0
09:55:19.172701 IP 10.0.0.1.443 > 10.0.0.6.49292: Flags [S.], seq 3674486788, ack 487543724, win 64296, options [mss 1380,sackOK,TS val 2331426627 ecr 1112141628,nop,wscale 7], length 0
09:55:19.172739 IP 10.0.0.6.49292 > 10.0.0.1.443: Flags [.], ack 1, win 510, options [nop,nop,TS val 1112141650 ecr 2331426627], length 0

[dmesad]

You're successfully connected to the Wiredoor server. Now let’s check DNS resolution:

1. Can you exec into the pod and run the following command?

kubectl -n default exec -it my-wiredoor-gateway-xxxxxxxxx-xxxxx -- sh
nslookup nginx-service.default.svc.cluster.local

2. Then, check that the resolved IP is within the subnet you configured for the gateway.
3. You can also verify that the service is responding correctly by running:

curl -I http://nginx-service.default.svc.cluster.local:80

If the IP is part of the subnet and the service responds as expected, you can safely configure it in Wiredoor using nginx-service.default.svc.cluster.local as backend host and port 80