How to setup Mail Gateway Cluster with one server behind NAT

[spaantje]

Hi,

I have 2 Proxmox Mail Gateway servers setup.

The first server is setup behind a firewall (NAT).
Where the server itself has an internal IP but is reachable from an external IP address.

And an second server is just a plain VPS with an direct external IP.
But when i try to connect the second server to the cluster of the first it looks like it connects but then get's the internal IP from the master and tries to sync to the internal IP.
Which is not going to work obviously.

Changing the IP in the cluster.conf on the second server to external IP of the master gives me the error "ERROR: 401 permission denied - invalid PMG ticket".

Any idea on what to do next?

Thanks for any help!

pmgcm join command output:

pmgcm join [EXTERNAL_IP_MASTER] --fingerprint=[FINGERPRINT]
stop all services accessing the database
save new cluster configuration
cluster node successfully joined
ssh: connect to host [INTERNAL_IP_MASTER] port 22: Connection timed out
rsync: connection unexpectedly closed (0 bytes received so far) [Receiver]
cluster join failed: syncing master configuration from '[INTERNAL_IP_MASTER]' failed: rsync error: unexplained error (code 255) at io.c(228) [Receiver=3.2.3]

2FA is disabled on the master (as per the docs)

 

[Stoiko Ivanov]

I would suggest to create a tunnel between both PMG instances using wireguard (or something similar) - this should make for a robust setup

I hope this helps!