12:17:19 <toasterson> Yeah that works. mTLS or Basic Auth
18:28:49 <extrowerk> So I was still unable to get communication working between the FAR GZ and NEAR GZ. Here is a network-map sketch: https://paste.omnios.org/?555253e8bd92fa3d#9Dnuhk2Y7HVbodwtZiPGMfaJvg9hGVXRYBERZiDSKtSP
18:38:10 <extrowerk> here is some additional info: https://paste.omnios.org/?67df501c2b9775cb#HewyjBWdopynVceenBJ8T7xsy4qj7wfLZHS4fUBYMBtw
18:42:10 <extrowerk> I can SSH from any NGZ to the other side's NGZ. I can SSH from any side NGZ to the other side GZ. However I can't SSH from any GZ to the other GZ.
18:44:49 <extrowerk> Just for info: I also can't call the other NGZ from the opposite GZ
18:45:10 <extrowerk> I would greatly appreciate any help.
18:46:17 <extrowerk> I believe the culprit is the routing table at both side GZ-NGZ boundary
18:46:34 <extrowerk> Let me know if you need any additional info
19:26:55 <m1ari> I'm wondering about why you're using addresses in the 100.64/10 range for your tun interface - that seems a little odd.
19:33:51 <m1ari> I don't think you need IPv4 routing enabled in the FAR-NGZ (only Forwarding)
19:35:13 <m1ari> I think you're missing the route for the FAR subnet (10.0.0.0/24) in the Near-GZ routing table.
19:35:35 <m1ari> (unless you've also got some internal NAT going on)
19:36:17 <m1ari> again I don't think you need IP4 Routing in the Near-NGZ (just Forwarding)
19:40:50 <m1ari> it might be useful to use the -n flag on netstat as well (netstat -nr) so we get numeric networks rather than names
19:44:43 <m1ari> I'm also wondering if you've got any required nat rules (incomming port maps) in place to make the VPN work properly (far end router and near-gz)
19:52:09 <extrowerk> m1ari: 100.64/10 is tailscale-specific thing
20:04:37 <extrowerk> here is the improved info collection: https://paste.omnios.org/?449ecdc66d4c339e#3BtgkbCrVvHkepsNfKJ6r5PpVvhCN7HsnAe9aArowznh