openwisp-monitor error with router connected only to mesh network

[Michele Salerno]

Hi,

My network is:

LAN network is 10.27.0.0/16
Backbone network is 172.27.0./16
VPN network is 172.27.253.0/24
Mesh network is with AutoIP (https://openwrt.org/packages/pkgdata/avahi-autoipd)

The routers connected via cable are fine, but a router connected only to the mesh network does not communicate with openwisp-monitoring (routing is ok but not with monitoring).

I tried to add the interface in the /etc/config/openwisp file, but I get this error:

daemon.err openwisp: Failed to connect to controller while getting checksum: curl exit code 60

ROUTER:

# ip r
default via 169.254.9.97 dev br-mesh proto bird metric 50 
default dev br-mesh scope link metric 1007 
10.27.0.0/24 via 169.254.9.97 dev br-mesh proto bird metric 50 
10.27.10.0/24 via 169.254.9.97 dev br-mesh proto bird metric 50 
10.27.22.0/24 via 169.254.9.97 dev br-mesh proto bird metric 50 
10.27.25.0/24 dev br-lan proto kernel scope link src 10.27.25.1 
169.254.0.0/16 dev br-mesh proto kernel scope link src 169.254.7.9 

OpenWISP

# ip r
default via 10.27.22.5 dev ens19 onlink 
10.27.0.0/24 via 172.27.253.2 dev zt6qwgqjee proto bird metric 50 
10.27.10.0/24 via 172.27.253.5 dev zt6qwgqjee proto bird metric 50 
10.27.22.0/24 dev ens19 proto kernel scope link src 10.27.22.252 
10.27.22.0/24 dev ens18 proto kernel scope link src 10.27.22.15 
10.27.22.0/24 via 10.27.22.253 dev ens18 proto bird metric 50 
10.27.25.0/24 via 10.27.22.253 dev ens18 proto bird metric 50 
172.27.253.0/24 dev zt6qwgqjee proto kernel scope link src 172.27.253.1 

OpenWisp does not recognize the 169.254.0.0/16 network.
This is most likely the problem.

Is it possible to use subnet rules to assign an IP address for the mesh interface so that you don't have to manually intervene on each router?

If “yes,” how can I do it?

Best regards,

Michele

[Federico Capoano]

From these mesh nodes, are you able to:

ping 8.8.8.8 successfully?

resolve DNS records successfully? Eg: nslookup google.it

The cURL exit code 60 (or CURLE_PEER_FAILED_VERIFICATION) indicates an SSL certificate problem, meaning cURL cannot verify the legitimacy of the server's SSL certificate. 

Do all your devices suffer from the same or only these mesh nodes?

F.

--
You received this message because you are subscribed to the Google Groups "OpenWISP" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openwisp+u...@googlegroups.com.
To view this discussion, visit https://groups.google.com/d/msgid/openwisp/819da8ee-24f3-482a-b0d7-e1c739eabe2e%40gmail.com.

[Michele Salerno]

Yes,

responde:

root@GL-MT300N-V2:~ # ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=25.4 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=117 time=26.9 ms
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 25.429/26.158/26.887/0.729 ms
root@GL-MT300N-V2:~ # ping controller.nnxx.ninux.org
PING controller.nnxx.ninux.org (195.32.4.188) 56(84) bytes of data.
64 bytes from host188-4-32-195.dimensionesrl.eu (195.32.4.188): icmp_seq=1 ttl=63 time=1.56 ms
64 bytes from host188-4-32-195.dimensionesrl.eu (195.32.4.188): icmp_seq=2 ttl=63 time=3.51 ms
^C
--- controller.nnxx.ninux.org ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.561/2.535/3.510/0.974 ms
root@GL-MT300N-V2:~ # nslookup google.it
Server:        127.0.0.1
Address:    127.0.0.1:53
Non-authoritative answer:
Name:    google.it
Address: 142.251.141.227
Non-authoritative answer:
Name:    google.it
Address: 2a00:1450:4002:401::2003
root@GL-MT300N-V2:~ # 

My /etc/config/openwisp is:

config controller 'http'
    option url 'https://controller.nnxx.ninux.org'
    option interval '120'
    option management_interval '10'
    option verify_ssl '1'
    option management_interface 'eth0.2'
    option uuid 'pippo'
    option key 'ciccio'
    option test_retries '8'

Il 03/02/26 18:15, Federico Capoano ha scritto:

To view this discussion, visit https://groups.google.com/d/msgid/openwisp/CAAGgX6Kae4_hKdW%2BTgayodFOJbYPwCKdV_kQ%3D%2Br-YNuFNNWSGg%40mail.gmail.com.

-- 
Informativa Privacy - Ai sensi del D. Lgs n. 196/2003 (Codice Privacy) si precisa che le informazioni contenute in questo messaggio sono riservate e ad uso esclusivo del destinatario. Qualora il messaggio in parola Le fosse pervenuto per errore, La preghiamo di eliminarlo senza copiarlo e di non inoltrarlo a terzi, dandocene gentilmente comunicazione. Grazie.

Privacy Information - This message, for the D. Lgs n. 196/2003 (Privacy Code), may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation.

[Federico Capoano]

So, if your internet works but you're getting this:

daemon.err openwisp: Failed to connect to controller while getting checksum: curl exit code 60

(which is the only error you mentioned in your email, so I'm focusing on this), it could be one of the following:

- date time not syncing with timeserver, check the date and time on the device is correct

- make sure the ca-certificates/ca-bundle package is up to date

- when copying the certificate file for nginx on the VM, make sure you're including the full certificate chain, if an intermediate CA is missing, some clients like curl on openwrt may not find the intermediate CA in the chain of trust and hence deem the certificate invalid

F.

To view this discussion, visit https://groups.google.com/d/msgid/openwisp/46d9ca55-1d91-4974-ab35-2aef675f6091%40gmail.com.