The only thing we havne't gotten to work is full 0.0.0.0 forwarding. Docs say it's possible (tho not fully common use case), but we always get hangs when attempting. Usually we have to use sshuttle
Other than that - incredible.
> Do you expose Netmaker bastion to the public Internet for all your VPC
Yes
> , where the bastion lives outside the VPC?
No, but I imagine you're talking about Subnets? which in that case Yes.
We run multiple Subnets. Only bastion machines live in public subnets while pretty much everything else is in private ones that routes via NATs.
> are you accessing using "external clients" or the regular netclient?
"External Clients" on OSX Wireguard.
[More Info]
The use case that we have is when we need access an Akami Network through a whitelisted IP during development.
Our AWS networks have a Priv Subnet w/ a static IP NAT and a Public Subnet, both prod and staging.
Since wanted our all our local machine's traffic to go through the AWS NAT we hoped for: Local -> Bastion EC2 (Public Subnet) -> EC2 (Private Subnet) -> NAT -> Internet.
So to get setup, we tested: Local -> Bastion EC2 (Public Subnet) -> Internet. When we set the Bastion EC2 to have Egress of 0.0.0.0 the Wireguard's Handshake would never complete, just hang.
Let me know if there's anything else I can provide.
did you compare it to others, what made you go with netmaker?