Search code examples
network-programmingzeek

Zeek Workers cannot communicate with Zeek Proxy/manager


I set up a small zeek cluster and had it working fine. Here's my rough setup:

Proxy/Manager/Logger - 192.168.1.10
Worker-1 - 192.168.1.10 (em1)
Worker-2 - 192.168.1.15 (em1)
Worker-3 - 192.168.1.15 (p1p1)
Worker-4 - 192.168.1.15 (p1p2)
Worker-5 - 192.168.1.16 (em1)
Worker-6 - 192.168.1.16 (p1p1)
Worker-7 - 192.168.1.16 (p1p2)

Everything was going swell. However, now nothing gets brokered except for worker-1 which is local to the proxy/manager/logger. I can do deploy, start, and stop workers through zeekctl. However, peerstatus hangs indefinitely when checking a remote worker.

I've even set up a new cluster on brand new systems starting from scratch with the same issues. This leads me to believe it's in the network but I can't figure out for the life of me what it could be. I know this is vague but does anyone have at least some troubleshooting ideas for me to try?

Let me know what else I can give you. I appreciate any kind of help you can send my way!


Solution

  • Seth Hall nailed it. I messed up the rules without knowing. Thankfully an easy fix. Thanks.