实在搞不定了，求助各位：除宿主机外其他设备无法访问容器的开放端口 #254

LisonFan · 2023-05-30T02:52:45Z

LisonFan
May 30, 2023

同样的 docker-compose.yaml，在 Mac 上运行是没问题的，但是在虚拟机（RockyLinux）就不行，只能本地访问

在虚拟机（RockyLinux）中，我把 Firewalld 和 SELinux 都关了，也不知道是什么姿势不对

虚拟机（RockyLinux）内核版本是5.14.0-284.11.1.el9_2.x86_64

netstat -ntlp

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      776/sshd: /usr/sbin
tcp        0      0 0.0.0.0:41080           0.0.0.0:*               LISTEN      1191/docker-proxy
tcp        0      0 0.0.0.0:48888           0.0.0.0:*               LISTEN      1168/docker-proxy
tcp6       0      0 :::22                   :::*                    LISTEN      776/sshd: /usr/sbin
tcp6       0      0 :::41080                :::*                    LISTEN      1197/docker-proxy
tcp6       0      0 :::48888                :::*                    LISTEN      1174/docker-proxy

iptables -L -n -v

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  181 78196 DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  181 78196 DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
   78 67550 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
  103 10646 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain DOCKER (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.2           tcp dpt:8888
    0     0 ACCEPT     tcp  --  !docker0 docker0  0.0.0.0/0            172.17.0.2           tcp dpt:1080

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination
  103 10646 DOCKER-ISOLATION-STAGE-2  all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
  181 78196 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
  103 10646 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
  181 78196 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

docker-compose.yaml

version: '3'

services:
  company:
    image: hagb/docker-easyconnect:cli
    restart: always
    network_mode: bridge
    container_name: easyconnect
    environment:
      - CLI_OPTS=-d https://vpn.com:12345/ -u username -p "password"
      - EC_VER=7.6.7
    devices:
      - "/dev/net/tun"
    cap_add:
      - NET_ADMIN
    ports:
      - 41080:1080
      - 48888:8888
    volumes:
      - ecdata:/root

volumes:
  ecdata:

Hagb · 2023-05-30T03:13:01Z

Hagb
May 30, 2023
Maintainer

你启动容器的命令是？

3 replies

LisonFan May 30, 2023
Author

通过 Compose 启动的，docker compose up -d，docker-compose.yaml文件内容在主题内容最后

Hagb May 30, 2023
Maintainer

通过 Compose 启动的，docker compose up -d，docker-compose.yaml文件内容在主题内容最后

如果你用的是仓库带的那个 docker-compose.yml，那么里面的

          - "127.0.0.1:1081:1080"
          - "127.0.0.1:8888:8888"

改成这样可以限定为从某网卡可以访问你的端口

          - "设备在某网卡上的IP:1081:1080"
          - "设备在某网卡上的IP:8888:8888"

或改成这样子可以让你的端口可从所有网卡访问

          - "1081:1080"
          - "8888:8888"

LisonFan May 30, 2023
Author

通过 Compose 启动的，docker compose up -d，docker-compose.yaml文件内容在主题内容最后

如果你用的是仓库带的那个 docker-compose.yml，那么里面的
          - "127.0.0.1:1081:1080"
          - "127.0.0.1:8888:8888"
改成这样可以限定为从某网卡可以访问你的端口
          - "设备在某网卡上的IP:1081:1080"
          - "设备在某网卡上的IP:8888:8888"
或改成这样子可以让你的端口可从所有网卡访问
          - "1081:1080"
          - "8888:8888"

我试了

      - 1080:1080
      - 8888:8888

      - 172.20.21.125:1080:1080
      - 172.20.21.125:8888:8888

都不行

Hagb · 2023-05-30T03:26:58Z

Hagb
May 30, 2023
Maintainer

看看宿主机和容器 iptables-save 的输出，以及容器输出到 docker 的日志（docker logs 容器名）？

3 replies

LisonFan May 30, 2023
Author

看看宿主机和容器 iptables-save 的输出，以及容器输出到 docker 的日志（docker logs 容器名）？

tcpdump 抓了下包，这是 telnet 过去的请求

iptables-save

# Generated by iptables-save v1.8.8 (nf_tables) on Tue May 30 11:32:14 2023
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8888 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 1080 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
COMMIT
# Completed on Tue May 30 11:32:14 2023
# Generated by iptables-save v1.8.8 (nf_tables) on Tue May 30 11:32:14 2023
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 8888 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 1080 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 8888 -j DNAT --to-destination 172.17.0.2:8888
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 1080 -j DNAT --to-destination 172.17.0.2:1080
COMMIT
# Completed on Tue May 30 11:32:14 2023

docker logs

Hagb May 30, 2023
Maintainer

试试 iptables -P FORWARD ACCEPT

LisonFan May 30, 2023
Author

iptables-save

不行，iptables 和 firewalld 都关了的

还是说需要打开？

LisonFan · 2023-06-01T01:54:01Z

LisonFan
Jun 1, 2023
Author

@Hagb 换到Ubuntu就正常了，难道是和RockyLinux不兼容？

1 reply

guxiaotu Oct 11, 2023

我也是遇到了你一样的问题，Ubuntu也不行，映射相同端口可以访问，不同端口就不能转发了
Chain DOCKER-ISOLATION-STAGE-2 (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * docker0 0.0.0.0/0 0.0.0.0/0

这个网桥直接DROP了

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

实在搞不定了，求助各位：除宿主机外其他设备无法访问容器的开放端口 #254

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments 7 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

实在搞不定了，求助各位：除宿主机外其他设备无法访问容器的开放端口 #254

LisonFan May 30, 2023

Replies: 3 comments · 7 replies

Hagb May 30, 2023 Maintainer

LisonFan May 30, 2023 Author

Hagb May 30, 2023 Maintainer

LisonFan May 30, 2023 Author

Hagb May 30, 2023 Maintainer

LisonFan May 30, 2023 Author

Hagb May 30, 2023 Maintainer

LisonFan May 30, 2023 Author

LisonFan Jun 1, 2023 Author

guxiaotu Oct 11, 2023

LisonFan
May 30, 2023

Replies: 3 comments 7 replies

Hagb
May 30, 2023
Maintainer

LisonFan May 30, 2023
Author

Hagb May 30, 2023
Maintainer

LisonFan May 30, 2023
Author

Hagb
May 30, 2023
Maintainer

LisonFan May 30, 2023
Author

Hagb May 30, 2023
Maintainer

LisonFan May 30, 2023
Author

LisonFan
Jun 1, 2023
Author