0

Situation: Several VPS servers around the US connected to my laptop via wireguard mesh network. For wireguard mesh network Im using tool called innernet (https://github.com/tonarino/innernet).

So basically its like my laptop and vps servers are on same internal network.

VPS ip    = 10.32.89.1
laptop ip = 10.32.90.1

Looks like VPS and laptop has this virtual interface defined (not sure if this matters):

innernet

VPS server has mysql container runig (I dont expose 3306 port to the host). How can I can connect to that dockerized mysql server from my laptop without mounting mysql port to the host?

Reasoning:
Why I want it this way?
Because I dont want to make it (mysql server) visible to entire internet and thus attackers, but at same time i want easy access to mysql data from my laptop.

Possible solution:
Is that what docker macvlan is for? Do I need to create a network on VPS that has innernet interface as a parent or something? and then attach my mysql container to that network?

I've tried this:

docker network create \
-d macvlan \
--attachable \
--subnet=172.40.110.0/24 \
--gateway=172.40.110.1 \
-o parent=innernet \
infranet2

And then I've tried joining mysql container to it:

docker network connect infranet2 mysql-server

But I only get an error:
root@vps:~$ sudo docker network connect infranet2mysql-server Error response from daemon: failed to create the macvlan port: invalid argument

Improve this question

1 Answer 1

Reset to default
3

What you can do is you can expose your port (3306) only on the internal ip, accessible via wireguard, such as the tunnel ip (as opposed to exposing it on all ips (0.0.0.0/0), as it happens by default). Given your tunnel ip is 192.168.0.1, this is how you would do it:

docker run --name mysql-server \
-p 192.168.0.1:3306:3306 \
-e MYSQL_ROOT_PASSWORD=my-secret-pw \
-d mysql

Then you can access your remote mysql server, but the access from the internet wouldn't be possible.

Improve this answer
4
  • Thanks I thought about that - but not sure how is docker going to behave if wireguard network suddenly goes down. Will that also bring down the mysql container? Was hoping to find a solution where if innernet/wireguard network isn't available this wont cause container to go down. ^and i suspect above will lock it.
    – Dannyboy
    Aug 9, 2021 at 12:15
  • no the container will not go down along with the interface, container is still going to be running, it just won't be accessible
    – jabbson
    Aug 9, 2021 at 12:19
  • thanks. you are right. just tested it and it works - mysql is accessible on innernet mesh network and not on public ip. no need for esoteric networking types. wireguard meshes are fantastic.
    – Dannyboy
    Aug 10, 2021 at 12:08
  • ah interesting - actually - if wireguard network is down mysql container WILL NOT be able to start. Ive tested using random ip address and I got this error trying to boot stack up: "Error starting userland proxy: listen tcp 10.32.89.22:3306: bind: cannot assign requested address". meaning that I think if wireguard network is down - stack wontbe able to boot / reboot properly affecting reliability....
    – Dannyboy
    Aug 10, 2021 at 12:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .