1

I set up a Google Compute Engine (GCE) instance with an assigned static IP address. My goal is to run a Docker container for osticket on that instance.

I started up the Docker container as normal. I can connect using Lynx from a bash shell running inside the container (lynx http://0.0.0.0).

Please understand I'm no networking pro. After reading up on Docker networking I used this suggested iptables command on the instance (iptables -t nat -L -n) and discovered an IP address (172.17.0.7) whose purpose is a mystery to me:

Chain DOCKER (2 references) 
target  prot opt source        destination
DNAT    tcp  --  0.0.0.0/0     0.0.0.0/0      tcp dpt:8080 to:172.17.0.7:80

However, I charged forward and within the instance shell (outside the container) I ran Lynx connecting to that IP addr (172.17.0.7:80) and it connected to the osticket website! I'm assuming it connected to the container.

The full output of iptables was:

Chain PREROUTING (policy ACCEPT) 
target     prot opt source      destination
DOCKER     all  --  0.0.0.0/0   0.0.0.0/0        ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT) 
target     prot opt source      destination         

Chain OUTPUT (policy ACCEPT) 
target     prot opt source       destination
DOCKER     all  --  0.0.0.0/0    !127.0.0.0/8   ADDRTYPE match dst-type LOCAL 

Chain POSTROUTING (policy ACCEPT) 
target     prot opt source           destination  
MASQUERADE all  --  172.17.0.0/16    0.0.0.0/0           
MASQUERADE tcp  --  172.17.0.7       172.17.0.7     tcp dpt:80

Chain DOCKER (2 references) 
target     prot opt source           destination          
DNAT       tcp  --  0.0.0.0/0        0.0.0.0/0      tcp dpt:8080 to:172.17.0.7:80

So my question:

Now that I know the docker container is working and I can get to it (at least from within the instance and through that mysterious addr) how is it that GCE external IP addr is supposed to connect through the instance and to that container?

It isn't working yet. Trying to connect from my laptop browser to that external IP, connecting to port 80 I get: "This site can't be reached. XXX.XXX.XXX.XXX refused to connect." Connecting to port 8080, I get "This site can’t be reached. XXX.XXX.XXX.XXX took too long to respond."

I can't find a configuration fix that will make it connect. I can successfully ping that external address so I know it is connecting to something. I am certain that the static IP is assigned to the osticket GCE instance.

A little extra bg: Earlier, I installed another GCE with a Docker container (Mattermost) with a similar external static IP. The external IP worked! It connected through to the container without a hitch. I was hoping the same would be true again. No luck.

[Edit: fixed a typo.]

2

You need to create a firewall rule at https://console.cloud.google.com/networking/firewalls/list to open port 80 for inbound external traffic.

  • Thanks, this is what I needed. I had to open up 8080 instead, but that was otherwise spot-on. – ustamills Aug 26 '16 at 14:56
  • Some additional details I believe that port 80 is supposed to be opened already when you use the checkbox for "Allow HTTP Traffic" during your GCE instance definition. Google could probably have chosen many ports for which to provide ports, but I guess HTTP and HTTPS were "good enough". My particular need was for port 8080 as that is what this Docker container is using. In hindsight, I'm guessing that the HTTP and HTTPS checkboxes probably define rules ala the edit page that Mr. Ginkel illumined. Any port other than those two require explicit openings. – ustamills Aug 29 '16 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.