4

I'm running a VPN client in a docker container. I'm trying to connect from the host to a web server running in the docker container over port 8080. When I try to connect, I see my incoming packet on port 8080 via tcpdump, but the web server never sees it. I've added iptables '-j LOG' rules for all possible state transitions of the packet to try to trace it down. I see the packet at:

  • table 'raw', chain PREROUTING
  • table 'mangle', chain PREROUTING
  • table'nat', chain PREROUTING

and then... nothing. After a small delay, the packet is re-sent, and I see the new packet go through PREROUTING. Nothing ever appears on the mangle INPUT or mangle FORWARD chains - which as far as I can tell is impossible - it has to hit one of those. Is there any way for a packet to go through PREROUTING, but not hit INPUT or FORWARD? My iptables are below:

root@87ff7ad8e4f9:/# iptables -t raw -L 
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
NFLOG      tcp  --  anywhere             anywhere             tcp spt:http-alt nflog-prefix  "raw pre-route Src incoming packet"
NFLOG      tcp  --  anywhere             anywhere             tcp dpt:http-alt nflog-prefix  "raw pre-route Dest incoming packet"

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
NFLOG      tcp  --  anywhere             anywhere             tcp dpt:http-alt nflog-prefix  "Dest outgoing packet"
NFLOG      tcp  --  anywhere             anywhere             tcp spt:http-alt nflog-prefix  "Src outgoing packet"
root@87ff7ad8e4f9:/# iptables -t mangle -L 
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
NFLOG      tcp  --  anywhere             anywhere             tcp dpt:http-alt nflog-prefix  "mangle PREROUTING Dest incoming packet"

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
NFLOG      all  --  anywhere             anywhere             nflog-prefix  "mangle INPUT Dest incoming packet any2"

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
NFLOG      all  --  anywhere             anywhere             nflog-prefix  "mangle FORWARD Dest incoming packet any"

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
MARK       tcp  --  anywhere             anywhere             tcp spt:http-alt MARK set 0x1
MARK       tcp  --  anywhere             anywhere             tcp dpt:http-alt MARK set 0x1
NFLOG      tcp  --  anywhere             anywhere             tcp spt:http-alt nflog-prefix  "MARK set 0x1"
NFLOG      tcp  --  anywhere             anywhere             tcp dpt:http-alt nflog-prefix  "Dest MARK set 0x1"

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
root@87ff7ad8e4f9:/# iptables -t nat -L 
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
NFLOG      tcp  --  anywhere             anywhere             tcp dpt:http-alt nflog-prefix  "nat PREROUTING Dest incoming packet"

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
NFLOG      tcp  --  anywhere             anywhere             tcp dpt:http-alt nflog-prefix  "nat INPUT Dest incoming packet"

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
root@87ff7ad8e4f9:/# iptables -t filter -L 
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
NFLOG      tcp  --  anywhere             anywhere             nflog-prefix  "connection made"
NFLOG      tcp  --  anywhere             anywhere             tcp dpt:http-alt nflog-prefix  "filter INPUT Dest incoming packet"

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             172.17.0.0/16       
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             owner GID match vpn
ACCEPT     udp  --  anywhere             anywhere             owner GID match vpn
DROP       all  --  anywhere             anywhere            

And my syslog shows:

Oct  4 07:22:56 87ff7ad8e4f9 raw pre-route Dest incoming packet IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:2e:2c:fd:2e:08:00 SRC=76.167.254.196 DST=172.17.0.2 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=39119 DF PROTO=TCP SPT=46644 DPT=8080 SEQ=4027056663 ACK=0 WINDOW=29200 SYN URGP=0 MARK=0 
Oct  4 07:22:56 87ff7ad8e4f9 mangle PREROUTING Dest incoming packet IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:2e:2c:fd:2e:08:00 SRC=76.167.254.196 DST=172.17.0.2 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=39119 DF PROTO=TCP SPT=46644 DPT=8080 SEQ=4027056663 ACK=0 WINDOW=29200 SYN URGP=0 MARK=0 
Oct  4 07:22:56 87ff7ad8e4f9 nat PREROUTING Dest incoming packet IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:2e:2c:fd:2e:08:00 SRC=76.167.254.196 DST=172.17.0.2 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=39119 DF PROTO=TCP SPT=46644 DPT=8080 SEQ=4027056663 ACK=0 WINDOW=29200 SYN URGP=0 MARK=0 
Oct  4 07:22:57 87ff7ad8e4f9 raw pre-route Dest incoming packet IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:2e:2c:fd:2e:08:00 SRC=76.167.254.196 DST=172.17.0.2 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=39120 DF PROTO=TCP SPT=46644 DPT=8080 SEQ=4027056663 ACK=0 WINDOW=29200 SYN URGP=0 MARK=0 
Oct  4 07:22:57 87ff7ad8e4f9 mangle PREROUTING Dest incoming packet IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:2e:2c:fd:2e:08:00 SRC=76.167.254.196 DST=172.17.0.2 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=39120 DF PROTO=TCP SPT=46644 DPT=8080 SEQ=4027056663 ACK=0 WINDOW=29200 SYN URGP=0 MARK=0 
Oct  4 07:22:57 87ff7ad8e4f9 nat PREROUTING Dest incoming packet IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:2e:2c:fd:2e:08:00 SRC=76.167.254.196 DST=172.17.0.2 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=39120 DF PROTO=TCP SPT=46644 DPT=8080 SEQ=4027056663 ACK=0 WINDOW=29200 SYN URGP=0 MARK=0 
0

I think I got it. What is between PREROUTING and INPUT/FORWARD ? Look at the map : the routing decision.

From you logs : SRC=76.167.254.196 DST=172.17.0.2. You cannot route public to private ip address without DNAT. Try to add this :

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to-destination 172.17.0.2

Or you can setup your VPN to have a private IP instead.

  • Thank you for your suggestion. Unfortunately it did not help. Adding DNAT as you suggested did not change the behavior at all. Looking at the netfilter map you referred to only confirms my confusion. There are not paths out of NAT/PREROUTING that don't go to MANGLE/INPUT or MANGLE/FORWARD - yet somehow my packets don't hit either. – user875729 Oct 13 '16 at 4:13
0

I don't completely understand why, but the Reverse Path filter was the cause of the dropped packets. Turning it off via the following command resolved my issue: sysctl -w net.ipv4.conf.eth0.rp_filter=0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.