How can the docker-host reach an exported port without hitting the iptables DNAT-rule?
Bonus: Why are the iptables log messages only shown with curl 127.0.0.1:8082
but not with curl localhost:8082
?
UPDATE: Similar to https://stackoverflow.com/questions/29629620, connecting to the container works with empty iptables rules too (# systemctl stop iptables
clears all tables, sets policies to accept).
Setup
docker-compose.yml
version: '3.2'
services:
webapp:
image: httpd:latest
networks:
- webapp
ports:
- "8082:80"
networks:
webapp:
driver: bridge
#port mapping does not work for internal networks
# internal: true
Observed Behaviour
- Packet starts in OUTPUT chain
- Packet leaves (lo), arrives again (lo)
- Accepted by conntrack target in *filterINPUT chain
Expected Behaviour
$ curl 127.0.0.1:8082
Although the nat-table [is traversed only once per connection][1], the counters for the DNAT should not be zero; Traversal for first packet:
- Packet starts in OUTPUT chain
- Packet leaves unchanged (-> lo), arrives again (lo)
- Packet still unchanged: *natPREROUTING -jump-> *natDOCKER
- DNAT --to-destination 172.18.0.2:80
- Routing decision --> *filterFORWARD (destination is foreign host)
- *filterFORWARD -jump-> *filterDOCKER ang get accepted, further packets already accepted by conntrack target
Counters
*nat (UPDATE: full output instead of DOCKER-chain)
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER all -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 44 packets, 4248 bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER all -- * * 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT 44 packets, 4248 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * !br-cac172d73716 172.18.0.0/16 0.0.0.0/0
0 0 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0
0 0 MASQUERADE tcp -- * * 172.18.0.2 172.18.0.2 tcp dpt:80
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all -- br-cac172d73716 * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- docker0 * 0.0.0.0/0 0.0.0.0/0
0 0 DNAT tcp -- !br-cac172d73716 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8082 to:172.18.0.2:80
*filter
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- !br-cac172d73716 br-cac172d73716 0.0.0.0/0 172.18.0.2 tcp dpt:80
with:
docker network ls
NETWORK ID NAME DRIVER SCOPE
cac172d73716 docker_webapp bridge local
iptables -t nat -L -n -v
please – Andreas Rogge Feb 17 '19 at 18:38