I have django app launched with gunicorn on 0.0.0.0:8000 behind nginx as a reverse proxy listened on 1337 port.
version: '3.7'
services:
web:
build: .
command: gunicorn myapp.wsgi:application --name myapp --log-file - --log-level info --bind 0.0.0.0:8000
volumes:
- ./web-backend/src/:/usr/src/app/
ports:
- 8000:8000
env_file:
- .env_web
depends_on:
- db
db:
image: postgres:11.5-alpine
volumes:
- postgres_data:/var/lib/postgresql/data/
env_file:
- .env_db
nginx:
build: ./nginx
ports:
- 1337:80
depends_on:
- web
volumes:
postgres_data:
with nginx.conf:
upstream myapp {
server web:8000;
}
server {
listen 80;
location / {
proxy_pass http://myapp;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_redirect off;
}
}
The application is naturally reachable from localhost both at 8000 and 1337, however I would like it to be also reachable from all hosts in a different network (Info below).
Some info: Django app host which I am able to connect with ssh: 10.157.100.98/24 whereas the eth0 on the host itself is 192.168.0.13/24 which I believe will in the future have opened port for the internet, but for now just to have possibility for all users in 10.157.100.0 network to access the app.
Tracert:
Tracing route to 10.157.100.98 over a maximum of 30 hops
1 5 ms 4 ms 5 ms 10.156.80.1
2 5 ms 4 ms 6 ms 172.30.237.241
3 3 ms 3 ms 4 ms 172.30.225.6
4 4 ms 4 ms 4 ms 172.30.225.6
5 23 ms 23 ms 23 ms 135.7.192.30
6 42 ms 42 ms 42 ms 135.7.192.7
7 42 ms 43 ms 43 ms 135.7.193.21
8 43 ms 43 ms 43 ms sth-vlan478-domain.net [172.30.8z.x1]
9 43 ms 43 ms 43 ms sth2-vlan20-domain.net [172.30.8z.x2]
10 43 ms 44 ms 44 ms sth3-vlan22-domain.net [172.30.8z.x3]
11 43 ms 45 ms 43 ms 172.30.8z.x4
12 * * * Request timed out.
13 * * * Request timed out.
14 43 ms 42 ms 45 ms 10.157.100.98
Trace complete.
route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.0.1 0.0.0.0 UG 0 0 0 eth0
instance-data.e 192.168.0.1 255.255.255.255 UGH 0 0 0 eth0
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
172.30.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-df38aebf18b9
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
iptables
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:http-alt
Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-1 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain DOCKER (2 references)
target prot opt source destination
ACCEPT tcp -- anywhere sth5-vlan401-domain.net tcp dpt:postgresql
ACCEPT tcp -- anywhere sth6-certr01-domain.net tcp dpt:8000
ACCEPT tcp -- anywhere 172.30.0.5 tcp dpt:http
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target prot opt source destination
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-ISOLATION-STAGE-2 (2 references)
target prot opt source destination
DROP all -- anywhere anywhere
DROP all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-USER (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
route
'''
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.0.1 0.0.0.0 UG 0 0 0 eth0
instance-data.e 192.168.0.1 255.255.255.255 UGH 0 0 0 eth0
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
172.30.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-df38aebf18b9
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
'''
I would like to point out that i am a complete newbie when it comes to networking. So:
I am connecting via 172.30.86.42 to my django app server, so in order to enable all users (who will also connect via that proxy) to access application by 10.157.100.98:8000 or 1337 I need to open those ports for that interface, am I correct? Is there anything more?
Should anyone feel free to demonstrate how the traffic goes bit by bit, I believe it would be beneficial for all newbies.
