not quite working for me

[juli3nk]

not quite working for me

[ecamaj]

Of course, when I disable csf and restart docker service, it works from both domain and 127.0.0.1.

Hi Eddie,

I tried to query a webpage using curl http://localhost and curl http://<domain>. Both worked for me.

Could you try to remove the script csfpost.sh and see if it works.

Thanks
Julien

[ecamaj]

No, when I remove csfpost.sh and I restart csf, docker is not accessible at all (both domain and localhost).
Can I give you some details from server maybe?

[ecamaj]

iptables -L -n -t nat:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  172.17.0.0/16        0.0.0.0/0           
MASQUERADE  tcp  --  172.17.0.4           172.17.0.4           tcp dpt:5601
MASQUERADE  tcp  --  172.17.0.4           172.17.0.4           tcp dpt:9200
MASQUERADE  tcp  --  172.17.0.5           172.17.0.5           tcp dpt:8000
MASQUERADE  tcp  --  172.17.0.5           172.17.0.5           tcp dpt:8888
MASQUERADE  tcp  --  172.17.0.5           172.17.0.5           tcp dpt:8889
MASQUERADE  tcp  --  172.17.0.7           172.17.0.7           tcp dpt:80

Chain DOCKER (2 references)
target     prot opt source               destination         
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:5601 to:172.17.0.4:5601
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:9200 to:172.17.0.4:9200
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8000 to:172.17.0.5:8000
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8888 to:172.17.0.5:8888
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8889 to:172.17.0.5:8889
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:5001 to:172.17.0.7:80

Chain WEAVE (0 references)
target     prot opt source               destination         

[ecamaj]

I just noticed that when I restart docker service, this line in iptables is different:

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL

goes to:

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

And first line in POSTROUTING is added:

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match src-type LOCAL

Smells like a clue. :)

which version of docker do you use?

[ecamaj]

Downgraded little because of docker cloud for which this is latest version ...

root@server1 [/etc/init.d]# docker version
Client:
 Version:      1.9.1-cs2
 API version:  1.21
 Go version:   go1.4.3
 Git commit:   4ade326
 Built:        Mon Nov 30 21:56:07 UTC 2015
 OS/Arch:      linux/amd64

Server:
 Version:      1.9.1-cs2
 API version:  1.21
 Go version:   go1.4.3
 Git commit:   4ade326
 Built:        Mon Nov 30 21:56:07 UTC 2015
 OS/Arch:      linux/amd64

i see that you are using Weave. Maybe something with that?

[ecamaj]

no, I even don't know what's that ... I think docker cloud uses that.
Anyway, from what I sent you - changes of iptables before and after - you don't think that the exact line mentioning 127.0.0.1 holds information about the problem?

Don't this means something like (not)127.0.0.0/8?

DOCKER all -- 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL

i checked 2 of my servers and they both have that line. And not reporting prob.

[ecamaj]

Interesting... and do you have this line in your servers?

Chain OUTPUT (policy ACCEPT)
DOCKER all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL

i have the same as in your first output

Chain OUTPUT (policy ACCEPT)
DOCKER all -- 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL

[ecamaj]

Then I don't know.
Can I send you something that would lead you to the problem why restarting CSF kills routing to localhost:port exposed previously by Docker?

sure

[ecamaj]

:) that was a question - what to send for you to check? I'm not sure.

:) sorry, didnt catch that.

access to the server :D

[ecamaj]

:) anything else?
send some output? :)

verbose output of iptables:

• iptables -nvL
• iptables -nvL -t nat

output of docker: docker ps

[ecamaj]

any thoughts?
thanks

the output that you sent was with or without csfpost?

[ecamaj]

Hi, did you had time to check this out? Just to remove it from the list... :)
This would make script complete.
thanks

Hi Eddie,

Let's try teamviewer (http://www.teamviewer.com/) so I can see your terminal.

[ecamaj]

Sure, http://get.teamviewer.com/v11/s03239658

contact me by email

[ecamaj]

Can't find one... I'm ready to accept connection now. :)

do a git log on the clone of the repo

[ecamaj]

Solved, I guess Julien will merge it in the script.