Help: Port forwarding problem

[moby]

Help: Port forwarding problem

[djs55]

Hi -- I think I can spot 2 problems:

• as you suspected, port forwarding is done over virtio-vsock. There are 2 parts to this: the control interface is currently a 9P filesystem mount manipulated by vpnkit-expose-port (although we'll probably replace this with GRPC or similar at some point). Once the port is "exposed" and vpnkit is listening on the host, incoming connections are forwarded over AF_VSOCK connections to a server process called vpnkit-forwarder -- I suspect this will fail to start if the kernel doesn't support the address family.

• secondly, I think there's a minor problem in the vpnkit-expose-port command line. When incoming connections are forwarded, vpnkit writes a short header telling vpnkit-forwarder the final destination to connect to which is the container-ip on the vpnkit-expose-port command line. So I think you to give it an IP bound inside the VM instead of 0.0.0.0:

~/vpnkit-expose-port.linux -i -host-ip 127.0.0.1 -host-port 8000 -container-ip 127.0.0.1 -container-port 8000 -no-local-ip

At one point in the past we did support using the internal network for port forwarding but unfortunately that code was removed :(

Another way you could set up access would be a reverse port forward with ssh -- inside the VM you should be able to ssh <vpnkit gateway IP> -R localhost:8000:127.0.0.1:8000 (if I've remembered the syntax properly). This will connect to the host's sshd and tell it to listen on localhost:8000 (on the host) and forward connections back to 127.0.0.1:8000 in the VM.

In case it's helpful, recent versions of vpnkit should respond to DNS queries for docker.for.mac.localhost with the vpnkit IP. (Although we'll probably have to change the DNS name used since we shouldn't have used localhost)

Hope this helps a little!

[gerboland]

Hey djs55,
thank you so much for the info, you've cleared up a lot of for me. Reverse port forwarding sounds like a more flexible solution for my needs.
Thanks again!
-G