<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">On 2017-09-02 06:13, Mike Wright wrote:
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">On 09/01/2017 07:02 PM, Benjamin Asbach wrote:
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">Hi there,<br /> <br /> I've some problems with connecting to my containers via my public domain from the host itself. I'm using bridged network by lxc network. The setup looks like this<br /> <br /> remote -> domain.com -> host -> container1 (nginx) -> container2 (app)<br /> <br /> When I curl from a remote location this works quite fine:<br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">curl <a href="https://sub.domain.com" target="_blank" rel="noopener noreferrer">https://sub.domain.com</a><br /> <html></html>%<br /> </blockquote>
But when I'm doing the same from the host itself:<br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">curl <a href="https://sub.domain.com" target="_blank" rel="noopener noreferrer">https://sub.domain.com</a><br /> curl: (7) Failed to connect to sub.domain.com port 443: Connection refused<br /> </blockquote>
I'm a little bit confused why this happens. I though it might be connected to iptables. But the rules look good for me:<br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">iptables-save<br /> # Generated by iptables-save v1.6.1 on Sat Sep 2 02:24:33 2017<br /> *nat<br /> :PREROUTING ACCEPT [138088:14417714]<br /> :INPUT ACCEPT [51357:4468554]<br /> :OUTPUT ACCEPT [8593:788743]<br /> :POSTROUTING ACCEPT [8445:711271]<br /> -A PREROUTING -i ens18 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.4.187:80<br /> -A PREROUTING -i ens18 -p tcp -m tcp --dport 443 -j DNAT --to-destination 10.0.4.187:443<br /> -A PREROUTING -i ens18 -p tcp -m tcp --dport 8022 -j DNAT --to-destination 10.0.4.116:8022<br /> -A POSTROUTING -s 10.0.4.0/24 ! -d 10.0.4.0/24 -m comment --comment "generated for LXD network lxdbr0" -j MASQUERADE<br /> COMMIT<br /> # Completed on Sat Sep 2 02:24:33 2017<br /> # Generated by iptables-save v1.6.1 on Sat Sep 2 02:24:33 2017<br /> *mangle<br /> :PREROUTING ACCEPT [293993:48599155]<br /> :INPUT ACCEPT [188065:31562883]<br /> :FORWARD ACCEPT [19475:7104838]<br /> :OUTPUT ACCEPT [124159:16994042]<br /> :POSTROUTING ACCEPT [147110:24355452]<br /> -A POSTROUTING -o lxdbr0 -p udp -m udp --dport 68 -m comment --comment "generated for LXD network lxdbr0" -j CHECKSUM --checksum-fill<br /> COMMIT<br /> # Completed on Sat Sep 2 02:24:33 2017<br /> # Generated by iptables-save v1.6.1 on Sat Sep 2 02:24:33 2017<br /> *filter<br /> :INPUT ACCEPT [449:65419]<br /> :FORWARD ACCEPT [0:0]<br /> :OUTPUT ACCEPT [274:37570]<br /> -A INPUT -i lxdbr0 -p tcp -m tcp --dport 53 -m comment --comment "generated for LXD network lxdbr0" -j ACCEPT<br /> -A INPUT -i lxdbr0 -p udp -m udp --dport 53 -m comment --comment "generated for LXD network lxdbr0" -j ACCEPT<br /> -A INPUT -i lxdbr0 -p udp -m udp --dport 67 -m comment --comment "generated for LXD network lxdbr0" -j ACCEPT<br /> -A FORWARD -o lxdbr0 -m comment --comment "generated for LXD network lxdbr0" -j ACCEPT<br /> -A FORWARD -i lxdbr0 -m comment --comment "generated for LXD network lxdbr0" -j ACCEPT<br /> -A OUTPUT -o lxdbr0 -p tcp -m tcp --sport 53 -m comment --comment "generated for LXD network lxdbr0" -j ACCEPT<br /> -A OUTPUT -o lxdbr0 -p udp -m udp --sport 53 -m comment --comment "generated for LXD network lxdbr0" -j ACCEPT<br /> -A OUTPUT -o lxdbr0 -p udp -m udp --sport 67 -m comment --comment "generated for LXD network lxdbr0" -j ACCEPT<br /> COMMIT<br /> # Completed on Sat Sep 2 02:24:33 2017<br /> </blockquote>
Might be the issue related to the bridged network or do you've any ideas what's causing the problem?!</blockquote>
<br /> Hi Benjamin, I'll give this a stab.<br /> <br /> Does the host have an address on the bridge? To test, give it one. <br /> If it works make sure to add iptables rules so the host only accepts<br /> EST,REL traffic from the bridge guests (barbarians at the gates, etc).<br /> <br /> If you don't want the host to have a bridge address you'll have to set<br /> up some other method such as NAT like you did for traffic coming in on<br /> ens18.<br /> <br /> Good luck,<br /> Mike Wright</blockquote>
<br /> Hi Mike,<br /> <br /> thanks for your reply! I checked that the adapter has an address:</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">ip addr<br /> 2: lxdbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000<br /> link/ether fe:06:96:f6:16:da brd ff:ff:ff:ff:ff:ff<br /> inet 10.0.4.1/24 scope global lxdbr0<br /> valid_lft forever preferred_lft forever<br /> inet6 fe80::5c98:e8ff:fe13:66e3/64 scope link <br /> valid_lft forever preferred_lft forever<br /> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">I tried to get some information what you've meant. But currently I'm a little bit confused howto apply these ESTABLISHED and RELATED rules to iptables. Do you mind if you can get a litte bit more detail in that?</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">Thanks</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">Benjamin</div>
</body></html>