0

I am using LAMP image for my DOCKER container and in my apache access.log all of the requests are from same ip address: 172.17.0.1. This is bridge ip. My question is: is there a possibility to forward ip from Synology to Docker container? Or maybe I am doing something wrong here and I am missing something in container/synology configuration?

As per @SYN suggestion about iptables - can someone tell me which rules should I change and to what?

This are my nat rules on Synology (Docker host):

-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N DEFAULT_OUTPUT
-N DEFAULT_POSTROUTING
-N DEFAULT_PREROUTING
-N DOCKER
-A PREROUTING -j DEFAULT_PREROUTING
-A OUTPUT -j DEFAULT_OUTPUT
-A POSTROUTING -j DEFAULT_POSTROUTING
-A DEFAULT_OUTPUT -m addrtype --dst-type LOCAL -j DOCKER
-A DEFAULT_POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 3306 -j MASQUERADE
-A DEFAULT_POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A DEFAULT_POSTROUTING -o docker0 -m addrtype --src-type LOCAL -j MASQUERADE
-A DEFAULT_PREROUTING ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A DOCKER -p tcp -m tcp --dport 40001 -j DNAT --to-destination 172.17.0.2:3306
-A DOCKER -p tcp -m tcp --dport 40000 -j DNAT --to-destination 172.17.0.2:80

And here's the default table:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DEFAULT_FORWARD
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-A FORWARD -j DEFAULT_FORWARD
-A DEFAULT_FORWARD -j DOCKER-USER
-A DEFAULT_FORWARD -j DOCKER-ISOLATION-STAGE-1
-A DEFAULT_FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DEFAULT_FORWARD -o docker0 -j DOCKER
-A DEFAULT_FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A DEFAULT_FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 3306 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN

And the verbose output:

admin@SynologyCluster:/$ sudo iptables -vL
Chain INPUT (policy ACCEPT 2954K packets, 2329M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DEFAULT_FORWARD  all  --  any    any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 2741K packets, 16G bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain DEFAULT_FORWARD (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DOCKER-USER  all  --  any    any     anywhere             anywhere
    0     0 DOCKER-ISOLATION-STAGE-1  all  --  any    any     anywhere             anywhere
    0     0 ACCEPT     all  --  any    docker0  anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  any    docker0  anywhere             anywhere
    0     0 ACCEPT     all  --  docker0 !docker0  anywhere             anywhere
    0     0 ACCEPT     all  --  docker0 docker0  anywhere             anywhere

Chain DOCKER (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  !docker0 docker0  anywhere             172.17.0.2           tcp dpt:mysql
    0     0 ACCEPT     tcp  --  !docker0 docker0  anywhere             172.17.0.2           tcp dpt:http

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DOCKER-ISOLATION-STAGE-2  all  --  docker0 !docker0  anywhere             anywhere
    0     0 RETURN     all  --  any    any     anywhere             anywhere

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  any    docker0  anywhere             anywhere
    0     0 RETURN     all  --  any    any     anywhere             anywhere

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RETURN     all  --  any    any     anywhere             anywhere
admin@SynologyCluster:/$ sudo iptables -t nat -vL
Chain PREROUTING (policy ACCEPT 10733 packets, 1338K bytes)
 pkts bytes target     prot opt in     out     source               destination
 342K   36M DEFAULT_PREROUTING  all  --  any    any     anywhere             anywhere

Chain INPUT (policy ACCEPT 10702 packets, 1334K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 8937 packets, 554K bytes)
 pkts bytes target     prot opt in     out     source               destination
36669 2325K DEFAULT_OUTPUT  all  --  any    any     anywhere             anywhere

Chain POSTROUTING (policy ACCEPT 8937 packets, 554K bytes)
 pkts bytes target     prot opt in     out     source               destination
26637 1655K DEFAULT_POSTROUTING  all  --  any    any     anywhere             anywhere

Chain DEFAULT_OUTPUT (1 references)
 pkts bytes target     prot opt in     out     source               destination
19352 1183K DOCKER     all  --  any    any     anywhere             anywhere             ADDRTYPE match dst-type LOCAL

Chain DEFAULT_POSTROUTING (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  tcp  --  any    any     172.17.0.2           172.17.0.2           tcp dpt:mysql
    7   420 MASQUERADE  all  --  any    docker0  anywhere             anywhere             ADDRTYPE match src-type LOCAL
    0     0 MASQUERADE  tcp  --  any    any     172.17.0.2           172.17.0.2           tcp dpt:http

Chain DEFAULT_PREROUTING (1 references)
 pkts bytes target     prot opt in     out     source               destination
 234K   15M DOCKER     all  --  any    any     anywhere            !127.0.0.0/8          ADDRTYPE match dst-type LOCAL

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  any    any     anywhere             anywhere             tcp dpt:40001 to:172.17.0.2:3306
   12   720 DNAT       tcp  --  any    any     anywhere             anywhere             tcp dpt:40000 to:172.17.0.2:80

As I understand I should change this nat rule:

-A DEFAULT_POSTROUTING -o docker0 -m addrtype --src-type LOCAL -j MASQUERADE

Am I thinking correctly? I am not sure right now and I don't want to blow this all up by messing with it too much.

5
  • Do you mean that your Synology should have access to your apache container? Then you'ld want to enable ip forwarding and setup some iptables rule forwarding traffic in, from your Docker host address to your container. – SYN Oct 15 '19 at 13:57
  • Yes, I mean I already have reverse proxy set on my Synology which allows me to connect to my container with LAMP. But every connection made is logged in Apache as from 172.17.0.1 which is of course unwanted. I was reading this yesterday: github.com/pi-hole/docker-pi-hole/issues/… and I was wondering does it concern my problem (for me it seems like so). I don't have experience with IPTABLES configuration. Guess I need to read more to configurate this because as for now it is above my head. – Thomas Kolasa Oct 16 '19 at 6:05
  • @SYN can You take a look at my post now and say if I am on to something? :) – Thomas Kolasa Oct 16 '19 at 9:21
  • looks like so. the last rule you mention does a NAT (MASQUERADE) for packets leaving your docker0 interface (to a container). Which would explain why your apache sees its clients to be something like 172.17.X.Y. Either we replace MASQUERADE with ACCEPT, and you'ld need to make sure clients reaching that service would have a route for 172.17.0.0/24 pointing to your synology (ip r add 172.17.0.0/24 via synology.ip.address), or we replace that rule such as connections to your NAS address, on given ports, are forwarded to your container. – SYN Oct 16 '19 at 14:03
  • Thank You @SYN but sadly this doesn't help. The LAMP stops responding after changing the rule to ACCEPT and the ip route is already in container resolv.conf. I can see that packets are counted in iptables when I try to reach the website in container. Is there some way to debug what is exactly happening with the packets? – Thomas Kolasa Oct 17 '19 at 11:26
0

Not sure if this will work in your situation but it did work for my Pi-hole to see the client IP (as described here):

sudo iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER

Be aware that this is not permanent, so if you reboot the NAS you will have to apply it again.

2
  • The solution was simple, I just had to add new network in docker and add all my containers to that new network. The default network in Docker for Synology doesn't support ip forwarding. Everything works as supposed to after this. But thank You for Your answer and interest Pedro. Maybe I should add my own answer and mark it as solved? – Thomas Kolasa May 31 '20 at 11:39
  • If that worked for you, then you definitely should do just that, @ThomasKolasa – Pedro Lamas Jun 1 '20 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.