0

I have deployed a dockerized Java web app on a CentOS server. The app is exposed on port 80, and at first, the server would block every request made to that port. I managed to solve it by enabling communication on port 80 with this guide.

But, my app makes requests to other APIs, mostly via GET request to those endpoints. On my machine, the docker image works just fine, but my app cant communicate with those external APIs from inside the CentOS server. I tried turning the firewall off, and the application began to communicate with the external APIs again.

I have tried searching for ways to enable these requests, but could not find anything that would make it work. I am not very experienced with network and security issues, so maybe I could not use search keywords effectively.

How can I configure the firewall to enable these requests made by my app to external APIs?

EDIT: I am using FirewallD with CentOS 8. I am not sure what is failing. The logs on my app says the requested target cannot be reached.

2
  • What version of CentOS and what is failing? DNS lookup or unable to connect to host?
    – jsbillings
    Commented Jun 7, 2020 at 19:53
  • Added clarification on an edit on the question. Thank you for your reply. Commented Jun 7, 2020 at 21:26

2 Answers 2

2

You need to add the docket interface into the trusted firewalld zone:

firewall-cmd --zone=trusted --change-interface=docker0
firewall-cmd --zone=trusted --add-masquerade --permanent
firewall-cmd --reload

I’ve also heard that if you switch the firewalld backend from “nftables” to “iptables” in /etc/firewalld/firewalld.conf, it works out of the box.

2
  • Thank you sir. I will test that out. Can you ellaborate a little bit on what each of those commands do, and why enabling them makes my app be able to make requests from the inside the server to the outside? I want to be able to troubleshoot simillar problems by myself in the future. Commented Jun 9, 2020 at 2:27
  • Excellent answer, thanks! In my case firewall was blocking eth0. So, if anyone is looking, one should run ifconfig and consider what can be blocked like eth0, eno1 etc. instead of docker0 in this answer.
    – Celuk
    Commented Apr 26 at 17:22
0

Sorry I can't just add a comment yet but:

What firewall are you using?

What does it print out when you request its status?

If you are using ufw try ufw allow out ...

3
  • CentOS doesn’t use “ufw” so this doesn’t answer the question.
    – jsbillings
    Commented Jun 7, 2020 at 19:49
  • Well you could have just mentioned what firewall you are using instead of letting people guess. Because you can use most firewalls with cent os. Commented Jun 7, 2020 at 20:14
  • 1
    Added clarification on an edit on the question. Thank you for your reply. Commented Jun 7, 2020 at 21:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .