1

I have this scenario:

  • a HOST machine running Debian with ufw installed.
  • a CentOS docker container that have an VM that working on an specific IP.
  • This VM have an app working on the container calling https://app.domain as put an entry in hosts file (APP_IP).

I want calling localhost:7000 on my HOST machine and use the VM app that is in the container.

I already exposed the port of the container while running it with -p 7000:7000.

I read about iptables and I tried to redirect the traffic on the container, but without success!

If this is the way... can anyone make an example of iptables command that I should run?


EDIT: Following this I tried:

IP_CONTAINER=xxx.xxx.xxx.xxx
APP_IP=xxx.xxx.xxx.xxx

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING --protocol tcp --destination $APP_IP --dport 80 --source $IP_CONTAINER --jump DNAT --to-destination $APP_IP
iptables -t nat -A POSTROUTING -j MASQUERADE

but still without success!

4
  • 1
    I'm not following what you're trying to do. If you want a port on the host that will forward to a port in the container, the -p option you used should have done that. Jul 18, 2020 at 0:22
  • It's not only the port as the container app that I would use outside the container work on a proper IP.
    – Kambei
    Jul 18, 2020 at 7:32
  • 1
    Are you contacting 127.0.0.0:8080 ? You shouldn't need the IP forwarding or iptables rule.
    – Ned64
    Jul 18, 2020 at 7:50
  • sorry, maybe I was not clear enough! The app is inside a VM in the CentOS docker container. For that expose only the port isn't enough. I've edited the question.
    – Kambei
    Jul 19, 2020 at 16:16

3 Answers 3

1

To redirect traffic from your HOST machine port to the app running on the VM inside the CentOS Docker container, you need to configure the Docker container network and use iptables rules to forward the traffic.

Here's an example of the steps you can take:

  1. Create a Docker network and attach the CentOS container to it:

    docker network create mynetwork
    docker run --network=mynetwork --name=centos_container centos
    
  2. Inside the CentOS container, configure the VM to use a static IP address in the same network as the Docker network. For example, if the Docker network IP range is 172.18.0.0/16, you can configure the VM to use 172.18.0.2.

  3. Expose the port of the VM inside the CentOS container to the Docker network. For example, if the app is running on port 80 inside the VM, you can use the docker run command with the -p option to map the port to the Docker network:

    docker run --network=mynetwork --name=centos_container -p 7000:80 centos
    

    This will map the container port 80 to the host machine port 7000.

  4. Enable IP forwarding on the HOST machine:

    echo 1 > /proc/sys/net/ipv4/ip_forward
    
  5. Configure iptables rules to forward the traffic from the HOST machine port 7000 to the VM inside the Docker container. For example, if the IP address of the VM inside the container is 172.18.0.2, you can use the following iptables rules:

    iptables -t nat -A PREROUTING -p tcp --dport 7000 -j DNAT --to-destination 172.18.0.2:80
    iptables -t nat -A POSTROUTING -j MASQUERADE
    

    These rules will forward incoming traffic to port 7000 on the HOST machine to port 80 on the VM inside the container, and rewrite the source IP address to the IP address of the HOST machine.

After following these steps, you should be able to access the app running on the VM inside the CentOS container by visiting http://localhost:7000 on your HOST machine.

0

I was able to connect to the app, inside the VM that is inside the CentOS Docker container, from Host using a proxy properly configured in the CentOS container that forward traffic from the container's exposed IP to VM ip and app port!

So the way is... a proxy inside the container!

I used HAProxy with this configuration for haproxy.conf:

global
log 127.0.0.1 local0
debug

defaults
log global
mode http
timeout connect 5000
timeout check 5000
timeout client 30000
timeout server 30000

frontend apps
bind CONTAINER_IP:80
bind CONTAINER_IP:443
option tcplog
mode tcp
default_backend apps

backend apps
mode tcp
balance roundrobin
option ssl-hello-chk
server webserver1 APP_IP:APP_PORT check

frontend api
bind CONTAINER_IP:6443
option tcplog
mode tcp
default_backend api

backend api
mode tcp
balance roundrobin
option ssl-hello-chk
server webserver1 APP_IP:APP_PORT check

and I have enabled forwarding for the container:

$ sysctl net.ipv4.conf.all.forwarding=1
$ sudo iptables -P FORWARD ACCEPT
0
  1. Check current iptables rules
    iptables -t nat -L -n -v
    
  2. Enable IP forwarding
    echo "1" > /proc/sys/net/ipv4/ip_forward
    cat /proc/sys/net/ipv4/ip_forward
    
  3. Rules to forward PG traffic
    iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination new-master-ip:80
    iptables -t nat -A POSTROUTING -j MASQUERADE
    
  4. Check iptables rules
    iptables -t nat -L -n -v
    

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .