Re: Problems accessing host from docker container running on host

Thanks Winston - I had hoped to avoid getting my hands dirty with tcpdump b=
ut it =

looks like I might have to. Do you find it straightforward to track movemen=
ts through =

the chains and tables with tcpdump?

The client runs in a docker container - my main objective is to use curl fr=
om within a docker
container as the client and a http server running on the host but I've also=
 been trying it
out with and ssh client and a ping client (both working inside the containe=
r).

We have basically 3 zones: the firewall zone, the network zone and the dock=
er zone.
The firewall zone is as defined by shorewall. The network zone refers to tr=
affic on the
(single) network interface and the docker zone refer to traffic originating=
 and terminating
on the docker bridge.

Thanks for any insights.

BR,
Sean.


__________________________________
Sean Murphy
Senior Platform Engineer
[email protected]
T +41 44=A0 289-84-22
www.datahouse.ch
Linkedin: https://www.linkedin.com/company/wuestpartner/posts/?feedView=3Da=
ll&viewAsMember=3Dtrue
YouTube: https://www.youtube.com/channel/UC4Esiu5N_zg2JRERufw5HvA
__________________________________


________________________________________
From:=A0Winston Sorfleet <[email protected]>
Sent:=A0Wednesday, March 19, 2025 7:16 PM
To:[email protected] <[email protected]=
rge.net>
Subject:=A0Re: [Shorewall-users] Problems accessing host from docker contai=
ner running on host
=A0
[You don't often get email from [email protected]. Learn why this is important=
 at https://aka.ms/LearnAboutSenderIdentification=A0]

Normally I'd start with tcpdump as the lowest-level tracing tool, but
first I'd want to know a bit more about your scenario. Instead of using
"host" and "docker" terminology (I am not familiar with docker, so I am
not sure if you are implying a VM trying to communicate with the
underlying host), could you perhaps re-frame your question with "client"
and "server" and explain which are in which zones (and networks)?=A0 Or
are the client and server on the same host?

On 2025-03-19 05:49, Sean Murphy via Shorewall-users wrote:
> Hi all,,
>
> We have been (ab)using shorewall for some years now and we're v happy wit=
h it -
> thanks everyone and Tom in particular for such a great tool.
>
> We have been using it to manage security for a set of VMs running applica=
tions
> with docker-compose. Almost all of our hosts have a single external netwo=
rk
> interface; this is perhaps not the use case for which shorewall was desig=
ned
> but it has been working for us so far.
>
> We now have a scenario which is proving more difficult: we want to access=
 a
> service running on a host from within a container.
>
> We have tried the most open configuration possible - a policy with all:all
> ACCEPT and no rules; it seems the service is accessible from anywhere exc=
ept
> inside the docker container.
>
> Accessing the service from inside the container results in timeouts, so p=
resumably
> the packets are being dropped somewhere. We tried ping, ssh (on standard =
ports)
> and an http service running on a high port number.
>
> Zone configuration:
> root@dhit-disposable01:/etc/shorewall# cat zones
> #########################################################################=
######
> #ZONE=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 TYPE=A0=A0=A0=A0=A0 OPTIONS=A0=A0=A0=
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 IN=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 OUT
> #=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 OP=
TIONS=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 OPTIONS
> fw=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 firewall
> net=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 ipv4
> dock=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 ipv4
>
> Interface configuration:
> root@dhit-disposable01:/etc/shorewall# cat interfaces
> #########################################################################=
######
> ?FORMAT 2
> #########################################################################=
######
> #ZONE=A0=A0 INTERFACE=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 OPT=
IONS
> net=A0=A0=A0=A0 eth=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=
=A0=A0=A0=A0 physical=3Deth+,dhcp,nosmurfs
> net=A0=A0=A0=A0 en=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=
=A0=A0=A0=A0=A0 physical=3Den+,dhcp,nosmurfs
> dock=A0=A0=A0 docker0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=
=A0 physical=3Ddocker+,routeback=3D1
> dock=A0=A0=A0 br=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=
=A0=A0=A0=A0 physical=3Dbr-+,routeback=3D1
>
> Policy configuration:
> root@dhit-disposable01:/etc/shorewall# cat policy
> #SOURCE=A0=A0=A0=A0=A0=A0=A0 DEST=A0=A0=A0=A0=A0=A0=A0 POLICY=A0=A0=A0=A0=
=A0 LOGLEVEL=A0=A0=A0 LIMIT
> all=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 all=A0=A0=A0=A0=A0=A0=A0=A0 ACCEPT
>
> Rules configuration:
> root@dhit-disposable01:/etc/shorewall# cat rules
> #ACTION=A0=A0=A0=A0=A0 SOURCE=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=
=A0=A0=A0 DEST=A0=A0=A0=A0=A0=A0 PROTO=A0=A0=A0=A0=A0 DPORT
> # No rules
>
> Docker configuration as per shorewall.conf
> root@dhit-disposable01:/etc/shorewall# grep -i docker shorewall.conf
> # Default shorewall config, except for DOCKER=3DYes (and this comment).
> DOCKER=3DYes
> DOCKER_BRIDGE=3Ddocker0
>
> I did shorewall compile, safe-reload and then restarted the docker deamon=
 but
> the packets still seem to be being dropped. I tried iptables-tracer [1] t=
o get some
> info on where they disappear and it seems packets are being dropped on the
> return path.
>
> I checked the documentation and could not find any answer in the FAQs. I
> could not generate a shorewall dump as we are using journald rather than
> syslog and it's unclear to me how such a dump can be generated in this ca=
se.
>
> Happy to provide further information as required.
>
> Any thoughts/pointers appreciated...
>
> Best rgds,
> Sean.
>
> [1] https://github.com/x-way/iptables-tracer
>
> __________________________________
> Sean Murphy
> Senior Platform Engineer
> [email protected]
> T +41 44=A0 289-84-22
> www.datahouse.ch
> Linkedin: https://www.linkedin.com/company/wuestpartner/posts/?feedView=
=3Dall&viewAsMember=3Dtrue
> YouTube: https://www.youtube.com/channel/UC4Esiu5N_zg2JRERufw5HvA
> __________________________________
>
>
> _______________________________________________
> Shorewall-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>


_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users