Re: Problems accessing host from docker container running on host
Sean Murphy via Shorewall-users <[email protected]> Fri, 21 Mar 2025 10:35:18 +0000
| Newsgroups | gmane.comp.security.shorewall |
|---|---|
| Message-ID | <ZR3P278MB12269B64F6279BB3B42B7A5797DB2@ZR3P278MB1226.CHEP278.PROD.OUTLOOK.COM> |
--===============8449172948530520160== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_ZR3P278MB12269B64F6279BB3B42B7A5797DB2ZR3P278MB1226CHEP_" --_000_ZR3P278MB12269B64F6279BB3B42B7A5797DB2ZR3P278MB1226CHEP_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Thanks Simon - good point. Right now, we're allow docker to manage some iptables stuff to support isol= ation between different docker compose instances which could be running on = the same host. We might need to modify that. BR, Sean. __________________________________ Sean Murphy Senior Platform Engineer [email protected] T +41 44 289-84-22 www<http://www.wuestpartner.com>.datahouse.ch Linkedin<https://www.linkedin.com/company/wuestpartner/posts/?feedView=3Dal= l&viewAsMember=3Dtrue> | YouTube<https://www.youtube.com/channel/UC4Esiu5N_= zg2JRERufw5HvA> __________________________________ ________________________________ From: Simon Matter <[email protected]> Sent: Thursday, March 20, 2025 11:23 AM To: Shorewall Users <[email protected]> Cc: Sean Murphy <[email protected]> Subject: Re: [Shorewall-users] Problems accessing host from docker containe= r running on host [You don't often get email from [email protected]. Learn why this is i= mportant at https://aka.ms/LearnAboutSenderIdentification ] > Thanks Matt. > > Yes - if I do a shorewall clear, it's possible to access the host from > inside the docker container. The > default docker iptables config seems to support this. However, when I > enable shorewall (with docker > support), it's not possible. > > It really seems like some interaction between the docker iptables > functionality and the shorewall > iptables functionality is causing the problem and more specifically, on > the return path from the service > running on the host to the docker container. Maybe you have to configure docker so that it doesn't fiddle with the iptables config? Simon > > It could be something of an edge case as mostly the point of having > containers is to have (some) > isolation from the host but we think it prob should be possible to eg > access stuff from inside the > containers which is accessible from anywhere on the internet. > > Thanks for any insights. > > BR, > Sean. > > __________________________________ > Sean Murphy > Senior Platform Engineer > [email protected] > T +41 44 289-84-22 > www.datahouse.ch<http://www.datahouse.ch> > Linkedin | YouTube > __________________________________ > > > ________________________________________ > From: Matt Darfeuille <[email protected]> > Sent: Wednesday, March 19, 2025 8:19 PM > To: [email protected] > <[email protected]> > Subject: Re: [Shorewall-users] Problems accessing host from docker > container running on host > > [You don't often get email from [email protected]. Learn why this is > important at https://aka.ms/LearnAboutSenderIdentification ] > > On 3/19/25 10:49, Sean Murphy via Shorewall-users wrote: >> Hi all,, >> >> We have been (ab)using shorewall for some years now and we're v happy >> with it - >> thanks everyone and Tom in particular for such a great tool. >> >> We have been using it to manage security for a set of VMs running >> applications >> with docker-compose. Almost all of our hosts have a single external >> network >> interface; this is perhaps not the use case for which shorewall was >> designed >> but it has been working for us so far. >> >> We now have a scenario which is proving more difficult: we want to >> access a >> service running on a host from within a container. >> >> We have tried the most open configuration possible - a policy with >> all:all >> ACCEPT and no rules; it seems the service is accessible from anywhere >> except >> inside the docker container. >> >> Accessing the service from inside the container results in timeouts, so >> presumably >> the packets are being dropped somewhere. We tried ping, ssh (on standard >> ports) >> and an http service running on a high port number. >> >> Zone configuration: >> root@dhit-disposable01:/etc/shorewall# cat zones >> ########################################################################= ####### >> #ZONE TYPE OPTIONS >> IN OUT >> # >> OPTIONS OPTIONS >> fw firewall >> net ipv4 >> dock ipv4 >> >> Interface configuration: >> root@dhit-disposable01:/etc/shorewall# cat interfaces >> ########################################################################= ####### >> ?FORMAT 2 >> ########################################################################= ####### >> #ZONE INTERFACE OPTIONS >> net eth physical=3Deth+,dhcp,nosmurfs >> net en physical=3Den+,dhcp,nosmurfs >> dock docker0 physical=3Ddocker+,routeback=3D1 >> dock br physical=3Dbr-+,routeback=3D1 >> >> Policy configuration: >> root@dhit-disposable01:/etc/shorewall# cat policy >> #SOURCE DEST POLICY LOGLEVEL LIMIT >> all all ACCEPT >> >> Rules configuration: >> root@dhit-disposable01:/etc/shorewall# cat rules >> #ACTION SOURCE DEST PROTO DPORT >> # No rules >> >> Docker configuration as per shorewall.conf >> root@dhit-disposable01:/etc/shorewall# grep -i docker shorewall.conf >> # Default shorewall config, except for DOCKER=3DYes (and this comment). >> DOCKER=3DYes >> DOCKER_BRIDGE=3Ddocker0 >> >> I did shorewall compile, safe-reload and then restarted the docker >> deamon but >> the packets still seem to be being dropped. I tried iptables-tracer [1] >> to get some >> info on where they disappear and it seems packets are being dropped on >> the >> return path. > > If you do a `shorewall clear`, does it work at all? > > > Note that the project is unmaintained. > > -- > Matt Darfeuille <[email protected]> > Unmaintained project, no more releases or bug fixes > Community: https://sourceforge.net/p/shorewall/mailman/message/37107049/ > > > _______________________________________________ > Shorewall-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/shorewall-users > > _______________________________________________ > Shorewall-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/shorewall-users > --_000_ZR3P278MB12269B64F6279BB3B42B7A5797DB2ZR3P278MB1226CHEP_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> Thanks Simon - good point.</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> Right now, we're allow docker to manage some iptables stuff to support isol= ation between different docker compose instances which could be running on = the same host. We might need to modify that.</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> BR,</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> Sean.</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" id=3D"Signature"> <p><span style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontServi= ce, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">= __________________________________</span></p> <p><span style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontServi= ce, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">= <b>Sean Murphy</b><br> Senior Platform Engineer</span></p> <p><span style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontServi= ce, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">= [email protected]<br> T +41 44 289-84-22<br> <a href=3D"http://www.wuestpartner.com" id=3D"OWAe7f6ee8a-dcb2-9f86-ce3f-02= 9fce9baed2" class=3D"external-link OWAAutoLink" rel=3D"nofollow" style=3D"c= olor: rgb(0, 0, 0); margin-top: 0px; margin-bottom: 0px;">www</a>.datahouse= .ch<br> <a href=3D"https://www.linkedin.com/company/wuestpartner/posts/?feedView=3D= all&viewAsMember=3Dtrue" id=3D"OWAe8ae955c-b085-8ce8-e870-17ce52775d7d"= class=3D"external-link OWAAutoLink" rel=3D"nofollow" style=3D"color: rgb(0= , 0, 0); margin-top: 0px; margin-bottom: 0px;">Linkedin</a> | <a href=3D"https://www.youtube.com/channel/UC4Esiu5N_zg2JRERufw5HvA" id=3D"= OWAdd7c5fd8-eb39-5f57-967d-66e50631bac7" class=3D"external-link OWAAutoLink= " rel=3D"nofollow" style=3D"color: rgb(0, 0, 0); margin-top: 0px; margin-bo= ttom: 0px;"> YouTube</a><br> __________________________________</span></p> <div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, = Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> </div> <div id=3D"appendonsend"></div> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st= yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Simon Matter <simo= [email protected]><br> <b>Sent:</b> Thursday, March 20, 2025 11:23 AM<br> <b>To:</b> Shorewall Users <[email protected]><br= > <b>Cc:</b> Sean Murphy <[email protected]><br> <b>Subject:</b> Re: [Shorewall-users] Problems accessing host from docker c= ontainer running on host</font> <div> </div> </div> <div class=3D"BodyFragment"><font size=3D"2"><span style=3D"font-size:11pt;= "> <div class=3D"PlainText">[You don't often get email from simon.matter@invoc= a.ch. Learn why this is important at <a href=3D"https://aka.ms/LearnAboutSenderIdentification">https://aka.ms/Le= arnAboutSenderIdentification</a> ]<br> <br> > Thanks Matt.<br> ><br> > Yes - if I do a shorewall clear, it's possible to access the host from= <br> > inside the docker container. The<br> > default docker iptables config seems to support this. However, when I<= br> > enable shorewall (with docker<br> > support), it's not possible.<br> ><br> > It really seems like some interaction between the docker iptables<br> > functionality and the shorewall<br> > iptables functionality is causing the problem and more specifically, o= n<br> > the return path from the service<br> > running on the host to the docker container.<br> <br> Maybe you have to configure docker so that it doesn't fiddle with the<br> iptables config?<br> <br> Simon<br> <br> ><br> > It could be something of an edge case as mostly the point of having<br= > > containers is to have (some)<br> > isolation from the host but we think it prob should be possible to eg<= br> > access stuff from inside the<br> > containers which is accessible from anywhere on the internet.<br> ><br> > Thanks for any insights.<br> ><br> > BR,<br> > Sean.<br> ><br> > __________________________________<br> > Sean Murphy<br> > Senior Platform Engineer<br> > [email protected]<br> > T +41 44 289-84-22<br> > <a href=3D"http://www.datahouse.ch">www.datahouse.ch</a><br> > Linkedin | YouTube<br> > __________________________________<br> ><br> ><br> > ________________________________________<br> > From: Matt Darfeuille <[email protected]><br> > Sent: Wednesday, March 19, 2025 8:19 PM<br> > To: [email protected]<br> > <[email protected]><br> > Subject: Re: [Shorewall-users] Problems accessing host from docker<br> > container running on host<br> ><br> > [You don't often get email from [email protected]. Learn why this is<= br> > important at <a href=3D"https://aka.ms/LearnAboutSenderIdentification"= >https://aka.ms/LearnAboutSenderIdentification</a> ]<br> ><br> > On 3/19/25 10:49, Sean Murphy via Shorewall-users wrote:<br> >> Hi all,,<br> >><br> >> We have been (ab)using shorewall for some years now and we're v ha= ppy<br> >> with it -<br> >> thanks everyone and Tom in particular for such a great tool.<br> >><br> >> We have been using it to manage security for a set of VMs running<= br> >> applications<br> >> with docker-compose. Almost all of our hosts have a single externa= l<br> >> network<br> >> interface; this is perhaps not the use case for which shorewall wa= s<br> >> designed<br> >> but it has been working for us so far.<br> >><br> >> We now have a scenario which is proving more difficult: we want to= <br> >> access a<br> >> service running on a host from within a container.<br> >><br> >> We have tried the most open configuration possible - a policy with= <br> >> all:all<br> >> ACCEPT and no rules; it seems the service is accessible from anywh= ere<br> >> except<br> >> inside the docker container.<br> >><br> >> Accessing the service from inside the container results in timeout= s, so<br> >> presumably<br> >> the packets are being dropped somewhere. We tried ping, ssh (on st= andard<br> >> ports)<br> >> and an http service running on a high port number.<br> >><br> >> Zone configuration:<br> >> root@dhit-disposable01:/etc/shorewall# cat zones<br> >> ##################################################################= #############<br> >> #ZONE = TYPE OPTIONS<br> >> IN &nbs= p; OUT<br> >> #<br> >> OPTIONS  = ; OPTIONS<br> >> fw &nbs= p; firewall<br> >> net &nb= sp; ipv4<br> >> dock &n= bsp; ipv4<br> >><br> >> Interface configuration:<br> >> root@dhit-disposable01:/etc/shorewall# cat interfaces<br> >> ##################################################################= #############<br> >> ?FORMAT 2<br> >> ##################################################################= #############<br> >> #ZONE INTERFACE &nb= sp; OPTIONS<br> >> net eth  = ; &n= bsp; physical=3Deth+,dhcp,nosmurfs<br> >> net en = &nb= sp; physical=3Den+,dhcp,nosmurfs<br> >> dock docker0 = ph= ysical=3Ddocker+,routeback=3D1<br> >> dock br  = ; &n= bsp; physical=3Dbr-+,routeback=3D1<br> >><br> >> Policy configuration:<br> >> root@dhit-disposable01:/etc/shorewall# cat policy<br> >> #SOURCE DEST = POLICY LOGLEVE= L LIMIT<br> >> all &nb= sp; all ACCEPT<br> >><br> >> Rules configuration:<br> >> root@dhit-disposable01:/etc/shorewall# cat rules<br> >> #ACTION SOURCE &nbs= p; &= nbsp; DEST PROTO  = ; DPORT<br> >> # No rules<br> >><br> >> Docker configuration as per shorewall.conf<br> >> root@dhit-disposable01:/etc/shorewall# grep -i docker shorewall.co= nf<br> >> # Default shorewall config, except for DOCKER=3DYes (and this comm= ent).<br> >> DOCKER=3DYes<br> >> DOCKER_BRIDGE=3Ddocker0<br> >><br> >> I did shorewall compile, safe-reload and then restarted the docker= <br> >> deamon but<br> >> the packets still seem to be being dropped. I tried iptables-trace= r [1]<br> >> to get some<br> >> info on where they disappear and it seems packets are being droppe= d on<br> >> the<br> >> return path.<br> ><br> > If you do a `shorewall clear`, does it work at all?<br> ><br> ><br> > Note that the project is unmaintained.<br> ><br> > --<br> > Matt Darfeuille <[email protected]><br> > Unmaintained project, no more releases or bug fixes<br> > Community: <a href=3D"https://sourceforge.net/p/shorewall/mailman/mess= age/37107049/"> https://sourceforge.net/p/shorewall/mailman/message/37107049/</a><br> ><br> ><br> > _______________________________________________<br> > Shorewall-users mailing list<br> > [email protected]<br> > <a href=3D"https://lists.sourceforge.net/lists/listinfo/shorewall-user= s">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a><br> ><br> > _______________________________________________<br> > Shorewall-users mailing list<br> > [email protected]<br> > <a href=3D"https://lists.sourceforge.net/lists/listinfo/shorewall-user= s">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a><br> ><br> <br> <br> </div> </span></font></div> </body> </html> --_000_ZR3P278MB12269B64F6279BB3B42B7A5797DB2ZR3P278MB1226CHEP_-- --===============8449172948530520160== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============8449172948530520160== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline