Can't acces web of containers outside local network #278

dhrysh · 2021-10-30T10:48:35Z

dhrysh
Oct 30, 2021

Describe the bug
I set up docker containers with my service and nordVPN, but I can access the web of my container only if the request is made to the local network (127.0.0.1:port). NETWORK environment is right and I am sure that my service is working

To Reproduce without docker CLI
docker-compose.yml if used (hide credentials)

version: '3.7'
services:
  vpn:
    image: ghcr.io/bubuntux/nordvpn
    cap_add:
      - NET_ADMIN               # Required
    environment:                # Review https://github.com/bubuntux/nordvpn#environment-variables
      - USER=     # Required
      - "PASS=T"         # Required
      - CONNECT=Ukraine
      - TECHNOLOGY=NordLynx
      - NETWORK=0.0.0.0/0
      - PORTS=8085
      - DEBUG=trace
    ports:
      - 8085:8085
  hls:
    container_name: proxy
    build: ./
    volumes:
      - ./data:/opt/hlsp/
    network_mode: "service:vpn"
  ...

Expected behavior
I can access my webUI from public IP
Logs
++ cat /etc/timezone

'[' /UTC '!=' '' ']'
'[' -d /usr/share/zoneinfo/ ']'
TZ=Etc/UTC
ln -fs /usr/share/zoneinfo/Etc/UTC /etc/localtime
dpkg-reconfigure -f noninteractive tzdata
++ date -Iseconds
echo '[2021-10-30T10:43:29+00:00] Firewall is up, everything has to go through the vpn'
[2021-10-30T10:43:29+00:00] Firewall is up, everything has to go through the vpn
++ ip -o addr show dev eth0
++ awk '$3 == "inet" {print $4}'
docker_network=172.20.0.2/16
++ awk '$3 == "inet6" {print $4; exit}'
++ ip -o addr show dev eth0
docker6_network=
++ date -Iseconds
echo '[2021-10-30T10:43:29+00:00] Enabling connection to secure interfaces'
[[ -n 172.20.0.2/16 ]]
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
[2021-10-30T10:43:29+00:00] Enabling connection to secure interfaces
iptables -A INPUT -i lo -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i lo -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -o tap+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A OUTPUT -o nordlynx+ -j ACCEPT
iptables -t nat -A POSTROUTING -o tap+ -j MASQUERADE
iptables -t nat -A POSTROUTING -o tun+ -j MASQUERADE
iptables -t nat -A POSTROUTING -o nordlynx+ -j MASQUERADE
[[ -n '' ]]
++ date -Iseconds
echo '[2021-10-30T10:43:29+00:00] Enabling connection to nordvpn group'
[[ -n 172.20.0.2/16 ]]
iptables -A OUTPUT -m owner --gid-owner nordvpn -j ACCEPT
[2021-10-30T10:43:29+00:00] Enabling connection to nordvpn group
[[ -n '' ]]
++ date -Iseconds
[2021-10-30T10:43:29+00:00] Enabling connection to docker network
echo '[2021-10-30T10:43:29+00:00] Enabling connection to docker network'
[[ -n 172.20.0.2/16 ]]
iptables -A INPUT -s 172.20.0.2/16 -j ACCEPT
iptables -A FORWARD -d 172.20.0.2/16 -j ACCEPT
iptables -A FORWARD -s 172.20.0.2/16 -j ACCEPT
iptables -A OUTPUT -d 172.20.0.2/16 -j ACCEPT
[[ -n '' ]]
[[ -n 172.20.0.2/16 ]]
[[ -n 0.0.0.0/0 ]]
++ ip route
++ awk '/default/ {print $3}'
[2021-10-30T10:43:29+00:00] Enabling connection to network 0.0.0.0/0
gw=172.20.0.1
for net in ${NETWORK//[;,]/ }
++ date -Iseconds
echo '[2021-10-30T10:43:29+00:00] Enabling connection to network 0.0.0.0/0'
ip route
grep -q 0.0.0.0/0
ip route add to 0.0.0.0/0 via 172.20.0.1 dev eth0
RTNETLINK answers: File exists
iptables -A INPUT -s 0.0.0.0/0 -j ACCEPT
iptables -A FORWARD -d 0.0.0.0/0 -j ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -j ACCEPT
iptables -A OUTPUT -d 0.0.0.0/0 -j ACCEPT
[[ -n '' ]]
[[ -n '' ]]
mkdir -p /dev/net
[[ -c /dev/net/tun ]]
mknod -m 0666 /dev/net/tun c 10 200
restart_daemon
[2021-10-30T10:43:29+00:00] Restarting the service
++ date -Iseconds
echo '[2021-10-30T10:43:29+00:00] Restarting the service'
service nordvpn stop
rm -rf /run/nordvpn/nordvpnd.sock
service nordvpn start
++ date -Iseconds
[2021-10-30T10:43:29+00:00] Waiting for the service to start
echo '[2021-10-30T10:43:29+00:00] Waiting for the service to start'
attempt_counter=0
max_attempts=50
'[' -S /run/nordvpn/nordvpnd.sock ']'
'[' 0 -eq 50 ']'
attempt_counter=1
sleep 0.1
'[' -S /run/nordvpn/nordvpnd.sock ']'
[[ -z Trux8822! ]]
++ date -Iseconds
echo '[2021-10-30T10:43:29+00:00] Logging in'
nordvpn logout
[2021-10-30T10:43:29+00:00] Logging in
nordvpn login --username --password ''
Welcome to NordVPN! You can now connect to VPN by using 'nordvpn connect'.
++ date -Iseconds
++ nordvpn -version
echo '[2021-10-30T10:43:30+00:00] Setting up NordVPN Version 3.10.0'
[2021-10-30T10:43:30+00:00] Setting up NordVPN Version 3.10.0
[[ -n '' ]]
[[ -n '' ]]
[[ -n '' ]]
[[ -n '' ]]
[[ -n '' ]]
[[ -n '' ]]
[[ -n NordLynx ]]
nordvpn set technology NordLynx
Technology is successfully set to 'NordLynx'.
[[ -n 172.20.0.2/16 ]]
nordvpn whitelist add subnet 172.20.0.2/16
Subnet 172.20.0.0/16 is whitelisted successfully.
[[ -n 0.0.0.0/0 ]]
for net in ${NETWORK//[;,]/ }
nordvpn whitelist add subnet 0.0.0.0/0
Subnet 0.0.0.0/0 is whitelisted successfully.
[[ -n '' ]]
[[ -n 8085 ]]
for port in ${PORTS//[;,]/ }
nordvpn whitelist add port 8085
Port 8085 (UDP|TCP) is whitelisted successfully.
[[ -n '' ]]
[[ -n trace ]]
nordvpn settings
Technology: NordLynx
Firewall: enabled
Kill Switch: disabled
CyberSec: disabled
Notify: disabled
Auto-connect: disabled
IPv6: disabled
DNS: disabled
Whitelisted ports:
8085 (UDP|TCP)
Whitelisted subnets:
172.20.0.0/16
0.0.0.0/0
connect
++ date -Iseconds
echo '[2021-10-30T10:43:30+00:00] Connecting...'
[2021-10-30T10:43:30+00:00] Connecting...
attempt_counter=0
max_attempts=15
nordvpn connect Ukraine
Connecting to Ukraine using as a proxy #60 (ua60.nordvpn.com)
You are connected to Ukraine using as a proxy #60 (ua60.nordvpn.com)!
trap cleanup SIGTERM SIGINT EXIT
[[ -n '' ]]
true
sleep 300
[[ -n trace ]]
tail -n 1 -f /var/log/nordvpn/daemon.log
Additional context
Dockerfile:

FROM arm64v8/ubuntu:latest
EXPOSE 8085

RUN apt-get update
RUN apt-get install -y wget
RUN apt-get install -y unzip
RUN mkdir -p /opt/hlsp
VOLUME [ "/opt/hlsp" ]
COPY index.sh .
ENTRYPOINT [ "./index.sh" ]

And index.sh

#!/bin/sh
echo '------ DOWNLOADING HLS PROXY -------'
wget https://www.hls-proxy.com/downloads/8.0.0-beta.15/hls-proxy-8.0.0-beta.15.linux-arm64.zip -O /var/tmp/hlsproxy.zip
echo '------ UNZIP HLS PROXY -------'
mkdir -p /var/tmp/hlsp/
unzip -o /var/tmp/hlsproxy.zip -d /var/tmp/hlsp/
cp /var/tmp/hlsp/* /opt/hlsp
echo '------ CLEAN UP TEMP -------'
rm -rf /var/tmp/hlsp/
rm -rf /var/tmp/hlsproxy.zip
echo '------ CHMOD HLS PROXY -------'
chmod +x /opt/hlsp/hls-proxy
echo '------ ALLOW HLS PROXY ON EVERY INTERFACE -------'
/opt/hlsp/hls-proxy -address 0.0.0.0 -port 8085 -save -quit
echo '------ SERVE HLS PROXY -------'
/opt/hlsp/hls-proxy

stephaje · 2021-11-01T03:09:53Z

stephaje
Nov 1, 2021

Just want to confirm that I am seeing the same issue. I have tried 0.0.0.0/0, <my client external public IP>/32, and <my client external public IP>/24 all without luck. It works on my local network with 192.168.1.0/24 as expected.

IP=72.XXX.XXX.0/24
docker stop vpn
docker rm vpn
docker run -ti -p 8080:8080 --cap-add=NET_ADMIN --name vpn -e USER=<> -e PASS=<> -e TECHNOLOGY=NordLynx -e NETWORK=$IP -e PORTS=8080 --restart unless-stopped -d ghcr.io/bubuntux/nordvpn

0 replies

dhrysh · 2021-11-02T13:29:25Z

dhrysh
Nov 2, 2021
Author

@stephaje
I solved it with nginx proxy. You can also do same.
But I'm not going to close this issue, maybe it will be fixed

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Can't acces web of containers outside local network #278

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Uh oh!

Can't acces web of containers outside local network #278

Uh oh!

dhrysh Oct 30, 2021

Replies: 2 comments

Uh oh!

Uh oh!

stephaje Nov 1, 2021

Uh oh!

Uh oh!

dhrysh Nov 2, 2021 Author

dhrysh
Oct 30, 2021

stephaje
Nov 1, 2021

dhrysh
Nov 2, 2021
Author