Partially obstructed communication when publishing Docker container on different host port The Next CEO of Stack Overflowconnecting from docker container to docker hostHow to handle an abuse complaint?OpenVPN Access Server: Remote Subnet Cannot Access Client's ResourcesNginx rewrite on docker machine when host port != container portHowto expose port in docker containerHow to ACCEPT multicast connection with iptables's rule?Docker container crashing ubuntu hostWhy packets to hosts in local network going via gatewayopenvpn: can't manage to control client-to-client connections with iptablesDocker bridge to host communication
calculus parametric curve length
Why does the UK parliament need a vote on the political declaration?
Preparing Indesign booklet with .psd graphics for print
What happened in Rome, when the western empire "fell"?
Rotate a column
Is micro rebar a better way to reinforce concrete than rebar?
How do I go from 300 unfinished/half written blog posts, to published posts?
What flight has the highest ratio of time difference to flight time?
Different harmonic changes implied by a simple descending scale
Complex fractions
If a black hole is created from light, can this black hole then move at speed of light?
Indicator light circuit
Is it possible to search for a directory/file combination?
Won the lottery - how do I keep the money?
Written every which way
SQL Server 2016 - excessive memory grant warning on poor performing query
Is "for causing autism in X" grammatical?
What is ( CFMCC ) on ILS approach chart?
What is the result of assigning to std::vector<T>::begin()?
Example of a Mathematician/Physicist whose Other Publications during their PhD eclipsed their PhD Thesis
Is there an analogue of projective spaces for proper schemes?
Do I need to enable Dev Hub in my PROD Org?
Is there a way to save my career from absolute disaster?
Unreliable Magic - Is it worth it?
Partially obstructed communication when publishing Docker container on different host port
The Next CEO of Stack Overflowconnecting from docker container to docker hostHow to handle an abuse complaint?OpenVPN Access Server: Remote Subnet Cannot Access Client's ResourcesNginx rewrite on docker machine when host port != container portHowto expose port in docker containerHow to ACCEPT multicast connection with iptables's rule?Docker container crashing ubuntu hostWhy packets to hosts in local network going via gatewayopenvpn: can't manage to control client-to-client connections with iptablesDocker bridge to host communication
2
I have a game server running inside a Docker container that listens on UDP port 1111 (EXPOSE 1111/udp). When I publish this server on the same port on the host (-p 1111:1111/udp) everything works as expected.
Symptoms
When I publish it on a different host port (-p 2222:1111/udp) it starts behaving erratically:
The server responds to queries as expected (this is done over the exact same port used to join the server);
The server does not respond when trying to join it. None of the packets actually reach the server program (they do appear to be routed to the container correctly, see traffic logs below). This is confirmed by the fact that there are no connection attempts logged on the server.
NAT
Here are the POSTROUTING and DOCKER chains from the iptables NAT table as set by Docker:
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.0.0/16 0.0.0.0/0
POSTROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
POSTROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
POSTROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
MASQUERADE udp -- 172.17.0.2 172.17.0.2 udp dpt:1111
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
DNAT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:2222 to:172.17.0.2:1111
Traffic Analysis
Analyzing traffic flow by adding a LOG rule to the FORWARD chain in iptables shows expected results when querying the server (request comes in, response goes out):
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=39 TOS=0x08 PREC=0x40 TTL=116 ID=24686 PROTO=UDP SPT=56333 DPT=1111 LEN=19
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=43 TOS=0x08 PREC=0x40 TTL=116 ID=24687 PROTO=UDP SPT=56333 DPT=1111 LEN=23
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=111 TOS=0x00 PREC=0x00 TTL=63 ID=9115 DF PROTO=UDP SPT=1111 DPT=56333 LEN=91
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=43 TOS=0x00 PREC=0x00 TTL=63 ID=9116 DF PROTO=UDP SPT=1111 DPT=56333 LEN=23
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=39 TOS=0x08 PREC=0x40 TTL=116 ID=24688 PROTO=UDP SPT=56333 DPT=1111 LEN=19
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=39 TOS=0x08 PREC=0x40 TTL=116 ID=24689 PROTO=UDP SPT=56333 DPT=1111 LEN=19
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=41 TOS=0x00 PREC=0x00 TTL=63 ID=9119 DF PROTO=UDP SPT=1111 DPT=56333 LEN=21
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=145 TOS=0x00 PREC=0x00 TTL=63 ID=9120 DF PROTO=UDP SPT=1111 DPT=56333 LEN=125
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=43 TOS=0x08 PREC=0x40 TTL=116 ID=24690 PROTO=UDP SPT=56333 DPT=1111 LEN=23
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=43 TOS=0x00 PREC=0x00 TTL=63 ID=9121 DF PROTO=UDP SPT=1111 DPT=56333 LEN=23
This is what happens when I actually try to join the server, the incoming packets appear to be routed correctly but there's no response whatsoever:
Mar 29 00:24:26 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24694 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:27 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24696 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:28 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24698 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:29 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24700 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:30 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24702 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:31 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24704 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:32 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24706 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:33 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24708 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:34 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24710 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:35 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24712 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:36 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24714 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:37 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24716 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:38 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24718 PROTO=UDP SPT=63688 DPT=1111 LEN=12
Mar 29 00:24:39 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24720 PROTO=UDP SPT=63688 DPT=1111 LEN=12
Environment
The machine is running Fedora Server 29. iptables is controlled by firewalld.
Docker:
Client:
Version: 1.13.1
API version: 1.26
Package version: docker-1.13.1-66.git1185cfd.fc29.x86_64
Go version: go1.11.5
Git commit: 1185cfd/1.13.1
Built: Mon Mar 18 13:59:32 2019
OS/Arch: linux/amd64
Server:
Version: 1.13.1
API version: 1.26 (minimum version 1.12)
Package version: docker-1.13.1-66.git1185cfd.fc29.x86_64
Go version: go1.11.5
Git commit: 1185cfd/1.13.1
Built: Mon Mar 18 13:59:32 2019
OS/Arch: linux/amd64
Experimental: false
Given the above traffic logs it seems that the packets do reach the container, but not the actual server program when I try to join it. As far as I know there's nothing inside the container that can block packets. I am completely clueless at this point.
- What type of issue could I possibly be looking at here?
- How should I proceed to troubleshoot the issue?
Maybe a bit far-fetched, but could packet size have anything to do with it? It's the only substantial difference I can see between the two logs, and well, I have kind of run out of ideas.
routing docker port-forwarding udp
asked 2 days ago
ThomasThomas
112
migrated from unix.stackexchange.com yesterday
This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems.
add a comment |
2
I have a game server running inside a Docker container that listens on UDP port 1111 (EXPOSE 1111/udp). When I publish this server on the same port on the host (-p 1111:1111/udp) everything works as expected.
Symptoms
When I publish it on a different host port (-p 2222:1111/udp) it starts behaving erratically:
The server responds to queries as expected (this is done over the exact same port used to join the server);
The server does not respond when trying to join it. None of the packets actually reach the server program (they do appear to be routed to the container correctly, see traffic logs below). This is confirmed by the fact that there are no connection attempts logged on the server.
NAT
Here are the POSTROUTING and DOCKER chains from the iptables NAT table as set by Docker:
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.0.0/16 0.0.0.0/0
POSTROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
POSTROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
POSTROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
MASQUERADE udp -- 172.17.0.2 172.17.0.2 udp dpt:1111
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
DNAT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:2222 to:172.17.0.2:1111
Traffic Analysis
Analyzing traffic flow by adding a LOG rule to the FORWARD chain in iptables shows expected results when querying the server (request comes in, response goes out):
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=39 TOS=0x08 PREC=0x40 TTL=116 ID=24686 PROTO=UDP SPT=56333 DPT=1111 LEN=19
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=43 TOS=0x08 PREC=0x40 TTL=116 ID=24687 PROTO=UDP SPT=56333 DPT=1111 LEN=23
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=111 TOS=0x00 PREC=0x00 TTL=63 ID=9115 DF PROTO=UDP SPT=1111 DPT=56333 LEN=91
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=43 TOS=0x00 PREC=0x00 TTL=63 ID=9116 DF PROTO=UDP SPT=1111 DPT=56333 LEN=23
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=39 TOS=0x08 PREC=0x40 TTL=116 ID=24688 PROTO=UDP SPT=56333 DPT=1111 LEN=19
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=39 TOS=0x08 PREC=0x40 TTL=116 ID=24689 PROTO=UDP SPT=56333 DPT=1111 LEN=19
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=41 TOS=0x00 PREC=0x00 TTL=63 ID=9119 DF PROTO=UDP SPT=1111 DPT=56333 LEN=21
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=145 TOS=0x00 PREC=0x00 TTL=63 ID=9120 DF PROTO=UDP SPT=1111 DPT=56333 LEN=125
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=43 TOS=0x08 PREC=0x40 TTL=116 ID=24690 PROTO=UDP SPT=56333 DPT=1111 LEN=23
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=43 TOS=0x00 PREC=0x00 TTL=63 ID=9121 DF PROTO=UDP SPT=1111 DPT=56333 LEN=23
This is what happens when I actually try to join the server, the incoming packets appear to be routed correctly but there's no response whatsoever:
Mar 29 00:24:26 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24694 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:27 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24696 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:28 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24698 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:29 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24700 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:30 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24702 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:31 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24704 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:32 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24706 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:33 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24708 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:34 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24710 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:35 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24712 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:36 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24714 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:37 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24716 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:38 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24718 PROTO=UDP SPT=63688 DPT=1111 LEN=12
Mar 29 00:24:39 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24720 PROTO=UDP SPT=63688 DPT=1111 LEN=12
Environment
The machine is running Fedora Server 29. iptables is controlled by firewalld.
Docker:
Client:
Version: 1.13.1
API version: 1.26
Package version: docker-1.13.1-66.git1185cfd.fc29.x86_64
Go version: go1.11.5
Git commit: 1185cfd/1.13.1
Built: Mon Mar 18 13:59:32 2019
OS/Arch: linux/amd64
Server:
Version: 1.13.1
API version: 1.26 (minimum version 1.12)
Package version: docker-1.13.1-66.git1185cfd.fc29.x86_64
Go version: go1.11.5
Git commit: 1185cfd/1.13.1
Built: Mon Mar 18 13:59:32 2019
OS/Arch: linux/amd64
Experimental: false
Given the above traffic logs it seems that the packets do reach the container, but not the actual server program when I try to join it. As far as I know there's nothing inside the container that can block packets. I am completely clueless at this point.
- What type of issue could I possibly be looking at here?
- How should I proceed to troubleshoot the issue?
Maybe a bit far-fetched, but could packet size have anything to do with it? It's the only substantial difference I can see between the two logs, and well, I have kind of run out of ideas.
routing docker port-forwarding udp
asked 2 days ago
ThomasThomas
112
migrated from unix.stackexchange.com yesterday
This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems.
add a comment |
2
2
2
I have a game server running inside a Docker container that listens on UDP port 1111 (EXPOSE 1111/udp). When I publish this server on the same port on the host (-p 1111:1111/udp) everything works as expected.
Symptoms
When I publish it on a different host port (-p 2222:1111/udp) it starts behaving erratically:
The server responds to queries as expected (this is done over the exact same port used to join the server);
The server does not respond when trying to join it. None of the packets actually reach the server program (they do appear to be routed to the container correctly, see traffic logs below). This is confirmed by the fact that there are no connection attempts logged on the server.
NAT
Here are the POSTROUTING and DOCKER chains from the iptables NAT table as set by Docker:
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.0.0/16 0.0.0.0/0
POSTROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
POSTROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
POSTROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
MASQUERADE udp -- 172.17.0.2 172.17.0.2 udp dpt:1111
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
DNAT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:2222 to:172.17.0.2:1111
Traffic Analysis
Analyzing traffic flow by adding a LOG rule to the FORWARD chain in iptables shows expected results when querying the server (request comes in, response goes out):
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=39 TOS=0x08 PREC=0x40 TTL=116 ID=24686 PROTO=UDP SPT=56333 DPT=1111 LEN=19
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=43 TOS=0x08 PREC=0x40 TTL=116 ID=24687 PROTO=UDP SPT=56333 DPT=1111 LEN=23
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=111 TOS=0x00 PREC=0x00 TTL=63 ID=9115 DF PROTO=UDP SPT=1111 DPT=56333 LEN=91
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=43 TOS=0x00 PREC=0x00 TTL=63 ID=9116 DF PROTO=UDP SPT=1111 DPT=56333 LEN=23
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=39 TOS=0x08 PREC=0x40 TTL=116 ID=24688 PROTO=UDP SPT=56333 DPT=1111 LEN=19
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=39 TOS=0x08 PREC=0x40 TTL=116 ID=24689 PROTO=UDP SPT=56333 DPT=1111 LEN=19
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=41 TOS=0x00 PREC=0x00 TTL=63 ID=9119 DF PROTO=UDP SPT=1111 DPT=56333 LEN=21
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=145 TOS=0x00 PREC=0x00 TTL=63 ID=9120 DF PROTO=UDP SPT=1111 DPT=56333 LEN=125
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=43 TOS=0x08 PREC=0x40 TTL=116 ID=24690 PROTO=UDP SPT=56333 DPT=1111 LEN=23
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=43 TOS=0x00 PREC=0x00 TTL=63 ID=9121 DF PROTO=UDP SPT=1111 DPT=56333 LEN=23
This is what happens when I actually try to join the server, the incoming packets appear to be routed correctly but there's no response whatsoever:
Mar 29 00:24:26 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24694 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:27 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24696 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:28 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24698 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:29 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24700 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:30 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24702 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:31 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24704 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:32 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24706 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:33 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24708 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:34 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24710 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:35 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24712 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:36 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24714 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:37 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24716 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:38 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24718 PROTO=UDP SPT=63688 DPT=1111 LEN=12
Mar 29 00:24:39 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24720 PROTO=UDP SPT=63688 DPT=1111 LEN=12
Environment
The machine is running Fedora Server 29. iptables is controlled by firewalld.
Docker:
Client:
Version: 1.13.1
API version: 1.26
Package version: docker-1.13.1-66.git1185cfd.fc29.x86_64
Go version: go1.11.5
Git commit: 1185cfd/1.13.1
Built: Mon Mar 18 13:59:32 2019
OS/Arch: linux/amd64
Server:
Version: 1.13.1
API version: 1.26 (minimum version 1.12)
Package version: docker-1.13.1-66.git1185cfd.fc29.x86_64
Go version: go1.11.5
Git commit: 1185cfd/1.13.1
Built: Mon Mar 18 13:59:32 2019
OS/Arch: linux/amd64
Experimental: false
Given the above traffic logs it seems that the packets do reach the container, but not the actual server program when I try to join it. As far as I know there's nothing inside the container that can block packets. I am completely clueless at this point.
- What type of issue could I possibly be looking at here?
- How should I proceed to troubleshoot the issue?
Maybe a bit far-fetched, but could packet size have anything to do with it? It's the only substantial difference I can see between the two logs, and well, I have kind of run out of ideas.
routing docker port-forwarding udp
asked 2 days ago
ThomasThomas
112
I have a game server running inside a Docker container that listens on UDP port 1111 (EXPOSE 1111/udp). When I publish this server on the same port on the host (-p 1111:1111/udp) everything works as expected.
Symptoms
When I publish it on a different host port (-p 2222:1111/udp) it starts behaving erratically:
The server responds to queries as expected (this is done over the exact same port used to join the server);
The server does not respond when trying to join it. None of the packets actually reach the server program (they do appear to be routed to the container correctly, see traffic logs below). This is confirmed by the fact that there are no connection attempts logged on the server.
NAT
Here are the POSTROUTING and DOCKER chains from the iptables NAT table as set by Docker:
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.0.0/16 0.0.0.0/0
POSTROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
POSTROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
POSTROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
MASQUERADE udp -- 172.17.0.2 172.17.0.2 udp dpt:1111
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
DNAT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:2222 to:172.17.0.2:1111
Traffic Analysis
Analyzing traffic flow by adding a LOG rule to the FORWARD chain in iptables shows expected results when querying the server (request comes in, response goes out):
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=39 TOS=0x08 PREC=0x40 TTL=116 ID=24686 PROTO=UDP SPT=56333 DPT=1111 LEN=19
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=43 TOS=0x08 PREC=0x40 TTL=116 ID=24687 PROTO=UDP SPT=56333 DPT=1111 LEN=23
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=111 TOS=0x00 PREC=0x00 TTL=63 ID=9115 DF PROTO=UDP SPT=1111 DPT=56333 LEN=91
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=43 TOS=0x00 PREC=0x00 TTL=63 ID=9116 DF PROTO=UDP SPT=1111 DPT=56333 LEN=23
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=39 TOS=0x08 PREC=0x40 TTL=116 ID=24688 PROTO=UDP SPT=56333 DPT=1111 LEN=19
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=39 TOS=0x08 PREC=0x40 TTL=116 ID=24689 PROTO=UDP SPT=56333 DPT=1111 LEN=19
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=41 TOS=0x00 PREC=0x00 TTL=63 ID=9119 DF PROTO=UDP SPT=1111 DPT=56333 LEN=21
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=145 TOS=0x00 PREC=0x00 TTL=63 ID=9120 DF PROTO=UDP SPT=1111 DPT=56333 LEN=125
Mar 29 00:24:08 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=43 TOS=0x08 PREC=0x40 TTL=116 ID=24690 PROTO=UDP SPT=56333 DPT=1111 LEN=23
Mar 29 00:24:08 hostname kernel: udp connection: IN=docker0 OUT=ens3 PHYSIN=veth3d1a8aa MAC=removed SRC=172.17.0.2 DST=my_ip LEN=43 TOS=0x00 PREC=0x00 TTL=63 ID=9121 DF PROTO=UDP SPT=1111 DPT=56333 LEN=23
This is what happens when I actually try to join the server, the incoming packets appear to be routed correctly but there's no response whatsoever:
Mar 29 00:24:26 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24694 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:27 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24696 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:28 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24698 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:29 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24700 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:30 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24702 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:31 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24704 PROTO=UDP SPT=63682 DPT=1111 LEN=12
Mar 29 00:24:32 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24706 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:33 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24708 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:34 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24710 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:35 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24712 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:36 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24714 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:37 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24716 PROTO=UDP SPT=63685 DPT=1111 LEN=12
Mar 29 00:24:38 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24718 PROTO=UDP SPT=63688 DPT=1111 LEN=12
Mar 29 00:24:39 hostname kernel: udp connection: IN=ens3 OUT=docker0 MAC=removed2 SRC=my_ip DST=172.17.0.2 LEN=32 TOS=0x08 PREC=0x40 TTL=116 ID=24720 PROTO=UDP SPT=63688 DPT=1111 LEN=12
Environment
The machine is running Fedora Server 29. iptables is controlled by firewalld.
Docker:
Client:
Version: 1.13.1
API version: 1.26
Package version: docker-1.13.1-66.git1185cfd.fc29.x86_64
Go version: go1.11.5
Git commit: 1185cfd/1.13.1
Built: Mon Mar 18 13:59:32 2019
OS/Arch: linux/amd64
Server:
Version: 1.13.1
API version: 1.26 (minimum version 1.12)
Package version: docker-1.13.1-66.git1185cfd.fc29.x86_64
Go version: go1.11.5
Git commit: 1185cfd/1.13.1
Built: Mon Mar 18 13:59:32 2019
OS/Arch: linux/amd64
Experimental: false
Given the above traffic logs it seems that the packets do reach the container, but not the actual server program when I try to join it. As far as I know there's nothing inside the container that can block packets. I am completely clueless at this point.
- What type of issue could I possibly be looking at here?
- How should I proceed to troubleshoot the issue?
Maybe a bit far-fetched, but could packet size have anything to do with it? It's the only substantial difference I can see between the two logs, and well, I have kind of run out of ideas.
routing docker port-forwarding udp
routing docker port-forwarding udp
asked 2 days ago
ThomasThomas
112
asked 2 days ago
ThomasThomas
112
edited 48 mins ago
Thomas
asked 2 days ago
ThomasThomas
112
asked 2 days ago
ThomasThomas
112
asked 2 days ago
ThomasThomas
112
112
migrated from unix.stackexchange.com yesterday
This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems.
migrated from unix.stackexchange.com yesterday
This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems.
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f960503%2fpartially-obstructed-communication-when-publishing-docker-container-on-different%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
draft saved
draft discarded
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f960503%2fpartially-obstructed-communication-when-publishing-docker-container-on-different%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
