Mar 17, 2019 16:31
Maybe i will even find a way later to avoid per-container rules and utilize --network host advantage for this and append the answer
Mar 17, 2019 16:28
17.0.3 is vpn-client container IP
Mar 17, 2019 16:28
Maybe you should update the answer with rules above. They will be very useful to someone, i uess
Mar 17, 2019 16:27
yes
Mar 17, 2019 16:26
Thank you very much. You made that day:)
Mar 17, 2019 16:26
I cannot believe this man, i spent day on this
Mar 17, 2019 16:25
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE


iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 9000 -j DNAT --to-destination 172.17.0.2

iptables -t nat -A POSTROUTING -p tcp -d 172.17.0.2 --dport 9000 -j SNAT --to-source 172.17.0.3

iptables -A FORWARD -m state -p tcp -d 172.17.0.2 --dport 9000 --state NEW,ESTABLISHED,RELATED -j ACCEPT
Mar 17, 2019 16:25
AAAAHH! Worked!!!
Mar 17, 2019 16:24
doing test
Mar 17, 2019 16:20
Containers must be isolated from vpn stuff, they are ephemeral thing
Mar 17, 2019 16:19
vpn-client container IP instead of vpn subnet IP, ill try changing rules to this
Mar 17, 2019 16:17
Oops, a typo in port. I only use 9000, but does not changes tht outcome:(
Mar 17, 2019 16:16
But thanks for the link!
Mar 17, 2019 16:15
it kinda mirrors the PREROUTING
Mar 17, 2019 16:15
Unfortunately, the POSTROUTING rule did not help. I used this one
```iptables -t nat -A POSTROUTING -p tcp -d 172.17.0.2 --dport 80 -j SNAT --to-source 10.8.0.2```
Mar 17, 2019 16:12
doing:P
Mar 17, 2019 16:09
Yeah. Do you think right?
Mar 17, 2019 16:07
I added rule intuitively

`iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 9000 -j DNAT --to-destination 172.17.0.2`

And now i have timeout, not connection refuse from other VPN client by VPN IP to port 9000.
Mar 17, 2019 16:04
I am glad there is no need to compile openvpn inside temporary container and move it to coreos just to test config. Because there are too many things missing in coreos
Mar 17, 2019 16:01
Do you know a way to forward ports so that vpn client container convert requests to port 9000 to 172.17.0.2 (portainer ip)
Mar 17, 2019 16:00
yeah, right
Mar 17, 2019 16:00
I can do "curl 172.17.0.2:9000" from both host and vpn-client-container!
Mar 17, 2019 15:59
i assume it is "0.0.0.0"
Mar 17, 2019 15:59
it runs on ":9000"
Mar 17, 2019 15:59
yes
Mar 17, 2019 15:59
Ah, inspect says it is 172.17.0.2 for portainer
Mar 17, 2019 15:58
container IP?
Mar 17, 2019 15:56
Yes, i have coreos host with two container, vpn-client and portainer with -p 9000
Mar 17, 2019 15:56
If i do curl localhost:9000 OR curl 10.8.0.2:9000 from vpn-client container, i get connection refused
Mar 17, 2019 15:52
Inside portainer - yes curl works.
Mar 17, 2019 15:52
If i do telnet 10.8.0.2 9000 from coreos, it works. Curl the same, yeah
Mar 17, 2019 15:48
About an hour ago Up 43 minutes 0.0.0.0:9000->9000/tcp portainer
Mar 17, 2019 15:47
yes
Mar 17, 2019 15:47
There is web server for portainer
Mar 17, 2019 15:46
-p 9000:9000
Mar 17, 2019 15:46
container exoposed port
Mar 17, 2019 15:46
I have access to the VPN server. Although i have reasons not to blame it since everything worked before i switched to coreos and containerized openvpn client.
Mar 17, 2019 15:44
Okay, ill try vpn client with same config just natively on top of coreos. This is going to be hard to build openvpn from source i am fraid since coreos has no package manager.
Mar 17, 2019 15:40
Thank you! Both your suggestions are correct. However, i cannot access custom TCP port 9000 from another VPN client. I get connection refused error when doing telnet 10.8.0.2 9000 (the ip of container vpn), while have iptables policy ACCEPT both in docker host and docker vpn container. Could you tell me what i can be missing? I use bridge network(default, without --network ..)
Mar 17, 2019 15:40
True! I can use my ports as localhost inside VPN container already. Will check why other VPN clients can't knock them from their side. It is surely the container trouble, not client's.
Mar 17, 2019 15:40
Let me try. I actually found chain DOCKER in container's iptables that includes my publushed ports, by the way. I don't yet understand what's this. I just used --network host alongside with --device and --cap-add.
 

Python

Room rules: sopython.com/chatroom Code formatting guide: tinyu...
Aug 17, 2015 16:36
Thanks
Jul 21, 2015 10:06
:D okay
Jul 21, 2015 09:51
oh, how can you use that shitty duck duck go? I love anonymity but it really ugly looking
 

 Python Ouroboros - The Rotating Knives

Messages from the Python room that didn't meet our standards o...
Aug 17, 2015 16:36
Hello, has anyone ever seen error when using requests.get: IncompleteRead: IncompleteRead(0 bytes read)? I don't know. stackoverflow.com/questions/32055298/…