docker - 如果不在localhost代理-> vpn上，则docker-compose端口转发不起作用

Question

我真的无法理解为什么在同一主机上一切正常，但是端口在主机外部进行了过滤(即使在同一主机上的虚拟机上也处于桥接模式)

services:
  vpn:
    build: ./openvpn
    # cap_add, security_opt, and volume required for the image to function
    cap_add:
      - net_admin
    environment:
      OPENVPN_USERNAME: 'XXXXXX'
      OPENVPN_PASSWORD: 'XXXXXXXX'
      OPENVPN_PROVIDER: 'XXXXXXXXXXX'
      OPENVPN_CONFIG: 'Amsterdam'
      SQUID_EXT_PORT: "3001"
    networks:
      - dockerproxy

    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
    read_only: true
    tmpfs:
      - /run
      - /tmp
    restart: unless-stopped
    security_opt:
      - label:disable
    stdin_open: true
    tty: true
    ports:
      - "0.0.0.0:${SQUID_EXT_PORT:-3001}:3128"
    volumes:
      - /dev/net:/dev/net:z
      - /config
  squid:
    build: ./squid
    environment:
      SQUID_VERSION: '3.5.27'
      SQUID_CACHE_DIR: '/squid/var/cache/squid'
      SQUID_LOG_DIR: '/var/log/squid'
      SQUID_USER: 'proxy'
    tty: true
    network_mode: service:vpn
    volumes:
      - /srv/docker/squid/cache:/squid/var/cache/squid
    restart: unless-stopped

networks:
  dockerproxy:
    external:
      name: dockerproxy 

我检查端口是否打开

netstat -tulpn | grep 3001
tcp6       0      0 :::3001                 :::*                    LISTEN      -   

CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                   PORTS                    NAMES
cba39f7e94dc        amsterdam_squid     "/sbin/entrypoint.sh"    9 minutes ago       Up 9 minutes                                      amsterdam_squid_1
2856f2bb2b7c        amsterdam_vpn       "/usr/local/bin/open…"   9 minutes ago       Up 9 minutes (healthy)   0.0.0.0:3001->3128/tcp   amsterdam_vpn_1

我怀疑这可能是docker daemon iptables配置，由于我对它们不太自信，所以我没有更改。

sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain /* managed by anbox-bridge */
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain /* managed by anbox-bridge */
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:bootps /* managed by anbox-bridge */
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps /* managed by anbox-bridge */

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DOCKER-USER  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             /* managed by anbox-bridge */
ACCEPT     all  --  anywhere             anywhere             /* managed by anbox-bridge */
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (3 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             172.28.0.2           tcp dpt:3128

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-ISOLATION-STAGE-2 (3 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere  

没有人能比我找到在同一主机上进行代理的原因:

nmap localhost -p 3001

Starting Nmap 7.60 ( https://nmap.org ) at 2020-01-10 17:06 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00023s latency).

PORT     STATE SERVICE
3001/tcp open  nessus

Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds

但不能从另一个主机

map 192.168.1.14 -p 3001
Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-10 10:54 EST
Nmap scan report for 192.168.1.14
Host is up (0.00076s latency).

PORT     STATE    SERVICE
3001/tcp filtered nessus

Nmap done: 1 IP address (1 host up) scanned in 0.26 seconds

我之前从未注意到过这种行为，并且我始终能够访问同一台机器上的所有docker服务，但该代理vpn除外。

Answer 1

问题在于VPN容器并不真正了解托管它的网络。

换句话说，为了使此功能起作用，您必须在VPN容器中添加一条路由(该路由由于network_mode: service:vpn指令而将单独用于网络连接)到发送答复数据包的位置(通常是Docker主机网关)。否则，您的数据包将被简单地丢弃，通常从该数据包进入nmap filtered状态。奇怪的是，数据包甚至无法到达您的鱿鱼服务器，因此该部分将没有日志。这使我离开了很长一段时间，但是实际上数据包没有到达鱿鱼服务器这一事实正在发生，所以我想我是唯一被误导的人。

添加允许您的数据包返回的路由的有效方法是:

/sbin/ip r a "${localNet}" via "${GW}" dev "${INT}"

我从很棒的Docker应用程序中学到的
https://github.com/haugene/docker-transmission-openvpn
您可以在上面的脚本行中找到变量的含义。