Port forwarding #39

Luicosas · 2024-09-21T07:09:15Z

Luicosas
Sep 21, 2024

I'm setting up a wg-easy container and the docker-compose.yml works when I use podman-compose up -d, but when I converted it to a docker-compose.nix with compose2nix the port forwarding breaks. I'm port forwarding port 51821 so I can go to localhost:51821 to configure wg-easy. I speculate that the firewall isn't allowing systemd services to be port forwarded because they run as root. When I run sudo su, then run podman-compose up -d the same issue appears (can't connect to localhost:51821).

Does compose2nix require any changes to networking / firewall settings? I think I'm missing something obvious.

Here is my docker-compose.yml file:

name: 
  wg-easy
services:
  wg-easy:
    environment:
      - LANG=en
      - WG_HOST=luilab.ddns.net
      - WG_ALLOWED_IPS=10.8.1.0/24
      - WG_DEFAULT_DNS=
      - WG_PERSISTENT_KEEPALIVE=25
      - WG_DEFAULT_ADDRESS=10.8.0.x
      - PORT=51821
      - WG_PORT=51820
    image: ghcr.io/wg-easy/wg-easy
    container_name: wg-easy
    volumes:
      - /nixos-data/wg-easy-data:/etc/wireguard
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
      - NET_RAW # Uncomment if using Podman
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
    networks:
      internal-net:
        ipv4_address: 10.8.1.1
networks: 
  internal-net: 
    internal: true
    driver: bridge
    ipam: 
      config: 
        - subnet: 10.8.1.0/24
          gateway: 10.8.1.0

Answered by Luicosas

Sep 22, 2024

Oh I see, thanks, the workaround worked! got my remote backup working and checked that it can't access the internet. Sorry about not checking the podman discussions first, I thought it was a compose2nix specific issue 😅.

Posting my final working compose in case anyone else stumbles on this thread.

name: 
  wg-easy
services:
  wg-easy:
    environment:
      - LANG=en
      - WG_HOST=<some-domain-name>
      - WG_ALLOWED_IPS=10.8.1.0/24
      - WG_DEFAULT_DNS=
      - WG_PERSISTENT_KEEPALIVE=25
      - WG_DEFAULT_ADDRESS=10.8.0.x
      - PORT=51821
      - WG_PORT=51820
    image: ghcr.io/wg-easy/wg-easy
    container_name: wg-easy
    volumes:
      - /nixos-data/wg-easy-data:/etc/wiregua…

View full answer

aksiksi · 2024-09-21T13:37:15Z

aksiksi
Sep 21, 2024
Maintainer

That’s strange. This seems firewall related, but that shouldn’t have any impact if accessing the ports locally…

Can you try limiting the ports to localhost? Like this:

"127.0.0.1:51820:51820/tcp"

Also, if possible, could you share the output of sudo iptables --list for the working and non-working cases?

8 replies

aksiksi Sep 22, 2024
Maintainer

I think the problem are the gateway and internal options you've set on the network. Any reason why you're setting these? The wg-easy sample does not have these set.

I was able to reproduce this using the nginx container:

$ sudo podman network create internal-net --driver=bridge --subnet=10.8.1.0/24 --gateway=10.8.1.0 --internal
$ sudo podman run -it --name=nginx -p 12345:80 --rm --network internal-net docker.io/library/nginx

Cannot connect from host:

$ curl 127.0.0.1:12345

But I can connect inside the container (no internet access from within though):

$ sudo podman exec -it nginx curl 127.0.0.1:80
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

But without gateway and internal set, you can connect from the host:

$ sudo podman network create internal-net --driver=bridge --subnet=10.8.1.0/24

Luicosas Sep 22, 2024
Author

I originally set internal: true because I wanted to isolate the container from interacting with the internet, the intention was to create a local docker network to put other containers in so I can wireguard into the network and backup my stuff / interact with other services I run on a old laptop. I thought it would be more secure that way, though I its only a minor concern, I'll probably just turn that setting off for now. Thanks for the help!

aksiksi Sep 22, 2024
Maintainer

I see. There might be a workaround for that: containers/podman#21451

There are a ton of questions on this topic on the Podman repo.

Luicosas Sep 22, 2024
Author

Oh I see, thanks, the workaround worked! got my remote backup working and checked that it can't access the internet. Sorry about not checking the podman discussions first, I thought it was a compose2nix specific issue 😅.

Posting my final working compose in case anyone else stumbles on this thread.

name: 
  wg-easy
services:
  wg-easy:
    environment:
      - LANG=en
      - WG_HOST=<some-domain-name>
      - WG_ALLOWED_IPS=10.8.1.0/24
      - WG_DEFAULT_DNS=
      - WG_PERSISTENT_KEEPALIVE=25
      - WG_DEFAULT_ADDRESS=10.8.0.x
      - PORT=51821
      - WG_PORT=51820
    image: ghcr.io/wg-easy/wg-easy
    container_name: wg-easy
    volumes:
      - /nixos-data/wg-easy-data:/etc/wireguard
    ports:
      - "51820:51820/udp"
      - "127.0.0.1:51821:51821/tcp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
      - NET_RAW # Uncomment if using Podman
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
    networks:
      internal-net:
        ipv4_address: 10.8.1.1
networks: 
  internal-net: 
    driver: bridge
    driver_opts: 
      no_default_route: 1
    ipam: 
      config: 
        - subnet: 10.8.1.0/24
          gateway: 10.8.1.0

Only --internal seems to affect networking and setting gateway is fine. Earlier gateway was being set to one of the ips allocated to the container and that made the networking go wonky.

Answer selected by aksiksi

aksiksi Sep 22, 2024
Maintainer

Nice! Thanks for sharing the config.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Port forwarding #39

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 1 comment 8 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

Select a reply

Port forwarding #39

Luicosas Sep 21, 2024

Replies: 1 comment · 8 replies

aksiksi Sep 21, 2024 Maintainer

aksiksi Sep 22, 2024 Maintainer

Luicosas Sep 22, 2024 Author

aksiksi Sep 22, 2024 Maintainer

Luicosas Sep 22, 2024 Author

aksiksi Sep 22, 2024 Maintainer

Luicosas
Sep 21, 2024

Replies: 1 comment 8 replies

aksiksi
Sep 21, 2024
Maintainer

aksiksi Sep 22, 2024
Maintainer

Luicosas Sep 22, 2024
Author

aksiksi Sep 22, 2024
Maintainer

Luicosas Sep 22, 2024
Author

aksiksi Sep 22, 2024
Maintainer