Cannot access container port published to 0.0.0.0:80 via GRE tunnel interface

General
1

Hello.

I have a container running on a host we’ll call “Origin”, and exposing 0.0.0.0:80 (among others) on a bridged network:

6c300ec343f8 traefik:v3.0.0-beta3 "/entrypoint.sh --gl…" 19 minutes ago Up 19 minutes 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 0.0.0.0:443->443/udp traefik

This works fine over localhost or the server’s public IP:

root@xxx ~ # curl 127.0.0.1
404 page not found
root@xxx ~ # curl 4.ipquail.com
78.46.xxx.yyy
root@xxx ~ # curl 78.46.xxx.yyy
404 page not found

I set up a GRE tunnel between a host we’ll call “Edge” (10.8.8.1) and “Origin” (10.8.8.2) and can ping back and forth, as well as access resources running directly on the host (outside of docker). Here’s an example curl sent to 10.8.8.2:8989, from “Edge”:

~ # nc -l 8989
GET / HTTP/1.1
Host: 10.8.8.2:8989
User-Agent: curl/7.81.0
Accept: */*

So the tunnel works, and can access resources on the other machine. It however, does not work for the above sample container running on 0.0.0.0:80 (or any other similarly bridged containers) and I never get a response. A packet capture on “Origin” shows this:

22:30:32.196236 IP 10.8.8.1.58510 > 10.8.8.2.80: Flags [S], seq 4006092923, win 64260, options [mss 1428,sackOK,TS val 3739138394 ecr 0,nop,wscale 7], length 0
22:30:32.196284 IP 10.8.8.1.58510 > 172.18.0.2.80: Flags [S], seq 4006092923, win 64260, options [mss 1428,sackOK,TS val 3739138394 ecr 0,nop,wscale 7], length 0
22:30:33.200587 IP 10.8.8.1.58510 > 10.8.8.2.80: Flags [S], seq 4006092923, win 64260, options [mss 1428,sackOK,TS val 3739139399 ecr 0,nop,wscale 7], length 0
22:30:33.200612 IP 10.8.8.1.58510 > 172.18.0.2.80: Flags [S], seq 4006092923, win 64260, options [mss 1428,sackOK,TS val 3739139399 ecr 0,nop,wscale 7], length 0
22:30:35.216574 IP 10.8.8.1.58510 > 10.8.8.2.80: Flags [S], seq 4006092923, win 64260, options [mss 1428,sackOK,TS val 3739141415 ecr 0,nop,wscale 7], length 0
22:30:35.216593 IP 10.8.8.1.58510 > 172.18.0.2.80: Flags [S], seq 4006092923, win 64260, options [mss 1428,sackOK,TS val 3739141415 ecr 0,nop,wscale 7], length 0
22:30:39.472574 IP 10.8.8.1.58510 > 10.8.8.2.80: Flags [S], seq 4006092923, win 64260, options [mss 1428,sackOK,TS val 3739145671 ecr 0,nop,wscale 7], length 0
22:30:39.472598 IP 10.8.8.1.58510 > 172.18.0.2.80: Flags [S], seq 4006092923, win 64260, options [mss 1428,sackOK,TS val 3739145671 ecr 0,nop,wscale 7], length 0

Any ideas?