Can't access bridged docker containers with LAN IP

General
1

I have previously posted on serverfault with no success: networking - Docker service unreachable on host-IP, but works on localhost - Server Fault , let me try it here:

I want to access a docker container with a published port from the host machine using the host LAN IP (not the internal container IP, not the external WAN IP). I can access the container port via localhost and can access the container with the LAN IP from other hosts. Also on the host I can access ports just fine using the LAN IP, just nothing in a container.
I don’t have this behavior on another docker host (raspberrypi), so it must be some setting on this specific docker host (Synology Diskstation), I just don’t know where and what else to check.

Host: 192.168.178.188
Docker Container: 172.17.0.2

Directly the host :white_check_mark:

  1. Starting a netcat [1] listen session:
    $ netcat -vvl -p 8182
  2. Connecting [2] to it from the same host:
$  netcat 192.168.178.188 8182
foo
  1. Receiving message from [2] with [1]
$  netcat -vvl -p 8182
foo

Also connecting to localhost 8182, or 127.0.0.1 8182 works.

From the host to docker :x:

  1. Starting a network test container:
    docker run -ti --rm -p 1180:1180 -p 11443:11443 -p 8181:8181 -e HTTP_PORT=1180 -e HTTPS_PORT=11443 wbitt/network-multitool:alpine-extra /bin/bash
  2. Checking container IP
bash-5.1# ip a s|sed -ne '/127.0.0.1/!{s/^[ \t]*inet[ \t]*\([0-9.]\+\)\/.*$/\1/p}'
172.17.0.2
  1. Starting a netcat listen session inside the container:
bash-5.1# nc -vvl -p 8181
Listening on [0.0.0.0] (family 0, port 8181)
  1. Receiving a connection via the internal docker IP :white_check_mark::
# host
$  netcat 172.17.0.2 8181
bar

# container
bash-5.1# nc -vvl -p 8181
Listening on [0.0.0.0] (family 0, port 8181)
Connection from 172.17.0.1 36172 received!
bar
  1. Receiving a connection via localhost :white_check_mark::
# host
$  netcat 127.0.0.1 8181
foobar

# container
bash-5.1# nc -vvl -p 8181
Listening on [0.0.0.0] (family 0, port 8181)
Connection from 172.17.0.1 40582 received!
foobar
  1. Receiving a connection via the local LAN IP of the host :x::
# host
$  netcat 192.168.178.188 8181

# container
bash-5.1# nc -vvl -p 8181
Listening on [0.0.0.0] (family 0, port 8181)

#host
$  nc -zv 192.168.178.188 8181
DiskStation.domain.local [192.168.178.188] 8181: Network is unreachable

$  nc -zv localhost 8181
localhost [127.0.0.1] 8181 open

I have tried starting the container with specific IP:Port mappings. i.e. -p 192.168.178.188:8181:8181 with no luck - same problem.

  1. Receiving a connection from another host in the network :white_check_mark:

I’m going to spare you the details on the last one, but same as before: connecting via netcat with the local LAN IP (192.168.178.188) works.

The problem seems to be that I can only connect to containers from the host using localhost & their internal IP - here comes the kicker: I don’t have that problem on another docker host (raspberrypi 4). I can call the same commands I showed above and everything works.

I ran tcpdump and I always receive two packets when trying to to nc 192.168.178.188 8181:

7	2.669182	192.168.178.188	172.17.0.2	TCP	76	35912 → 8181 [SYN] Seq=0 Win=43690 Len=0 MSS=65495 SACK_PERM=1 TSval=7727405 TSecr=0 WS=128
8	2.669189	192.168.178.188	172.17.0.2	TCP	76	[TCP Out-Of-Order] [TCP Port numbers reused] 35912 → 8181 [SYN] Seq=0 Win=43690 Len=0 MSS=65495 SACK_PERM=1 TSval=7727405 TSecr=0 WS=128

How can I make this docker host behave the same as the other hosts I have? Why doesn’t it like the LAN IP?

2

I could neither find nc, nor netcat in DSM6.2.x or DSM7.x. Also it seems there is no “SynoCli Tools” that provides nc or netcat. I remember that synogear might provide it and it does, just under the slightly different name ncat. I installed it with sudo synogear install, which convinenty seem to have installed tmux as well.

I used your commands from step 1 and 3, then run ncat ${lan-ip} 8181 and it works flawless.

I assume you already tried to temporarily disable the Synology Firewall during your test?

3

I installed netcat via entware / opkg. Also I tried to use netcat for testing purposes since I can easily test ports, but netcat really was just for that - testing. I could also fire up nginx with some custom ports - same result.

The Synology firewall is disabled.

4

It is not that the objective is unclear, I just picked up your test approach, but got a different outcome.

With turned off firewall, this should have worked with a container in a bridged network.

N.B.: If it would have been a macvlan, instead of a bridged network, the observation in your op in 6) and 7) would make sense.