I’m running docker container using below command and this container’s host is in the internal private network.
docker run --restart always --name srs2 -d -p 1935:1935 -p 1985:1985 -p 8080:8080 -p 8000:8000/udp -p 10080:10080/udp ossrs/srs:5
I need to access container’s 8080 port from the external hosts and i’ve set port forwarding in my router config page as 28080:8080. With this setup i expect i can access container using 28080 port but this not even allows me to start tcp handshake(SYN packet is not reaching).
I should mention that it is possible to access other ports(not in the container) of host without any issue. So there is no issue on port forwarding setup. Also it is possible that accessing container from other hosts in the same private network but not external.
The below is the output of docker inspect
"NetworkSettings": {
"Bridge": "",
"SandboxID": "59c04190dbc0ee6f24b8e48a3e3e4ac927995c35ebb00bdef057b4ab0887d025",
"SandboxKey": "/var/run/docker/netns/59c04190dbc0",
"Ports": {
"10080/udp": [
{
"HostIp": "0.0.0.0",
"HostPort": "10080"
},
{
"HostIp": "::",
"HostPort": "10080"
}
],
"1935/tcp": [
{
"HostIp": "0.0.0.0",
"HostPort": "1935"
},
{
"HostIp": "::",
"HostPort": "1935"
}
],
"1985/tcp": [
{
"HostIp": "0.0.0.0",
"HostPort": "1985"
},
{
"HostIp": "::",
"HostPort": "1985"
}
],
"5060/tcp": null,
"8000/udp": [
{
"HostIp": "0.0.0.0",
"HostPort": "8000"
},
{
"HostIp": "::",
"HostPort": "8000"
}
],
"8080/tcp": [
{
"HostIp": "0.0.0.0",
"HostPort": "8080"
},
{
"HostIp": "::",
"HostPort": "8080"
}
],
"9000/tcp": null
}
This is the output of ss -ao sport :8080 which ensures the port is listening.
❯ ss -ao sport :8080
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
tcp LISTEN 0 4096 0.0.0.0:http-alt 0.0.0.0:*
tcp LISTEN 0 4096 [::]:http-alt [::]:*
And there is no firewall on my machine, The below one is the output of iptables --list-rules
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p udp -m udp --dport 10080 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8080 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p udp -m udp --dport 8000 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 1985 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 1935 -j ACCEPT
-A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
Added docker version output
❯ docker version
Client: Docker Engine - Community
Version: 26.1.2
API version: 1.45
Go version: go1.21.10
Git commit: 211e74b
Built: Wed May 8 13:59:58 2024
OS/Arch: linux/arm64
Context: default
Server: Docker Engine - Community
Engine:
Version: 26.1.2
API version: 1.45 (minimum version 1.24)
Go version: go1.21.10
Git commit: ef1912d
Built: Wed May 8 13:59:58 2024
OS/Arch: linux/arm64
Experimental: false
containerd:
Version: 1.6.31
GitCommit: e377cd56a71523140ca6ae87e30244719194a521
runc:
Version: 1.1.12
GitCommit: v1.1.12-0-g51d5e94
docker-init:
Version: 0.19.0
GitCommit: de40ad0
I’m glad it was not complicated as I expected