Docker Service Only Accessible from Localhost and not Host's LAN IP

General
1

I have a machine running Ubuntu Server and Docker.

I have a container that shares its network stack with a VPN container. All ports (seem) to be appropriately published.

When attempting to access a service provided by the container (located at port 8080) via the host machine’s LAN IP, the request times out. When using localhost, however, the request works just fine.

I have verified all firewalls are turned off, and iptables also seem fine:

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER (6 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             172.18.0.2           tcp dpt:8920
ACCEPT     tcp  --  anywhere             172.18.0.2           tcp dpt:8096
ACCEPT     udp  --  anywhere             172.18.0.2           udp dpt:7359
ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:9443
ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:8000
ACCEPT     udp  --  anywhere             172.18.0.2           udp dpt:1900
ACCEPT     tcp  --  anywhere             172.29.0.2           tcp dpt:http-alt
ACCEPT     tcp  --  anywhere             172.20.0.3           tcp dpt:https
ACCEPT     tcp  --  anywhere             172.29.0.5           tcp dpt:6789
ACCEPT     tcp  --  anywhere             172.29.1.1           tcp dpt:https
ACCEPT     tcp  --  anywhere             172.29.1.1           tcp dpt:81
ACCEPT     tcp  --  anywhere             172.29.1.1           tcp dpt:http
ACCEPT     tcp  --  anywhere             172.29.0.6           tcp dpt:8989
ACCEPT     tcp  --  anywhere             172.29.0.8           tcp dpt:6767
ACCEPT     tcp  --  anywhere             172.29.0.3           tcp dpt:http-alt
ACCEPT     tcp  --  anywhere             172.29.0.3           tcp dpt:6881
ACCEPT     udp  --  anywhere             172.29.0.3           udp dpt:6881
ACCEPT     tcp  --  anywhere             172.29.0.4           tcp dpt:9117
ACCEPT     tcp  --  anywhere             172.29.0.7           tcp dpt:7878

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-ISOLATION-STAGE-2 (6 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

The container in question is located at 172.29.0.3 and port 8080 (httpalt) seems to be opened.

Below is the ifconfig entry for the LAN interface on my host:

eno1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.27  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::1a03:73ff:feb6:dc44  prefixlen 64  scopeid 0x20<link>
        ether 18:03:73:b6:dc:44  txqueuelen 1000  (Ethernet)
        RX packets 650854  bytes 613465621 (613.4 MB)
        RX errors 0  dropped 5  overruns 0  frame 0
        TX packets 525503  bytes 462771766 (462.7 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 20  memory 0xe1800000-e1820000

Any help is appreciated, thanks!

2

Have you tried with another container that doesn’t connect to the VPN container?