# Docker swarm timeout gateway

**URL:** <https://forums.docker.com/t/docker-swarm-timeout-gateway/147767>\
**Category:** General\
**Tags:** swarm\
**Created:** [April 19, 2025, 10:05am UTC](https://forums.docker.com/t/docker-swarm-timeout-gateway/147767 "2025-04-19T10:05:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vicnos999](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/vicnos999/32/58821_2.png) [@vicnos999](https://forums.docker.com/u/vicnos999)\
**Post date:** [April 19, 2025, 10:05am UTC](https://forums.docker.com/t/docker-swarm-timeout-gateway/147767/1 "2025-04-19T10:05:29Z")

</div>

Hi guys I would appreciate your help.  
I have this scenario:  
VMWARE:

- Two VMs

- Docker Swarm

- Firewall

PROBLEM: Grafana web UI not accesible from traefik container on the manager: curl 192.168.10.1:3000, nor from outside.  
GATEWAY TIMEOUT, 502  
IMPORTANT: from traefik container we can ping grafana container, but we can’t reach the service, curl grafana\_container\_ip:3000.

Anyone have a clue of what is happening? I’ve also tried disabling ufw but I still have the error  
Thanks in advance

---

<div class="post-metadata">

**Author:** ![meyay](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/meyay/32/34000_2.png) [@meyay](https://forums.docker.com/u/meyay)\
**Post date:** [April 19, 2025, 11:23am UTC](https://forums.docker.com/t/docker-swarm-timeout-gateway/147767/2 "2025-04-19T11:23:18Z")

</div>

If the overlay traffic is not working, usually those are the suspects:

- Firewall needs following ports to be open on all nodes:
  - Port 2377 TCP for communication with and between manager nodes
  - Port 7946 TCP/UDP for overlay network node discovery
  - Port 4789 UDP (configurable) for overlay network traffic

- The mtu size is not identical on all nodes
  - `ip addr show scope global | grep mtu`

- The nodes don’t share a low latency network connection
- Nodes are running in vms on VMware vSphere with NSX
  - Outgoing traffic to port 4789 UDP is silently dropped as it conflicts with VMware NSX’s communication port for VXLAN
  - Re-create the swarm with a different data-port:
    - `docker swarm init --data-path-port=7789`

- Problems with checksum offloading
  - Disable checksum offloading for the network interface (eth0 is a placeholder):
  - `ethtool -K eth0 tx-checksum-ip-generic off`

---

<div class="post-metadata">

**Author:** ![vicnos999](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/vicnos999/32/58821_2.png) [@vicnos999](https://forums.docker.com/u/vicnos999)\
**Post date:** [April 19, 2025, 7:04pm UTC](https://forums.docker.com/t/docker-swarm-timeout-gateway/147767/3 "2025-04-19T19:04:46Z")

</div>

HI Meyay,

- We’ve rules to allow all that ports in manager and work nodes.
- I’ve checked mtu but is the same size
- We don’t use vSphere, vms are running on the **same ESXi host**

I think the main problem is in layer 4 since **we can ping** grafana container (worker node) from traefik container (manager node). They share same overlay network (traefik-network). But we **can’t curl IP:3000**

---

<div class="post-metadata">

**Author:** ![vicnos999](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/vicnos999/32/58821_2.png) [@vicnos999](https://forums.docker.com/u/vicnos999)\
**Post date:** [April 21, 2025, 2:51pm UTC](https://forums.docker.com/t/docker-swarm-timeout-gateway/147767/4 "2025-04-21T14:51:48Z")

</div>

Update: finally the ethtool -K eth0 tx-checksum-ip-generic off solved the problem, thanks a lot!

---

<div class="post-metadata">

**Author:** ![meyay](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/meyay/32/34000_2.png) [@meyay](https://forums.docker.com/u/meyay)\
**Post date:** [April 21, 2025, 3:13pm UTC](https://forums.docker.com/t/docker-swarm-timeout-gateway/147767/5 "2025-04-21T15:13:18Z")

</div>

To be honest, it’s a forums effort.

I just shared a text template where I gathered all the root causes and solution related to swarm networking. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/docker/original/3X/d/4/d4fbccd46c81bfcffe9822e20e17736d946fa821.png) [@system](https://forums.docker.com/u/system)\
**Post date:** [May 21, 2025, 3:13pm UTC](https://forums.docker.com/t/docker-swarm-timeout-gateway/147767/6 "2025-05-21T15:13:40Z")

</div>

Closed on May 21, 2025, 3:13pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.