Hey,
You might want to consider either address type or specific ip address:
iptables -t nat -I PREROUTING -i docker0 -p tcp -m tcp --dport 9999 -m addrtype --dst-type LOCAL -j DNAT --to-destination 127.0.0.1:18888
or
iptables -t nat -I PREROUTING -d 172.17.0.1 -j DNAT --to-destination 172.17.0.1:18888
or
iptables -t nat -I PREROUTING -I docker0 -j DNAT --to-port 18888
I am not sure if a DNAT to 127.0.0.1 should work from another interface like dokcer0 to lo.
All The Bests,
----
Eliezer Croitoru
Tech Support
Mobile: +972-5-28704261
Email: ngtech1ltd@xxxxxxxxx
-----Original Message-----
From: Hongyi Zhao <hongyi.zhao@xxxxxxxxx>
Sent: Tuesday, November 3, 2020 4:31 AM
To: netfilter@xxxxxxxxxxxxxxx
Subject: Use the socks5 proxy sever running in the host network from the docker container.
Hi,
On Ubuntu 20.04, I use docker with its default bridge network mode shown as following:
$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: enp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 3c:ec:ef:00:f1:28 brd ff:ff:ff:ff:ff:ff
inet 192.168.0.5/24 brd 192.168.0.255 scope global dynamic enp4s0
valid_lft 7014sec preferred_lft 7014sec
inet6 fe80::3eec:efff:fe00:f128/64 scope link
valid_lft forever preferred_lft forever
3: enp5s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 3c:ec:ef:00:f1:29 brd ff:ff:ff:ff:ff:ff
4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:e6:d5:4e:82 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:e6ff:fed5:4e82/64 scope link
valid_lft forever preferred_lft forever
And I've a socks5 proxy 127.0.0.1:18888 running on the host network. I want to use this proxy server in a docker container. So I try to add the following iptables rule on the host:
$ sudo iptables -t nat -I PREROUTING -i docker0 -p tcp -m tcp --dport
9999 -j DNAT --to-destination 127.0.0.1:18888
Also I've enabled the following option:
$ sysctl -a |& grep net.ipv4.conf.all.route_localnet net.ipv4.conf.all.route_localnet = 1
Then I do the testings from a docker container and on the host, but both of them failed, see following for more info:
On the host:
werner@X10DAi-01:~$ curl -vIx socks5h://172.17.0.1:9999 www.baidu.com
* Trying 172.17.0.1:9999...
* TCP_NODELAY set
* connect to 172.17.0.1 port 9999 failed: Connection refused
* Failed to connect to 172.17.0.1 port 9999: Connection refused
* Closing connection 0
curl: (7) Failed to connect to 172.17.0.1 port 9999: Connection refused
In a docker container:
root@in-dev-docker:/apollo# curl -vIx socks5h://172.17.0.1:9999 www.baidu.com
* Rebuilt URL to: www.baidu.com/
* Trying 172.17.0.1...
* TCP_NODELAY set
* connect to 172.17.0.1 port 9999 failed: Connection refused
* Failed to connect to 172.17.0.1 port 9999: Connection refused
* Closing connection 0
curl: (7) Failed to connect to 172.17.0.1 port 9999: Connection refused
Any hints for this problem will be highly appreciated.
Reards,
--
Assoc. Prof. Hongyi Zhao <hongyi.zhao@xxxxxxxxx> Theory and Simulation of Materials Hebei Polytechnic Vocational and Technical University NO. 552 North Gangtie Road, Xingtai, China
