Reaching another host on LAN from container

Traefik Traefik v3 (latest)
1

Hello gang I have a quite annoying but simple problem, I want my container to be able to access my LAN. It is possible to curl the machine when I use network_mode: host but due to traefik it isnt really feasible. I have not been able to get it to work without it set :confused:
I use nftables, and have tried to accept all without any success either.
I’m using ubuntu.

services:
    client:
        image: nginx
        labels:
        - "traefik.enable=true"
        - "traefik.http.routers.https.rule=Host(`website`)"
        - "traefik.http.routers.https.entrypoints=websecure"
        - "traefik.http.routers.https.tls=true"
        - "traefik.http.routers.https.tls.certresolver=myresolver"
        ports:
            - 8080:80
        volumes:
            - ./html:/usr/share/nginx/html
            - ./default.conf:/etc/nginx/conf.d/default.conf:ro
        networks:
          - traefik
        restart: unless-stopped
networks:
  traefik:
    external: true```
2

By default, any Docker container has access to the network.

What are you trying to achieve?

3

My main goal is for a docker container handled by traefik to be able to perform internal requests to another machine on the LAN.

I’ll give some more description:

I have 2 machines A and B

Machine A 10.10.10.10 runs nginx via docker
Machine B 10.10.10.20 runs an arbitray http service on 8080

I want the nginx container to be able to connect to 10.10.10.20:8080

From my understand and experience per default containers are not able to connect to another machine on the LAN unless network_mode:host is enabled. I’m able to make the connection work

I’ve heard about:
extra_hosts: - "host.docker.internal:host-gateway"

But my understanding is that only gets me to localhost of the host machine.

4

The target service/container needs to publish the port, which should be reachable. Or you use network_mode: host to automatically have all open ports of the container on the host. Or you attach all services/containers to a common Docker Swarm network.

And for Traefik to proxy/forward requests to a different host, you should use loadbalancer.servers.url, like in the example (doc). Or use Docker Swarm and providers.swarm to automatically configure targets by labels.

5

Machine B is not using docker, just a simple API so I don’t think this applies

And for Traefik to proxy/forward requests to a different host, you should use loadbalancer.servers.url, like in the example (doc). Or use Docker Swarm and providers.swarm to automatically configure targets by labels.

But this sounds promising, I’ll dig through this today, thanks!

6

You’re missing a lot of the important concepts of docker networking.

First, it’s so much easier to just dockerize _everything! If machine B’s http service was a docker container, nginx would just connect to it directly.

Second, your understanding about network_mode: host is incorrect. There are two ways to put the container on the local network, and you (and almost everyone!) want macvlan.

In a compose file, you would define your VLAN:

networks:
vlan: # Reference to the network used in docker compose files
name:vlan # A user visible name of the network
driver:macvlan # Use the macvlan network driver
driver_opts:
parent:enp0s31f6
ipam:
config:
- gateway:10.10.10.1 # Gateway address
subnet:10.10.10.0/24 # Specify subnet
ip_range: 10.10.10.0/29 # 10.10.10.2-10.10.10.7

Modify gateway if that’s not where your gateway is, parent is the interface name of the container’s host, and ip_range is any range on your LAN that is not being assigned by your DHCP server).

Now, in the configuration for nginx, set networks:

networks: 
- vlan

Now, your nginx has an address on your LAN.

extra_hosts only works with docker-desktop, so I have no understanding of it, but I thought it should give you access to the whole LAN.

7

I’m sorry about the formatting, but this site does not preserve whitespace in code examples!

8

Thank you for the answer, I really appreciate it! The macvlan solution sounds like the perfect thing. Is it possible to keep my traefik network and append a vlan network using macvlan or is there somehting else I should keep in mind?

Im still having trouble understanding how the service on machine B would be accessible if it was a docker container since my current problem is that I’m not even able to route from the container on machine A.

9

It does, just use 3 backticks or select text and choose </>.

no spacing
  some  more    spacing
10

I tried both of those (and it’s pretty clear on the page, that I have), and then kept adding more and more spaces to the beginning of the line parent:enp0s31f6 and it still keeps trying to align it under driver_opts

11

Doh! Of course, you need the traefik network. networks is a list, just add your traefik network under - vlan

12

Thank you, it worked like a charm, and my docker networking understanding has gotten a little better thanks to you two.

13

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.