Hi all, I've a network related issue.
On ProxMox VE 6.1-8 I have several containers, all based on debian 10.3.
All containers are connected via two bridges:
- vmbr0 connected to the physical ethernet port enp0s8 for outside connection, with address 192.168.1.210/24;
- vmbr1 internal to all containers; all addresses are 192.168.10.0/24.
CT100 is a mailserver with a MariaDB instance for user's credentials and a webserver with roudcube; MariaDB has been configured to listen on ALL addresses without ssl (just for a container to container communication). The nmap gives these results:
So MariaDB ports are listening on ALL interfaces (of course also on 127.0.0.1 - dovecot and postfix can query for user's credentials).
CT105 is a "tool" container, with tools for internal administrative use, like phpmyadmin, with following interfaces:
- eth0 : 192.168.1.152/24
- eth1 : 192.168.10.12/24
Well, the issue: When issuing nmap from this container against the CT100 container, here is the result:
As you notice the port 3306 appears to be closed!
As a proof I created a third container, CT107 called "test", where I installed another MariaDB instance and configured as the instance at CT100 and the port 3306 are correctly open and reacheable from the CT105.
If the port 3306 appeared to be closed also nmap-ping from CT100 I'd supposed something wrong on MariaDB instance, but the 3306 is open locally but appears to be closed when querying from other containers! So I'm thinking something related to ProxMox.
One more thing: Firewall has been disabled on the containers, all containers are unpriviledged, I tried to clone the CT100 container without any result (port 3306 open when queried locally, closed when queried from other containers); I'd like to avoid to rebuild the CT100 from scratch due to long configuration time, and I prefers to understands what's happening before simply redo the job, with the risk to have the same issue.
Any help is strongly appreciated to understand what's happening.
Francesco
On ProxMox VE 6.1-8 I have several containers, all based on debian 10.3.
All containers are connected via two bridges:
- vmbr0 connected to the physical ethernet port enp0s8 for outside connection, with address 192.168.1.210/24;
- vmbr1 internal to all containers; all addresses are 192.168.10.0/24.
CT100 is a mailserver with a MariaDB instance for user's credentials and a webserver with roudcube; MariaDB has been configured to listen on ALL addresses without ssl (just for a container to container communication). The nmap gives these results:
Code:
# nmap -sT 192.168.1.150
Starting Nmap 7.70 ( https://nmap.org ) at 2020-03-21 08:58 CET
Nmap scan report for mail.mydomain.ch (192.168.1.150)
Host is up (0.00014s latency).
Not shown: 992 closed ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
80/tcp open http
143/tcp open imap
443/tcp open https
587/tcp open submission
993/tcp open imaps
3306/tcp open mysql
# nmap -sT 192.168.10.13
Starting Nmap 7.70 ( https://nmap.org ) at 2020-03-21 08:59 CET
Nmap scan report for 192.168.10.13
Host is up (0.00014s latency).
Not shown: 992 closed ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
80/tcp open http
143/tcp open imap
443/tcp open https
587/tcp open submission
993/tcp open imaps
3306/tcp open mysqlSo MariaDB ports are listening on ALL interfaces (of course also on 127.0.0.1 - dovecot and postfix can query for user's credentials).
CT105 is a "tool" container, with tools for internal administrative use, like phpmyadmin, with following interfaces:
- eth0 : 192.168.1.152/24
- eth1 : 192.168.10.12/24
Well, the issue: When issuing nmap from this container against the CT100 container, here is the result:
Code:
# nmap -sT 192.168.1.150
Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-21 09:04 CET
Nmap scan report for 192.168.1.150
Host is up (0.00018s latency).
Not shown: 993 closed ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
80/tcp open http
143/tcp open imap
443/tcp open https
587/tcp open submission
993/tcp open imaps
MAC Address: 96:75:B8:D9:37:7B (Unknown)
# nmap -sT 192.168.10.13
Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-21 09:04 CET
Nmap scan report for 192.168.10.13
Host is up (0.00015s latency).
Not shown: 993 closed ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
80/tcp open http
143/tcp open imap
443/tcp open https
587/tcp open submission
993/tcp open imaps
MAC Address: 42:8C:59:BB:7B:49 (Unknown)As you notice the port 3306 appears to be closed!
As a proof I created a third container, CT107 called "test", where I installed another MariaDB instance and configured as the instance at CT100 and the port 3306 are correctly open and reacheable from the CT105.
If the port 3306 appeared to be closed also nmap-ping from CT100 I'd supposed something wrong on MariaDB instance, but the 3306 is open locally but appears to be closed when querying from other containers! So I'm thinking something related to ProxMox.
One more thing: Firewall has been disabled on the containers, all containers are unpriviledged, I tried to clone the CT100 container without any result (port 3306 open when queried locally, closed when queried from other containers); I'd like to avoid to rebuild the CT100 from scratch due to long configuration time, and I prefers to understands what's happening before simply redo the job, with the risk to have the same issue.
Any help is strongly appreciated to understand what's happening.
Francesco
