[SOLVED] Docker breaks my Proxmox access

[citgot]

I’m running Proxmox and a VM with a minimal debian OS. Everything worked fine until I installed docker and Portainer. Well, docker, Portainer and my containers work fine. But now my Proxmox is not accessable, not by GUI and not by SSH.
I’ve read that docker could break the bridge as it uses iptables but the suggested fixes I’ve tried don’t work for me. I’m also afraid that all non-working fixes will break something.

is there someone who had the same problem with debian VM on a Proxmox setup who can guide me on how to solve it (not just disable iptables)?

 

[oguz]

hi,

do i understand correctly that you installed docker on the PVE host? this isn't recommended or supported.

if you've installed docker/portainer on the VM it shouldn't interfere with the host networking.

Well, docker, Portainer and my containers work fine. But now my Proxmox is not accessable, not by GUI and not by SSH.

are you able to reach the containers? if so maybe you can connect to your PVE host through a container

 

[citgot]

Sorry, I was a bit unclear. Docker is installed on a Debian VM running only docker/portainer and two containers.

I can reach the containers and they work as they should. The PVE-host is not reachable through GUI or SSH. The host has a static IP from my router and when attaching a display directly to my server on which the PVE-host Proxmox is installed bare metal I can confirm that the host is running as before the docker installation. It got an IP address and I can use CLI commands and login.

Before installing docker the same Debian VM was running but with no problem to reach the PVE-host. So all points to docker in the VM is screwing something up for the host.

I’ve tried to change the IP for the docker bridge but that resulted in nothing. Same problem. I also tried some other fixes for the forwarding of IPs that I found online but that just broke docker and I had the revert all changes.

So I’m out of ideas. I’ll try to reach the host through the containers tonight, but I’m unsure what that would tell me.

 

[oguz]

The PVE-host is not reachable through GUI or SSH.

unreachable how exactly? do you get a time out? do you get connection refused? does it just hang? can you provide some details?

It got an IP address and I can use CLI commands and login.

* does it have internet connectivity?
* can you ping the PVE host?


installing docker in a VM normally won't interfere with the host networking (as the bridge is created in the VM).

if you need help then you need to tell us more about your network configuration, like the contents /etc/network/interfaces from your PVE host.
output of command ip a and maybe ip r .

 

[citgot]

unreachable how exactly? do you get a time out? do you get connection refused? does it just hang? can you provide some details?


* does it have internet connectivity?
* can you ping the PVE host?

sorry about the lack of details. I just don’t know what is important to share.

I get timed out when trying to connect to the PVE host GUI or SSH.

The host has internet connectivity. I can ping web addresses and I can ping different devices in my network. The host can ping itself.

I can’t however ping the host from any other device.

if you need help then you need to tell us more about your network configuration, like the contents /etc/network/interfaces from your PVE host.

output of command ip a and maybe ip r

I attach an image showing the output for ip a, ip r.

The contents of /etc/networks and /etc/network/interfaces is also attached in pictures

If I can provide some more info please just let me know.

One of the fixes I’ve tried is: Link but that only made the docker not to restart as it logged errors on stop sequence.

 

[oguz]

I get timed out when trying to connect to the PVE host GUI or SSH.

The host has internet connectivity. I can ping web addresses and I can ping different devices in my network. The host can ping itself.

can you post the output of ss -antlp? you should be seeing the port 8006 and port 22 open under normal circumstances.

you can also try checking with nmap: nmap -p22,8006 your.pve.host.ip and see if the ports are open/closed/filtered

if the ports aren't open, then you should check the systemctl output from the host and see if any services are in failed state. if they are please check journalctl

 

[citgot]

can you post the output of ss -antlp? you should be seeing the port 8006 and port 22 open under normal circumstances.

you can also try checking with nmap: nmap -p22,8006 your.pve.host.ip and see if the ports are open/closed/filtered

if the ports aren't open, then you should check the systemctl output from the host and see if any services are in failed state. if they are please check journalctl

Thanks for all the help.

ss -antlp output is in the attached file. So is output of nmap -p22,8006

systemctl shows no failed state services

 

[oguz]

can you try running the nmap scan from the computer you're trying to connect to the server from?

if the services are running and nothing is failing, then it might be a networking problem. is there anything between your computer and the PVE host, like a firewall?

 

[citgot]

Well, this is embarrassing. When installing and configuring Proxmox I disabled the pve-firewall as it blocked the GUI. The host and VMs worked like that until I installed docker. Now I find the pve-firewall is back up and it once again blocked access to the host.

As I had pve-firewall disabled I just focused on my main firewall and made sure that it wouldn’t block access. But somehow pve-firewall was back up. I let it run now with an open port 8006 so I can access GUI.
Does the docker install activate the pve-firewall? It activates on pve host reboot now, it didn’t before docker.

I’m sorry for wasting mine and your time with this. My bad. Thanks for your help, at least I learned something.

 

[oguz]

Does the docker install activate the pve-firewall? It activates on pve host reboot now, it didn’t before docker.

no, it doesn't activate it (just tested here on clean installation). i'm not sure what caused it in your case.

I’m sorry for wasting mine and your time with this. My bad. Thanks for your help, at least I learned something.

no worries, you're welcome. you can mark the thread as [SOLVED] by editing the thread title prefix