No access between CT's over domain name.

[jsieler]

Hello everyone. My Proxmox machine has single external IP address and everything is working well, also have multiple containers installed, added iptables rules to portforward all required ports and can access my caddy/nginx page by assigned external domain name.

my home PC -> mydomain.com -> proxmox vm -> container with caddy/nginx = working well
proxmox container -> mydomain.com -> proxmox vm -> container with caddy/nginx = not working

The problem is that i can't access my container with caddy/nginx from another containers. I can do that by IP but not by doing like "wget mydomain.com". It tell me the right IP and DNS looks like to work well... but connection hangs or getting refused.

root@test: /tmp # wget https://mydomain.com
--2023-06-06 15:04:13--  https://mydomain.com/
Resolving mydomain.com (mydomain.com)... 5.5.5.5
Connecting to mydomain.com (mydomain.com)|5.5.5.5|:443...

That's part from my network/interfaces:

auto vmbr0
iface vmbr0 inet static
        address 172.16.0.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up   iptables -t nat -A POSTROUTING -s '172.16.0.0/24' -o vmbr1 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '172.16.0.0/24' -o vmbr1 -j MASQUERADE
        post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
        post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1

auto vmbr1
iface vmbr1 inet static
        address 5.5.5.X/27
        gateway 5.5.5.X
        bridge-ports enp41s0
        bridge-stp off
        bridge-fd 0
        post-up   iptables -t nat -A PREROUTING -i vmbr1 -p tcp --dport 80 -j DNAT --to-destination 172.16.0.100:80
        post-down iptables -t nat -D PREROUTING -i vmbr1 -p tcp --dport 80 -j DNAT --to-destination 172.16.0.100:80
        post-up   iptables -t nat -A PREROUTING -i vmbr1 -p tcp --dport 443 -j DNAT --to-destination 172.16.0.100:443
        post-down iptables -t nat -D PREROUTING -i vmbr1 -p tcp --dport 443 -j DNAT --to-destination 172.16.0.100:443
        post-up   iptables -t nat -A PREROUTING -i vmbr1 -p udp --dport 443 -j DNAT --to-destination 172.16.0.100:443
        post-down iptables -t nat -D PREROUTING -i vmbr1 -p udp --dport 443 -j DNAT --to-destination 172.16.0.100:443

Anything else i need to add? Thanks!

 

[jsieler]

Hm, turning node firewall off giving me following now:

root@projects: / # wget https://mydomain.com
--2023-06-06 16:49:36--  https://mydomain.com/
Resolving mydomain.com (mydomain.com)... 5.5.5.5
Connecting to mydomain.com (mydomain.com)|5.5.5.5|:443... failed: Connection refused.

What I'm missing?

 

[baolinhtb]

I also have the same problem, does anyone have a solution?

Thanks!!