欢迎光临
我的个人博客网站

在CentOS 7 上为docker配置端口转发以兼容firewall

在CentOS 7上当我们以类似下列命令将主机端口与容器端口映射时可能遇到无法访问容器服务的问题

docker run --name web_a -p 192.168.1.250:803:80 -d web_a:beta1.0.0 .

由于docker在执行此命令时,是向iptables注入了一条规则将主机803映射到容器80端口,但是CentOS 7中以firewalld服务替代了iptables。因此,上述命令的端口映射不会生效。

解决方法:首先观察一下主机上的网卡信息,确认增加了一个docker0的虚拟网卡:

[root@localhost /home]# ifconfig docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500         inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255         inet6 fe80::42:5cff:fe0e:82f9  prefixlen 64  scopeid 0x20<link>         ether 02:42:5c:0e:82:f9  txqueuelen 0  (Ethernet)         RX packets 1288  bytes 1561177 (1.4 MiB)         RX errors 0  dropped 0  overruns 0  frame 0         TX packets 1594  bytes 108755 (106.2 KiB)         TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0  enp2s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500         inet 192.168.1.250  netmask 255.255.255.0  broadcast 192.168.1.255         inet6 fe80::76f4:9aea:4973:ec6c  prefixlen 64  scopeid 0x20<link>         inet6 240e:379:542:2800:8844:77ba:78dd:7  prefixlen 128  scopeid 0x0<global>         inet6 240e:379:542:2811:3ead:218:ba68:38e6  prefixlen 64  scopeid 0x0<global>         ether 74:d4:35:09:93:19  txqueuelen 1000  (Ethernet)         RX packets 10166908  bytes 1221399579 (1.1 GiB)         RX errors 0  dropped 3014  overruns 0  frame 0         TX packets 982334  bytes 427296782 (407.5 MiB)         TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0         device interrupt 18  lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536         inet 127.0.0.1  netmask 255.0.0.0         inet6 ::1  prefixlen 128  scopeid 0x10<host>         loop  txqueuelen 1000  (Local Loopback)         RX packets 1833650  bytes 450567722 (429.6 MiB)         RX errors 0  dropped 0  overruns 0  frame 0         TX packets 1833650  bytes 450567722 (429.6 MiB)         TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0  vethecef228: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500         inet6 fe80::f425:f1ff:fe82:9c19  prefixlen 64  scopeid 0x20<link>         ether f6:25:f1:82:9c:19  txqueuelen 0  (Ethernet)         RX packets 234  bytes 1520113 (1.4 MiB)         RX errors 0  dropped 0  overruns 0  frame 0         TX packets 613  bytes 39809 (38.8 KiB)         TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

使用如下命令确认容器实例得到的虚拟ip:

docker inspect web_a

假设容器中的ip为172.17.0.2,接下来我们要为此IP做个NAT转发规则,并让firewalld服务处理此规则:

#主机端口请求转发到容器(容器中的服务不要监听localhost而要监听容器分配的虚拟IP或者以0.0.0.0替代) firewall-cmd --permanent --zone=public --add-masquerade 启用端口NAT转发 #将主机803端口请求转发到容器上的80端口 firewall-cmd --add-forward-port=port=803:proto=tcp:toaddr=172.17.0.2:toport=80 --permanent #重载规则 firewall-cmd --reload #列出所有规则 firewall-cmd --list-all public (active)   target: default   icmp-block-inversion: no   interfaces: enp2s0   sources:   services: ssh dhcpv6-client   ports: 3306/tcp 80/tcp 21/tcp 5000/tcp 6379/tcp 900/tcp 801/tcp 802/tcp 6000/tcp 5002/tcp 90/tcp 9092/tcp 81/tcp 803/tcp   protocols:   masquerade: yes   forward-ports: port=803:proto=tcp:toport=80:toaddr=172.17.0.2   source-ports:   icmp-blocks:   rich rules:

#重新启动docker systemctl restart docker #重新启动容器 docker start web_a

经上述操作,就能以主机IP:803访问容器上的80端口的服务,并不需要关闭firewalld(很多网上的结论是换成iptables服务,实测不需要)。

赞(0) 打赏
未经允许不得转载:张拓的天空 » 在CentOS 7 上为docker配置端口转发以兼容firewall
分享到: 更多 (0)

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址

专业的IT技术经验分享 更专业 更方便

联系我们本站主机

觉得文章有用就打赏一下文章作者

支付宝扫一扫打赏

微信扫一扫打赏