Port Forwarding into Docker Containers not working

sokratz

I'm having an odd issue and I can't tell if it's on the Docker networking side or the PFense side.. I have two working NATs setup (plex and a web server) that were just simple to setup. However, when I try to port forward into a docker container I can't seem to get it to work.

External DNS is working fine and dandy to my WAN IP

Setup looks a little bit like this:
Synology DiskStation listening on 5051 for DSM - works great internal or external via Port Forwarding. Internal IP is 192.168.0.144:5051.

Plex Server running on windows host using 32400 - works great internal or external via Port Forwarding. Internal IP is 192.168.0.245:32400

Docker container running on Synology. Publishing port 192.168.0.144:32003 to internal container port 8989 - Works fine internally but can't get any NAT response.

Docker bridge network is 172.17.0.0/16 and this container is running on 172.17.0.4

My guess is there's something to do with the response back from the docker container that I don't have configured right?

Any tips?

Thanks much!

johnpoz

@sokratz said in Port Forwarding into Docker Containers not working:

192.168.0.144:32003

Are you forwarding to that port?

Your docker network would have nothing to do with anything.

sokratz

Yah. I'm forwarding to 32003. I've setup a variety of containers and none seem reachable. I can see the rules get hit on the pfsense side as well.

johnpoz

Well look to your containers then..

If pfsense sends the traffic to the IP and port - there is nothing else it can do..

Can your containers talk to the internet?

sokratz

omg... synology firewall...

hours and hours of waste.

#Facepalm.

johnpoz

@sokratz said in Port Forwarding into Docker Containers not working:

#Facepalm.

That is pretty much the fix for every single port forward issue I have seen here in 10+ years.. It always comes down to pebkac ;)

sokratz

@johnpoz lol. sometimes you just need to post the question to think critically about something. maybe someone will get lucky and see this. That Syno firewall has tripped me up a whole slew of times. Thanks for placating me ;)

johnpoz

I have no problems helping users find where the issue is.. And yup - posting questions and having someone ask questions in return can quite often spark some insight to what was overlooked.

That is why the best thing when having such issues is to follow the traffic.. Sniffing will tell you instantly where the problem is.

A sniff showing pfsense sending the traffic to where you forwarded would get you looking to why there was no answer, etc.

Glad you got it sorted.

dragoangel

@johnpoz then please check this topic https://forum.netgate.com/topic/159354/pfsense-2-5-0-a-20201127-0650-nat-issues/1 and you will get fresh new expirience