我只能从 localhost 访问 Docker 容器

Question

I have Docker installed on a VPS but unfortunately I can't access the containers from other machines. I also have WireGuard running on 10.210.1.1 on the VPS. With docker run -d --name apache-server -p 8080:80 httpd I created the Apache2 container.

I can access http://10.210.1.1:8080 from the localhost with curl, but not from other machines. Services that have BareMetal installed can also be reached under the IP, so the problem should be with Docker.

Maybe it is also due to my nftables config:

define pub_iface = eth0
define wg_iface = wg0
define wg_port = 51821

table inet basic-filter {
        chain input {
                type filter hook input priority 0; policy drop;
                ct state { established, related } accept
                iif lo accept
                ip protocol icmp accept
                ip6 nexthdr ipv6-icmp accept
                meta l4proto ipv6-icmp accept
                iif $pub_iface tcp dport 51829 accept
                iif $pub_iface udp dport $wg_port accept
                iifname $wg_iface accept
                ct state invalid drop
                reject
        }
        chain forward {
                type filter hook forward priority 0; policy drop;
                ct state { established, related } accept
                iifname $wg_iface oifname $wg_iface accept
                iifname $wg_iface oifname $pub_iface accept
                ct state invalid drop
                reject with icmpx type host-unreachable
        }
        chain postrouting {
                type nat hook postrouting priority 100; policy accept;
                iifname $wg_iface oifname $pub_iface masquerade
        }
}

I don't know but I surely have a mistake somewhere.

Answer 1

the following entry was missing in the forward chain:

iifname "wg0" oifname "docker0" accept

sorry