Hitting resources in a private network from within a Docker container using VPN

Question

I'm running Docker 1.9.1 on OSX, and I'm connected to my private work network with Cisco AnyConnect VPN. A service that I'm running in a Docker container connects to a DB within the work network, and is unreachable from within the container, but reachable from outside the container in OSX. It's also reachable from within the container if I'm connected directly to the work network, not through VPN. I suspect I may have to do some network configuration with the docker-machine VM, but I'm not sure where to go from here.

Answer 1

If you are using Virtualbox as your hypervisor for the docker-machines, I suggest you set your network mode as Bridged Adapter . This way your VM will be connected to the network individually just like your own machine. Also to gather more information for troubleshooting try pinging the db host machine from the container machine command line. use docker exec -it <container-name> /bin/bash

Answer 2

Check your routing inside the Docker Machine VM with

docker-machine ssh default
$ route -n

which looks like this on a fresh machine:

docker@default:~$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.0.2.2 0.0.0.0 UG 1 0 0 eth0 10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 127.0.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 lo 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0 192.168.99.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1

If you've created a lot of networks, ie by using docker-compose it might have created routes to stacks, which conflict with your VPN or local network routes.

docker@dev15:~$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.0.2.2 0.0.0.0 UG 1 0 0 eth0 10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 127.0.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 lo 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0 172.18.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-7400365dbd39 172.25.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-4db568a601b4 [...] 192.168.80.0 0.0.0.0 255.255.240.0 U 0 0 0 br-97690a1b4313 192.168.105.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1

TL;dr

It should be safe to remove all networks, with

docker network rm $(docker network ls -q)

since active networks are not removed by default ... but nonetheless be careful when running rm commands :)

Answer 3

I ran into this problem today and got AnyConnect to work without the need for split tunneling or a different VPN client like OpenConnect. All it took was a bit of port forwarding.

My Setup

• MacOS Sierra 10.12
• VirtualBox 5.0.26
• Docker ToolBox 1.12.2
• docker-vpn-helper script located at https://gist.github.com/philpodlevsky/040b44b2f8cee750ecc308271cb8d1ab

Instructions

1. The above software configuration was utilized when tested.

2. Make sure you don't have any VMs running and you are disconnected from the VPN.

3. Modify line 47 to either specify your insecure registry or delete the "--engine-insecure-registry :5000" parameter.

4. Execute the following in a shell on your Mac:

sudo launchctl unload /System/Library/LaunchDaemons/org.ntp.ntpd.plist

Workaround for MacOS Sierra. For some reason having NTP enabled causes the docker engine to hang. See:

https://forums.docker.com/t/docker-beta-for-mac-does-not-work-and-hangs-frequently-on-macos-10-12/18109/7

./docker-vpn-helper

Sets up the port forwarding, regenerates TLS certificates.

Pay attention to the following lines emitted by the script you will need to cut and paste them into your shell.

export DOCKER_HOST=tcp://localhost:2376 export DOCKER_CERT_PATH=/Users/<username>/.docker/machine/machines/default export DOCKER_MACHINE_NAME=default

Connect to your AnyConnect VPN and test out docker:

docker run hello-world