| "Connection refused" when connecting from VE to host's public IP [message #50964] |
Sun, 15 December 2013 00:44  |
Ventzy
Messages: 3
Registered: December 2013
|
Junior Member |
|
|
Hello,
I have my network config like this - single public IP address, assigned to the host (eth0) and multiple VEs in private network with IPs like 10.0.X.X. I have apache in one VE, mysql in other and so on. I have port forwarding on host for apache like this:
iptables -t nat -A PREROUTING -p TCP -i eth0 --dport 80 -j DNAT --to 10.0.0.3:80
This works as expected - I can access web sites hosted in 10.0.0.3 from outside through host's public IP and 10.0.0.3 connects successfully to Internet. The problem is that I cannot connect from VE to the public IP of the host. Let's say my public IP is 1.1.1.1, then I get this from 10.0.0.3
root@apache:/# telnet 1.1.1.1 80
Trying 1.1.1.1...
telnet: Unable to connect to remote host: Connection refused
What in the end I want to do is to load a web page from withing 10.0.0.3 that is hosted on 10.0.0.3. I have domain mydomain.com which resolves to 1.1.1.1 and when I try to load http ://mydomain.com/ from 10.0.0.3, domain is resolved to 1.1.1.1 and connection is refused as with telnet example.
I can workaround the problem if in the 10.0.0.3 /etc/hosts add
I don't like that solution, because I have hundreds of sites and on new site I must alter hosts file. Besides, if some other software needs to create connection to the 1.1.1.1 it will fail.
I use Proxmox 3.1 and here are my /etc/network/interfaces on the host
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 1.1.1.1
netmask 255.255.255.240
gateway 2.2.2.2
post-up echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
auto vmbr0
iface vmbr0 inet static
address 10.0.0.1
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '10.0.0.0/16' -o eth0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/16' -o eth0 -j MASQUERADE
And on container
auto lo
iface lo inet loopback
# Auto generated venet0 interface
auto venet0
iface venet0 inet manual
up ifconfig venet0 up
up ifconfig venet0 127.0.0.2
up route add default dev venet0
down route del default dev venet0
down ifconfig venet0 down
iface venet0 inet6 manual
up route -A inet6 add default dev venet0
down route -A inet6 del default dev venet0
auto venet0:0
iface venet0:0 inet static
address 10.0.0.3
netmask 255.255.255.255
Here is the output of iptables -t nat -L && iptables -t filter -L && iptables -t mangle -L command
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- anywhere anywhere tcp dpt:mysql to:10.0.0.2:3306
DNAT tcp -- anywhere anywhere tcp dpt:https to:10.0.0.3:443
DNAT tcp -- anywhere anywhere tcp dpt:http to:10.0.0.3:80
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.0.0.0/16 anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
How can I solve the problem?
|
|
|
|
|
|
|
|
|
|
| Re: "Connection refused" when connecting from VE to host's public IP [message #50980 is a reply to message #50975] |
Mon, 16 December 2013 12:18  |
Ventzy
Messages: 3
Registered: December 2013
|
Junior Member |
|
|
grep wrote on Mon, 16 December 2013 09:52So your server answers.
Can you ssh into it? is only http refused?
iptables from ve (iptables-save in terminal to show all)?
I get "Connection refused" from VE to host for all ports, that was redirected in the host with
iptables -t nat -A PREROUTING -p TCP -i eth0 --dport 80 -j DNAT --to 10.0.0.3:80
I have no such forwarding rule on port 22, so I have no problem. Here is summary of different scenarios
| Non-redirected port (22) | Redirected port (80) |
----------------------------------------------------------------------------
Outside -> Host | OK | OK |
5.6.7.8 -> 1.1.1.1 | | |
----------------------------------------------------------------------------
VE -> Host | OK | Connection refused |
10.0.0.3 -> 1.1.1.1 | | |
----------------------------------------------------------------------------
There are no iptable rules in the VE.
I am far from expert in this and may be wrong, but I suspect that I have "NAT loopback" issue like described here http ://en.wikipedia.org/wiki/Network_address_translation#NAT_loo pback
|
|
|
|
OpenVZ Forum
Members
Search
Help
Register
Login
Home
