[
https://issues.apache.org/jira/browse/MESOS-9269?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16632654#comment-16632654
]
z s commented on MESOS-9269:
----------------------------
Investigating further, I decided to deploy a DC/OS cluster to view how those
iptables are configured. I'm not sure what exactly the diff is between the two
but the MESOS UCR works perfectly on DC/OS.
The DC/OS cluster iptables seem to have the same original configuration as the
Mesos/Marathon-only cluster:
DC/OS Cluster:
{code:java}
$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-1 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate
RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate
RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate
RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain DOCKER (3 references)
target prot opt source destination
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target prot opt source destination
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-ISOLATION-STAGE-2 (3 references)
target prot opt source destination
DROP all -- anywhere anywhere
DROP all -- anywhere anywhere
DROP all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-USER (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere{code}
{code:java}
$ sudo iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DOCKER all -- anywhere anywhere ADDRTYPE match
dst-type LOCAL
UCR-DEFAULT-BRIDGE all -- anywhere anywhere ADDRTYPE
match dst-type LOCAL
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DOCKER all -- anywhere
!ip-127-0-0-0.us-west-2.compute.internal/8 ADDRTYPE match dst-type LOCAL
UCR-DEFAULT-BRIDGE all -- anywhere
!ip-127-0-0-0.us-west-2.compute.internal/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- anywhere anywhere vdir ORIGINAL
vmethod MASQ /* Minuteman-IPVS-IPTables-masquerade-rule */
MASQUERADE all -- ip-172-17-0-0.us-west-2.compute.internal/16 anywhere
MASQUERADE all -- 9.0.0.0/8 anywhere match-set
overlay dst
CNI-1ca4fce35f5dae9dad10d9ba all --
ip-172-31-254-0.us-west-2.compute.internal/24 anywhere /* name:
"mesos-bridge" id: "6e424731-3d67-4d37-8f67-fc94972af19c" */
Chain CNI-1ca4fce35f5dae9dad10d9ba (1 references)
target prot opt source destination
ACCEPT all -- anywhere
ip-172-31-254-0.us-west-2.compute.internal/24 /* name: "mesos-bridge" id:
"6e424731-3d67-4d37-8f67-fc94972af19c" */
MASQUERADE all -- anywhere !base-address.mcast.net/4 /* name:
"mesos-bridge" id: "6e424731-3d67-4d37-8f67-fc94972af19c" */
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain UCR-DEFAULT-BRIDGE (2 references)
target prot opt source destination
DNAT tcp -- anywhere anywhere tcp dpt:9998 /*
container_id: 6e424731-3d67-4d37-8f67-fc94972af19c */ to:172.31.254.3:9998
DNAT tcp -- anywhere anywhere tcp dpt:https /*
container_id: 6e424731-3d67-4d37-8f67-fc94972af19c */ to:172.31.254.3:443
DNAT tcp -- anywhere anywhere tcp dpt:24124 /*
container_id: 6e424731-3d67-4d37-8f67-fc94972af19c */ to:172.31.254.3:24124
{code}
> Mesos UCR with Docker only Works on Host
> ----------------------------------------
>
> Key: MESOS-9269
> URL: https://issues.apache.org/jira/browse/MESOS-9269
> Project: Mesos
> Issue Type: Bug
> Components: agent, docker
> Affects Versions: 1.7.0
> Environment: Ubuntu 16.04
> Mesos 1.7.0
> Marathon 1.7.111
> Reporter: z s
> Priority: Major
>
> I'm having an issue setting up the `mesos-cni-port-mapper` to allow remote
> connectivity.
> When I `curl <host>:<port>` from the machine I get a response but from a
> remote machine the `curl` connection timesout. I'm not sure what's wrong with
> my route settings.
>
> */var/lib/mesos/cni/config/mesos-bridge.json*
>
> {code:java}
> {
> "name" : "mesos-bridge",
> "type" : "mesos-cni-port-mapper",
> "excludeDevices" : ["mesos-cni0"],
> "chain": "MESOS-BRIDGE-PORT-MAPPER",
> "delegate": {
> "type": "bridge",
> "bridge": "mesos-cni0",
> "isGateway": true,
> "ipMasq": true,
> "ipam": {
> "type": "host-local",
> "subnet": "10.1.0.0/16",
> "routes": [
> { "dst":
> "0.0.0.0/0" }
> ]
> }
> }
> }
> {code}
>
> {code:java}
> $ route -n
> Kernel IP routing table
> Destination Gateway Genmask Flags Metric Ref Use Iface
> 0.0.0.0 172.27.1.1 0.0.0.0 UG 0 0 0 ens3
> 10.1.0.0 0.0.0.0 255.255.0.0 U 0 0 0 mesos-cni0
> 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
> 172.27.1.0 0.0.0.0 255.255.255.0 U 0 0 0 ens3
> {code}
> Any suggestions?
>
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
