missing -d flag from https://github.com/cloudfoundry-community/port-forwarding-boshrelease/blob/master/jobs/port_forwarding/templates/bin/forward_ports.sh.erb#L28 by drnic · Pull Request #13 · cloudfoundry-attic/networking-release

drnic · 2017-03-21T07:59:47Z

Discussion of issue and missing -d flag on #bosh channel https://cloudfoundry.slack.com/archives/C02HPPYQ2/p1490081101496048

…orwarding-boshrelease/blob/master/jobs/port_forwarding/templates/bin/forward_ports.sh.erb#L28

cfdreddbot · 2017-03-21T07:59:48Z

Hey drnic!

Thanks for submitting this pull request! I'm here to inform the recipients of the pull request that you and the commit authors have already signed the CLA.

dpb587-pivotal · 2017-03-21T20:33:10Z

 	<% internal_port = rule['internal_port'] || raise("Expected non-empty 'internal_port' on '#{rule.inspect}' rule") %>

-	sudo iptables -t nat -A portforwarding-release -p tcp --dport <%= external_port %> -j DNAT --to <%= internal_ip %>:<%= internal_port %>
+	sudo iptables -t nat -A portforwarding-release -p tcp -d <%= spec.networks.send(spec.networks.methods(false).first).ip %> --dport <%= external_port %> -j DNAT --to <%= internal_ip %>:<%= internal_port %>


or spec.address? https://bosh.io/docs/jobs.html#properties

It might make more sense to add support for rule['external_ip'] though (maybe falling back to spec.address, unless people would genuinely want to listen on all IPs).

drnic · 2017-03-21T21:29:37Z

@dpb587-pivotal thx, updated

drnic · 2017-10-30T01:15:10Z

This issue also manifests on the host machine - without this PR I cannot even curl google.

drnic · 2017-10-30T03:36:28Z

I'm going to log this issue within this PR. When I apply this PR to a bosh-lite, the host vm and its containers do not have same routes available to them:

api/55564424-a752-4e6a-83f3-59c958200f24:~$ curl -k https://api.10-213-13-10.sslip.io/v2/info
curl: (7) Failed to connect to api.10-213-13-10.sslip.io port 443: Connection refused
api/55564424-a752-4e6a-83f3-59c958200f24:~$ curl google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.google.es/?gfe_rd=cr&amp;dcr=0&amp;ei=9p32WZ_WHo3Y8gfrzqmYBQ">here</A>.
</BODY></HTML>

But curl -k https://api.10-213-13-10.sslip.io/v2/info works from outside the host vm.

drnic · 2017-10-30T06:52:43Z

I've added changes to allow loopbacks.

drnic · 2017-10-30T07:31:10Z

Damnit, whilst curl -k https://api.10-213-13-10.sslip.io/v2/info now works from the host vm, it still does not work from within garden containers (bosh-lite instances) within that VM.

drnic · 2017-10-30T12:14:37Z

I've rebuilt my bosh-lite using the original https://github.com/cloudfoundry-community/port-forwarding-boshrelease/blob/master/jobs/port_forwarding/templates/bin/forward_ports.sh.erb#L28 but I'm still getting the same behavior - containers within the bosh-lite vm are unable to curl -k https://api.10-213-13-10.sslip.io/v2/info.

I swear this used to work. Until the middle of this year I had lots of CI pipelines that deployed things to the same bosh-lite, registered service brokers, etc.

dpb587-pivotal · 2017-11-01T00:41:58Z

I'm confused; are you saying this change is no needed or working as expected?

drnic · 2017-11-01T07:11:34Z

This PR does something important; but apparently not everything. Without this PR as it stands, neither containers nor the host machine has a loopback to the port forwarding/nor egress access. The PR currently allows egress internet access and allows host machine to access the port forwarding via loopback. But I cannot figure out how to allow containers (eg bosh-lite instances) to accsss the port forwarding rules. Ideas?

…

________________________________ From: Danny Berger <notifications@github.com> Sent: Wednesday, November 1, 2017 10:41:58 AM To: cloudfoundry/networking-release Cc: Dr Nic Williams; Author Subject: Re: [cloudfoundry/networking-release] missing -d flag from https://github.com/cloudfoundry-community/port-forwarding-boshrelease/blob/master/jobs/port_forwarding/templates/bin/forward_ports.sh.erb#L28 (#13) I'm confused; are you saying this change is no needed or working as expected? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#13 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AAAAbJHiyjKwwWZ3iIOfGHQvh4NiYwWJks5sx75WgaJpZM4Mjca9>.

drnic · 2017-11-09T05:58:23Z

@dpb587-pivotal this PR can be merged; the remaining issue of containers having egress access to host loopback can be solved later

drnic · 2017-11-10T01:27:30Z

I have closure on the unresolved issue above that I claimed use to work. It never worked. I've searched thru my CI history and found jobs where I used to have "it working" - but it turns out I was not running bosh errands, rather I was hard coding errand functionality into concourse tasks - so I had ingress traffic from a 3rd party client (concourse) rather than bosh-lite containers (bosh errands) trying for egress traffic to the host machine.

This PR is good to merge @dpb587-pivotal @cppforlife - or any final comments.

drnic · 2017-12-22T08:26:37Z

@cppforlife @dpb587-pivotal can we merge this please and cut a release?

drnic · 2018-03-21T14:29:59Z

@dpb587-pivotal @cppforlife this is the 1 year birthday of this ticket (I was randomly explaining why this PR exists and noticed its creation date). Could we merge + cut a release?

cppforlife · 2018-03-26T21:44:58Z


-# Reset in case when there is no localhost routing
-sysctl net.ipv4.conf.all.route_localnet=0
+sysctl net.ipv4.conf.all.route_localnet=1


i would prefer if this stays as is, conditional.

cppforlife · 2018-03-26T21:45:19Z

+	sudo iptables -t nat -A portforwarding-release -p tcp -d <%= external_ip %> --dport <%= external_port %> -j DNAT --to <%= internal_ip %>:<%= internal_port %>
+
+	# loopback
+	sudo iptables -t nat -A portforwarding-release -p tcp -d 127.0.0.1 --dport <%= external_port %> -j DNAT --to <%= internal_ip %>:<%= internal_port %> -o lo


this should really be done thru port_forwarding config, instead of hard coded.

cppforlife · 2018-03-26T21:45:32Z

-	<% internal_ip   = rule['internal_ip']   || "127.0.0.1" %>
-	<% internal_port = rule['internal_port'] || raise("Expected non-empty 'internal_port' on '#{rule.inspect}' rule") %>
+	<%
+		external_ip   = rule['external_ip']   || spec.address


spec.address -> spec.ip. spec.address may be a dns name.

missing -d flag from https://github.com/cloudfoundry-community/port-f…

d349a25

…orwarding-boshrelease/blob/master/jobs/port_forwarding/templates/bin/forward_ports.sh.erb#L28

dpb587-pivotal reviewed Mar 21, 2017

View reviewed changes

default external_ip to spec.address [thx @dpb587-pivotal]

80ddd05

drnic added a commit to cloudfoundry-community/collection-of-pullrequests-boshrelease that referenced this pull request Nov 10, 2017

add port_forwarding from cloudfoundry-attic/networking-release#13

e35ac2e

always allow loopback access to forwared ports

ac65b4a

drnic force-pushed the minus-d branch from 6fb2608 to ac65b4a Compare December 22, 2017 12:06

cppforlife reviewed Mar 26, 2018

View reviewed changes

Conversation

drnic commented Mar 21, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cfdreddbot commented Mar 21, 2017

Uh oh!

dpb587-pivotal Mar 21, 2017

Choose a reason for hiding this comment

Uh oh!

drnic commented Mar 21, 2017

Uh oh!

drnic commented Oct 30, 2017

Uh oh!

drnic commented Oct 30, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

drnic commented Oct 30, 2017

Uh oh!

drnic commented Oct 30, 2017

Uh oh!

drnic commented Oct 30, 2017

Uh oh!

dpb587-pivotal commented Nov 1, 2017

Uh oh!

drnic commented Nov 1, 2017 via email

Uh oh!

drnic commented Nov 9, 2017

Uh oh!

drnic commented Nov 10, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

drnic commented Dec 22, 2017

Uh oh!

drnic commented Mar 21, 2018

Uh oh!

cppforlife Mar 26, 2018

Choose a reason for hiding this comment

Uh oh!

cppforlife Mar 26, 2018

Choose a reason for hiding this comment

Uh oh!

cppforlife Mar 26, 2018

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

drnic commented Mar 21, 2017 •

edited

Loading

drnic commented Oct 30, 2017 •

edited

Loading

drnic commented Nov 10, 2017 •

edited

Loading