☰

尽管端口 9283 已打开并处于监听状态，但连接仍被拒绝

tag-icon • tag-icon networking iptables port
尽管端口 9283 已打开并处于监听状态，但连接仍被拒绝

我正在运行格罗西码头工人容器在 Raspberry Pi 2 [全新安装的 Raspbian] 上；容器正在运行，端口80映射到9283主机上的端口：

  • 通过以下方式验证容器是否正在运行docker ps： 
    CONTAINER ID   IMAGE                       COMMAND   CREATED        STATUS        PORTS                                     NAMES
473614c3f885   ghcr.io/linuxserver/grocy   "/init"   16 hours ago   Up 15 hours   443/tcp, 6781/tcp, 0.0.0.0:9283->80/tcp   grocy
  • 验证端口9283是否打开并且正在监听sudo iptables -L： 
    Chain INPUT (policy ACCEPT)
target    prot opt source       destination
ACCEPT    tcp  --  anywhere     anywhere      tcp dpt:9283
    sudo netstat -pant： 
    Active Internet connections (servers and established)

Proto   Recv-Q  Send-Q  Local Address       Foreign Address         State         PID/Program name
tcp          0      0   0.0.0.0:9283        0.0.0.0:*               LISTEN        632/docker-proxy
tcp          0      0   0.0.0.0:22          0.0.0.0:*               LISTEN        428/sshd
tcp          0      0   192.168.1.40:22     192.168.1.11:58703      ESTABLISHED   1708/sshd: pi [priv
tcp6         0      0   :::22               :::*                    LISTEN        428/sshd
  • 我可以连接到127.0.0.1，但是连接到192.168.1.40[Pi] 被拒绝，无论是在 Pi 本身还是从我的本地网络
    wget 127.0.0.1:9283:: 
    --2021-03-06 10:49:51--  http://127.0.0.1:9283/
  Connecting to 127.0.0.1:9283... connected.
  HTTP request sent, awaiting response... Read error (Connection reset by peer) in headers.
    wget 192.168.1.40:9283： 
    --2021-03-06 10:52:09--  http://192.168.1.40:9283/
  Connecting to 192.168.1.40:9283... failed: Connection refused.


我已阅读此问题的答案问题，但是因为端口正在监听，我假设 Pi 上的防火墙正在阻止该端口，而且我不知道如何打开该端口（22SSH 端口已打开，但未出现在中iptables）。

某处是否还有另一层端口阻塞？

  • iptables -L： 
    Chain INPUT (policy ACCEPT)
target                    prot opt source       destination
ACCEPT                    tcp  --  anywhere     anywhere      tcp dpt:9283

Chain FORWARD (policy DROP)
target                    prot opt source       destination
DOCKER-USER               all  --  anywhere     anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere     anywhere
ACCEPT                    all  --  anywhere     anywhere      ctstate RELATED,ESTABLISHED
DOCKER                    all  --  anywhere     anywhere
ACCEPT                    all  --  anywhere     anywhere
ACCEPT                    all  --  anywhere     anywhere
ACCEPT                    all  --  anywhere     anywhere      ctstate RELATED,ESTABLISHED
DOCKER                    all  --  anywhere     anywhere
ACCEPT                    all  --  anywhere     anywhere
ACCEPT                    all  --  anywhere     anywhere

Chain OUTPUT (policy ACCEPT)
target                    prot opt source       destination

Chain DOCKER (2 references)
target                    prot opt source       destination
ACCEPT                    tcp  --  anywhere     172.18.0.2    tcp dpt:http

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target                    prot opt source       destination
DOCKER-ISOLATION-STAGE-2  all  --  anywhere     anywhere
DOCKER-ISOLATION-STAGE-2  all  --  anywhere     anywhere
RETURN                    all  --  anywhere     anywhere

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
target                    prot opt source       destination
DROP                      all  --  anywhere     anywhere
DROP                      all  --  anywhere     anywhere
RETURN                    all  --  anywhere     anywhere

Chain DOCKER-USER (1 references)
target                    prot opt source       destination
RETURN                    all  --  anywhere     anywhere
  • nft list ruleset： 
    table ip filter {
  chain INPUT {
    type filter hook input priority 0; policy accept;
    iifname "eth0" meta l4proto tcp tcp dport 9283 counter packets 0 bytes 0 accept
  }

  chain FORWARD {
    type filter hook forward priority 0; policy drop;
    counter packets 0 bytes 0 jump DOCKER-USER
    counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-1
    oifname "docker0" ct state related,established counter packets 0 bytes 0 accept
    oifname "docker0" counter packets 0 bytes 0 jump DOCKER
    iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 accept
    iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept
    oifname "br-3075040908de" ct state related,established counter packets 0 bytes 0 accept
    oifname "br-3075040908de" counter packets 0 bytes 0 jump DOCKER
    iifname "br-3075040908de" oifname != "br-3075040908de" counter packets 0 bytes 0 accept
    iifname "br-3075040908de" oifname "br-3075040908de" counter packets 0 bytes 0 accept
  }

  chain OUTPUT {
    type filter hook output priority 0; policy accept;
  }

  chain DOCKER {
    iifname != "br-3075040908de" oifname "br-3075040908de" meta l4proto tcp ip daddr 172.18.0.2 tcp dport 80 counter packets 0 bytes 0 accept
  }

  chain DOCKER-ISOLATION-STAGE-1 {
    iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2
    iifname "br-3075040908de" oifname != "br-3075040908de" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2
    counter packets 0 bytes 0 return
  }

  chain DOCKER-ISOLATION-STAGE-2 {
    oifname "docker0" counter packets 0 bytes 0 drop
    oifname "br-3075040908de" counter packets 0 bytes 0 drop
    counter packets 0 bytes 0 return
  }

  chain DOCKER-USER {
    counter packets 0 bytes 0 return
  }
}

table ip6 filter {
  chain INPUT {
    type filter hook input priority 0; policy accept;
  }

  chain FORWARD {
    type filter hook forward priority 0; policy accept;
  }

  chain OUTPUT {
    type filter hook output priority 0; policy accept;
  }
}

table ip nat {
  chain PREROUTING {
    type nat hook prerouting priority -100; policy accept;
    fib daddr type local counter packets 2 bytes 104 jump DOCKER
  }

  chain INPUT {
    type nat hook input priority 100; policy accept;
  }

  chain POSTROUTING {
    type nat hook postrouting priority 100; policy accept;
    oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 0 bytes 0 masquerade
    oifname != "br-3075040908de" ip saddr 172.18.0.0/16 counter packets 0 bytes 0 masquerade
    meta l4proto tcp ip saddr 172.18.0.2 ip daddr 172.18.0.2 tcp dport 80 counter packets 0 bytes 0 masquerade
  }

  chain OUTPUT {
    type nat hook output priority -100; policy accept;
    ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER
  }

  chain DOCKER {
    iifname "docker0" counter packets 0 bytes 0 return
    iifname "br-3075040908de" counter packets 0 bytes 0 return
    iifname != "br-3075040908de" meta l4proto tcp tcp dport 9283 counter packets 0 bytes 0 dnat to 172.18.0.2:80
  }
}

相关内容