I am using Ubuntu Server Ubuntu 22.04.2 LTS in my homelab (esx Server) to test some docker applications. First of all I was testing Bitwarden, a webbased Password-Manger. Without any success. I could not reach the bitwarden page in my local network. Then I installed a brand new ubuntu server to test Keeweb, also an webbased Password-Manager. Installed with docker too, everything with a tutorial. But I cant access the keeweb page over my network.
With nc -zv 192.168.0.137 443 Connection to 192.168.0.137 443 port [tcp/https] succeeded!
I can see that the port 443 is open. But when I try https://192.168.0.137 from any other system in my local network it doesnt work. I dont belive that there is any problem in my local network, because I also running a Windows VM with the PRTG monitoring system, and I can reach that webpage through my local netwok.
Powershell says that the port 443 and 80 is not open. UFW was disabled at the beginning, but for testing purposes I enabled it an set up some rules that supposed to allow everything:
To Action From
-- ------ ----
80 ALLOW IN Anywhere
443 ALLOW IN Anywhere
Anywhere ALLOW IN Anywhere
80 (v6) ALLOW IN Anywhere (v6)
443 (v6) ALLOW IN Anywhere (v6)
Anywhere (v6) ALLOW IN Anywhere (v6)
Anywhere ALLOW OUT Anywhere
Anywhere (v6) ALLOW OUT Anywhere (v6)
My docker container is also running:
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
625e33e7d24d antelle/keeweb "/opt/entrypoint.sh …" About an hour ago Up About an hour 192.168.0.137:80->80/tcp, 192.168.0.137:443->443/tcp keeweb
and run by:
sudo docker run --name keeweb -d -p 192.168.0.137:443:443 -p 192.168.0.137:80:80 antelle/keeweb
At my first try, I didnt set up the 192.168.0.137, it was just the ports.
This is the iptables output:
sudo iptables -L -t nat
# Warning: iptables-legacy tables present, use iptables-legacy to see them
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DOCKER all -- anywhere anywhere ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DOCKER all -- anywhere !localhost/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.0.0/16 anywhere
MASQUERADE tcp -- 172.17.0.2 172.17.0.2 tcp dpt:https
MASQUERADE tcp -- 172.17.0.2 172.17.0.2 tcp dpt:http
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- anywhere anywhere
DNAT tcp -- anywhere bitwarden-2 tcp dpt:https to:172.17.0.2:443
DNAT tcp -- anywhere bitwarden-2 tcp dpt:http to:172.17.0.2:80