Can't write to input from outside of graylog's subnet

[gawainxr]

I’ve been scratching my head with this particular issue,

Graylog currently has an IPVLAN IP so that I can give it special firewall privileges’ separate of the other containers on the host. I can ship logs to it fine from hosts within the same subnet, however i’m not able to send logs to it from hosts on other subnets.
I also can’t telnet 9000 or 5044

I’ve double and triple checked my network firewall issues,
I can think of three possible reasons.

• There’s a builtin firewall or IP filter on the docker container I would need to override.
• Somehow the default gateway isn’t set on the container

My ability to troubleshoot the container itself is limited unless I can figure out how to su to root so that I can install network connectivity test tools.
The Graylog network is an internal one shared with mongo and elastic

Relevant portions of my docker compose
(port bindings are omitted as all ports are automatically exposed when using iPVLAN)

graylog:
image: graylog/graylog:4.2
restart: unless-stopped
volumes:
- “/etc/localtime:/etc/localtime:ro”
- /srv/graylog/graylog/data:/usr/share/graylog/data
- /srv/graylog/graylog/certs:/etc/pki/graylog
environment:
- GRAYLOG_PASSWORD_SECRET=${GRAYLOG_PASSWORD_SECRET}
- GRAYLOG_ROOT_PASSWORD_SHA2=${GRAYLOG_ROOT_PASSWORD_SHA2}
- GRAYLOG_HTTP_EXTERNAL_URI=http://redacted.net:9000
entrypoint: /usr/bin/tini – wait-for-it elasticsearch:9200 – /docker-entrypoint.sh
depends_on:
- mongodb
- elasticsearch
networks:
graylog:
priority: 1000
ipvlan-bridge:
priority: 500
ipv4_address: 192.168.4.75

[tmacgbay]

From what I am quickly reading, you need to specifically set the gateway in the IPVLAN when you create it… was that done? If not it defaults to the first usable IP for a gateway. so for 192.168.1.0/24 it would default to 192.168.1.1 for the gateway… I was reading all this on this page

[gawainxr]

I switched the container to use port bindings on the host and things suddenly work, which supports my theory that for some reason the container isn’t setting the default gateway correctly. however lacking root pillages and without ip-tools or ping-tools installed in the container I don’t really have a way to verify my theory.

I do have the correct gateway defined on the IPVLAN connection itself, and other containers have no issue routing from other containers using the IPVLAN driver.

I’m going to leave the binding to the host for the time being as i’m much less concerned about inbound port access granted to discretely mapped ports opposed to granting the host IP outbound firewall rights.

Updated config:
graylog:

image: graylog/graylog:4.2

restart: unless-stopped

ports:

  # WebUI/API

  # - 9005:9000

  # Syslog

  - 1514:1514

  - 1514:1514/udp

    # GELF

  - 12201:12201

  - 12201:12201/udp

  # beats

  - 5044:5044

  - 5044:5044/udp

volumes:

  - "/etc/localtime:/etc/localtime:ro"

  - /srv/graylog/graylog/data:/usr/share/graylog/data

  - /srv/graylog/graylog/certs:/etc/pki/graylog

environment:

  - GRAYLOG_PASSWORD_SECRET=${GRAYLOG_PASSWORD_SECRET}

  - GRAYLOG_ROOT_PASSWORD_SHA2=${GRAYLOG_ROOT_PASSWORD_SHA2}

  - GRAYLOG_HTTP_EXTERNAL_URI=https://graylog.mydomain.net/

entrypoint: /usr/bin/tini -- wait-for-it elasticsearch:9200 --  /docker-entrypoint.sh

depends_on:

  - mongodb

  - elasticsearch

networks:

  graylog:

    priority: 1000

  web:

    priority: 500

labels:

  # Traefik

  - "traefik.enable=true"

  - "traefik.docker.network=web"

  - "traefik.http.routers.graylog.rule=Host(`graylog.mydomain.net`)"

  - "traefik.http.routers.librespeed.entrypoints=websecure"

  - "traefik.http.routers.librespeed.tls.certresolver=letsencrypt"

  # Specify service port as otherwise Traefik will select the SSL port

  - "traefik.http.routers.graylog.service=graylog"

  - "traefik.http.services.graylog.loadbalancer.server.port=9000"

  - "traefik.http.services.graylog.loadbalancer.server.scheme=http"

  # Watchtower

  - "com.centurylinklabs.watchtower.enable=true"

  - "com.centurylinklabs.watchtower.monitor-only=true"