I have followed the instructions for a HA setup, but I’m stuck at starting the rancher/server containers.
The logs from the rancher-ha container state the following lines:
level=info msg="Can not launch agent right now: Server not available at http://172.19.10.2:18080/ping:" component=service
Looking at the iptables configuraiton, it looks like port 18080 is meant to be DNAT’ted to port 8080.
The following works from my host:
curl 172.19.10.2:8080/ping
pong
From the rancher-ha container, neither works:
docker exec -it rancher-ha bash
root@rbsu1082:/# curl http://172.19.10.2:18080/ping
curl: (7) Failed to connect to 172.19.10.2 port 18080: Connection refused
Could it be that docker’s iptables rules are not permitting the flow correctly?
I’m running rancher/server:stable on docker 1.10.3.
iptables-save output below:
# Generated by iptables-save v1.4.21 on Tue Jun 14 12:52:57 2016
*nat
:PREROUTING ACCEPT [6105:275858]
:INPUT ACCEPT [2966:140188]
:OUTPUT ACCEPT [945:62650]
:POSTROUTING ACCEPT [947:62770]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.19.10.0/24 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 172.19.10.2/32 -d 172.19.10.2/32 -p tcp -m tcp --dport 16379 -j MASQUERADE
-A POSTROUTING -s 172.19.10.2/32 -d 172.19.10.2/32 -p tcp -m tcp --dport 13888 -j MASQUERADE
-A POSTROUTING -s 172.19.10.2/32 -d 172.19.10.2/32 -p tcp -m tcp --dport 12888 -j MASQUERADE
-A POSTROUTING -s 172.19.10.2/32 -d 172.19.10.2/32 -p tcp -m tcp --dport 12181 -j MASQUERADE
-A POSTROUTING -s 172.19.10.2/32 -d 172.19.10.2/32 -p tcp -m tcp --dport 8080 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 6379 -j DNAT --to-destination 172.19.10.2:16379
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 3888 -j DNAT --to-destination 172.19.10.2:13888
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 2888 -j DNAT --to-destination 172.19.10.2:12888
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 2181 -j DNAT --to-destination 172.19.10.2:12181
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 18080 -j DNAT --to-destination 172.19.10.2:8080
COMMIT
# Completed on Tue Jun 14 12:52:57 2016
# Generated by iptables-save v1.4.21 on Tue Jun 14 12:52:57 2016
*filter
:INPUT DROP [3092:132930]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [153359:38761977]
:DOCKER - [0:0]
:DOCKER-ISOLATION - [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 6556 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 80,443,18080 -j ACCEPT
-A INPUT -s 172.20.13.38/32 -p tcp -m multiport --dports 2181,2376,2888,3888,6379 -j ACCEPT
-A INPUT -s 172.20.13.38/32 -p udp -m multiport --dports 500,4500 -j ACCEPT
-A INPUT -s 172.20.13.39/32 -p tcp -m multiport --dports 2181,2376,2888,3888,6379 -j ACCEPT
-A INPUT -s 172.20.13.39/32 -p udp -m multiport --dports 500,4500 -j ACCEPT
-A INPUT -s 172.20.13.40/32 -p tcp -m multiport --dports 2181,2376,2888,3888,6379 -j ACCEPT
-A INPUT -s 172.20.13.40/32 -p udp -m multiport --dports 500,4500 -j ACCEPT
-A INPUT -s 172.20.13.38/32 -p vrrp -j ACCEPT
-A INPUT -s 172.20.13.39/32 -p vrrp -j ACCEPT
-A INPUT -s 172.20.13.40/32 -p vrrp -j ACCEPT
-A INPUT -s 172.19.10.0/24 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -s 172.20.13.38/32 -p tcp -m multiport --dports 3306,4444,4567,4568 -j ACCEPT
-A INPUT -s 172.20.13.39/32 -p tcp -m multiport --dports 3306,4444,4567,4568 -j ACCEPT
-A INPUT -s 172.20.13.40/32 -p tcp -m multiport --dports 3306,4444,4567,4568 -j ACCEPT
-A FORWARD -j DOCKER-ISOLATION
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER -d 172.19.10.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 16379 -j ACCEPT
-A DOCKER -d 172.19.10.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 13888 -j ACCEPT
-A DOCKER -d 172.19.10.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 12888 -j ACCEPT
-A DOCKER -d 172.19.10.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 12181 -j ACCEPT
-A DOCKER -d 172.19.10.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8080 -j ACCEPT
-A DOCKER-ISOLATION -j RETURN
COMMIT
# Completed on Tue Jun 14 12:52:57 2016