You are not logged in.
Hi
I have Docker installed and can enter the Debian container.
But I have no internet!
[morta@5erver ~]$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: enp8s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 04:d9:f5:bc:8f:c6 brd ff:ff:ff:ff:ff:ff
3: enp9s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 04:d9:f5:bc:8f:c7 brd ff:ff:ff:ff:ff:ff
4: enp10s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 04:d9:f5:bc:8f:c8 brd ff:ff:ff:ff:ff:ff
5: enp11s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 04:d9:f5:bc:8f:c9 brd ff:ff:ff:ff:ff:ff
6: enp7s0f0: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master bond0 state UP group default qlen 1000
link/ether 4e:b7:bc:18:c0:bf brd ff:ff:ff:ff:ff:ff permaddr 98:b7:85:89:7e:f8
7: enp7s0f1: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master bond0 state UP group default qlen 1000
link/ether 4e:b7:bc:18:c0:bf brd ff:ff:ff:ff:ff:ff permaddr 98:b7:85:89:7e:f9
10: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:a6:88:3d:aa brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fd00::1/80 scope global tentative
valid_lft forever preferred_lft forever
inet6 fe80::1/64 scope link tentative
valid_lft forever preferred_lft forever
11: br-abac02be342e: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:f0:b4:83:d0 brd ff:ff:ff:ff:ff:ff
inet 172.18.0.1/16 brd 172.18.255.255 scope global br-abac02be342e
valid_lft forever preferred_lft forever
inet6 fd00:dead:beef::1/48 scope global tentative
valid_lft forever preferred_lft forever
inet6 fe80::1/64 scope link tentative
valid_lft forever preferred_lft forever
21: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 4e:b7:bc:18:c0:bf brd ff:ff:ff:ff:ff:ff
inet 192.168.1.100/24 brd 192.168.1.255 scope global noprefixroute bond0
valid_lft forever preferred_lft forever
inet6 2a02:168:a774::2222/48 scope global noprefixroute
valid_lft forever preferred_lft forever
inet6 fe80::8a88:27bb:7e9e:e362/64 scope link noprefixroute
valid_lft forever preferred_lft forever#!/usr/bin/nft -f
# vim:set ts=2 sw=2 et:
# IPv4/IPv6 Simple & Safe firewall ruleset.
# More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/.
flush ruleset
table inet my_table {
set LANv4 {
type ipv4_addr
flags interval
elements = { 192.168.0.0/24, 172.18.0.1/16, 172.17.0.1/16 }
}
set LANv6 {
type ipv6_addr
flags interval
elements = { fd00::/8, fe80::/10, 2a02:168:a774::/48 }
}
chain my_input_lan {
meta l4proto { tcp, udp } th dport 2049 accept comment "Accept NFS"
udp dport netbios-ns accept comment "Accept NetBIOS Name Service (nmbd)"
udp dport netbios-dgm accept comment "Accept NetBIOS Datagram Service (nmbd)"
tcp dport netbios-ssn accept comment "Accept NetBIOS Session Service (smbd)"
tcp dport microsoft-ds accept comment "Accept Microsoft Directory Service (smbd)"
udp sport { bootpc, 4011 } udp dport { bootps, 4011 } accept comment "Accept PXE"
udp dport tftp accept comment "Accept TFTP"
}
chain my_input {
type filter hook input priority filter; policy drop;
iif lo accept comment "Accept any localhost traffic"
ct state invalid drop comment "Drop invalid connections"
ct state established,related accept comment "Accept traffic originated from us"
meta l4proto ipv6-icmp accept comment "Accept ICMPv6"
meta l4proto icmp accept comment "Accept ICMP"
ip protocol igmp accept comment "Accept IGMP"
udp dport mdns ip6 daddr ff02::fb accept comment "Accept mDNS"
udp dport mdns ip daddr 224.0.0.251 accept comment "Accept mDNS"
ip6 saddr @LANv6 jump my_input_lan comment "Connections from private IP address ranges"
ip saddr @LANv4 jump my_input_lan comment "Connections from private IP address ranges"
tcp dport ftp accept comment "Accept ftp on port 21"
tcp dport ssh accept comment "Accept SSH on port 22"
tcp dport ipp accept comment "Accept IPP/IPPS on port 631"
tcp dport 53 accept comment "Accept DNS on port 53"
# tcp dport 3001 accept comment "Accept VueTorrent on port 3001"
# tcp dport 4444 accept comment "Accept grafana on port 4444"
tcp dport { 5060, 8080 } accept comment "Accept Ooklaserver on port 5060, 8080"
tcp dport 5353 accept comment "Accept DNS Traffic on port 5353"
tcp dport 6680 accept comment "Accept mopidy on port 6680"
tcp dport 8000 accept comment "Accept OPNsense dev env on port 8000"
tcp dport 8008 accept comment "Accept Matrix on port 8008"
# tcp dport 5050 accept comment "Accept Firefox syncstorage on port 5050"
# tcp dport { 6666, 8888 } accept comment "Accept Promtheus and Crowdsec Port 6666, 8888"
tcp dport 50000-50010 accept comment "Accept FTP passiv 50000-50010"
tcp dport 55000-55111 accept comment "Accept Bittorrent 55000-55111"
udp dport { 5060, 8080 } accept comment "Accept OoklaServer on port 5060, 8080"
udp dport 6881 accept comment "Accept UDP Bittorrent 6881"
tcp dport { http, https, 8989 } accept comment "Accept HTTP (ports 80, 443, 8989)"
#udp sport bootpc udp dport bootps ip saddr 0.0.0.0 ip daddr 255.255.255.255 accept comment "Accept DHCPDISCOVER (for DHCP-Proxy)"
}
chain my_forward {
type filter hook forward priority filter; policy drop;
# Drop everything forwarded to us. We do not forward. That is routers job.
}
chain my_output {
type filter hook output priority filter; policy accept;
# Accept every outbound connection
}
} docker.service - Docker Application Container Engine
Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled; preset: d>
Drop-In: /etc/systemd/system/docker.service.d
└─execstart.conf
Active: active (running) since Thu 2023-11-02 14:38:25 CET; 1h 6min ago
TriggeredBy: ● docker.socket
Docs: https://docs.docker.com
Main PID: 1887 (dockerd)
Tasks: 19
Memory: 288.3M
CPU: 4.732s
CGroup: /system.slice/docker.service
└─1887 /usr/bin/dockerd -H unix:///var/run/docker.sock -H tcp://0.>
Nov 02 14:38:25 5erver dockerd[1887]: time="2023-11-02T14:38:25.424386786+01:00>
Nov 02 14:38:25 5erver dockerd[1887]: time="2023-11-02T14:38:25.440901159+01:00>
Nov 02 14:38:25 5erver dockerd[1887]: time="2023-11-02T14:38:25.441047543+01:00>
Nov 02 14:38:25 5erver dockerd[1887]: time="2023-11-02T14:38:25.441073224+01:00>
Nov 02 14:38:25 5erver dockerd[1887]: time="2023-11-02T14:38:25.441301870+01:00>
Nov 02 14:38:25 5erver dockerd[1887]: time="2023-11-02T14:38:25.459915957+01:00>
Nov 02 14:38:25 5erver dockerd[1887]: time="2023-11-02T14:38:25.459951330+01:00>
Nov 02 14:38:25 5erver systemd[1]: Started Docker Application Container Engine.
Nov 02 14:59:13 5erver dockerd[1887]: time="2023-11-02T14:59:13.917592628+01:00>
lines 1-23What is wrong?
Offline