{"action":"created","issue":{"url":"https://api.github.com/repos/rancher/rancher/issues/4323","repository_url":"https://api.github.com/repos/rancher/rancher","labels_url":"https://api.github.com/repos/rancher/rancher/issues/4323/labels{/name}","comments_url":"https://api.github.com/repos/rancher/rancher/issues/4323/comments","events_url":"https://api.github.com/repos/rancher/rancher/issues/4323/events","html_url":"https://github.com/rancher/rancher/issues/4323","id":146711938,"number":4323,"title":"Exposed port with manage network couldn't be reached outside host on Centos7","user":{"login":"easyrasta","id":1186969,"avatar_url":"https://avatars.githubusercontent.com/u/1186969?v=3","gravatar_id":"","url":"https://api.github.com/users/easyrasta","html_url":"https://github.com/easyrasta","followers_url":"https://api.github.com/users/easyrasta/followers","following_url":"https://api.github.com/users/easyrasta/following{/other_user}","gists_url":"https://api.github.com/users/easyrasta/gists{/gist_id}","starred_url":"https://api.github.com/users/easyrasta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/easyrasta/subscriptions","organizations_url":"https://api.github.com/users/easyrasta/orgs","repos_url":"https://api.github.com/users/easyrasta/repos","events_url":"https://api.github.com/users/easyrasta/events{/privacy}","received_events_url":"https://api.github.com/users/easyrasta/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rancher/rancher/labels/area/networking","name":"area/networking","color":"FBCA04"},{"url":"https://api.github.com/repos/rancher/rancher/labels/kind/bug","name":"kind/bug","color":"fc2929"},{"url":"https://api.github.com/repos/rancher/rancher/labels/status/resolved","name":"status/resolved","color":"0052cc"},{"url":"https://api.github.com/repos/rancher/rancher/labels/status/to-test","name":"status/to-test","color":"66aa66"}],"state":"open","locked":false,"assignee":{"login":"deniseschannon","id":11410997,"avatar_url":"https://avatars.githubusercontent.com/u/11410997?v=3","gravatar_id":"","url":"https://api.github.com/users/deniseschannon","html_url":"https://github.com/deniseschannon","followers_url":"https://api.github.com/users/deniseschannon/followers","following_url":"https://api.github.com/users/deniseschannon/following{/other_user}","gists_url":"https://api.github.com/users/deniseschannon/gists{/gist_id}","starred_url":"https://api.github.com/users/deniseschannon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deniseschannon/subscriptions","organizations_url":"https://api.github.com/users/deniseschannon/orgs","repos_url":"https://api.github.com/users/deniseschannon/repos","events_url":"https://api.github.com/users/deniseschannon/events{/privacy}","received_events_url":"https://api.github.com/users/deniseschannon/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/rancher/rancher/milestones/65","html_url":"https://github.com/rancher/rancher/milestones/Release%201.1.0-dev2","labels_url":"https://api.github.com/repos/rancher/rancher/milestones/65/labels","id":1723398,"number":65,"title":"Release 1.1.0-dev2","description":"* International UI framework\r\n* Improved Mesos UI\r\n* Kubernetes ingress controller Phase 1\r\n* Vault integration\r\n* Kubernetes persistent etcd","creator":{"login":"will-chan","id":10134676,"avatar_url":"https://avatars.githubusercontent.com/u/10134676?v=3","gravatar_id":"","url":"https://api.github.com/users/will-chan","html_url":"https://github.com/will-chan","followers_url":"https://api.github.com/users/will-chan/followers","following_url":"https://api.github.com/users/will-chan/following{/other_user}","gists_url":"https://api.github.com/users/will-chan/gists{/gist_id}","starred_url":"https://api.github.com/users/will-chan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/will-chan/subscriptions","organizations_url":"https://api.github.com/users/will-chan/orgs","repos_url":"https://api.github.com/users/will-chan/repos","events_url":"https://api.github.com/users/will-chan/events{/privacy}","received_events_url":"https://api.github.com/users/will-chan/received_events","type":"User","site_admin":false},"open_issues":18,"closed_issues":56,"state":"open","created_at":"2016-04-21T17:40:57Z","updated_at":"2016-05-21T13:33:29Z","due_on":"2016-05-18T07:00:00Z","closed_at":null},"comments":6,"created_at":"2016-04-07T18:47:31Z","updated_at":"2016-05-21T14:35:50Z","closed_at":null,"body":"Rancher Version:\r\n**1.0.0**\r\n\r\nDocker Version:\r\n**Docker version 1.10.3, build 20f81dd**\r\n\r\nOS:\r\n**Centos7 4.5.0-1.el7.elrepo.x86_64 **\r\n\r\nSteps to Reproduce: \r\nCreate a stack, add a service with container (eg, elasticsearch) with managed network and exposed port 9200\r\ncurl http://localhost:9200 return\r\n```\r\n{\r\n  \"name\" : \"Captain Savage\",\r\n  \"cluster_name\" : \"elasticsearch\",\r\n  \"version\" : {\r\n    \"number\" : \"2.3.1\",\r\n    \"build_hash\" : \"bd980929010aef404e7cb0843e61d0665269fc39\",\r\n    \"build_timestamp\" : \"2016-04-04T12:25:05Z\",\r\n    \"build_snapshot\" : false,\r\n    \"lucene_version\" : \"5.5.0\"\r\n  },\r\n  \"tagline\" : \"You Know, for Search\"\r\n}\r\n```\r\ncurl from other host return \r\n```\r\nconnect to 192.168.249.111 port 9200 failed: Connection refused\r\n```\r\nmy iptables, iptables -L -n -t nat\r\n```\r\nChain PREROUTING (policy ACCEPT)\r\ntarget     prot opt source               destination\r\nCATTLE_PREROUTING  all  --  0.0.0.0/0            0.0.0.0/0\r\nPREROUTING_direct  all  --  0.0.0.0/0            0.0.0.0/0\r\nPREROUTING_ZONES_SOURCE  all  --  0.0.0.0/0            0.0.0.0/0\r\nPREROUTING_ZONES  all  --  0.0.0.0/0            0.0.0.0/0\r\nDOCKER     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL\r\n\r\nChain INPUT (policy ACCEPT)\r\ntarget     prot opt source               destination\r\n\r\nChain OUTPUT (policy ACCEPT)\r\ntarget     prot opt source               destination\r\nOUTPUT_direct  all  --  0.0.0.0/0            0.0.0.0/0\r\nDOCKER     all  --  0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL\r\n\r\nChain POSTROUTING (policy ACCEPT)\r\ntarget     prot opt source               destination\r\nCATTLE_POSTROUTING  all  --  0.0.0.0/0            0.0.0.0/0\r\nMASQUERADE  all  --  172.17.0.0/16        0.0.0.0/0\r\nPOSTROUTING_direct  all  --  0.0.0.0/0            0.0.0.0/0\r\nPOSTROUTING_ZONES_SOURCE  all  --  0.0.0.0/0            0.0.0.0/0\r\nPOSTROUTING_ZONES  all  --  0.0.0.0/0            0.0.0.0/0\r\nMASQUERADE  udp  --  172.17.0.2           172.17.0.2           udp dpt:4500\r\nMASQUERADE  udp  --  172.17.0.2           172.17.0.2           udp dpt:500\r\nMASQUERADE  tcp  --  172.17.0.3           172.17.0.3           tcp dpt:9200\r\n\r\nChain CATTLE_POSTROUTING (1 references)\r\ntarget     prot opt source               destination\r\nACCEPT     all  --  10.42.0.0/16         169.254.169.250\r\nMASQUERADE  tcp  --  10.42.0.0/16        !10.42.0.0/16         masq ports: 1024-65535\r\nMASQUERADE  udp  --  10.42.0.0/16        !10.42.0.0/16         masq ports: 1024-65535\r\nMASQUERADE  all  --  10.42.0.0/16        !10.42.0.0/16\r\nSNAT       all  -- !10.42.0.0/16         169.254.169.250      mark match 0x3be07 to:10.42.245.255\r\nSNAT       all  -- !10.42.0.0/16         169.254.169.250      mark match 0x25a1e to:10.42.154.142\r\nMASQUERADE  tcp  --  172.17.0.0/16        0.0.0.0/0            masq ports: 1024-65535\r\nMASQUERADE  udp  --  172.17.0.0/16        0.0.0.0/0            masq ports: 1024-65535\r\n\r\nChain CATTLE_PREROUTING (1 references)\r\ntarget     prot opt source               destination\r\nDNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL tcp dpt:9200 to:10.42.245.255:9200\r\nMARK       all  -- !10.42.0.0/16         169.254.169.250      MAC 02:95:C2:2F:D7:6F MARK set 0x3be07\r\nMARK       all  -- !10.42.0.0/16         169.254.169.250      MAC 02:95:C2:50:C5:41 MARK set 0x25a1e\r\n\r\nChain DOCKER (2 references)\r\ntarget     prot opt source               destination\r\nRETURN     all  --  0.0.0.0/0            0.0.0.0/0\r\nDNAT       udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:4500 to:172.17.0.2:4500\r\nDNAT       udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:500 to:172.17.0.2:500\r\nDNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:9200 to:172.17.0.3:9200\r\n\r\nChain OUTPUT_direct (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain POSTROUTING_ZONES (1 references)\r\ntarget     prot opt source               destination\r\nPOST_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]\r\nPOST_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]\r\n\r\nChain POSTROUTING_ZONES_SOURCE (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain POSTROUTING_direct (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain POST_public (2 references)\r\ntarget     prot opt source               destination\r\nPOST_public_log  all  --  0.0.0.0/0            0.0.0.0/0\r\nPOST_public_deny  all  --  0.0.0.0/0            0.0.0.0/0\r\nPOST_public_allow  all  --  0.0.0.0/0            0.0.0.0/0\r\n\r\nChain POST_public_allow (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain POST_public_deny (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain POST_public_log (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain PREROUTING_ZONES (1 references)\r\ntarget     prot opt source               destination\r\nPRE_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]\r\nPRE_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]\r\n\r\nChain PREROUTING_ZONES_SOURCE (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain PREROUTING_direct (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain PRE_public (2 references)\r\ntarget     prot opt source               destination\r\nPRE_public_log  all  --  0.0.0.0/0            0.0.0.0/0\r\nPRE_public_deny  all  --  0.0.0.0/0            0.0.0.0/0\r\nPRE_public_allow  all  --  0.0.0.0/0            0.0.0.0/0\r\n\r\nChain PRE_public_allow (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain PRE_public_deny (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain PRE_public_log (1 references)\r\ntarget     prot opt source               destination\r\n```\r\n\r\niptables -L -n\r\n```\r\ntarget     prot opt source               destination\r\nACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED\r\nACCEPT     all  --  0.0.0.0/0            0.0.0.0/0\r\nINPUT_direct  all  --  0.0.0.0/0            0.0.0.0/0\r\nINPUT_ZONES_SOURCE  all  --  0.0.0.0/0            0.0.0.0/0\r\nINPUT_ZONES  all  --  0.0.0.0/0            0.0.0.0/0\r\nACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0\r\nREJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited\r\n\r\nChain FORWARD (policy ACCEPT)\r\ntarget     prot opt source               destination\r\nDOCKER-ISOLATION  all  --  0.0.0.0/0            0.0.0.0/0\r\nDOCKER     all  --  0.0.0.0/0            0.0.0.0/0\r\nACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED\r\nACCEPT     all  --  0.0.0.0/0            0.0.0.0/0\r\nACCEPT     all  --  0.0.0.0/0            0.0.0.0/0\r\nACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED\r\nACCEPT     all  --  0.0.0.0/0            0.0.0.0/0\r\nFORWARD_direct  all  --  0.0.0.0/0            0.0.0.0/0\r\nFORWARD_IN_ZONES_SOURCE  all  --  0.0.0.0/0            0.0.0.0/0\r\nFORWARD_IN_ZONES  all  --  0.0.0.0/0            0.0.0.0/0\r\nFORWARD_OUT_ZONES_SOURCE  all  --  0.0.0.0/0            0.0.0.0/0\r\nFORWARD_OUT_ZONES  all  --  0.0.0.0/0            0.0.0.0/0\r\nACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0\r\nREJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited\r\n\r\nChain OUTPUT (policy ACCEPT)\r\ntarget     prot opt source               destination\r\nOUTPUT_direct  all  --  0.0.0.0/0            0.0.0.0/0\r\n\r\nChain DOCKER (1 references)\r\ntarget     prot opt source               destination\r\nACCEPT     udp  --  0.0.0.0/0            172.17.0.2           udp dpt:4500\r\nACCEPT     udp  --  0.0.0.0/0            172.17.0.2           udp dpt:500\r\nACCEPT     tcp  --  0.0.0.0/0            172.17.0.3           tcp dpt:9200\r\n\r\nChain DOCKER-ISOLATION (1 references)\r\ntarget     prot opt source               destination\r\nRETURN     all  --  0.0.0.0/0            0.0.0.0/0\r\n\r\nChain FORWARD_IN_ZONES (1 references)\r\ntarget     prot opt source               destination\r\nFWDI_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]\r\nFWDI_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]\r\n\r\nChain FORWARD_IN_ZONES_SOURCE (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain FORWARD_OUT_ZONES (1 references)\r\ntarget     prot opt source               destination\r\nFWDO_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]\r\nFWDO_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]\r\n\r\nChain FORWARD_OUT_ZONES_SOURCE (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain FORWARD_direct (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain FWDI_public (2 references)\r\ntarget     prot opt source               destination\r\nFWDI_public_log  all  --  0.0.0.0/0            0.0.0.0/0\r\nFWDI_public_deny  all  --  0.0.0.0/0            0.0.0.0/0\r\nFWDI_public_allow  all  --  0.0.0.0/0            0.0.0.0/0\r\n\r\nChain FWDI_public_allow (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain FWDI_public_deny (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain FWDI_public_log (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain FWDO_public (2 references)\r\ntarget     prot opt source               destination\r\nFWDO_public_log  all  --  0.0.0.0/0            0.0.0.0/0\r\nFWDO_public_deny  all  --  0.0.0.0/0            0.0.0.0/0\r\nFWDO_public_allow  all  --  0.0.0.0/0            0.0.0.0/0\r\n\r\nChain FWDO_public_allow (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain FWDO_public_deny (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain FWDO_public_log (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain INPUT_ZONES (1 references)\r\ntarget     prot opt source               destination\r\nIN_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]\r\nIN_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]\r\n\r\nChain INPUT_ZONES_SOURCE (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain INPUT_direct (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain IN_public (2 references)\r\ntarget     prot opt source               destination\r\nIN_public_log  all  --  0.0.0.0/0            0.0.0.0/0\r\nIN_public_deny  all  --  0.0.0.0/0            0.0.0.0/0\r\nIN_public_allow  all  --  0.0.0.0/0            0.0.0.0/0\r\n\r\nChain IN_public_allow (1 references)\r\ntarget     prot opt source               destination\r\nACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22 ctstate NEW\r\nACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:2375 ctstate NEW\r\n\r\nChain IN_public_deny (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain IN_public_log (1 references)\r\ntarget     prot opt source               destination\r\n\r\nChain OUTPUT_direct (1 references)\r\ntarget     prot opt source               destination\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/rancher/rancher/issues/comments/220781058","html_url":"https://github.com/rancher/rancher/issues/4323#issuecomment-220781058","issue_url":"https://api.github.com/repos/rancher/rancher/issues/4323","id":220781058,"user":{"login":"deniseschannon","id":11410997,"avatar_url":"https://avatars.githubusercontent.com/u/11410997?v=3","gravatar_id":"","url":"https://api.github.com/users/deniseschannon","html_url":"https://github.com/deniseschannon","followers_url":"https://api.github.com/users/deniseschannon/followers","following_url":"https://api.github.com/users/deniseschannon/following{/other_user}","gists_url":"https://api.github.com/users/deniseschannon/gists{/gist_id}","starred_url":"https://api.github.com/users/deniseschannon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deniseschannon/subscriptions","organizations_url":"https://api.github.com/users/deniseschannon/orgs","repos_url":"https://api.github.com/users/deniseschannon/repos","events_url":"https://api.github.com/users/deniseschannon/events{/privacy}","received_events_url":"https://api.github.com/users/deniseschannon/received_events","type":"User","site_admin":false},"created_at":"2016-05-21T14:35:50Z","updated_at":"2016-05-21T14:35:50Z","body":"@easyrasta @virtuman Would either of you be able to test the fix in v1.1.0-dev2-rc4 for me? \r\n\r\nI have been unable to get an older setup to test this use case, so it'd be great if you could verify for me. "}}
{"actor":{"display_login":"deniseschannon"}}