-
Notifications
You must be signed in to change notification settings - Fork 2.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Unable to access UDP port 53 exposed by container from network #14365
Comments
By "from the network" do you mean other hosts on the same physical network, and not other containers on a Podman network, correct? If so, I'd assume that you have firewall rules blocking UDP traffic from reaching the host running Podman on that port. Firewalld being off doesn't prevent that, they could be plain iptables. Can you provide the output of |
Yes.
|
Hi, I'm battling with a similar problem, only my new OS is openSUSE MicroOS. I've been using netcat as a low-level connection tester. I've set it up to listen to either UDP or TCP traffic and in another terminal another instance of netcat is used to connect to the first. You could try that to see at low-level if there is any traffic. |
If I run I noticed these in the
I forgot to add these caps. Adding them didn't solve the issue though. I'm now starting
I don't understand why using When I |
Aardvark isn't running, otherwise Conmon wouldn't have been able to bind to 0.0.0.0:53. Can you also provide |
My Fedora VM runs kernel v5.17.5. |
Oh, sorry, typo on my part - |
|
@mheon do you see something useful? You should be able to reproduce the issue if you stop systemd resolved from using the port as indicated in the top comment, and using the |
0 packets matched the for our UDP/53 rules. Same in the hostport-dnat chain. The UDP rules are not matching, so no NAT is happening. Any chance you can run a DNS server on the local system without the Podman stack (maybe run the container with @Luap99 Thoughts? |
I have no idea. I agree that the iptables rules look correct. Can you check with tcpdump where the traffic is going? |
Do you have host directories mapped into the container as volumes? My connection problems were finally solved when I found out, that if I don't map a local directory as a volume into the container, Pi-hole works perfectly. If I uncomment those two volume definitions Pi-hole does not work as a nameserver, I can access web UI, but when volumes are commented out, everything works as with my previous Docker setup.
|
That makes very little sense. Volume mounting and networking are entirely distinct. Are you sure that it's not something to do with the config files you're mounting into the container? |
Thanks! I was so sure that mounting volumes broke something that I never checked the state of my host directory. It was empty, and by accident I had deleted the Ansible task responsible for creating that directory and its contents :) This is what you get when you try to do these things tired. |
initial:
After working query:
And now a query that times out:
So the
Using
I'm not sure what options to use. I'm using: For a query that works (
For a query that times out (
We don't seem to get a reply (or it doesn't show up here). |
@mheon did you see my last comment? Some values are incrementing on the rules. |
Sorry, been caught up in other issues. I'll try and take a look today or tomorrow. |
A friendly reminder that this issue had no activity for 30 days. |
@mheon Any update? |
A friendly reminder that this issue had no activity for 30 days. |
I'm having exact same issue even when it's not port 53 |
@Luap99 PTAL |
macOS has the same error. I can't bind.
Output is
|
OS X is going to be a separate issue, due to the involvement of |
@tmds Is this still an issue? |
I am going to close this since I haven't heard back anything. |
I currently have pihole running with docker on Debian, and I'm trying to get it to work on Fedora Server 36 with podman.
To be able to use port 53, I set
DNSStubListener=no
in/etc/systemd/resolved.conf
I've started the container using
podman
as the root user.I can use the DNS server using
127.0.0.1
:However, it doesn't work from the network. And, even on the machine itself it doesn't work when using the interface ip address:
I tried disabling SELinux, and firewalld, but that doesn't make a difference.
The UDP port (53) can only be reach from localhost.
The TCP ports can be reached from the network.
cc @mheon @rhatdan
The text was updated successfully, but these errors were encountered: