Setup:
RPi 5 running RaspberryPi OS lite (64bit)
VPS running Ubuntu 22.04.4
Both connected via Wireguard routing all traffic through the tunnel (I don’t like port forwarding). Works fine.
Intended Endstate: Having docker installed and properly running to install nextcloud on it.
Problem:
When running docker run hello-world on the RPi I get the following error:
Unable to find image 'hello-world:latest' locally
docker: Error response from daemon: unknown: <html><body><h1>408 Request Time-out</h1>
Your browser didn't send a complete request in time.</body></html>.
See 'docker run --help'.
nftables.conf for VPS:
table inet filter {
chain postrouting {
type nat hook postrouting priority 100; policy accept;
iifname $wg0_if oifname $pub_if masquerade
iifname $wg0_if oifname $wg0_if masquerade
}
chain input {
type filter hook input priority 0; policy drop;
# allow established/related connections
ct state {established, related} accept
# early drop of invalid connections
ct state invalid drop
# allow from loopback
iifname $lo_if accept
# allow icmp
ip protocol icmp ct state established accept
ip6 nexthdr icmpv6 ct state established accept
# allow ssh,http
tcp dport {ssh,http,https} accept
# Allow Wireguard
iifname $pub_if udp dport $wg0_port accept
iifname $wg0_if accept
tcp dport 123 drop
}
chain forward {
type filter hook forward priority 0; policy drop;
ct state { established,related } accept
iifname $wg0_if oifname $pub_if accept
iifname $wg0_if oifname $wg0_if accept
iifname $pub_if oifname $wg0_if accept
}
chain output {
type filter hook output priority 0;
}
}
nftables.conf for RPi:
table ip ip_filter {
chain natprerouting {
type nat hook prerouting priority 0; policy accept;
oifname $wg_if udp dport $wg_port dnat $VPS_IP
oifname $wg_if tcp dport { 80, 443 } dnat $VPS_IP
}
chain input {
type filter hook input priority 0; policy drop;
# allow established/related connections
ct state {established, related} accept
# early drop of invalid connections
ct state invalid drop
# allow from loopback
iifname lo accept
# allow icmp
ip protocol icmp accept
# allow ssh,http
tcp dport {ssh,http,https} accept
# Allow Wireguard
udp dport $wg_port accept
}
chain forward {
type filter hook forward priority 0; policy drop;
}
chain output {
type filter hook output priority 0; policy accept;
ct state {established, related} accept
}
}
I tried tcpdump on the VPS while running hello-world on the RPi. I see traffic from RPi to VPS, from VPS to docker and vice versa, from VPS to RPi.
When disabling Wireguard on the RPi everything works fine. So I guess it is either the VPS not handling traffic correct or the RPi not accepting the answers from the VPS.
New contributor
UltraW1re is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.