Docker容器内部端口映射到外部宿主机端口的方法小结

[root@docker- test ~] # docker run -ti -d --name my-nginx9 docker.io/nginx

990752e39d75b977cbff5a944247366662211ce43d16843a452a5697ddded12f

[root@docker- test ~] # docker ps

CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS            NAMES

990752e39d75        docker.io /nginx "nginx -g 'daemon ..." 2 seconds ago       Up 1 second         80 /tcp my-nginx9

这个时候，由于容器my-nginx9在启动时没有指定其内部的80端口映射到宿主机的端口上，所以默认是没法访问的！

现在通过宿主机的iptables进行net转发

首先获得容器的ip地址

[root@docker- test ~] # docker inspect my-nginx9|grep IPAddress
"SecondaryIPAddresses" : null,
"IPAddress" :  "172.17.0.9" ,
"IPAddress" :  "172.17.0.9" ,

[root@docker- test ~] # ping 172.17.0.9

PING 172.17.0.9 (172.17.0.9) 56(84) bytes of data.

64 bytes from 172.17.0.9: icmp_seq=1 ttl=64  time =0.105 ms

64 bytes from 172.17.0.9: icmp_seq=2 ttl=64  time =0.061 ms

.....

[root@docker- test ~] # telnet 172.17.0.9 80

Trying 172.17.0.9...

Connected to 172.17.0.9.

Escape character is  '^]'

centos7下部署iptables环境纪录（关闭默认的firewalle）

参考：http: //www .cnblogs.com /kevingrace/p/5799210 .html

将容器的80端口映射到dockers宿主机的9998端口

[root@docker- test ~] # iptables -t nat -A PREROUTING -p tcp -m tcp --dport 9998 -j DNAT --to-destination 172.17.0.9:80

[root@docker- test ~] # iptables -t nat -A POSTROUTING -d 172.17.0.9/32 -p tcp -m tcp --sport 80 -j SNAT --to-source 192.16.10.214

[root@docker- test ~] # iptables -t filter -A INPUT -p tcp -m state --state NEW -m tcp --dport 9998 -j ACCEPT

保存以上iptables规则

[root@docker- test ~] # iptables-save > /etc/sysconfig/iptables

查看 /etc/sysconfig/iptables 文件，注意下面两行有关icmp-host-prohibited的设置一定要注释掉！否则nat转发会失败！

[root@docker- test ~] # cat /etc/sysconfig/iptables

# Generated by iptables-save v1.4.21 on Fri Aug 10 11:13:57 2018

*nat

:PREROUTING ACCEPT [32:1280]

:INPUT ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:POSTROUTING ACCEPT [0:0]

-A PREROUTING -p tcp -m tcp --dport 9998 -j DNAT --to-destination 172.17.0.9:80

-A POSTROUTING -d 172.17.0.9 /32 -p tcp -m tcp --sport 80 -j SNAT --to- source 192.16.10.214

COMMIT

# Completed on Fri Aug 10 11:13:57 2018

# Generated by iptables-save v1.4.21 on Fri Aug 10 11:13:57 2018

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [50:5056]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 9998 -j ACCEPT

#-A INPUT -j REJECT --reject-with icmp-host-prohibited

#-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

# Completed on Fri Aug 10 11:13:57 2018

最后重启iptbales服务

[root@docker- test ~] # systemctl restart iptables

查看iptables规则

[root@docker- test ~] # iptables -L

Chain INPUT (policy ACCEPT)

target     prot opt  source destination        

ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

ACCEPT     icmp --  anywhere             anywhere           

ACCEPT     all  --  anywhere             anywhere           

ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt: ssh

ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:distinct32

Chain FORWARD (policy ACCEPT)

target     prot opt  source destination        

Chain OUTPUT (policy ACCEPT)

target     prot opt  source destination       

[root@docker- test ~] # iptables -L -t nat

Chain PREROUTING (policy ACCEPT)

target     prot opt  source destination        

DNAT       tcp  --  anywhere             anywhere             tcp dpt:distinct32 to:172.17.0.9:80

Chain INPUT (policy ACCEPT)

target     prot opt  source destination        

Chain OUTPUT (policy ACCEPT)

target     prot opt  source destination        

Chain POSTROUTING (policy ACCEPT)

target     prot opt  source destination        

SNAT       tcp  --  anywhere             172.17.0.9           tcp spt:http to:192.16.10.214

然后访问http: //192 .168.10.214:9998/，就能转发访问到my-nginx9容器的80端口了！！！ 

Original: https://www.cnblogs.com/x_wukong/p/10041071.html
Author: 明明是悟空
Title: Docker容器内部端口映射到外部宿主机端口的方法小结