Estou executando Ubuntu 16.04.2 LTS e Docker 17.05.0-ce por trás de um proxy da empresa com credenciais.
Meu objetivo é criar um proxy transparente no contêiner docker para que eu não precise mais configurar o proxy em variáveis de ambiente, arquivos de configuração ... e alterar a senha a cada mês sem esquecer uma em todas essas configurações. / p>
Primeiro passo: eu crio uma imagem com esse Dockerfile
FROM ubuntu:16.04
COPY apt.conf /etc/apt/
RUN apt-get update && \
apt-get upgrade -y && \
apt-get install squid -y
RUN rm -f /etc/apt/apt.conf
COPY squid.conf /etc/squid3/squid.conf
COPY entrypoint.sh /sbin/entrypoint.sh
RUN chmod 755 /sbin/entrypoint.sh
EXPOSE 3128/tcp
ENTRYPOINT ["/sbin/entrypoint.sh"]
e esse squid.conf
http_access allow all
http_port 3128 intercept
cache_peer x.x.x.x parent 8080 0 default no-query login=yyy:zzz
never_direct allow all
Então
docker build -t squid .
docker run --rm -d -p 3128:3128 --name squid squid
Agora, se eu fizer
export http_proxy=localhost:3128
curl www.google.be
Está funcionando bem.
Então, o próximo passo seria torná-lo transparente.
Eu tentei com isso (inspirado no link )
unset http_proxy
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
curl www.google.be
Mas não está mais funcionando. O que posso fazer?
Na minha máquina
br-4986226181db Link encap:Ethernet HWaddr ...
inet addr:... Bcast:0.0.0.0 Mask:255.255.0.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
br-5699616a00fb Link encap:Ethernet HWaddr ...
inet addr:... Bcast:0.0.0.0 Mask:255.255.0.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
docker0 Link encap:Ethernet HWaddr ...
inet addr:172.17.0.1 Bcast:0.0.0.0 Mask:255.255.0.0
inet6 addr: ... Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:16908 errors:0 dropped:0 overruns:0 frame:0
TX packets:33405 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:934408 (934.4 KB) TX bytes:47533855 (47.5 MB)
eth0 Link encap:Ethernet HWaddr ...
inet addr:... Bcast:... Mask:255.255.255.0
inet6 addr: ... Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1827743 errors:0 dropped:0 overruns:0 frame:0
TX packets:1131003 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:209300815 (209.3 MB) TX bytes:91477854 (91.4 MB)
Interrupt:16
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:4141231 errors:0 dropped:0 overruns:0 frame:0
TX packets:4141231 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1
RX bytes:311258498 (311.2 MB) TX bytes:311258498 (311.2 MB)
veth8b546f1 Link encap:Ethernet HWaddr ...
inet6 addr: ... Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:36 errors:0 dropped:0 overruns:0 frame:0
TX packets:65 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:16414 (16.4 KB) TX bytes:20798 (20.7 KB)
veth8b546f1 aparece depois de iniciar o contêiner.
e (antes de adicionar a regra)
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DOCKER all -- anywhere anywhere ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DOCKER all -- anywhere !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.0.0/16 anywhere
MASQUERADE all -- 172.18.0.0/16 anywhere
MASQUERADE all -- 172.19.0.0/16 anywhere
MASQUERADE tcp -- 172.17.0.2 172.17.0.2 tcp dpt:3128
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
DNAT tcp -- anywhere anywhere tcp dpt:3128 to:172.17.0.2:3128