Fail to access other apps that deployed in micropcf about pcfdev

[davidwadden]

thanks for opening this. we'll take a look at it. this one actually ought to work on AWS, but won't on VirtualBox or VMware due to differences in network configuration.

i don't have an estimate when we'll get to this, i have a feeling this is not a quick fix

[dwu-pivotal]

Looks this is caused by iptables setting in the vm, after I removed two REJECT item in iptables, it works.

[sclevine]

The following adjustment to the iptables rules should enable container-to-container networking (via the public app route) in microPCF for VMWare and Virtualbox:

iptables -D w--input -j REJECT --reject-with icmp-host-prohibited
iptables -A w--input -d 192.168.11.11/32 -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A w--input -d 192.168.11.11/32 -p tcp -m tcp --dport 443 -j ACCEPT
iptables -A w--input -j REJECT --reject-with icmp-host-prohibited

(Removing all of the REJECT rules will definitely break security groups and may introduce some unexpected behavior.)

@davidwadden After tracing an app to app connection, this ended up being more simple than I first thought.

[davidwadden]

@dwu-pivotal our latest nightly build supports container-to-router and container-to-host network access. this will allow apps to connect to one another via the router address. please try that and let us know if you have any issues

[sergiubodiu]

@davidwadden I've tested a mongod instance
so my changes were minimal:
added iptables -A w--input -d 192.168.11.11/32 -p tcp -m tcp --dport 27017 -j ACCEPT
and the on the vbox added port forwarding on 27017 for localhost

[davidwadden]

thanks @sbodiu-pivotal, i realized my term "container-to-host" is ambiguous here. you're running mongodb on your actual physical host (where virtualbox is running), but we enabled traffic to the VM itself (the host from the container POV).

we don't support container-to-host routing and your workaround is appropriate (probably a bit trickier to tweak the iptables to allow forwarding to 192.168.11.1). i'll change the phrasing on what we've actually enabled to "container-to-vm" routing instead

[davidwadden]

this was released with v0.4.1 -- re-open if this doesn't work!

@davidwadden