iptables -L DOCKER-USER -n -v
Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
[~] #

Process still running.

admin@192.168.7.5's password:
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Console Management - Main menu                                                                                |
  |                                                                                |
  |  1: Show network settings                                                                                |
  |  2: System event logs                                                                                |
  |  3: Reset to factory default (password required)                                                                |
  |  4: Activate/ deactivate a license                                                                              |
  |  5: App management                                                                                |
  |  6: Reboot in Rescue mode (w/o configured disk)                                                                 |
  |  7: Reboot in Maintenance Mode                                                                                |
  |  Q: Quit (return to normal shell environment)                                                                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> q[H[J
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Main > Quit                                                                                |
  |                                                                                |
  |  Are you sure you want to exit the console menu and return to normal shell environment? (Y/N)                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> y[H[J
c(B[0m[J[?25h[~] # iptables -L FORWARD -n -v | head -20
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  52M  153G DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  242  183K ACCEPT     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0
  353 32471 ACCEPT     all  --  lxcbr0 !lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lxcbr0 lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 !br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 !br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  21M 3653M DOCKER     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-39c2a3280439 !br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
  21M 3653M ACCEPT     all  --  br-39c2a3280439 br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
[~] # iptables -L DOCKER-USER -n -v
Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
[~] #


DOCKER-USER just returns everything, so that's not the problem. Let me check if Docker is actually binding to br1 (192.168.7.x network). The issue might be that Docker is only binding to one interface. Let me check the actual port bindings.

process

iptables -t nat -L PREROUTING -n -v | grep -E "(8989|7878|5055)"


Wrote 65 bytes to session vivid-zephyr.


Let me check the PREROUTING NAT rules for these ports.


iptables -t nat -L PREROUTING -n -v | grep -E "(8989|7878|5055)"
[~] #

Process still running.

ssh StrictHostKeyChecking=no

admin@192.168.7.5's password:
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Console Management - Main menu                                                                                |
  |                                                                                |
  |  1: Show network settings                                                                                |
  |  2: System event logs                                                                                |
  |  3: Reset to factory default (password required)                                                                |
  |  4: Activate/ deactivate a license                                                                              |
  |  5: App management                                                                                |
  |  6: Reboot in Rescue mode (w/o configured disk)                                                                 |
  |  7: Reboot in Maintenance Mode                                                                                |
  |  Q: Quit (return to normal shell environment)                                                                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> q[H[J
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Main > Quit                                                                                |
  |                                                                                |
  |  Are you sure you want to exit the console menu and return to normal shell environment? (Y/N)                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> y[H[J
c(B[0m[J[?25h[~] # iptables -L FORWARD -n -v | head -20
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  52M  153G DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  242  183K ACCEPT     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0
  353 32471 ACCEPT     all  --  lxcbr0 !lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lxcbr0 lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 !br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 !br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  21M 3653M DOCKER     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-39c2a3280439 !br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
  21M 3653M ACCEPT     all  --  br-39c2a3280439 br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
[~] # iptables -L DOCKER-USER -n -v
Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
[~] # iptables -t nat -L PREROUTING -n -v | grep -E "(8989|7878|5055)"
[~] #


No matches! That's very strange. Let me check the full PREROUTING chain.

process

iptables -t nat -L PREROUTING -n -v | head -10


Wrote 47 bytes to session vivid-zephyr.


iptables -t nat -L PREROUTING -n -v | head -10
Chain PREROUTING (policy ACCEPT 35 packets, 4713 bytes)
 pkts bytes target     prot opt in     out     source               destination
 543K   30M SYSDOCKER  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
 543K   30M DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
[~] #

Process still running.

ssh StrictHostKeyChecking=no

admin@192.168.7.5's password:
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Console Management - Main menu                                                                                |
  |                                                                                |
  |  1: Show network settings                                                                                |
  |  2: System event logs                                                                                |
  |  3: Reset to factory default (password required)                                                                |
  |  4: Activate/ deactivate a license                                                                              |
  |  5: App management                                                                                |
  |  6: Reboot in Rescue mode (w/o configured disk)                                                                 |
  |  7: Reboot in Maintenance Mode                                                                                |
  |  Q: Quit (return to normal shell environment)                                                                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> q[H[J
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Main > Quit                                                                                |
  |                                                                                |
  |  Are you sure you want to exit the console menu and return to normal shell environment? (Y/N)                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> y[H[J
c(B[0m[J[?25h[~] # iptables -L FORWARD -n -v | head -20
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  52M  153G DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  242  183K ACCEPT     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0
  353 32471 ACCEPT     all  --  lxcbr0 !lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lxcbr0 lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 !br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 !br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  21M 3653M DOCKER     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-39c2a3280439 !br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
  21M 3653M ACCEPT     all  --  br-39c2a3280439 br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
[~] # iptables -L DOCKER-USER -n -v
Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
[~] # iptables -t nat -L PREROUTING -n -v | grep -E "(8989|7878|5055)"
[~] # iptables -t nat -L PREROUTING -n -v | head -10
Chain PREROUTING (policy ACCEPT 35 packets, 4713 bytes)
 pkts bytes target     prot opt in     out     source               destination
 543K   30M SYSDOCKER  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
 543K   30M DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
[~] #


I see - there's a SYSDOCKER chain that runs BEFORE the DOCKER chain. This might be QNAP-specific. Let me check what's in SYSDOCKER.

process

iptables -t nat -L SYSDOCKER -n -v 2>/dev/null | head -20


Wrote 58 bytes to session vivid-zephyr.


iptables -t nat -L SYSDOCKER -n -v 2>/dev/null | head -20
Chain SYSDOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6056 to:172.30.0.2:80
[~] #

Process still running.

ssh StrictHostKeyChecking=no

admin@192.168.7.5's password:
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Console Management - Main menu                                                                                |
  |                                                                                |
  |  1: Show network settings                                                                                |
  |  2: System event logs                                                                                |
  |  3: Reset to factory default (password required)                                                                |
  |  4: Activate/ deactivate a license                                                                              |
  |  5: App management                                                                                |
  |  6: Reboot in Rescue mode (w/o configured disk)                                                                 |
  |  7: Reboot in Maintenance Mode                                                                                |
  |  Q: Quit (return to normal shell environment)                                                                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> q[H[J
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Main > Quit                                                                                |
  |                                                                                |
  |  Are you sure you want to exit the console menu and return to normal shell environment? (Y/N)                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> y[H[J
c(B[0m[J[?25h[~] # iptables -L FORWARD -n -v | head -20
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  52M  153G DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  242  183K ACCEPT     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0
  353 32471 ACCEPT     all  --  lxcbr0 !lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lxcbr0 lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 !br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 !br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  21M 3653M DOCKER     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-39c2a3280439 !br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
  21M 3653M ACCEPT     all  --  br-39c2a3280439 br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
[~] # iptables -L DOCKER-USER -n -v
Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
[~] # iptables -t nat -L PREROUTING -n -v | grep -E "(8989|7878|5055)"
[~] # iptables -t nat -L PREROUTING -n -v | head -10
Chain PREROUTING (policy ACCEPT 35 packets, 4713 bytes)
 pkts bytes target     prot opt in     out     source               destination
 543K   30M SYSDOCKER  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
 543K   30M DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
[~] # iptables -t nat -L SYSDOCKER -n -v 2>/dev/null | head -20
Chain SYSDOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6056 to:172.30.0.2:80
[~] #


OK, so SYSDOCKER only has one rule for port 6056. Let me check the DOCKER NAT chain.

process

iptables -t nat -L DOCKER -n -v | grep -E "(8989|7878|5055)"


Wrote 61 bytes to session vivid-zephyr.


iptables -t nat -L DOCKER -n -v | grep -E "(8989|7878|5055)"
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:7878 to:172.29.4.5:7878
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8989 to:172.29.4.16:8989
    7   448 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5055 to:172.29.4.19:5055
[~] #

Process still running.

ssh StrictHostKeyChecking=no

admin@192.168.7.5's password:
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Console Management - Main menu                                                                                |
  |                                                                                |
  |  1: Show network settings                                                                                |
  |  2: System event logs                                                                                |
  |  3: Reset to factory default (password required)                                                                |
  |  4: Activate/ deactivate a license                                                                              |
  |  5: App management                                                                                |
  |  6: Reboot in Rescue mode (w/o configured disk)                                                                 |
  |  7: Reboot in Maintenance Mode                                                                                |
  |  Q: Quit (return to normal shell environment)                                                                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> q[H[J
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Main > Quit                                                                                |
  |                                                                                |
  |  Are you sure you want to exit the console menu and return to normal shell environment? (Y/N)                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> y[H[J
c(B[0m[J[?25h[~] # iptables -L FORWARD -n -v | head -20
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  52M  153G DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  242  183K ACCEPT     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0
  353 32471 ACCEPT     all  --  lxcbr0 !lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lxcbr0 lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 !br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 !br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  21M 3653M DOCKER     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-39c2a3280439 !br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
  21M 3653M ACCEPT     all  --  br-39c2a3280439 br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
[~] # iptables -L DOCKER-USER -n -v
Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
[~] # iptables -t nat -L PREROUTING -n -v | grep -E "(8989|7878|5055)"
[~] # iptables -t nat -L PREROUTING -n -v | head -10
Chain PREROUTING (policy ACCEPT 35 packets, 4713 bytes)
 pkts bytes target     prot opt in     out     source               destination
 543K   30M SYSDOCKER  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
 543K   30M DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
[~] # iptables -t nat -L SYSDOCKER -n -v 2>/dev/null | head -20
Chain SYSDOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6056 to:172.30.0.2:80
[~] # iptables -t nat -L DOCKER -n -v | grep -E "(8989|7878|5055)"
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:7878 to:172.29.4.5:7878
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8989 to:172.29.4.16:8989
    7   448 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5055 to:172.29.4.19:5055
[~] #


OK, so the DNAT rules are there. Let me verify the IPs match the current container IPs.

process

docker inspect sonarr radarr jellyseerr | grep -E '"IPAddress": "172' | head -5


Wrote 80 bytes to session vivid-zephyr.


Let me verify the container IPs match the DNAT rules.


docker inspect sonarr radarr jellyseerr | grep -E '"IPAddress": "172' | head -5
                    "IPAddress": "172.29.4.16",
                    "IPAddress": "172.29.4.5",
                    "IPAddress": "172.29.4.19",
                    "IPAddress": "172.29.12.10",
[~] #

Process still running.

ssh StrictHostKeyChecking=no

admin@192.168.7.5's password:
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Console Management - Main menu                                                                                |
  |                                                                                |
  |  1: Show network settings                                                                                |
  |  2: System event logs                                                                                |
  |  3: Reset to factory default (password required)                                                                |
  |  4: Activate/ deactivate a license                                                                              |
  |  5: App management                                                                                |
  |  6: Reboot in Rescue mode (w/o configured disk)                                                                 |
  |  7: Reboot in Maintenance Mode                                                                                |
  |  Q: Quit (return to normal shell environment)                                                                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> q[H[J
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Main > Quit                                                                                |
  |                                                                                |
  |  Are you sure you want to exit the console menu and return to normal shell environment? (Y/N)                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> y[H[J
c(B[0m[J[?25h[~] # iptables -L FORWARD -n -v | head -20
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  52M  153G DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  242  183K ACCEPT     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0
  353 32471 ACCEPT     all  --  lxcbr0 !lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lxcbr0 lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 !br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 !br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  21M 3653M DOCKER     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-39c2a3280439 !br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
  21M 3653M ACCEPT     all  --  br-39c2a3280439 br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
[~] # iptables -L DOCKER-USER -n -v
Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
[~] # iptables -t nat -L PREROUTING -n -v | grep -E "(8989|7878|5055)"
[~] # iptables -t nat -L PREROUTING -n -v | head -10
Chain PREROUTING (policy ACCEPT 35 packets, 4713 bytes)
 pkts bytes target     prot opt in     out     source               destination
 543K   30M SYSDOCKER  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
 543K   30M DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
[~] # iptables -t nat -L SYSDOCKER -n -v 2>/dev/null | head -20
Chain SYSDOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6056 to:172.30.0.2:80
[~] # iptables -t nat -L DOCKER -n -v | grep -E "(8989|7878|5055)"
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:7878 to:172.29.4.5:7878
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8989 to:172.29.4.16:8989
    7   448 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5055 to:172.29.4.19:5055
[~] # docker inspect sonarr radarr jellyseerr | grep -E '"IPAddress": "172' | head -5
                    "IPAddress": "172.29.4.16",
                    "IPAddress": "172.29.4.5",
                    "IPAddress": "172.29.4.19",
                    "IPAddress": "172.29.12.10",
[~] #


The IPs match:
- sonarr: 172.29.4.16 ✓
- radarr: 172.29.4.5 ✓
- jellyseerr: 172.29.4.19 ✓ (and 172.29.12.10 on traefik-public)

So the NAT rules are correct. Let me check if there's a problem with the INPUT chain or if the connection is being dropped somewhere else. Let me trace what's happening with a specific port.


Wrote 35 bytes to session vivid-zephyr.


iptables -L INPUT -n -v | head -15
Chain INPUT (policy ACCEPT 12204 packets, 9809K bytes)
 pkts bytes target     prot opt in     out     source               destination
  19M 2502M QUFIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW
[~] #

Process still running.

admin@192.168.7.5's password:
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Console Management - Main menu                                                                                |
  |                                                                                |
  |  1: Show network settings                                                                                |
  |  2: System event logs                                                                                |
  |  3: Reset to factory default (password required)                                                                |
  |  4: Activate/ deactivate a license                                                                              |
  |  5: App management                                                                                |
  |  6: Reboot in Rescue mode (w/o configured disk)                                                                 |
  |  7: Reboot in Maintenance Mode                                                                                |
  |  Q: Quit (return to normal shell environment)                                                                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> q[H[J
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Main > Quit                                                                                |
  |                                                                                |
  |  Are you sure you want to exit the console menu and return to normal shell environment? (Y/N)                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> y[H[J
c(B[0m[J[?25h[~] # iptables -L FORWARD -n -v | head -20
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  52M  153G DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  242  183K ACCEPT     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0
  353 32471 ACCEPT     all  --  lxcbr0 !lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lxcbr0 lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 !br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 !br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  21M 3653M DOCKER     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-39c2a3280439 !br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
  21M 3653M ACCEPT     all  --  br-39c2a3280439 br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
[~] # iptables -L DOCKER-USER -n -v
Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
[~] # iptables -t nat -L PREROUTING -n -v | grep -E "(8989|7878|5055)"
[~] # iptables -t nat -L PREROUTING -n -v | head -10
Chain PREROUTING (policy ACCEPT 35 packets, 4713 bytes)
 pkts bytes target     prot opt in     out     source               destination
 543K   30M SYSDOCKER  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
 543K   30M DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
[~] # iptables -t nat -L SYSDOCKER -n -v 2>/dev/null | head -20
Chain SYSDOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6056 to:172.30.0.2:80
[~] # iptables -t nat -L DOCKER -n -v | grep -E "(8989|7878|5055)"
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:7878 to:172.29.4.5:7878
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8989 to:172.29.4.16:8989
    7   448 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5055 to:172.29.4.19:5055
[~] # docker inspect sonarr radarr jellyseerr | grep -E '"IPAddress": "172' | head -5
                    "IPAddress": "172.29.4.16",
                    "IPAddress": "172.29.4.5",
                    "IPAddress": "172.29.4.19",
                    "IPAddress": "172.29.12.10",
[~] # iptables -L INPUT -n -v | head -15
Chain INPUT (policy ACCEPT 12204 packets, 9809K bytes)
 pkts bytes target     prot opt in     out     source               destination
  19M 2502M QUFIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW
[~] #


There's a QUFIREWALL chain for new connections! This is QNAP's firewall. Let me check what rules are in it.

process

iptables -L QUFIREWALL -n -v 2>/dev/null | head -30


Wrote 52 bytes to session vivid-zephyr.


iptables -L QUFIREWALL -n -v 2>/dev/null | head -30
Chain QUFIREWALL (1 references)
 pkts bytes target     prot opt in     out     source               destination
[~] #

Process still running.

ssh StrictHostKeyChecking=no

admin@192.168.7.5's password:
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Console Management - Main menu                                                                                |
  |                                                                                |
  |  1: Show network settings                                                                                |
  |  2: System event logs                                                                                |
  |  3: Reset to factory default (password required)                                                                |
  |  4: Activate/ deactivate a license                                                                              |
  |  5: App management                                                                                |
  |  6: Reboot in Rescue mode (w/o configured disk)                                                                 |
  |  7: Reboot in Maintenance Mode                                                                                |
  |  Q: Quit (return to normal shell environment)                                                                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> q[H[J
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Main > Quit                                                                                |
  |                                                                                |
  |  Are you sure you want to exit the console menu and return to normal shell environment? (Y/N)                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> y[H[J
c(B[0m[J[?25h[~] # iptables -L FORWARD -n -v | head -20
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  52M  153G DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  242  183K ACCEPT     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0
  353 32471 ACCEPT     all  --  lxcbr0 !lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lxcbr0 lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 !br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 !br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  21M 3653M DOCKER     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-39c2a3280439 !br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
  21M 3653M ACCEPT     all  --  br-39c2a3280439 br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
[~] # iptables -L DOCKER-USER -n -v
Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
[~] # iptables -t nat -L PREROUTING -n -v | grep -E "(8989|7878|5055)"
[~] # iptables -t nat -L PREROUTING -n -v | head -10
Chain PREROUTING (policy ACCEPT 35 packets, 4713 bytes)
 pkts bytes target     prot opt in     out     source               destination
 543K   30M SYSDOCKER  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
 543K   30M DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
[~] # iptables -t nat -L SYSDOCKER -n -v 2>/dev/null | head -20
Chain SYSDOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6056 to:172.30.0.2:80
[~] # iptables -t nat -L DOCKER -n -v | grep -E "(8989|7878|5055)"
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:7878 to:172.29.4.5:7878
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8989 to:172.29.4.16:8989
    7   448 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5055 to:172.29.4.19:5055
[~] # docker inspect sonarr radarr jellyseerr | grep -E '"IPAddress": "172' | head -5
                    "IPAddress": "172.29.4.16",
                    "IPAddress": "172.29.4.5",
                    "IPAddress": "172.29.4.19",
                    "IPAddress": "172.29.12.10",
[~] # iptables -L INPUT -n -v | head -15
Chain INPUT (policy ACCEPT 12204 packets, 9809K bytes)
 pkts bytes target     prot opt in     out     source               destination
  19M 2502M QUFIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW
[~] # iptables -L QUFIREWALL -n -v 2>/dev/null | head -30
Chain QUFIREWALL (1 references)
 pkts bytes target     prot opt in     out     source               destination
[~] #


QUFIREWALL is empty. But wait - the INPUT chain is for traffic destined TO the host, not forwarded traffic. Docker port forwarding goes through FORWARD chain.

Let me think about this... The issue might be more subtle. When I test from inside the QNAP, I'm connecting to localhost which goes through loopback interface. When connecting from outside, the traffic comes from br1 (192.168.7.x).

Let me check if there's something specific about br1 interface or routing.


Wrote 14 bytes to session vivid-zephyr.


ip route show
default via 192.168.7.1 dev br1  proto static  metric 100
10.0.3.0/24 dev lxcbr0  proto kernel  scope link  src 10.0.3.1
10.0.5.0/24 dev docker0  proto kernel  scope link  src 10.0.5.1
10.0.7.0/24 dev lxdbr0  proto kernel  scope link  src 10.0.7.1
127.0.0.0/8 dev lo  scope link
169.254.0.0/16 dev tbtbr0  proto kernel  scope link  src 169.254.9.248 linkdown
172.29.0.0/22 dev br-617a54ad0f6d  proto kernel  scope link  src 172.29.0.1
172.29.0.0/22 dev br-b6bf9f831e2a  proto kernel  scope link  src 172.29.0.1
172.29.4.0/22 dev br-19e8edbf2211  proto kernel  scope link  src 172.29.4.1
172.29.4.0/22 dev br-39c2a3280439  proto kernel  scope link  src 172.29.4.1
172.29.8.0/22 dev br-c404fcb20277  proto kernel  scope link  src 172.29.8.1
172.29.12.0/22 dev br-da2d38a13b68  proto kernel  scope link  src 172.29.12.1
172.29.16.0/22 dev br-73e7e6797181  proto kernel  scope link  src 172.29.16.1
172.29.20.0/22 dev br-8ce7a78907a8  proto kernel  scope link  src 172.29.20.1
172.29.24.0/22 dev br-85b88b2612a8  proto kernel  scope link  src 172.29.24.1
172.29.28.0/22 dev br-8c29f4fbbf26  proto kernel  scope link  src 172.29.28.1
172.29.32.0/22 dev br-e871d3de8cb3  proto kernel  scope link  src 172.29.32.1
172.30.0.0/22 dev br-fe84eb1c6df1  proto kernel  scope link  src 172.30.0.1
192.168.7.0/24 dev br1  proto kernel  scope link  src 192.168.7.5
192.168.8.0/24 dev br0  proto kernel  scope link  src 192.168.8.237
[~] #

Process still running.

admin@192.168.7.5's password:
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Console Management - Main menu                                                                                |
  |                                                                                |
  |  1: Show network settings                                                                                |
  |  2: System event logs                                                                                |
  |  3: Reset to factory default (password required)                                                                |
  |  4: Activate/ deactivate a license                                                                              |
  |  5: App management                                                                                |
  |  6: Reboot in Rescue mode (w/o configured disk)                                                                 |
  |  7: Reboot in Maintenance Mode                                                                                |
  |  Q: Quit (return to normal shell environment)                                                                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> q[H[J
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Main > Quit                                                                                |
  |                                                                                |
  |  Are you sure you want to exit the console menu and return to normal shell environment? (Y/N)                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> y[H[J
c(B[0m[J[?25h[~] # iptables -L FORWARD -n -v | head -20
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  52M  153G DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  242  183K ACCEPT     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0
  353 32471 ACCEPT     all  --  lxcbr0 !lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lxcbr0 lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 !br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 !br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  21M 3653M DOCKER     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-39c2a3280439 !br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
  21M 3653M ACCEPT     all  --  br-39c2a3280439 br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
[~] # iptables -L DOCKER-USER -n -v
Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
[~] # iptables -t nat -L PREROUTING -n -v | grep -E "(8989|7878|5055)"
[~] # iptables -t nat -L PREROUTING -n -v | head -10
Chain PREROUTING (policy ACCEPT 35 packets, 4713 bytes)
 pkts bytes target     prot opt in     out     source               destination
 543K   30M SYSDOCKER  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
 543K   30M DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
[~] # iptables -t nat -L SYSDOCKER -n -v 2>/dev/null | head -20
Chain SYSDOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6056 to:172.30.0.2:80
[~] # iptables -t nat -L DOCKER -n -v | grep -E "(8989|7878|5055)"
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:7878 to:172.29.4.5:7878
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8989 to:172.29.4.16:8989
    7   448 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5055 to:172.29.4.19:5055
[~] # docker inspect sonarr radarr jellyseerr | grep -E '"IPAddress": "172' | head -5
                    "IPAddress": "172.29.4.16",
                    "IPAddress": "172.29.4.5",
                    "IPAddress": "172.29.4.19",
                    "IPAddress": "172.29.12.10",
[~] # iptables -L INPUT -n -v | head -15
Chain INPUT (policy ACCEPT 12204 packets, 9809K bytes)
 pkts bytes target     prot opt in     out     source               destination
  19M 2502M QUFIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW
[~] # iptables -L QUFIREWALL -n -v 2>/dev/null | head -30
Chain QUFIREWALL (1 references)
 pkts bytes target     prot opt in     out     source               destination
[~] # ip route show
default via 192.168.7.1 dev br1  proto static  metric 100
10.0.3.0/24 dev lxcbr0  proto kernel  scope link  src 10.0.3.1
10.0.5.0/24 dev docker0  proto kernel  scope link  src 10.0.5.1
10.0.7.0/24 dev lxdbr0  proto kernel  scope link  src 10.0.7.1
127.0.0.0/8 dev lo  scope link
169.254.0.0/16 dev tbtbr0  proto kernel  scope link  src 169.254.9.248 linkdown
172.29.0.0/22 dev br-617a54ad0f6d  proto kernel  scope link  src 172.29.0.1
172.29.0.0/22 dev br-b6bf9f831e2a  proto kernel  scope link  src 172.29.0.1
172.29.4.0/22 dev br-19e8edbf2211  proto kernel  scope link  src 172.29.4.1
172.29.4.0/22 dev br-39c2a3280439  proto kernel  scope link  src 172.29.4.1
172.29.8.0/22 dev br-c404fcb20277  proto kernel  scope link  src 172.29.8.1
172.29.12.0/22 dev br-da2d38a13b68  proto kernel  scope link  src 172.29.12.1
172.29.16.0/22 dev br-73e7e6797181  proto kernel  scope link  src 172.29.16.1
172.29.20.0/22 dev br-8ce7a78907a8  proto kernel  scope link  src 172.29.20.1
172.29.24.0/22 dev br-85b88b2612a8  proto kernel  scope link  src 172.29.24.1
172.29.28.0/22 dev br-8c29f4fbbf26  proto kernel  scope link  src 172.29.28.1
172.29.32.0/22 dev br-e871d3de8cb3  proto kernel  scope link  src 172.29.32.1
172.30.0.0/22 dev br-fe84eb1c6df1  proto kernel  scope link  src 172.30.0.1
192.168.7.0/24 dev br1  proto kernel  scope link  src 192.168.7.5
192.168.8.0/24 dev br0  proto kernel  scope link  src 192.168.8.237
[~] #


I notice that there's a duplicate route problem - 172.29.0.0/22 appears twice, and 172.29.4.0/22 appears twice. This might cause some issues but probably not the main problem.

Let me try something - maybe the problem is that Docker only bound to certain interfaces. Let me check if there's a Docker daemon configuration that might be limiting bindings.

process

cat /etc/docker/daemon.json 2>/dev/null || echo "no daemon.json"


Wrote 65 bytes to session vivid-zephyr.


cat /etc/docker/daemon.json 2>/dev/null || echo "no daemon.json"
no daemon.json
[~] #

Process still running.

ssh StrictHostKeyChecking=no

admin@192.168.7.5's password:
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Console Management - Main menu                                                                                |
  |                                                                                |
  |  1: Show network settings                                                                                |
  |  2: System event logs                                                                                |
  |  3: Reset to factory default (password required)                                                                |
  |  4: Activate/ deactivate a license                                                                              |
  |  5: App management                                                                                |
  |  6: Reboot in Rescue mode (w/o configured disk)                                                                 |
  |  7: Reboot in Maintenance Mode                                                                                |
  |  Q: Quit (return to normal shell environment)                                                                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> q[H[J
[H[J

  +-----------------------------------------------------------------------------------------------------------------+
  |  Main > Quit                                                                                |
  |                                                                                |
  |  Are you sure you want to exit the console menu and return to normal shell environment? (Y/N)                   |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  |                                                                                |
  +-----------------------------------------------------------------------------------------------------------------+
  >>
[K  >>
[K  >> y[H[J
c(B[0m[J[?25h[~] # iptables -L FORWARD -n -v | head -20
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  52M  153G DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  242  183K ACCEPT     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0
  353 32471 ACCEPT     all  --  lxcbr0 !lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  lxcbr0 lxcbr0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 !br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-c404fcb20277 br-c404fcb20277  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 !br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-73e7e6797181 br-73e7e6797181  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  21M 3653M DOCKER     all  --  *      br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br-39c2a3280439 !br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
  21M 3653M ACCEPT     all  --  br-39c2a3280439 br-39c2a3280439  0.0.0.0/0            0.0.0.0/0
[~] # iptables -L DOCKER-USER -n -v
Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
  52M  153G RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
[~] # iptables -t nat -L PREROUTING -n -v | grep -E "(8989|7878|5055)"
[~] # iptables -t nat -L PREROUTING -n -v | head -10
Chain PREROUTING (policy ACCEPT 35 packets, 4713 bytes)
 pkts bytes target     prot opt in     out     source               destination
 543K   30M SYSDOCKER  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
 543K   30M DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
[~] # iptables -t nat -L SYSDOCKER -n -v 2>/dev/null | head -20
Chain SYSDOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6056 to:172.30.0.2:80
[~] # iptables -t nat -L DOCKER -n -v | grep -E "(8989|7878|5055)"
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:7878 to:172.29.4.5:7878
    8   508 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8989 to:172.29.4.16:8989
    7   448 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5055 to:172.29.4.19:5055
[~] # docker inspect sonarr radarr jellyseerr | grep -E '"IPAddress": "172' | head -5
                    "IPAddress": "172.29.4.16",
                    "IPAddress": "172.29.4.5",
                    "IPAddress": "172.29.4.19",
                    "IPAddress": "172.29.12.10",
[~] # iptables -L INPUT -n -v | head -15
Chain INPUT (policy ACCEPT 12204 packets, 9809K bytes)
 pkts bytes target     prot opt in     out     source               destination
  19M 2502M QUFIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW
[~] # iptables -L QUFIREWALL -n -v 2>/dev/null | head -30
Chain QUFIREWALL (1 references)
 pkts bytes target     prot opt in     out     source               destination
[~] # ip route show
default via 192.168.7.1 dev br1  proto static  metric 100
10.0.3.0/24 dev lxcbr0  proto kernel  scope link  src 10.0.3.1
10.0.5.0/24 dev docker0  proto kernel  scope link  src 10.0.5.1
10.0.7.0/24 dev lxdbr0  proto kernel  scope link  src 10.0.7.1
127.0.0.0/8 dev lo  scope link
169.254.0.0/16 dev tbtbr0  proto kernel  scope link  src 169.254.9.248 linkdown
172.29.0.0/22 dev br-617a54ad0f6d  proto kernel  scope link  src 172.29.0.1
172.29.0.0/22 dev br-b6bf9f831e2a  proto kernel  scope link  src 172.29.0.1
172.29.4.0/22 dev br-19e8edbf2211  proto kernel  scope link  src 172.29.4.1
172.29.4.0/22 dev br-39c2a3280439  proto kernel  scope link  src 172.29.4.1
172.29.8.0/22 dev br-c404fcb20277  proto kernel  scope link  src 172.29.8.1
172.29.12.0/22 dev br-da2d38a13b68  proto kernel  scope link  src 172.29.12.1
172.29.16.0/22 dev br-73e7e6797181  proto kernel  scope link  src 172.29.16.1
172.29.20.0/22 dev br-8ce7a78907a8  proto kernel  scope link  src 172.29.20.1
172.29.24.0/22 dev br-85b88b2612a8  proto kernel  scope link  src 172.29.24.1
172.29.28.0/22 dev br-8c29f4fbbf26  proto kernel  scope link  src 172.29.28.1
172.29.32.0/22 dev br-e871d3de8cb3  proto kernel  scope link  src 172.29.32.1
172.30.0.0/22 dev br-fe84eb1c6df1  proto kernel  scope link  src 172.30.0.1
192.168.7.0/24 dev br1  proto kernel  scope link  src 192.168.7.5
192.168.8.0/24 dev br0  proto kernel  scope link  src 192.168.8.237
[~] # cat /etc/docker/daemon.json 2>/dev/null || echo "no daemon.json"
no daemon.json
[~] #


No daemon.json. Let me try restarting Docker entirely - this might fix stale iptables rules.

process

systemctl restart docker 2>/dev/null || /etc/init.d/docker.sh restart 2>/dev/null || echo "trying Container Station restart"


Wrote 125 bytes to session vivid-zephyr.