Access proxy outside server

[ondanieldev]

Hi,

I've setup a docker container on my server using a web proxy. It works fine using the proxy inside my server. However, I wanna use the proxy outside my server, and it's not working. I've tried a lot of thing but nothing has worked. Someone can help me finding out a way to solve it?

My docker-compose.yml:

version: "3"

services:
  transmission-openvpn:
    image: haugene/transmission-openvpn
    container_name: transmission
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    volumes:
      - "~/openvpn/:/data"
      - "~/openvpn/config:/etc/openvpn/custom/"
    ports:
      - 9091:9091
      - 8118:8118
    logging:
      driver: json-file
      options:
        max-size: 10m
    environment:
      - OPENVPN_PROVIDER=custom
      - OPENVPN_CONFIG=US-Roseburg_UDP
      - OPENVPN_USERNAME=ommited
      - OPENVPN_PASSWORD=ommited
      - LOCAL_NETWORK=192.168.0.0/24
      - WEBPROXY_ENABLED=true
      - WEBPROXY_PORT=8118

  transmission-proxy:
    image: haugene/transmission-openvpn-proxy
    container_name: transmission-proxy
    restart: unless-stopped
    links:
      - transmission:transmission
    ports:
      - 8080:8080

To give an example, it works properly if I run (inside my server):

curl --proxy http://localhost:8118 https://httpbin.org/ip

However, it doesn't work if I run (outside my server):

curl --proxy http:/my-ip:8118 https://httpbin.org/ip

Also, I've opened the 8118 port on my server panel, but it is not being shown if I run nmap:

PORT     STATE    SERVICE
22/tcp   open     ssh
25/tcp   filtered smtp
80/tcp   open     http
110/tcp  open     pop3
143/tcp  open     imap
443/tcp  open     https
465/tcp  open     smtps
587/tcp  open     submission
666/tcp  open     doom
888/tcp  open     accessbuilder
993/tcp  open     imaps
995/tcp  open     pop3s
1080/tcp open     socks
1434/tcp filtered ms-sql-m
8080/tcp open     http-proxy
9091/tcp filtered xmltec-xmlmail

So I've tried to use other ports, like 8080. However, when I try it, the port state turns from "open" to "filtered".

Thanks in advance for helping me :)

[edgd1er]

my guess is that privoxy has rules blocking your external traffic or most likely is listening only on localhost interface.

/etc/privoxy/config should a line like: listen-address 172.18.0.13:8118

[ondanieldev]

Running inside my server and outside the container:

It not loads when I do a curl using my IP:

Nothing is being printed here:

[ondanieldev]

could you provide me your docker-compose.yml and /etc/privoxt/config without your sensitive credentials?

[edgd1er]

you could add a line to privoxy's config to have more logs. this should log connections not only errors.
debug 2

nc -v 192.168.0.210 8888
Connection to 192.168.0.210 8888 port [tcp/*] succeeded!

curl -x http://192.168.0.210:8888 https://ifconfig.me/ip
1.2.3.4

docker compose exec transmission grep -v ^# /etc/privoxy/config

user-manual /usr/share/doc/privoxy/user-manual
confdir /etc/privoxy
logdir /var/log/privoxy
actionsfile match-all.action # Actions that are applied to all sites and maybe overruled later on.
actionsfile default.action   # Main actions file
actionsfile user.action      # User customizations
filterfile default.filter
filterfile user.filter      # User customizations
logfile logfile
listen-address 172.18.0.16:8118

toggle  1
enable-remote-toggle  0
enable-remote-http-toggle  0
enable-edit-actions 0
enforce-blocks 0
buffer-limit 4096
enable-proxy-authentication-forwarding 0
forwarded-connect-retries  0
accept-intercepted-requests 0
allow-cgi-request-crunching 0
split-large-forms 0
keep-alive-timeout 5
tolerate-pipelining 1
socket-timeout 300

[edgd1er]

Please note that

• my docker compose use a personal transmission image, based on haugene's though. Some settings may be specific to that image: logs-to_stdout, secrets, transmission v3, ...
• traeffik is set as a proxy
• many settings are set but with default value.
• blocklist as defined fails.

docker-compose.yml

version: "3.5"
services:
  transmission:
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    #command:
    container_name: transmission
    hostname: transmission
    image: edgd1er/transmission-openvpn:tbt_v3
    ports:
      - 8888:8118
      - 9091:9091
    restart: unless-stopped
    dns:
      - 172.18.0.1
    environment:
      - DEBUG=true
      - CREATE_TUN_DEVICE=no
      - DROP_DEFAULT_ROUTE=true
      - PEER_DNS=true
      - LOG_TO_STDOUT=false
      - GLOBAL_APPLY_PERMISSIONS=true
      - HEALTH_CHECK_HOST=google.com
      - LOCAL_NETWORK=192.168.0.0/24
      - NORDVPN_CATEGORY=p2p
      - NORDVPN_COUNTRY=bozostan
      - NORDVPN_PROTOCOL=tcp
      - OPENVPN_USERNAME=
      - OPENVPN_PASSWORD=
      - OPENVPN_PROVIDER=NORDVPN
      - OPENVPN_LOGLEVEL=1
      - OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60 --pull-filter ignore "ping"
      - PGID=100
      - PUID=1001
      - TRANSMISSION_ALT_SPEED_DOWN=1500
      - TRANSMISSION_ALT_SPEED_ENABLED=false
      - TRANSMISSION_ALT_SPEED_TIME_BEGIN=540
      - TRANSMISSION_ALT_SPEED_TIME_DAY=62
      - TRANSMISSION_ALT_SPEED_TIME_ENABLED=true
      - TRANSMISSION_ALT_SPEED_TIME_END=1020
      - TRANSMISSION_ALT_SPEED_UP=150
      - TRANSMISSION_BIND_ADDRESS_IPV4=0.0.0.0
      - 'TRANSMISSION_BIND_ADDRESS_IPV6=::'
      - TRANSMISSION_BLOCKLIST_ENABLED=true
      - TRANSMISSION_BLOCKLIST_URL=https://github.com/Naunter/BT_BlockLists/raw/master/bt_blocklists.gz
      - TRANSMISSION_CACHE_SIZE_MB=4
      - TRANSMISSION_DHT_ENABLED=true
      - TRANSMISSION_DOWNLOAD_LIMIT=5000
      - TRANSMISSION_DOWNLOAD_LIMIT_ENABLED=0
      - TRANSMISSION_DOWNLOAD_QUEUE_ENABLED=true
      - TRANSMISSION_DOWNLOAD_QUEUE_SIZE=5
      - TRANSMISSION_ENCRYPTION=1
      - TRANSMISSION_IDLE_SEEDING_LIMIT=30
      - TRANSMISSION_IDLE_SEEDING_LIMIT_ENABLED=false
      - TRANSMISSION_INCOMPLETE_DIR=/data/incomplete
      - TRANSMISSION_INCOMPLETE_DIR_ENABLED=true
      - TRANSMISSION_LPD_ENABLED=true
      - TRANSMISSION_MAX_PEERS_GLOBAL=200
      - TRANSMISSION_MESSAGE_LEVEL=2
      #- TRANSMISSION_PEER_CONGESTION_ALGORITHM=
      - TRANSMISSION_PEER_ID_TTL_HOURS=6
      - TRANSMISSION_PEER_LIMIT_GLOBAL=200
      - TRANSMISSION_PEER_LIMIT_PER_TORRENT=50
      - TRANSMISSION_PEER_PORT=51413
      - TRANSMISSION_PEER_PORT_RANDOM_HIGH=65535
      - TRANSMISSION_PEER_PORT_RANDOM_LOW=49152
      - TRANSMISSION_PEER_PORT_RANDOM_ON_START=false
      - TRANSMISSION_PEER_SOCKET_TOS=default
      - TRANSMISSION_PEX_ENABLED=true
      - TRANSMISSION_PORT_FORWARDING_ENABLED=false
      - TRANSMISSION_PREALLOCATION=1
      - TRANSMISSION_PREFETCH_ENABLED=1
      - TRANSMISSION_QUEUE_STALLED_ENABLED=true
      - TRANSMISSION_QUEUE_STALLED_MINUTES=30
      - TRANSMISSION_RATIO_LIMIT=2
      - TRANSMISSION_RATIO_LIMIT_ENABLED=false
      - TRANSMISSION_RENAME_PARTIAL_FILES=true
      - TRANSMISSION_RPC_BIND_ADDRESS=0.0.0.0
      - TRANSMISSION_RPC_ENABLED=true
      - TRANSMISSION_RPC_HOST_WHITELIST=
      - TRANSMISSION_RPC_HOST_WHITELIST_ENABLED=false
      - TRANSMISSION_RPC_PORT=9091
      - TRANSMISSION_RPC_AUTHENTICATION_REQUIRED=true
      - TRANSMISSION_RPC_URL=/transmission/
      - TRANSMISSION_RPC_USERNAME=username
      - TRANSMISSION_RPC_PASSWORD=password
      - TRANSMISSION_RPC_WHITELIST=127.0.0.1,192.168.0.*,172.18.0.*
      - TRANSMISSION_RPC_WHITELIST_ENABLED=true
      - TRANSMISSION_SCRAPE_PAUSED_TORRENTS_ENABLED=true
      - TRANSMISSION_SCRIPT_TORRENT_DONE_ENABLED=false
      - TRANSMISSION_SCRIPT_TORRENT_DONE_FILENAME=
      - TRANSMISSION_SEED_QUEUE_ENABLED=false
      - TRANSMISSION_SEED_QUEUE_SIZE=10
      - TRANSMISSION_SPEED_LIMIT_DOWN=5000
      - TRANSMISSION_SPEED_LIMIT_DOWN_ENABLED=true
      - TRANSMISSION_SPEED_LIMIT_UP=250
      - TRANSMISSION_SPEED_LIMIT_UP_ENABLED=true
      - TRANSMISSION_START_ADDED_TORRENTS=true
      - TRANSMISSION_TRASH_ORIGINAL_TORRENT_FILES=false
      - TRANSMISSION_UMASK=2
      - TRANSMISSION_UPLOAD_LIMIT=100
      - TRANSMISSION_UPLOAD_LIMIT_ENABLED=0
      - TRANSMISSION_UPLOAD_SLOTS_PER_TORRENT=14
      - TRANSMISSION_UTP_ENABLED=true
      - TRANSMISSION_WATCH_DIR_ENABLED=true
      - TRANSMISSION_WATCH_DIR_FORCE_GENERIC=false
      - TRANSMISSION_WEB_UI=transmission-web-control
      - TZ=America/Mexico
      - ENABLE_UFW=true
      - UFW_ALLOW_GW_NET=true
      - UFW_DISABLE_IPTABLES_REJECT=false
      - UFW_EXTRA_PORTS=8888,9091
      - WEBPROXY_ENABLED=true
      - WEBPROXY_PORT=
    logging:
      driver: json-file
      options: {}
    networks:
      - traefik_net
    volumes:
      - /root/containers_conf/transmission/config:/config:rw
      - /srv/dev-disk-by-label-R5Store/INCOMING:/data:rw
    labels:
      com.centurylinklabs.watchtower.enable: "true"
      traefik.enable: "true"
      autoheal: "true"
      traefik.http.routers.transmission-s.rule: "Host(`transmission.domain.tld`)"
      traefik.http.routers.transmission-s.entrypoints: "https"
      traefik.http.routers.transmission-s.tls: "true"
      traefik.http.services.transmission-service.loadbalancer.server.port: 9091
    secrets:
      - openvpn_creds
networks:
  traefik_net:
    external: true

secrets:
  openvpn_creds:
    file: ./openvpn_creds

[ondanieldev]

Hey, I'm still getting issues with that :(
This dns field: 172.18.0.1
And this IP on privoxy: 172.18.0.16:8118
What should I put on these fields? I've removed dns field and I've put localhost:8118 on privoxy. But got curl: (56) Recv failure: Connection reset by peer when trying to curl it.

[edgd1er]

It has been a while, you may have found what was wrong in the setup.
I'm running pihole as a local dns, hence the 172.18.0.1, you may use whatever dns server you wish or let docker set it up for your.
As the proxy is ok, with the localhost adress, you could define 0.0.0.0 as the default address in the port section to force listening to all adresses:
- 0.0.0.0:8888:8118
- 0.0.0.0:9091:9091

ss -tlnp src :8888 should list the docker proxy.
I'm afraid your server is blocking that port. firewall ?