Issues with connecting to FreeSwitch

[renesnezic]

I've followed the instructions in the README and for the most part things went smoothly.
Once everything is running, I'm able to access, log in, join room but unable to use microphone.
Inspecting the network tab there seems to be a problem with the web socket. Checking logs I see multiple errors related to connecting to ESL. Example:
error: [mcs-freeswitch-esl-wrapper] FreeSWITCH ESL connection received error ETIMEDOUT errno=-110, code=ETIMEDOUT, syscall=connect, address=10.7.7.1, port=8021

I've tried using telnet with the above mentioned IP and port from the HOST and the connection is successful but fails if I try doing the same from one of the containers (example: bbb-fsesl-akka)

I feel like I'm missing something basic here.. Any ideas?

[alangecker]

there was often the case, that firewalls blocked the requests.
do you have anything running like ufw, ferm or some other iptables rules?

[renesnezic]

I'm using iptables but with very simple configuration, nothing special. Ufw and firewalld are disabled.
Any ideas how to go about debugging this? I'll try disabling iptables but doubt it will change anything.

[alangecker]

could you paste the output of iptables-save here?

[renesnezic]

# Generated by iptables-save v1.6.0 on Sun Apr 11 11:50:34 2021
*mangle
:PREROUTING ACCEPT [934761:1558346786]
:INPUT ACCEPT [587221:180970481]
:FORWARD ACCEPT [347824:1377398791]
:OUTPUT ACCEPT [658979:84417156]
:POSTROUTING ACCEPT [1006803:1461815947]
COMMIT
# Completed on Sun Apr 11 11:50:34 2021
# Generated by iptables-save v1.6.0 on Sun Apr 11 11:50:34 2021
*nat
:PREROUTING ACCEPT [14543:940576]
:INPUT ACCEPT [6470:461031]
:OUTPUT ACCEPT [22285:1501132]
:POSTROUTING ACCEPT [49225:3117532]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 172.18.0.0/16 ! -o br-2fe7d0e71f9f -j MASQUERADE
-A POSTROUTING -s 10.7.7.0/24 ! -o br-f62c70676b91 -j MASQUERADE
-A POSTROUTING -s 172.20.0.0/16 ! -o br-7879ed92d2ca -j MASQUERADE
-A POSTROUTING -s 172.19.0.0/16 ! -o br-41c6189dba4f -j MASQUERADE
-A POSTROUTING -s 172.17.0.9/32 -d 172.17.0.9/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.9/32 -d 172.17.0.9/32 -p udp -m udp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.12/32 -d 172.17.0.12/32 -p tcp -m tcp --dport 6379 -j MASQUERADE
-A POSTROUTING -s 172.17.0.12/32 -d 172.17.0.12/32 -p udp -m udp --dport 6379 -j MASQUERADE
-A POSTROUTING -s 172.17.0.3/32 -d 172.17.0.3/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.3/32 -d 172.17.0.3/32 -p udp -m udp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.6/32 -d 172.17.0.6/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.6/32 -d 172.17.0.6/32 -p udp -m udp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.7/32 -d 172.17.0.7/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.7/32 -d 172.17.0.7/32 -p udp -m udp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.10/32 -d 172.17.0.10/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.10/32 -d 172.17.0.10/32 -p udp -m udp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.5/32 -d 172.17.0.5/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.5/32 -d 172.17.0.5/32 -p udp -m udp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 993 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p udp -m udp --dport 993 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 587 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p udp -m udp --dport 587 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 25 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p udp -m udp --dport 25 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
-A DOCKER -i br-2fe7d0e71f9f -j RETURN
-A DOCKER -i br-f62c70676b91 -j RETURN
-A DOCKER -i br-7879ed92d2ca -j RETURN
-A DOCKER -i br-41c6189dba4f -j RETURN
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p tcp -m tcp --dport 31412 -j DNAT --to-destination 172.17.0.9:80
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p udp -m udp --dport 31412 -j DNAT --to-destination 172.17.0.9:80
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p tcp -m tcp --dport 28435 -j DNAT --to-destination 172.17.0.12:6379
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p udp -m udp --dport 28435 -j DNAT --to-destination 172.17.0.12:6379
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p tcp -m tcp --dport 22092 -j DNAT --to-destination 172.17.0.3:80
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p udp -m udp --dport 22092 -j DNAT --to-destination 172.17.0.3:80
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p tcp -m tcp --dport 24505 -j DNAT --to-destination 172.17.0.6:80
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p udp -m udp --dport 24505 -j DNAT --to-destination 172.17.0.6:80
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p tcp -m tcp --dport 31084 -j DNAT --to-destination 172.17.0.7:80
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p udp -m udp --dport 31084 -j DNAT --to-destination 172.17.0.7:80
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p tcp -m tcp --dport 25270 -j DNAT --to-destination 172.17.0.10:80
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p udp -m udp --dport 25270 -j DNAT --to-destination 172.17.0.10:80
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p tcp -m tcp --dport 20690 -j DNAT --to-destination 172.17.0.5:80
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p udp -m udp --dport 20690 -j DNAT --to-destination 172.17.0.5:80
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p tcp -m tcp --dport 28695 -j DNAT --to-destination 172.17.0.2:993
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p udp -m udp --dport 28695 -j DNAT --to-destination 172.17.0.2:993
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p tcp -m tcp --dport 25993 -j DNAT --to-destination 172.17.0.2:587
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p udp -m udp --dport 25993 -j DNAT --to-destination 172.17.0.2:587
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p tcp -m tcp --dport 21570 -j DNAT --to-destination 172.17.0.2:25
-A DOCKER -d 172.17.0.1/32 ! -i docker0 -p udp -m udp --dport 21570 -j DNAT --to-destination 172.17.0.2:25
COMMIT
# Completed on Sun Apr 11 11:50:34 2021
# Generated by iptables-save v1.6.0 on Sun Apr 11 11:50:34 2021
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [364113:38781487]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 59405 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4646 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5347 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5222 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5280 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3478 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3008 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8888 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 10000 -j ACCEPT
-A INPUT -p udp -m udp --dport 3478 -j ACCEPT
-A INPUT -p udp -m udp --dport 443 -j ACCEPT
-A INPUT -p udp -m udp --dport 8888 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p udp -m udp --sport 123 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m limit --limit 15/min -j LOG --log-prefix "Dropped by firewall: " --log-level 7
-A INPUT -j DROP
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o br-2fe7d0e71f9f -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-2fe7d0e71f9f -j DOCKER
-A FORWARD -i br-2fe7d0e71f9f ! -o br-2fe7d0e71f9f -j ACCEPT
-A FORWARD -i br-2fe7d0e71f9f -o br-2fe7d0e71f9f -j ACCEPT
-A FORWARD -o br-f62c70676b91 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-f62c70676b91 -j DOCKER
-A FORWARD -i br-f62c70676b91 ! -o br-f62c70676b91 -j ACCEPT
-A FORWARD -i br-f62c70676b91 -o br-f62c70676b91 -j ACCEPT
-A FORWARD -o br-7879ed92d2ca -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-7879ed92d2ca -j DOCKER
-A FORWARD -i br-7879ed92d2ca ! -o br-7879ed92d2ca -j ACCEPT
-A FORWARD -i br-7879ed92d2ca -o br-7879ed92d2ca -j ACCEPT
-A FORWARD -o br-41c6189dba4f -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-41c6189dba4f -j DOCKER
-A FORWARD -i br-41c6189dba4f ! -o br-41c6189dba4f -j ACCEPT
-A FORWARD -i br-41c6189dba4f -o br-41c6189dba4f -j ACCEPT
-A OUTPUT -p udp -m udp --dport 123 -j ACCEPT
-A DOCKER -d 172.17.0.9/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.9/32 ! -i docker0 -o docker0 -p udp -m udp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.12/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 6379 -j ACCEPT
-A DOCKER -d 172.17.0.12/32 ! -i docker0 -o docker0 -p udp -m udp --dport 6379 -j ACCEPT
-A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p udp -m udp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p udp -m udp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.7/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.7/32 ! -i docker0 -o docker0 -p udp -m udp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.10/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.10/32 ! -i docker0 -o docker0 -p udp -m udp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.5/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.5/32 ! -i docker0 -o docker0 -p udp -m udp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 993 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p udp -m udp --dport 993 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 587 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p udp -m udp --dport 587 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 25 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p udp -m udp --dport 25 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-2fe7d0e71f9f ! -o br-2fe7d0e71f9f -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-f62c70676b91 ! -o br-f62c70676b91 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-7879ed92d2ca ! -o br-7879ed92d2ca -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-41c6189dba4f ! -o br-41c6189dba4f -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-2fe7d0e71f9f -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-f62c70676b91 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-7879ed92d2ca -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-41c6189dba4f -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
COMMIT
# Completed on Sun Apr 11 11:50:34 2021

[alangecker]

I am not so good in understanding iptable rules, but for me it seems like you would have a whitelist of ports there and everything else gets dropped. Port 8021 is not part of it:

-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 59405 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4646 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5347 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5222 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5280 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3478 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3008 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8888 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 10000 -j ACCEPT
-A INPUT -p udp -m udp --dport 3478 -j ACCEPT
-A INPUT -p udp -m udp --dport 443 -j ACCEPT
-A INPUT -p udp -m udp --dport 8888 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p udp -m udp --sport 123 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m limit --limit 15/min -j LOG --log-prefix "Dropped by firewall: " --log-level 7
-A INPUT -j DROP

you should allow all connections in the 10.7.7.0/24 subnet ;)

[renesnezic]

I only control traffic in iptables for external traffic. Up to now I never needed any specific docker rules as docker containers usually talk on the same network.
As kurento and freeswitch seem to bind on host, other containers on private networks seem unable to talk to them.
It seems you are correct in that iptables is blocking traffic as turning it off does resolve the issue. Usually docker controls iptables for its connection, so would be good to look in if there is any docker-compose specific settings to do this.

Thank you very much for all the help.

[renesnezic]

If anyone else faces this issue, this is the iptables rule I had to add to get this working:
iptables -I INPUT 1 -s 10.7.7.0/24 -j ACCEPT

Possibly worth mentioning this in README?

[lightweight]

This just saved me on a new Docker-based install of 2.3. Thanks - used sudo ufw allow 10.7.7.0/24. Made all the difference - fixed my Error 1007 (or was it 1004? Dang, not sure).