Allow bridged or NAT networking as an optional alternative to host-only network

[jonbca]

The host-only network that boot2docker exposes (via vbox) is not compatible with the Cisco Anyconnect VPN client. The VPN client (when running in split-tunnel mode) automatically adds firewall rules (at least on MacOS it does). The firewall rules block all network traffic except the whitelisted hosts on the VPN network, and the public internet over the en* ports. In effect, all network traffic via vboxnet0 is firewalled off.

If boot2docker made bridged or NAT networking available as an alternative to host-only networking, then Cisco AnyConnect VPN users could access their boot2docker hosts.

I realise that this opens a potential security hole, however I believe the impact is low because it would typically only be used by Cisco VPN users. The alternative is having no docker, which I think is worse.

[ghost]

Can confirm this. I'm in the process of introducing docker into the company. The majority are using a MacBook Pro/Air with Cisco AnyConnect VPN. Is there any solution for this problem?

[SvenDowideit]

we stopped using the NAT port forwarding because it gave us reliability issues.

but we will need to find a solution to this, yes.

[bortels]

This was an issue for me as well, so I looked around and found a workaround, at least.

In a nutshell - anyconnect's default firewall rules on OS X don't know about vboxnet0 and don't allow it.

For my install, the last few lines of the firewall looked like:

00060 skipto 65535 ip from 10.102.13.173 to 255.255.255.255 via utun0 out
00061 deny ip from any to any
65535 allow ip from any to any

And I did the following to fix it:

sudo ipfw delete 00061
sudo ipfw add 00061 skipto 65535 ip from 192.168.59.3 to 192.168.59.0/24 via vboxnet out
sudo ipfw add 00062 skipto 65535 ip from 192.168.59.0/24 to 192.168.59.3 via vboxnet0 in
sudo ipfw add 00063 deny ip from any to any

Obviously, the exact fw line numbers and IP/network will depend on the local network config and how boot2docker was set up by the user. It's also worth noting that because this bollixes up boot2docker, you need to do your initial boot2docker init without being attached to the VPN.

Making a script to do this automatically wouldn't be heinously hard, but it would be nice to have this built-in; I'm just not sure how to make it happen after the VPN is up (which is obviously when you'd need to modify the ipfw rules).

Credit to this page http://www.petefreitag.com/item/753.cfm - where I just noticed there's some work in the comments to make just such a script.

[knownasilya]

Also have this issue, and would love some support in this area.

[SvenDowideit]

@knownasilya I'd start with the fix outlined in @bortels comment above...

[knownasilya]

@SvenDowideit Tried but Yosemite is different and so far I've not figured out where the firewall record is and how to change it.. Looks like it's pfctl now, but where is the data..

[wizonesolutions]

@knownasilya Did you ever find out how the firewall actually works? No matter what I try, pfctl looks pretty empty. Even sudo pfctl -a com.apple/250.ApplicationFirewall -sr...

[wizonesolutions]

I had to update AnyConnect. Then I was able to use the network as long as it was created while not on the VPN. So for me that was:

vagrant up --no-provision

• connect to vpn *

vagrant provision

but for boot2docker that last step may be superfluous

[dchenbecker]

Just to throw this out there: OpenConnect has been updated to work with Mavericks and Yosemite and works flawlessly with our ASAs for access. Bonus: it doesn't mess with pfctl so boot2docker works just fine without any futzing around.

[bortels]

Fwiw - openconnect was where I finally landed. Unfortunately, in many
corporate environments, that lands you kinda out-of-bounds. I personally
prefer being out-of-bounds, but I suspect that's very much not the norm.
Finding a reasonable solution for Cisco anyconnect other than "replace it"
is probably desirable, if no longer absolutely necessary.
On Fri, May 15, 2015 at 9:39 PM Derek Chen-Becker notifications@github.com
wrote:

Just to throw this out there: OpenConnect has been updated to work with
Mavericks and Yosemite and works flawlessly with our ASAs for access.
Bonus: it doesn't mess with pfctl so boot2docker works just fine without
any futzing around.

—
Reply to this email directly or view it on GitHub
#213 (comment)
.

[FrancoisZhang]

Does anybody know how to fix it with Yosemite + Cisco Anyconnect? I stuck in here. Too many discussion I found but haven't found any suggestion works. The "ipfw" is removed from Yosemite now. Thanks a lot.

[knownasilya]

@FrancoisZhang try boot2docker/boot2docker#628 (comment)

[wizonesolutions]

Use openconnect if you can.

brew cask install tuntap # needs homebrew cask
brew install openconnect
El 9/6/2015 2:58, "Ilya Radchenko" notifications@github.com escribió:

@FrancoisZhang https://github.com/FrancoisZhang try boot2docker/boot2docker#628
(comment)
boot2docker/boot2docker#628 (comment)

—
Reply to this email directly or view it on GitHub
#213 (comment)
.

[keenaudio]

Setting up port forwarding in Virtual Box worked for me, as described here: boot2docker/boot2docker#628 (comment) (thanks @johnnyt)
I used the Virtual Box UI (Settings / Network) Network type should be NAT. Click on port forwarding and add a rule to forward on 127.0.0.1:2376, then update your ~/.profile file:

export DOCKER_HOST=tcp://127.0.0.1:2376

[norbertpy]

openconnect is awesome:

$ brew install openconnect
$ sudo openconnect --user={username} {vpn-hostname}

[tianon]

Sorry, this repository is long-since deprecated in favor of Docker Toolbox (whose usage is now also discouraged in favor of Docker for Windows and Docker for Mac).