Search code examples
dockerdocker-swarmsubnet

Docker-Swarm: Join a docker-swarm from another subnet

I have 4 virtual machines in the same subnet, which are part of a docker-swarm. Now I want connect another node (virtual machine), which is located in a different country (not the same subnet). I am an IP noob and it is hard for me to set up an overlay network in docker, which is able to handle this connection.

Which aspects I need to keep in mind, by setting up this kind of docker-swarm?

Solution

  • You need the following ports open between your swarm nodes:

    • 2377/tcp: Swarm mode api
    • 7946/both: Overlay networking control
    • 4789/udp: Overlay networking data
    • protocol 50 for ipsec (secure option) of overlay networking

    The following iptables commands can be used for this (you may want to limit the source host to only your other docker swarm nodes):

    iptables -A INPUT -p tcp -m tcp --dport 2377 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 7946 -j ACCEPT
iptables -A INPUT -p tcp -m udp --dport 7946 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 4789 -j ACCEPT
iptables -A INPUT -p 50 -j ACCEPT

    This needs to be configured on all of your swarm nodes if they have a restrictive host firewall, and on the network firewalls protecting your subnets.