Docker redsocks proxy behind HTTP proxy with no internet DNS - proxy

Question

Network Environment
No internet DNS available
Corporate squid proxy allowing HTTP and HTTPS traffic on port 3128
Docker Environment
Docker is running on an Ubuntu 15.04 guest inside VirtualBox on OS X.
A container docker-forgetproxy (https://github.com/k-labs/docker-forgetproxy) which is running redsocks on top of the host's network infrastructure, run with:
$ docker run -it --rm --net=host --privileged \
-e http_proxy=$http_proxy \
-e https_proxy=$https_proxy \
klabs/docker-forgetproxy
This modifies the host's iptables rules by issuing the following commands where $1 is set to A:
iptables -t nat -$1 PREROUTING -i docker0 -d 127.0.0.0/8 -j RETURN
iptables -t nat -$1 PREROUTING -i docker0 -d 169.254.0.0/16 -j RETURN
iptables -t nat -$1 PREROUTING -i docker0 -d 172.16.0.0/12 -j RETURN
iptables -t nat -$1 PREROUTING -i docker0 -d 192.168.0.0/16 -j RETURN
iptables -t nat -$1 PREROUTING -i docker0 -d 224.0.0.0/4 -j RETURN
iptables -t nat -$1 PREROUTING -i docker0 -d 240.0.0.0/4 -j RETURN
iptables -t nat -$1 PREROUTING -p tcp --dport 80 -i docker0 -j REDIRECT --to 12345 2>/dev/null
iptables -t nat -$1 PREROUTING -p tcp --dport 8080 -i docker0 -j REDIRECT --to 12345 2>/dev/null
iptables -t nat -$1 PREROUTING -p tcp --dport 53 -i docker0 -j REDIRECT --to 5300
iptables -t nat -$1 PREROUTING -p tcp -i docker0 -j REDIRECT --to 12346
and launches redsocks is launched with the
base {
log_debug = off;
log_info = on;
log = "stderr";
daemon = off;
user = redsocks;
group = redsocks;
redirector = iptables;
}
redsocks {
type = http-relay;
ip = http://my-proxy;
port = 3128;
local_ip = 0.0.0.0;
local_port = 12345;
}
redsocks {
type = http-connect;
ip = http://my-proxy;
port = 3128;
local_ip = 0.0.0.0;
local_port = 12346;
}
dnstc {
local_ip = 127.0.0.1;
local_port = 5300;
}
Problem
When I launch a new docker container with docker run -it --rm ubuntu apt-get update it seems the container's requests aren't getting rerouted to the redsocks container.
Watching the packets on wireshark it appears the DNS resolution for archive.ubuntu.com from the apt-get container tries to go to my domain DNS server (which can't perform internet look ups) if I set the DNS server to that of the docker0 iface it seems it gets captured by the 172.16.0.0/12 iptables rule since today it was 172.17.42.1

Answer 1

This applies to a Ubuntu Xenial host.
On your host, under Connection Information, get your current DNS addresses; in my case, 172.21.17.212 and 172.21.17.210.
Under /etc/default/docker, add the DNS addresses on DOCKER_OPTS:
DOCKER_OPTS="--dns 172.21.17.212 --dns 172.21.17.210"
Create /etc/systemd/system/docker.service.d/ubuntu.conf, with the following:
[Service]
EnvironmentFile=/etc/default/docker
ExecStart=
ExecStart=/usr/bin/docker daemon -H fd:// $DOCKER_OPTS
Then:
sudo systemctl daemon-reload
sudo systemctl restart docker