Hi

Stock nginx built into Synology DSM won’t cut it, so I decided to install Nginx Proxy Manager. Before doing so, I created a macvlan and assigned the NPM container to use the assigned IP. Once install is finished, and I try to launch NPM, it fails to load. I tried the same install without macvlan, and it works and loads just fine. I have installed many other containers on macvlan, so I know what I am doing and have the knowledge and experience, but I have never run into this before where there seems to be a conflict I am not aware of.

Help? Anyone?

  • @isleepbad@alien.topB
    link
    fedilink
    English
    11 year ago

    You shouldn’t have conflicts with the DSM ngnix after setting up a macvlan on a Synology.

    Saying that, there are a few more steps you have to do to get it working. I’ve done it successfully on my Synology. Here is a guide I wrote for traefik in my notes. Also see the references for additional explanations.

    I apologize for the formatting. I am on my phone.

    Introduction

    Long story short, Traefik uses ports 80 and 440. On the Synology NAS (from DSM 7 and upwards), those ports are occupied by the OS. There are two options to solve this issue:

    Reroute all traffic on 80 and 443 on the router to a new port

    Pros: no need for a VLAN (see 2.). Cons: need to expose all services on the Synology via Traefik Create a MAC VLAN + bridge, attach the docker container to it and assign an IP

    Pros: Cleaner approach as the docker container gets assigned a new IP Cons: More complicated

    This guide will discuss option 2.

    Preparation

    IP Reservation

    Before we begin, some ip configuration is necessary. First you must configure any DHCP service on your network such that it will not assign addresses in a given range. This guide assumes you already have your raspberry pi set up as your DHCP service (and turned DHCP off in your router). Go to your pi-hole admin page and go to settings→DHCP.

    Figure: DHCP Settings on the Pi-Hole

    Here an IP range of 192.168.2.50-192.168.2.199 has been reserved by the pi-hole to be assigned. This leaves addresses 192.168.2.2-192.168.2.49 and 192.168.2.200-192.168.2.254 to us to use. I shall use the tail end of the range 192.168.2.200-192.168.2.254.

    MACVLANs

    The following is specifically for those that have a Synology NAS with a single ethernet port. This port should be designated eth0. To be sure, check using the following command:

    ip link show

    Figure 2: List of IP links available

    Note: If you have multiple ethernet ports and have already set up a bond, follow this guide: https://blog.alexis.lc/docker-macvlan-network-synology

    We will link our macvlan to this physical port so that information and be routed from outside the NAS to the docker container.

    Docker and MACVLANs

    Warning! This is the danger zone. If you mess up and/or want to get your network settings back to normal follow these steps. TL;DR: find and press the reset button on the back of your NAS for 4 seconds until you hear a beep, then release.

    Now that we have our address range reserved and we know which device we can link our macvlan to, it is time to create our docker network and a macvlan network!

    Step 1: Create the necessary docker network:

     docker network create -d macvlan \
      -o parent=eth0 \
      --subnet=192.168.2.0/24 \
     	--gateway=192.168.2.1 \
      --ip-range 192.168.2.200/27 \
     	--aux-address="host=192.168.2.201" \
       dockervlan
    

    –aux-address reserves the address from our subnet (this is the new ip my NAS host will be accessed from on the macvlan network)

    –ip-range is the range of IPs that can be assigned by docker

    –gateway the gateway docker will use to communicate with the world (this is my router address)

    –subnet the macvlan’s subnet we will be creating

    -o parent specifies the interface through which we want to comminicate

    Synology NAS MACVLAN

    The next step is to create a MACVLAN that will act as a new host and network and provide new IP addresses to the containers we attach to it.

    First create a MACVLAN and add a fictitious MAC address to it. This is so that if you need to start over, you don’t have multiple virtual nodes popping up in your router

    sudo ip link add link eth0 name macvlan0 address 02:42:C0:A8:02:C9 type macvlan mode bridge

    Then assign the reserved host address (aux-address from above) to the MACVLAN

    sudo ip addr add 192.168.2.201/32 dev macvlan0

    Spin up the MACVLAN

    sudo ip link set macvlan0 up

    Allow routing to the subnet

    sudo ip route add 192.168.2.200/29 dev macvlan0

    Now you should see a new host on your network with ip 192.168.2.201 and MAC address 02:42:C0:A8:02:C9

    Make sure the synology can get packets to the macvlan subnet

    sudo iptables -A INPUT -s 192.168.2.200/29 -j ACCEPT &&
    sudo iptables -A OUTPUT -d 192.168.2.200/29 -j ACCEPT &&
    sudo iptables -A FORWARD -s 192.168.2.200/29 -j ACCEPT &&
    sudo iptables -A FORWARD -d 192.168.2.200/29 -j ACCEPT

    Traefik with a new IP

    To assign Traefik it’s own IP so that the NAS does not interfere with traefik (by taking up ports 80 and 443) add the following to your docker compose:

    service: . . networks: default: #eth0 linked network traefik-net: #traefik’s network proxy: #proxy network mac_address: “02:42:C0:A8:02:C9” . . . #define networks networks: traefik-net: external: true proxy: external: true default: external: name: “dockervlan”

    Note the 3 networks:

    default/dockervlan this docker network is the subnet that exists in the router and is linked to eth0. This manages all external communication

    proxy socket-proxy docker network (never to be exposed)

    traefik-net the network any container will use in order to communicate with traefik

    Sources:

    https://blog.oddbit.com/post/2018-03-12-using-docker-macvlan-networks/

    https://community.synology.com/enu/forum/1/post/133969?page=2&sort=oldest

    https://www.reddit.com/r/synology/comments/s5j9d8/howto_vlan_configuration_with_docker/

    • @Illuminated_Humanoid@alien.topOPB
      link
      fedilink
      English
      11 year ago

      I appreciate the heck out of you for trying, but my god this confuses the crap out of me even more lol. I’ve read it over several times, and I am just not connecting the dots ☹️

    • @Illuminated_Humanoid@alien.topOPB
      link
      fedilink
      English
      11 year ago

      What’s the main kicker here? Reading this over, it sounds like you’re saying to create two macvlans, but I only see an execution of one? I am confused brother

      • @isleepbad@alien.topB
        link
        fedilink
        English
        11 year ago

        Sorry. I wrote it for my notes and wasn’t necessarily polished for external use.

        The basic gist of it is:

        1. Reserve your IP range

        2. Create the docker network (compatible with MACVLANs)

        3. Create the macvlan on your Synology

        4. Set up your container with the new network

        • @Illuminated_Humanoid@alien.topOPB
          link
          fedilink
          English
          11 year ago

          Here, let me show you what I did and you tell me where I went wrong.

          1. SSH into Synology NAS and Create macvlan network with modified command below to my system:sudo docker network create -d macvlan \-o parent=eth0 \–subnet=192.168.1.0/24 \–gateway=192.168.1.1 \npm_network

          2. Install Nginx Proxy Manager docker container

          3. Assign NPM to use the new macvlan network and assign it an IP on the subnet that’s not already in use with the following command:docker network connect --ip 192.168.1.99 npm_network nginx_proxy_manager

          4. Go into portainer and under container settings for NPM, ensure the container is connected to both the new macvlan with the info we used and also connected to the default bridge network.

          This is where I hit a wall. I still cannot connect to my web interface at this point when I feel like I should be able to with the macvlan ip 192.168.1.99

          What am I doing wrong?

          • @isleepbad@alien.topB
            link
            fedilink
            English
            11 year ago

            So basically all you did was create a docker network with no macvlan on your synology. The docker network you created will simply look for a macvlan and communicate with it. There needs to be an actual macvlan there to communicate with. You really should read through my responses again.

            Here are some pointers:

            • Your step 2 needs an auxiliary address for your host. –aux-address=“host=192.168.2.201”

            • Look at my step 3. You have to run those commands to setup the macvlan on your synology. You have to use your auxiliary host address in the series of commands I showed you. When you run them properly you will see the host show up in your router.

            • @Illuminated_Humanoid@alien.topOPB
              link
              fedilink
              English
              11 year ago

              Okay, so here’s where I’m confused. From my understanding you say all I did is create a docker network and I need to create a macvlan but the ‘npm_network’ that I created literally says macvlan beside it in the network tab of either container manager or portainer. Even the command literally says ‘create macvlan’ so I am confused why you say that’s not a macvlan and only a docker network.
              Am I making sense? Also, two other outdated guides ive seen on this describe it the same way. The way you describe it is a first that I’ve seen. Not saying you’re wrong, but there’s certainly a difference I’m noticing.

              • @isleepbad@alien.topB
                link
                fedilink
                English
                11 year ago

                Those other guides assume you already have a macvlan and want to use docker on it. Like I said, not many complete guides out there. Mine is the most comprehensive you’ll find.

                The gist of it is, you create a macvlan network on your NAS then you place a docker network on that macvlan network.

        • @Illuminated_Humanoid@alien.topOPB
          link
          fedilink
          English
          11 year ago

          3.Create the macvlan on your Synology

          sudo ip link add link eth0 name macvlan0 address XX:ZZ:AA:BB:00:YY type macvlan mode bridge

          I follow your instructions carefully. When I get here I get the terminal response :“XX” is invalid lladdr.

          • @isleepbad@alien.topB
            link
            fedilink
            English
            11 year ago

            You have to create your own Mac address.

            Google “valid MAC addresses” and place your own there. Anyone will do.

            You’re creating a virtual LAN on your network and as such you need a MAC address. You can skip it but as I said in my guide, one will be automatically created for you each time and you’ll have multiple virtual devices sitting on your network.

            • @Illuminated_Humanoid@alien.topOPB
              link
              fedilink
              English
              11 year ago

              I think I am about 99% of the way there. Seems like I got it mostly figured out, but I do have a couple questions for you. And thanks again for your time, you have no idea how much I appreciate you and your assistance in this.

              #1. After creating the docker network, you suggest creating the macvlan and the command for creating the macvlan involes ‘macvlan0’. I cannot use macvlan0 and instead am forced to use macvlan1 because macvlan0 is taken by the docker network we created just before creating the macvlan. Seems to be a conflict. I checked and there’s nothing else conflicting other than the already created macvlan0 from the step before.

              #2. After completing the steps, I can access my NAS as usual, the Nginx proxy manager is accessible via it’s macvlan IP, but I can also connect to the NAS and the Nginx from the auxillary host IP. What’s the deal with that?

              #3. Once all is said and done. Should my Nginx be connected to both the bridge network and the new macvlan or just the macvlan? It’s always connected to the bridge by default, but when I add the container to the new macvlan, am I supposed to disconnect it from the bridge?

              • @isleepbad@alien.topB
                link
                fedilink
                English
                11 year ago

                I think I am about 99% of the way there. Seems like I got it mostly figured out, but I do have a couple questions for you. And thanks again for your time, you have no idea how much I appreciate you and your assistance in this.

                1. After completing the steps, I can access my NAS as usual, the Nginx proxy manager is accessible via it’s macvlan IP, but I can also connect to the NAS and all it’s services including the Nginx container from the auxillary host IP. What’s the deal with that?

                Yes, the auxiliary host IP is basically a new virtual IP that sits on your LAN. So basically when you connect your synology to your home network, it gets assigned an IP (with its own MAC address included). With the MACVLAN network, you’ve basically created a new virtual network on your NAS with its on device (MAC) address. It is in essence a virtual copy of your NAS host that your router sees it as a new device on your network.

                1. Once all is said and done. Should my Nginx be connected to both the default bridge network and the new macvlan or just the macvlan? It’s always connected to the default bridge when installing any new container, but when I add the container to the new macvlan, am I supposed to disconnect it from the default bridge at the same time?

                This is up to you how you want your network architecture to look like, but when you spin up a new container that you want available accessible by your ngnix, you have to:

                1. Specify your docker’s macvlan network as your container’s network (and remove it from the default bridge) OR

                2. Connect your ngnix container to your application’s docker network (basically isolate all containers in their own network)

                Up to you. Personally I do #2.

                1. Your fourth command for adding routing. How do I know what to use? My IP range for example is 192.168.87.96/30 with an auxiliary IP of 192.168.87.99. How do I decide the routing CIDR notation? I tried to look at yours and wasn’t sure how you decided on yours. I just went with 192.168.87.96/30 which is the same as my IP range, but I’m not exactly sure what that is doing or not doing and if I should’ve chosen a different Ip for that. My CIDR notation for IP range is just 4 IPs, as you can probably tell by now. I notice this one is very important and if not configured properly can make or break the connection. At first, I selected 192.168.87.98, but that didn’t work. When I chose by IP range for routing, it worked. I blindly did this, so I have no idea why one is working over the other and how to decide this part.

                I presume you’re talking about this one ? sudo ip addr add 192.168.2.201/32 dev macvlan0 I guess I didn’t explain properly but that is your auxiliary host’s IP. If you look at command 2 you’ll see --aux-address="host=192.168.2.201". Basically the CIDR notation /32 is the same as the subnet mask 255.255.255.255, only one IP address can be served in macvlan0.

                1. Your final command, which you say is optional for communication between the macvlan and the NAS. I’m not sure if I need to be using this? My entire reason for doing all this is to use NPM for accessing my FQDN on my LAN with SSL certs only on my LAN and nothing exposed to outside internet. I just want all the DNS rewrites from Adguard Home to point to the Nginx macvlan IP so that Nginx can proxy it to the correct NAS service and also SSL it at the same time. Adguard home cannot use port numbers in the DNS rewrites and only can use IP, which is why I am doing all this in the first place. I had to give Nginx its own IP, or Adguard home DNS rewrites couldn’t communicate with it.

                Yea its optional. For my purposes it was nice to have because I have gitea and wanted to use GIT on the Synology locally. You don’t have to.

                Overall, I am able to execute all you’ve described with just these concerns I’ve listed above. Again, thanks a ton, brother. I learned a lot in this experience.

                Yea it’s not straightforward and I spent a ton of time researching it. Glad to help.

                • @Illuminated_Humanoid@alien.topOPB
                  link
                  fedilink
                  English
                  11 year ago

                  I presume you’re talking about this one ?

                  sudo ip addr add 192.168.2.201/32 dev macvlan0

                  I guess I didn’t explain properly but that is your auxiliary host’s IP. If you look at command 2 you’ll see

                  --aux-address=“host=192.168.2.201”

                  . Basically the CIDR notation

                  /32

                  is the same as the subnet mask

                  255.255.255.255

                  , only one IP address can be served in macvlan0.

                  I was actually referring to ‘sudo ip route add 192.168.2.200/29 dev macvlan0’ for #3

                  This one has me stumped. I hope you’re not one of those who deletes his Reddit posts because I may need to come back to this post one day 😁

                  • @isleepbad@alien.topB
                    link
                    fedilink
                    English
                    11 year ago

                    I was actually referring to ‘sudo ip route add 192.168.2.200/29 dev macvlan0’ for #3

                    That is the MACVLANs subnet. That’s basically carving a small subnet out of your LAN that your virtual LAN will sit on. See the preparation section of the original post.

                    And yes, all proxying goes to the aux IP.