Docker-Swarm Join a docker-swarm from another subnet

Question

I have 4 virtual machines in the same subnet, which are part of a docker-swarm. Now I want connect another node (virtual machine), which is located in a different subnet.

How do i set an overlay network in docker that is able to handle such a connection?

Answer 1

You need the following ports open between your swarm nodes:

• 2377/tcp: Swarm mode api
• 7946/both: Overlay networking control
• 4789/udp: Overlay networking data
• protocol 50 for ipsec (secure option) of overlay networking

The following iptables commands can be used for this (you may want to limit the source host to only your other docker swarm nodes):

iptables -A INPUT -p tcp -m tcp --dport 2377 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 7946 -j ACCEPT
iptables -A INPUT -p tcp -m udp --dport 7946 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 4789 -j ACCEPT
iptables -A INPUT -p 50 -j ACCEPT

This needs to be configured on all of your swarm nodes if they have a restrictive host firewall, and on the network firewalls protecting your subnets.