# Accessing managed network from external

**URL:** <https://forums.suse.com/t/accessing-managed-network-from-external/8015>\
**Category:** Rancher 1.x\
**Created:** [December 8, 2017, 8:56pm UTC](https://forums.suse.com/t/accessing-managed-network-from-external/8015 "2017-12-08T20:56:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ian](https://avatars.discourse-cdn.com/v4/letter/i/bb73d2/32.png) [@Ian](https://forums.suse.com/u/Ian)\
**Post date:** [December 8, 2017, 8:56pm UTC](https://forums.suse.com/t/accessing-managed-network-from-external/8015/1 "2017-12-08T20:56:22Z")

</div>

I’m confused. My load balancer and dns require services to be on the managed 10.42.x.x/16 network. How do I access this network (i.e. port forward/nat)?

I’m using the following:

```
docker-compose.yml:
version: '2'
volumes:
  itrdevpsql:
    external: true
    driver: rancher-nfs
  itrdevcdn:
    external: true
    driver: rancher-nfs
services:
  itrdevpsql:
    image: postgres
    environment:
      POSTGRES_PASSWORD: XXXXXXXXXXXXXXXXXXXXXXXX
      POSTGRES_USER: devuser
      PGDATA: /var/lib/postgresql/data
      POSTGRES_DB: itrdevdb
    stdin_open: true
    volumes:
    - itrdevpsql:/var/lib/postgresql/data
    domainname: dev.project
    tty: true
    labels:
      io.rancher.container.pull_image: always
  itrdevcdn:
    image: nginx
    environment:
      NGINX_HOST: m.dev.project
      NGINX_PORT: '80'
    stdin_open: true
    volumes:
    - itrdevcdn:/usr/share/nginx/html
    domainname: dev.project
    tty: true
    labels:
      io.rancher.container.pull_image: always
  lbitrdev:
    image: rancher/lb-service-haproxy:v0.7.15
    ports:
    - 0.0.0.0:5432:5432/tcp
    - 0.0.0.0:8000:8000/tcp
    labels:
      io.rancher.container.agent.role: environmentAdmin,agent
      io.rancher.container.agent_service.drain_provider: 'true'
      io.rancher.container.create_agent: 'true'

rancher-compose.yml:
version: '2'
services:
  itrdevpsql:
    scale: 1
    start_on_create: true
  itrdevcdn:
    scale: 1
    start_on_create: true
  lbitrdev:
    scale: 1
    start_on_create: true
    lb_config:
      certs: []
      port_rules:
      - backend_name: ''
        priority: 3
        protocol: tcp
        service: itrdevpsql
        source_port: 5432
        target_port: 5432
      - priority: 4
        protocol: tcp
        service: itrdevcdn
        source_port: 8000
        target_port: 8000
    health_check:
      healthy_threshold: 2
      response_timeout: 2000
      port: 42
      unhealthy_threshold: 3
      initializing_timeout: 60000
      interval: 2000
      reinitializing_timeout: 60000
```

---

<div class="post-metadata">

**Author:** ![Ian](https://avatars.discourse-cdn.com/v4/letter/i/bb73d2/32.png) [@Ian](https://forums.suse.com/u/Ian)\
**Post date:** [December 8, 2017, 9:11pm UTC](https://forums.suse.com/t/accessing-managed-network-from-external/8015/2 "2017-12-08T21:11:53Z")

</div>

To clarify:  
I created a load balancer. 2 machines (one nginx, one psql).  
I also added a host ip: 192.168.1.5 and port 8000.

From the console of rancher os:  
root@rancher-server:~# curl 192.168.1.5:8000  
`<h4>hello world</h4>`

However, from my Windows 10 workstation (with an IP of 192.168.1.97), it gets a:  
This site can’t be reached.  
ERR\_CONNECTION\_REFUSED

… in the browser.

Also, I looked and the reason it appears I can’t connect is due to a firewall rule on the rancher server:  
root@rancher-server:~# iptables -nL  
Chain INPUT (policy ACCEPT)  
target prot opt source destination

Chain FORWARD (policy ACCEPT)  
target prot opt source destination  
CATTLE\_NETWORK\_POLICY all – 10.42.0.0/16 10.42.0.0/16  
CATTLE\_FORWARD all – 0.0.0.0/0 0.0.0.0/0  
DOCKER-ISOLATION all – 0.0.0.0/0 0.0.0.0/0  
DOCKER all – 0.0.0.0/0 0.0.0.0/0  
ACCEPT all – 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED  
ACCEPT all – 0.0.0.0/0 0.0.0.0/0  
ACCEPT all – 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)  
target prot opt source destination

Chain CATTLE\_FORWARD (1 references)  
target prot opt source destination  
ACCEPT all – 0.0.0.0/0 0.0.0.0/0 mark match 0x1068  
ACCEPT all – 0.0.0.0/0 0.0.0.0/0 mark match 0x4000  
ACCEPT all – 0.0.0.0/0 10.42.0.0/16

Chain CATTLE\_NETWORK\_POLICY (1 references)  
target prot opt source destination

Chain DOCKER (1 references)  
target prot opt source destination  
ACCEPT tcp – 0.0.0.0/0 172.17.0.3 tcp dpt:27017  
ACCEPT tcp – 0.0.0.0/0 172.17.0.2 tcp dpt:80  
ACCEPT tcp – 0.0.0.0/0 172.17.0.4 tcp dpt:8080

Chain DOCKER-ISOLATION (1 references)  
target prot opt source destination  
RETURN all – 0.0.0.0/0 0.0.0.0/0

am I going about this wrong?