CODEWITHSUNDEEP
asp.netsql-serveramazon-web-servicesdockerdocker-compose
NitinSingh
NitinSingh

Reputation: 2068

Connect webapp running in docker (windows) container to SQL Server running on AWS private subnet

Environment

  1. ASPNET MVC App running on docker
  2. Docker image: microsoft/aspnet:4.7.2-windowsservercore-1803 running on Docker-for-Windows on Win10Ent host
  3. SQL Server running on AWS EC2 in a private subnet
  4. VPN Connection to subnet

Background

The application is able to connect to database when VPN is activated and everything works fine. However when app runs on docker, the underlying connection to database is refused. Since the database is in a private subnet, VPN is needed to connect. I am able to ping the database server as well as the general internet successfully from the command prompt launched inside the container, thus underlying networking is working fine.

Configuration

Dockerfile

FROM microsoft/aspnet:4.7.2-windowsservercore-1803
ARG source
WORKDIR /inetpub/wwwroot
COPY ${source:-obj/Docker/publish} .

Docker Compose

version: '3.4'

services:
  myWebApp:
    image: ${DOCKER_REGISTRY}myWebApp
    build:
      context: .
      dockerfile: Dockerfile

The network entry is removed as NAT is mapped to Ethernet and I am running on WiFi thus having it disabled.

SQL Connection string (default instance on def port)

"Data Source=192.168.1.100;Initial Catalog=Admin;Persist Security Info=True;User ID=admin;Password=WVU8PLDR" providerName="System.Data.SqlClient"

Local network configuration

Local network configuration

Ping status

Ping status for db server and google

Let me know what needs to be fixed. Any environment or configuration-specific information can be provided

Upvotes: 1

Views: 705

Answers (1)

NitinSingh
NitinSingh

Reputation: 2068

After multiple iterations of different ways to address this issue, we finally figured out the solution which we incorporated in our production environment.

The SQL Server primary instance was in a private subnet, hence it cannot be accessed from any application outside the subnet. The SQL Enterprise manager and other apps living on local machines are able to access it via VPN as the OS tunnels that traffic to the private network. However, since docker cannot join the VPN network easily (would be too complicated, may not be actually impossible), we need to figure out a possible solution.

For this, we set up a Reverse Proxy on the private subnet, which lives on the public IP, hence accessible via the public Internet. This server has permission granted in the underlying security group setting to talk to the SQL Server (port 1433 being opened to the private IP).

So the application running on docker calls the IP of the Reverse Proxy, which in turn routes it to the SQL Server. There's a cost of one additional hop involved here, but that's something we gotta live with.

Let me know if anyone can figure out a better design. Thanks

Upvotes: 2

Related Questions