Answers: <p>The problem was that the vpn network has the subnet 10.0.0.0/8 and the ingress network of docker swarm has the subnet 10.0.0.0/24.
  So there were a conflict.</p>
  <p>Fix:
  Changing either the vpn subnet or the ingress network subnet.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-08-12T04:40:46.497Z
Answers: How to change that though?
Answers: Soerendip
Answers: CC BY-SA 4.0
Answers: 2021-08-13T05:54:40.477Z
Answers: @Sören I Donät remeber which aproach I choosed.. but changing the ip of your vpn network depends on the vpn server. And take a look at [this post](https://stackoverflow.com/questions/42954017/how-to-change-ip-address-range-of-docker-swarm-ingress-network) for changing the ingress network
Answers: D. Weber
Answers: CC BY-SA 4.0
Answers: 2020-11-28T00:05:53.723Z
Answers: 2020-12-02T11:59:15.290Z
Answers: 2020-12-02T11:59:15.290Z
Answers: D. Weber
Body: <p>Currently I try to setup docker-swarm using two nodes and deploy portainer on them.</p>
  <p>Both nodes are virtual machines on the same host and are on the same network (172.16.255.255). Addtionally there is a firewall in these local network providing a VPN server (255.255.0.0). The VPN routes requests to 172.16.255.255 in the local network (e. g. 10.0.0.3 can access 172.16.0.80). No ports are blocked.<br />
  I have no trouble accessing the virtual machines (e. g. by ssh).</p>
  <p>I followed the installation instructions on <a href="https://www.portainer.io/installation/" rel="nofollow noreferrer">portainer.io</a>.</p>
  <p>Compose File:</p>
  <pre><code>version: '3.2'
  
  services:
    agent:
      image: portainer/agent
      volumes:
        - /var/run/docker.sock:/var/run/docker.sock
        - /var/lib/docker/volumes:/var/lib/docker/volumes
      networks:
        - agent_network
      deploy:
        mode: global
        placement:
          constraints: [node.platform.os == linux]
  
    portainer:
      image: portainer/portainer-ce
      command: -H tcp://tasks.agent:9001 --tlsskipverify
      ports:
        - 9000:9000
        - 8000:8000
      volumes:
        - portainer_data:/data
      networks:
        - agent_network
      deploy:
        mode: replicated
        replicas: 1
        placement:
          constraints: [node.role == manager]
  
  networks:
    agent_network:
      driver: overlay
      attachable: true
  
  volumes:
    portainer_data:
  </code></pre>
  <p>Run  command:</p>
  <pre><code>docker stack deploy --compose-file=portainer-agent-stack.yml portainer
  </code></pre>
  <p>The stack is successfully deployed and I can access the portainer UI as long as I'm in the local network. The UI is even accessible from other virtual machines, which are not part of the swarm.</p>
  <p>But when I try to access the UI from my VPN, I get a timeout (SYN, but no ACK).<br />
  This happen for other container as well (e. g. I tried to test it with jwilder/whoami for different ports).</p>
  <p>When I setup a container, with identical settings, without swarm, the service is accessiable via VPN.</p>
  
Tags: <docker><docker-swarm>
Title: Cannot access service using docker-swarm, but without
UserDisplayName: D. Weber
ThreadText: # Cannot access service using docker-swarm, but without
  
  (Asked by: username_0 on 2020-11-22)
  
  Currently I try to setup docker-swarm using two nodes and deploy portainer on them.
  
  Both nodes are virtual machines on the same host and are on the same network (172.16.255.255). Addtionally there is a firewall in these local network providing a VPN server (255.255.0.0). The VPN routes requests to 172.16.255.255 in the local network (e. g. 10.0.0.3 can access 172.16.0.80). No ports are blocked.  
  I have no trouble accessing the virtual machines (e. g. by ssh).
  
  I followed the installation instructions on [portainer.io](https://www.portainer.io/installation/).
  
  Compose File:
  
  ```
  version: '3.2'
  
  services:
    agent:
      image: portainer/agent
      volumes:
        - /var/run/docker.sock:/var/run/docker.sock
        - /var/lib/docker/volumes:/var/lib/docker/volumes
      networks:
        - agent_network
      deploy:
        mode: global
        placement:
          constraints: [node.platform.os == linux]
  
    portainer:
      image: portainer/portainer-ce
      command: -H tcp://tasks.agent:9001 --tlsskipverify
      ports:
        - 9000:9000
        - 8000:8000
      volumes:
        - portainer_data:/data
      networks:
        - agent_network
      deploy:
        mode: replicated
        replicas: 1
        placement:
          constraints: [node.role == manager]
  
  networks:
    agent_network:
      driver: overlay
      attachable: true
  
  volumes:
    portainer_data:
  
  ```
  
  Run command:
  
  ```
  docker stack deploy --compose-file=portainer-agent-stack.yml portainer
  
  ```
  
  The stack is successfully deployed and I can access the portainer UI as long as I'm in the local network. The UI is even accessible from other virtual machines, which are not part of the swarm.
  
  But when I try to access the UI from my VPN, I get a timeout (SYN, but no ACK).  
  This happen for other container as well (e. g. I tried to test it with jwilder/whoami for different ports).
  
  When I setup a container, with identical settings, without swarm, the service is accessiable via VPN.
  
  **Tags:** docker, docker-swarm
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2020-11-28. Score: 1 | Accepted answer
  
  The problem was that the vpn network has the subnet 10.0.0.0/8 and the ingress network of docker swarm has the subnet 10.0.0.0/24.
  So there were a conflict.
  
  Fix:
  Changing either the vpn subnet or the ingress network subnet.
  
  > **Comments:**
  > **username_1**: How to change that though?  
  > **username_0**: @Sören I Donät remeber which aproach I choosed.. but changing the ip of your vpn network depends on the vpn server. And take a look at [this post](https://stackoverflow.com/questions/42954017/how-to-change-ip-address-range-of-docker-swarm-ingress-network) for changing the ingress network  
  
  ---
  
  