Windows Server中Docker容器无法被客户端访问的问题求助

我正在开发一个包含多个ASP.NET MVC Core项目的Docker镜像系统，部署到Windows Server的Docker引擎后，客户端无法访问容器内的页面/API，已做以下排查：

• 基于Windows环境，Docker网络无bridge驱动网络
• 服务器本地可正常打开容器内页面
• 已配置防火墙规则开放所需端口

执行docker info命令结果 #

Client:
 Context:    default
 Debug Mode: false
 Plugins:
  app: Docker App (Docker Inc., v0.9.1-beta3)
  cluster: Manage Mirantis Container Cloud clusters (Mirantis Inc., v1.9.0)
  registry: Manage Docker registries (Docker Inc., 0.1.0)

Server:
 Containers: 2
  Running: 1
  Paused: 0
  Stopped: 1
 Images: 3
 Server Version: 20.10.9
 Storage Driver: windowsfilter
  Windows:
 Logging Driver: json-file
 Plugins:
  Volume: local
  Network: ics internal l2bridge l2tunnel nat null overlay private transparent
  Log: awslogs etwlogs fluentd gcplogs gelf json-file local logentries splunk syslog
 Swarm: inactive
 Default Isolation: process
 Kernel Version: 10.0 17763 (17763.1.amd64fre.rs5_release.180914-1434)
 Operating System: Windows Server 2019 Standard Version 1809 (OS Build 17763.4010)
 OSType: windows
 Architecture: x86_64
 CPUs: 4
 Total Memory: 8GiB
 Name: ITTSCRMDB
 ID: AQYX:7V62:VD2W:LNLC:WOLS:VCIH:6K6R:DC3R:S6XW:O3EF:QHRL:PAVA
 Docker Root Dir: C:\ProgramData\docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

执行docker network ls命令结果 #

NETWORK ID     NAME      DRIVER    SCOPE
a96e452c5a6c   nat       nat       local
ca3ffe37f040   nat2      nat       local
f0bf64220013   none      null      local

Dockerfile（Visual Studio自动生成） #

FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443

FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
WORKDIR /src
COPY ["A/A.csproj", "A/"]
COPY ["B/B.csproj", "B/"]
COPY ["C/C.csproj", "C/"]
RUN dotnet restore "C/C.csproj"
COPY . .
WORKDIR "/src/C"
RUN dotnet build "C.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "C.csproj" -c Release -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "C.dll"]

问题解决思路 #

1. 修正容器端口映射的绑定地址 #

Windows Docker默认使用NAT网络，仅指定-p 80:80时，端口只会绑定到127.0.0.1，导致仅本地可访问。启动容器时需明确绑定到所有地址或服务器的外部IP：

# 绑定到所有地址
docker run -d -p 0.0.0.0:80:80 your-image-name

# 绑定到服务器指定IP（替换为实际局域网/公网IP）
docker run -d -p 192.168.x.x:80:80 your-image-name

2. 检查并修复NAT端口转发规则 #

Windows Docker的NAT网络依赖系统端口转发，可通过以下命令查看规则：

netsh interface portproxy show v4tov4

若缺少对应转发规则，手动添加（替换容器IP和端口）：

# 容器IP可通过docker inspect <容器ID/名称>获取，对应NetworkSettings.Networks.nat.IPAddress字段
netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=80 connectaddress=172.x.x.x connectport=80

3. 确认防火墙规则的访问范围 #

检查已配置的防火墙规则，确保"远程IP地址"设置为任何IP地址，而非仅本地地址，避免外部请求被拦截。

4. 配置ASP.NET Core绑定所有地址 #

ASP.NET Core默认可能仅绑定localhost，需修改项目配置：

• 在Program.cs中指定绑定地址：

var builder = WebApplication.CreateBuilder(args);
// 其他配置代码...
var app = builder.Build();
// 中间件配置代码...
app.Run("http://0.0.0.0:80");

• 或启动容器时通过环境变量设置：

docker run -d -p 0.0.0.0:80:80 -e ASPNETCORE_URLS=http://0.0.0.0:80 your-image-name

内容的提问来源于stack exchange，提问作者Gary Lu