Docker容器中ASP.NET MVC应用连接AWS私有子网SQL Server失败排查

Let’s tackle this issue where your ASP.NET MVC app runs fine locally (with VPN active) but fails to connect to the private subnet SQL Server when inside a Windows Docker container. Since you’ve already confirmed ping works from the container, we know basic network connectivity is there—so the problem is likely tied to SQL-specific connectivity, routing gaps, or container network configuration.

Possible Root Causes #

• Windows Docker containers use a NAT network by default, which might not inherit the host’s full VPN routing table
• SQL Server isn’t configured to accept TCP/IP connections (or is restricted to listening only on localhost)
• The container’s Windows firewall is blocking SQL’s default port (1433)
• The connection string relies on a protocol that doesn’t work across container NAT (like named pipes)

Step-by-Step Troubleshooting #

1. Test SQL Port Connectivity in the Container
   Ping only confirms ICMP works—let’s validate the actual SQL port. Run these commands inside the container:

# Test TCP connectivity to SQL's default port
Test-NetConnection 192.168.1.100 -Port 1433
# Or use telnet if available
telnet 192.168.1.100 1433

If this fails, the issue is port-level blocking (firewall, SQL config, or missing routing).

2. Check the Container’s Routing Table
   Windows containers don’t automatically inherit all host routes. Run route print inside the container and look for a route entry for 192.168.1.0/24 (your SQL subnet) pointing to your VPN adapter’s gateway. If it’s missing, the container doesn’t know to send SQL traffic over the VPN.

3. Validate SQL Server’s TCP/IP Configuration
   Even if ping works, SQL might be restricted to localhost:

• On your AWS EC2 SQL server, open SQL Server Configuration Manager
• Navigate to SQL Server Network Configuration > Protocols for MSSQLSERVER
• Ensure TCP/IP is enabled
• Double-click TCP/IP, go to the IP Addresses tab:
  • Set Listen All to Yes
  • For each IP entry (including your private subnet IP), set Active and Enabled to Yes
• Restart the SQL Server service

4. Rule Out Container Firewall Blocking
   Windows Server Core containers have a firewall enabled by default. Test temporarily disabling it to confirm:

netsh advfirewall set allprofiles state off

If the connection works after this, add a permanent rule to allow port 1433:

netsh advfirewall firewall add rule name="Allow SQL Port" dir=in action=allow protocol=TCP localport=1433

Fixes to Implement #

1. Fix Container Routing #

If the container lacks the VPN route, choose one of these options:

• Manual Route Addition: Run this inside the container (replace <VPN_GATEWAY_IP> with your VPN’s gateway address):

  route add 192.168.1.0 mask 255.255.255.0 <VPN_GATEWAY_IP>
  

  To make this persistent, add the command to your Dockerfile or a startup script.
• Use Host Network Mode (Windows-specific): Modify your Docker Compose to bypass NAT and use the host’s network (note: this can cause port conflicts, but simplifies routing):

  version: '3.4'
  services:
    myWebApp:
      image: ${DOCKER_REGISTRY}myWebApp
      build:
        context: .
        dockerfile: Dockerfile
      network_mode: "host"
  

2. Update the Connection String #

Force the use of TCP/IP in your connection string (named pipes don’t work across container NAT):

"Data Source=192.168.1.100,1433;Initial Catalog=Admin;Persist Security Info=True;User ID=admin;Password=WVU8PLDR;Network Library=DBMSSOCN"

The Network Library=DBMSSOCN parameter ensures the app uses TCP/IP instead of named pipes.

3. Ensure Docker Recognizes the VPN Network #

In Docker Desktop (Windows) settings:

• Go to Settings > Resources > Network
• Verify your VPN adapter is listed under "Network adapters"
• Enable Allow containers to communicate with host networks

Final Notes #

Start with the port connectivity test—it’ll quickly narrow down whether the issue is routing, SQL config, or firewall. If you still hit roadblocks, share the output of Test-NetConnection from the container and the container’s route print results for more targeted help.

内容的提问来源于stack exchange，提问作者NitinSingh