2FA is successfull when starting the docker, and yet I'm not able to connect to the API

[LucaMinutilloMenga]

Hi everybody, I need some help please.

In paper mode, all is fine.

When starting the docker in live mode, I receive the 2FA on my phone, which I promptly acknowledge. This is correctly reflected in the docker logs, as expected:

2025-03-22 15:27:19:105 IBC: Second Factor Authentication initiated
2025-03-22 15:27:19:105 IBC: detected frame entitled: Authenticating...; event=Lost focus
2025-03-22 15:27:19:106 IBC: detected frame entitled: Authenticating...; event=Deactivated
2025-03-22 15:27:19:106 IBC: detected dialog entitled: Second Factor Authentication; event=Activated
2025-03-22 15:27:19:108 IBC: detected dialog entitled: Second Factor Authentication; event=Focused
2025-03-22 15:27:28:686 IBC: detected dialog entitled: Second Factor Authentication; event=Lost focus
2025-03-22 15:27:28:686 IBC: detected dialog entitled: Second Factor Authentication; event=Deactivated
2025-03-22 15:27:28:690 IBC: detected dialog entitled: Second Factor Authentication; event=Closed
2025-03-22 15:27:28:694 IBC: Duration since login: 12 seconds
LogModuleConfigurator-Init: Log4j Ver2.x found on classpath
LogModuleConfigurator-Init: LogModuleConfigurator initialized with Log4j Veri.x
2025-03-22 15:27:34:379 IBC: detected dialog entitled: Trader Workstation Configuration; event=Opened
2025-03-22 15:27:34:379 IBC: Got config dialog from future
2025-03-22 15:27:34:379 IBC: Got config dialog from future
2025-03-22 15:27:34:380 IBC: detected dialog entitled: Trader Workstation Configuration; event=Activated
2025-03-22 15:27:34:381 IBC: detected dialog entitled: Trader Workstation Configuration; event=Focused
2025-03-22 15:27:34:382 IBC: detected frame entitled: Starting application...; event=Closed
2025-03-22 15:27:34:382 IBC: Login has completed

So far, so good. However, after this, when then I try to connect to the API, the troubles begin. For example, this simple script fails with timeout error (regardless of the client id that I use):

from ib_insync import IB, util
util.logToConsole('DEBUG')
ib = IB()
ib.connect('127.0.0.1', 4001, clientId=1234)

2025-03-22 15:27:42,546 ib_insync.client INFO Connecting to 127.0.0.1:4001 with clientId 1234...
2025-03-22 15:27:42,547 ib_insync.client INFO Connected
2025-03-22 15:27:42,547 ib_insync.client INFO Disconnected.
2025-03-22 15:27:46,551 ib_insync.client INFO Disconnecting
2025-03-22 15:27:46,552 ib_insync.client ERROR API connection failed: TimeoutError()

Same outcome when using telnet to test the connectivity:

Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Connection closed by foreign host.

When checking the tcpdump output, I can clearly see that, as soon as the connection is successfully completed, the server initiates a connection termination with FIN, which is then acknowledged and mirrored by the client:

07:52:10.620266 IP (tos 0x0, ttl 64, id 44595, offset 0, flags [DF], proto TCP (6), length 52)
127.0.0.1.4001 > 127.0.0.1.40536: Flags [F.], cksum 0xfe28 (incorrect -> 0xd391), seq 1, ack 1, win 512, options [nop,nop,TS val 1665007770 ecr 1665007770], length 0

07:52:10.620787 IP (tos 0x0, ttl 64, id 7837, offset 0, flags [DF], proto TCP (6), length 52)
127.0.0.1.40536 > 127.0.0.1.4001: Flags [.], cksum 0xfe28 (incorrect -> 0xd390), ack 2, win 512, options [nop,nop,TS val 1665007771 ecr 1665007770], length 0

07:52:10.620887 IP (tos 0x0, ttl 64, id 7838, offset 0, flags [DF], proto TCP (6), length 52)
127.0.0.1.40536 > 127.0.0.1.4001: Flags [F.], cksum 0xfe28 (incorrect -> 0xd38f), seq 1, ack 2, win 512, options [nop,nop,TS val 1665007771 ecr 1665007770], length 0

Has anybody encountered similar issues when connecting in live mode? Thanks!

[gnzsnz]

Please make sure that you are mapping ports to the outside correctly. The docker compose file in the repo is tested and working.

Another thing to try is to enable api logs trough vnc and check the output in ib gateway

Hope this helps.

[Awnedion]

After updating to the latest stable docker image, I get a similar problem here. The auto login and 2FA works fine, but my client can't connect to the 4001 port.

The port forwarding is fine since I can vncviewer into the container fine. My IB client is getting the following error:
IB error: -1 502 Couldn't connect to TWS. Confirm that "Enable ActiveX and Socket Clients" is enabled and connection port is the same as "Socket Port" on the TWS "Edit->Global Configuration...->API->Settings" menu. Live Trading ports: TWS: 7496; IB Gateway: 4001. Simulated Trading ports for new installations of version 954.1 or newer: TWS: 7497; IB Gateway: 4002

It talks about the 'Enable ActiveX and Socket Clients' option, but that option seems to no longer exist in the IB Gateway settings GUI that I see in vncviewer.

Anyone know what's going on?

[gnzsnz]

looks like your "Edit->Global Configuration...->API->Settings->Enable ActiveX and Socket Clients" is disabled