I have two containers running (A and B) inside a Virtual Machine (Ubuntu 18.04). For network simulation purposes I am routing packets from A to B (this part works). What I want to do is to allow A and B to communicate with the outside world. Thus I would have :

A ---- B ---- Host VM --- Host --- Internet

I've done this so far :

ip link add name br_routing type bridge
ip link set dev br_routing up

Then add another virtual interface so container B has an interface to reach host vm network :

ip link add vm_side_iface type veth peer name containerb_side_iface

Add interface to the bridge

ip link set dev vm_side_iface master br_routing

Set ips for bridge and interface inside container

ip addr add dev br_routing
ip addr add dev vm_side_iface

Activate interface on vm side

ip link set vm_side_iface up
ip link set containerb_side_iface netns $container_pid

Then inside container B network namespace :

ip addr add broadcast dev containerb_side_iface
ip route add default via dev containerb_side_iface

At this point I'm able to ping A and B from the host virtual Machine

However I cannot ping beyond the bridge from A or B. The error seems to come from routing so here it is : B routing Table : dev eth0  proto kernel  scope link  src via dev eth0 dev containerb_side_iface  proto kernel  scope link  src

host VM routing Table :

default via dev enp0s3 proto dhcp metric 100 dev  enp0s3 proto kernel scope link src metric 100 #Irrelevant here via dev br_routing #Route to reach B via dev br_routing #Route to reach A dev br_routing proto kernel scope link src #This seems odd dev router_0 proto kernel scope link src #This seems odd

My second guess is my routing tables, this is what I've tried :

iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
iptables -A FORWARD -i enp0s3 -o vm_side_iface, -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i vm_side_iface, -o enp0s3 -j ACCEPT
iptables -A FORWARD -i enp0s3 -o vm_side_iface, -j ACCEPT

I also tried replacing vm_side_iface by br_routing but it would not work either way. Moreover, the rules are not used (0 accepted packets, 0 dropped). These are the only rules that are configured in the VM. Regardless, the ping from the Host VM to A/B works without these rules.

Finally, modprobe br_netfilter and flushing files inside /etc/sys/net/bridge does not change anything.

What does not work :

ping from A or B to HOST VM
ping from A or B to vm_side_iface
ping from A or B to br_routing

What works :

ping from HOST VM to A or B

I've noticed that the messages get to the bridge (tcpdump -i br_routing) but are not forwarded to the enp0s3 interface.

Any guess ?

  • 1
    Bridges do not route packets, that's what routers do. Bridges switch frames. – Ron Maupin Nov 27 '18 at 18:24
  • Thanks for the comment, I've edited the post accordingly. – Merkle Daamgard Nov 28 '18 at 11:24

I managed to make it work by using the docker0 bridge that is created by default when starting docker containers without network parameters

docker run -itd image_name

The bridge is the same as the one I was creating but somehow this one works.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.