I have two containers running (A and B) inside a Virtual Machine (Ubuntu 18.04). For network simulation purposes I am routing packets from A to B (this part works). What I want to do is to allow A and B to communicate with the outside world. Thus I would have :

A ---- B ---- Host VM --- Host --- Internet

I've done this so far :

ip link add name br_routing type bridge
ip link set dev br_routing up

Then add another virtual interface so container B has an interface to reach host vm network :

ip link add vm_side_iface type veth peer name containerb_side_iface

Add interface to the bridge

ip link set dev vm_side_iface master br_routing

Set ips for bridge and interface inside container

ip addr add dev br_routing
ip addr add dev vm_side_iface

Activate interface on vm side

ip link set vm_side_iface up
ip link set containerb_side_iface netns $container_pid

Then inside container B network namespace :

ip addr add broadcast dev containerb_side_iface
ip route add default via dev containerb_side_iface

At this point I'm able to ping A and B from the host virtual Machine

However I cannot ping beyond the bridge from A or B. The error seems to come from routing so here it is : B routing Table : dev eth0  proto kernel  scope link  src via dev eth0 dev containerb_side_iface  proto kernel  scope link  src

host VM routing Table :

default via dev enp0s3 proto dhcp metric 100 dev  enp0s3 proto kernel scope link src metric 100 #Irrelevant here via dev br_routing #Route to reach B via dev br_routing #Route to reach A dev br_routing proto kernel scope link src #This seems odd dev router_0 proto kernel scope link src #This seems odd

My second guess is my routing tables, this is what I've tried :

iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
iptables -A FORWARD -i enp0s3 -o vm_side_iface, -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i vm_side_iface, -o enp0s3 -j ACCEPT
iptables -A FORWARD -i enp0s3 -o vm_side_iface, -j ACCEPT

I also tried replacing vm_side_iface by br_routing but it would not work either way. Moreover, the rules are not used (0 accepted packets, 0 dropped). These are the only rules that are configured in the VM. Regardless, the ping from the Host VM to A/B works without these rules.

Finally, modprobe br_netfilter and flushing files inside /etc/sys/net/bridge does not change anything.

What does not work :

ping from A or B to HOST VM
ping from A or B to vm_side_iface
ping from A or B to br_routing

What works :

ping from HOST VM to A or B

I've noticed that the messages get to the bridge (tcpdump -i br_routing) but are not forwarded to the enp0s3 interface.

Any guess ?

  • 1
    Bridges do not route packets, that's what routers do. Bridges switch frames.
    – Ron Maupin
    Commented Nov 27, 2018 at 18:24
  • Thanks for the comment, I've edited the post accordingly. Commented Nov 28, 2018 at 11:24

1 Answer 1


I managed to make it work by using the docker0 bridge that is created by default when starting docker containers without network parameters

docker run -itd image_name

The bridge is the same as the one I was creating but somehow this one works.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .