I'm struggling with this problem for two days.


  • Docker network (and interface) named docknet type bridge subnet
  • Two interfaces eth0 (Gateway IP:, Interface Static IP: and eth1 (Gateway IP:, Interface Static IP:
  • Default routing goes through eth0

What I want:

  • Outgoing traffic from container attached to docknet must go to eth1

What I tried:

  • Default iptable rule created by docker left untouched:

-A POSTROUTING -s ! -o docknet -j MASQUERADE

  • My rules:

iptables -t mangle -I PREROUTING -s -j MARK --set-mark 1

ip rule add from all fwmark 1 table 2

Where table 2 is:

default via dev eth1 proto static

With this setup when I try to ping from a container ( attached to docknet the following happens:

  • gets translated to
  • the packet goes through eth1
  • the packet returns to eth1 with src addr and dst

from here a reverse translation from to should happen but running tcpdump -i any host there is not trace about this translation

I checked out also conntrack -L and this is the result:

icmp 1 29 src= dst= type=8 code=0 id=9 src= dst= type=0 code=0 id=9 mark=0 use=1

Useful info:

  • eth1 is actually a 4G usb dongle
  • ip forwarding is active
  • curl --interface eth1 ipinfo.io works as expected


output from ip -d link show eth1

eth1: mtu 1500 qdisc fq_codel state UNKNOWN mode DEFAULT group default qlen 1000 link/ether 00:b0:d6:00:00:00 brd ff:ff:ff:ff:ff:ff promiscuity 0 addrgenmode eui64 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535

  • Do I understand well that in table 2 via really means "do ARP requests for any internet IP, 4G card will handle it" ? or is the interface not ethernet but a layer 3 interface and/or with NOARP attribute? Or did you intend to put an actual gateway which is not I understand it's not the cause of the issue, but if you could edit and clarify this point (perhaps even adding some parts of ip -d link show eth1, this would avoid confusion.
    – A.B
    Apr 18, 2019 at 20:49
  • @A.B Good catch!
    – kubanczyk
    Apr 18, 2019 at 21:19
  • I added the output of that cmd, A.B the interface is a netgear aircard
    – Luca O
    Apr 18, 2019 at 22:47


You must log in to answer this question.

Browse other questions tagged .