0

I have a box with a single network interface eno1 and two IPs (x.x.x.100 and x.x.x.101). My datacenter (Hetzner) requires different MACs for each IP.

/etc/network/interfaces:

auto  br0
iface br0 inet static
  address x.x.x.100
  netmask 255.255.255.255
  gateway x.x.x.1
  bridge_ports eno1
  bridge_stp off
  bridge_fd 1
  bridge_hello 2
  bridge_maxage 12

Inside the guest I have an interface of type "bridge" with the second IP's mac.

2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether x:x:x:x:x:x brd ff:ff:ff:ff:ff:ff
inet x.x.x.101/27 brd x.x.x.x scope global dynamic ens3
   valid_lft 40300sec preferred_lft 40300sec
inet6 ...

Docker is running on it's own bridge "docker0".

Because docker was messing with iptables on my host I ran

iptables -A FORWARD -p all -i br0 -j ACCEPT

Now my guest, host and docker containers (on the host) can access the internet. From the host I can ping and tcp both IPs. From the KVM guest I can ping the host.

I cannot ping the KVM guest from inside any of the docker containers and I do not get any reply from the dockerized webserver.

How can I connect the two bridges br0 and docker0?

[EDIT] Output of iptables -S:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-A INPUT -i docker0 -j ACCEPT
-A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o br-5acb826875b5 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-5acb826875b5 -j DOCKER
-A FORWARD -i br-5acb826875b5 ! -o br-5acb826875b5 -j ACCEPT
-A FORWARD -i br-5acb826875b5 -o br-5acb826875b5 -j ACCEPT
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i br0 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 443 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.19/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 9980 -j ACCEPT
-A DOCKER -d 172.17.0.25/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8000 -j ACCEPT
-A DOCKER -d 172.17.0.28/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8000 -j ACCEPT
-A DOCKER -d 172.17.0.30/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8000 -j ACCEPT
-A DOCKER -d 172.17.0.33/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8000 -j ACCEPT
-A DOCKER -d 172.17.0.36/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8000 -j ACCEPT
-A DOCKER -d 172.17.0.39/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8000 -j ACCEPT
-A DOCKER -d 172.17.0.44/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 22 -j ACCEPT
-A DOCKER -d 172.17.0.44/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.18.0.8/32 ! -i br-5acb826875b5 -o br-5acb826875b5 -p tcp -m tcp --dport 9000 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-5acb826875b5 ! -o br-5acb826875b5 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-5acb826875b5 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
2
  • 1
    you need to show your iptables rules
    – c4f4t0r
    Jun 23, 2019 at 11:19
  • thanks @c4f4t0r . I've added them to the original post
    – m_z
    Jun 23, 2019 at 16:22

1 Answer 1

0

Before these two rules:

-A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable

You need to allow the traffic from docker0 to virbr0

-A FORWARD -i docker0 -o virbr0 -j ACCEPT
-A FORWARD -i virbr0 -o docker0 -j ACCEPT
3
  • Thanks, I've added the rules but I still cannot connect from a docker container to the IP of the interface inside my guest. How should the virbr0 interface be connected to my Guest? As a NAT with DHCP and forward to "Physical Device virbr0"?
    – m_z
    Jun 24, 2019 at 6:43
  • @m_z to start to debug which rule is blocking the traffic, you can try to use iptables -vnL and look the pkts column, I know this is not related to issue, but why you don't use docker in a vm intent of mix vm and docker on the same host
    – c4f4t0r
    Jun 24, 2019 at 7:57
  • 1
    this is what I ended up doing, I put the docker part in its own guest, keeps the host's iptables clean and the performance impact is negligible. thanks for the suggestion @c4f4t0r
    – m_z
    Jun 28, 2019 at 11:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .