Docker Community Forums

Share and learn in the Docker community.

Can reach container on MACVLAN from host, but not from rest of network

Hello,
I’ve been racking my brain for 3 days on this, and figure it must be something simple I’m missing. I’m relatively new to docker, so please be patient with this newbie.

I have a docker host set up as a VMWare esxi 6.5 VM. It is Ubuntu 20.04.2 LTS server. Docker version is 20.10.5.

Client network: 192.168.123.0/24
Docker host network: 192.168.10/24
MACVLAN network: 192.168.10/25

The situation is the following:
I can ping from the docker host to everywhere:

  • MACVLAN address
  • Container address
  • Client address

But, from the client, I can ping only the Docker host address. I cannot ping:

  • MACVLAN address
  • Container address

I added a static route on the L3 switch:
ip route 192.168.10.0 255.255.255.128

I can now ping the MACVLAN address, but still not the container address

Here is the the docker-compose.yaml file:
services:
:
extends:
service:
file: /docker-compose.yaml
networks:
vlan10_network:
ipv4_address:
mac_address:
networks:
vlan10_network:
driver: macvlan
driver_opts:
parent: ens160
ipam:
config:
- subnet: 192.168.10.0/24
gateway: 192.168.10.254
ip_range: 192.168.10.1/25
aux_addresses:
host1:

And, to the linux host I have executed:

ip link add vlan10-shim link ens160 type macvlan mode bridge
ip addr add /32 dev vlan10-shim
ip link set vlan10-shim up
ip route add 192.168.10.0/25 dev vlan10-shim

The 192.168.10.x subnet DHCP server scope excludes the front half of the subnet.

So, at the moment, the container is running but I can’t access it!

Any help is greatly appreciated.

Thank you!

You might want to start by reading up on simple routing concepts or subnets and routing

How do I create a macvlan docker network if my gateway is out of my subnet?

A gateway address must be on the same subnet as an interface. To use this new subnet you will need to use up one of the IP addresses and assign it somewhere on the host as a gateway.

Subnet routing to a bridge network.
From the hosting screen shot, the 88.99.114.16/28 subnet has been setup to route via your host 88.99.102.103. You need to create an interface somewhere on your host to use as the gateway if you want Docker to use the rest of the IP addresses in the subnet.

Create a bridge network for Docker to use, the bridge will be assigned the gateway address 88.99.114.17

docker network create
–driver=bridge
–subnet 88.99.114.16/28
–gateway=88.99.114.17
name0
You may also need to enable IP forwarding for routing to work. Configure ip forwarding in /etc/sysctl.conf:

net.ipv4.ip_forward = 1
and Apply the new setting

sysctl -p /etc/sysctl.conf
Then run a container on the new bridge with your routed network should be able to access the gateway and the internet

docker run --net=name0 --rm busybox
sh -c “ip ad sh && ping -c 4 88.99.114.17 && wget api.ipify.org
You may need to allow access into the subnet in iptables, depending on your default FORWARD policy

iptables -I DOCKER -d 88.99.114.16/28 -j ACCEPT
Services on the subnet will be accessible from the outside world

docker run --net=name0 busybox
nc -lp 80 -e echo -e “HTTP/1.0 200 OK\nContent-Length: 3\n\nHi\n”
Then outside

○→ ping -c 2 88.99.114.18
PING 88.99.114.18 (88.99.114.18): 56 data bytes
64 bytes from 88.99.114.18: icmp_seq=0 ttl=63 time=0.527 ms
64 bytes from 88.99.114.18: icmp_seq=1 ttl=63 time=0.417 ms

— 88.99.114.18 ping statistics —
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.417/0.472/0.527/0.055 ms

○→ curl 88.99.114.18
Hi
No need for macvlan interface mapping.

How do I run a container using macvlan network when I have only IP address but no mac address?

macvlan is use to map a physical/host interface into a container. As you don’t have a physical interface for these addresses it will be hard to map one into a container.

Hi there,

Thanks for taking the time and effort to respond. After much review and research, I discovered there are some errors in what you describe (possibly due to a lack of clarity on my part) and the solution was very simple (once known).

TLDR; set the network switch to promiscuous mode and reboot the server. I also had to remove the static route in my L3 switch that pointed traffic to the docker network via the docker host interface, that I had put in as a test workaround.

RE: IP settings - there were no errors in my network settings described above. However, my statement about the MACVLAN network on /25 was mis-stated (it’s on the /24 with an IP range of /25), but the settings copied from the config file into my post were accurate and correct. The host network, docker network, and gateway are all on the same /24, but the IP range available to the docker network for use is /25. So, the settings are correct. It’s also important to remember to create a fake MAC address for the container to map to a real IP address.

RE: bridge network - as this is being setup as a MACVLAN network, these directions do not appear to be relevant. However, if I were to use a bridge network to split the same class D subnet into routable parts, perhaps it would apply.