Can reach container on MACVLAN from host, but not from rest of network

General
1

Hello,
I’ve been racking my brain for 3 days on this, and figure it must be something simple I’m missing. I’m relatively new to docker, so please be patient with this newbie.

I have a docker host set up as a VMWare esxi 6.5 VM. It is Ubuntu 20.04.2 LTS server. Docker version is 20.10.5.

Client network: 192.168.123.0/24
Docker host network: 192.168.10/24
MACVLAN network: 192.168.10/25

The situation is the following:
I can ping from the docker host to everywhere:

  • MACVLAN address
  • Container address
  • Client address

But, from the client, I can ping only the Docker host address. I cannot ping:

  • MACVLAN address
  • Container address

I added a static route on the L3 switch:
ip route 192.168.10.0 255.255.255.128

I can now ping the MACVLAN address, but still not the container address

Here is the the docker-compose.yaml file:

services:
  <service name>:
    extends:
      service: <service name>
      file: <service name>/docker-compose.yaml
    networks:
      vlan10_network:
        ipv4_address: <container ip>
    mac_address: <manual random mac>
networks:
  vlan10_network:
    driver: macvlan
    driver_opts:
      parent: ens160
    ipam:
      config:
        - subnet: 192.168.10.0/24          
          gateway: 192.168.10.254            
          ip_range: 192.168.10.1/25      
          aux_addresses:
            host1: <MACVLAN ip>

And, to the linux host I have executed:

ip link add vlan10-shim link ens160 type macvlan  mode bridge
ip addr add <MACVLAN ip>/32 dev vlan10-shim
ip link set vlan10-shim up
ip route add 192.168.10.0/25 dev vlan10-shim

The 192.168.10.x subnet DHCP server scope excludes the front half of the subnet.

So, at the moment, the container is running but I can’t access it!

Any help is greatly appreciated.

Thank you!

3

The solution was very simple (once known).

TLDR; set the network switch to promiscuous mode and reboot the server. I also had to remove the static route in my L3 switch that pointed traffic to the docker network via the docker host interface, that I had put in as a test workaround.

My statement about the MACVLAN network on /25 was mis-stated (it’s on the /24 with an IP range of /25), but the settings copied from the config file into my post were accurate and correct. The host network, docker network, and gateway are all on the same /24, but the IP range available to the docker network for use is /25. So, the settings are correct. It’s also important to remember to create a fake MAC address for the container to map to a real IP address.

2 Likes