Hello, I have the exact same issue.
I am trying to set up pihole on an raspberry pi 2 on a container via macvlan interface. The container is not responding to ARP replies before I ping the outside host from which I want to access the container, from within the container. After I ping a host from the container, that host will populate it’s arp table with the container’s mac address.
Below, please find the details of my setup:
Docker info:
Client:
Debug Mode: false
Server:
Containers: 2
Running: 2
Paused: 0
Stopped: 0
Images: 2
Server Version: 19.03.6
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 7ad184331fa3e55e52b890ea95e65ba581ae3429
runc version: dc9208a3303feef5b3839f4323d9beb36df0a9dd
init version: fec3683
Security Options:
seccomp
Profile: default
Kernel Version: 4.19.97-v7+
Operating System: Raspbian GNU/Linux 10 (buster)
OSType: linux
Architecture: armv7l
CPUs: 4
Total Memory: 926.1MiB
Name: raspberrypi
ID: SWGQ:PDUG:JZEZ:N4QH:NG7H:HUE6:ZSW5:NXBE:GZZT:NUXZ:2HLH:53XK
Docker Root Dir: /srv/dev-disk-by-label-docker
Debug Mode: false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false
WARNING: No swap limit support
WARNING: No cpu cfs quota support
WARNING: No cpu cfs period support
Container compose file:
version: '2'
services:
pihole:
container_name: pihole
image: pihole/pihole:latest
mac_address: d0:ca:ab:cd:ef:01
cap_add:
- NET_ADMIN
networks:
pihole_network:
ipv4_address: 192.168.100.199
dns:
- 127.0.0.1
- 8.8.8.8
ports:
- "443:443/tcp"
- "53:53/tcp"
- "53:53/udp"
- "67:67/udp"
- "80:80/tcp"
environment:
TZ: 'Europe/Bucharest'
VIRTUAL_HOST: pihole.home.geo
WEBPASSWORD: "XXXXXX"
DNS1: 1.1.1.1
DNS2: 1.0.0.1
DNSMASQ_LISTENING: all
ServerIP: 192.168.100.199
restart: unless-stopped
volumes:
- /etc/pihole
- /etc/dnsmasq.d
networks:
pihole_network:
driver: macvlan
driver_opts:
parent: eth0
ipam:
config:
- subnet: 192.168.100.0/24
gateway: 192.168.100.1
ip_range: 192.168.100.192/28
aux_address: 192.168.100.100
Docker Networks:
NETWORK ID NAME DRIVER SCOPE
a49c40eed7cb bridge bridge local
a66e512eb428 host host local
7560b65028f8 none null local
151b447a370b pi_pihole_network macvlan local```
Docker macvlan network:
```$ docker network inspect pi_pihole_network
[
{
"Name": "pi_pihole_network",
"Id": "151b447a370bd8806f358644f77761f1dd817fd14d632ea428a2cb1233e99cad",
"Created": "2020-03-04T18:26:01.78449681Z",
"Scope": "local",
"Driver": "macvlan",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "192.168.100.0/24",
"IPRange": "192.168.100.192/28",
"Gateway": "192.168.100.1"
}
]
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {
"b257249c4dd2e3fad43184d18c75ae96f67fb64a11d55ae168dab3891f623aea": {
"Name": "pihole",
"EndpointID": "51e1bfd3c51a9f221400e9a08270dee055a532524b9a361005fb7a674497ac67",
"MacAddress": "d0:ca:ab:cd:ef:01",
"IPv4Address": "192.168.100.199/24",
"IPv6Address": ""
}
},
"Options": {
"parent": "eth0"
},
"Labels": {}
}
]
Docker Container:
$ docker network inspect pi_pihole_network
[
{
"Name": "pi_pihole_network",
"Id": "151b447a370bd8806f358644f77761f1dd817fd14d632ea428a2cb1233e99cad",
"Created": "2020-03-04T18:26:01.78449681Z",
"Scope": "local",
"Driver": "macvlan",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "192.168.100.0/24",
"IPRange": "192.168.100.192/28",
"Gateway": "192.168.100.1"
}
]
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {
"b257249c4dd2e3fad43184d18c75ae96f67fb64a11d55ae168dab3891f623aea": {
"Name": "pihole",
"EndpointID": "51e1bfd3c51a9f221400e9a08270dee055a532524b9a361005fb7a674497ac67",
"MacAddress": "d0:ca:ab:cd:ef:01",
"IPv4Address": "192.168.100.199/24",
"IPv6Address": ""
}
},
"Options": {
"parent": "eth0"
},
"Labels": {}
}
]
In order to permit network communication between the container and the host network I also created another macvlan interface with eth0 as parent interface:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether b8:27:eb:85:cd:5d brd ff:ff:ff:ff:ff:ff
inet 192.168.100.30/24 brd 192.168.100.255 scope global dynamic eth0
valid_lft 5959328sec preferred_lft 5959328sec
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:1a:7c:ac:14 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
5: veth40e3e9d@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
link/ether 3a:77:72:1b:d0:41 brd ff:ff:ff:ff:ff:ff link-netnsid 0
7: macvlan0@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 86:97:a1:79:ee:dd brd ff:ff:ff:ff:ff:ff
inet 192.168.100.195/28 scope global macvlan0
valid_lft forever preferred_lft forever
pi@raspberrypi:/etc/network $ sudo ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether b8:27:eb:85:cd:5d brd ff:ff:ff:ff:ff:ff
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default
link/ether 02:42:1a:7c:ac:14 brd ff:ff:ff:ff:ff:ff
5: veth40e3e9d@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP mode DEFAULT group default
link/ether 3a:77:72:1b:d0:41 brd ff:ff:ff:ff:ff:ff link-netnsid 0
7: macvlan0@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 86:97:a1:79:ee:dd brd ff:ff:ff:ff:ff:ff
IP route of raspberry:
$ ip route
default via 192.168.100.1 dev eth0
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
192.168.100.0/24 dev eth0 proto kernel scope link src 192.168.100.30
192.168.100.192/28 dev macvlan0 proto kernel scope link src 192.168.100.195
IP route of pihole container:
default via 192.168.100.1 dev eth0
192.168.100.0/24 dev eth0 proto kernel scope link src 192.168.100.199
To reproduce the issue I will try to reach the container from my PC, which is connected to the network via an eth switch. I will flush the arp cache form both the pi and my PC, restart the pihole container and then try to connect to it from my PC. Ping will fail until I ping the PC from the container because the container is not responding to ARP requests, therefore, my doesn’t have the MAC address of the pihole container.
PC IP addr: 192.168.100.4
PI IP addr: 192.168.100.30
Container IP addr: 192.168.100.199
Below, is an arp capture after flushing the arp cache on the pc and pi, and restarting the container:
pi@raspberrypi:~ $ cat tcpdump.arp
23:32:16.981417 ARP, Request who-has _gateway tell 192.168.100.199, length 28
23:32:16.982087 ARP, Reply _gateway is-at 20:f1:7c:2d:de:4e (oui Unknown), length 46
23:32:22.424704 ARP, Request who-has _gateway tell raspberrypi, length 28
23:32:22.425232 ARP, Reply _gateway is-at 20:f1:7c:2d:de:4e (oui Unknown), length 46
23:33:05.144724 ARP, Request who-has _gateway tell 192.168.100.199, length 28
23:33:05.145358 ARP, Reply _gateway is-at 20:f1:7c:2d:de:4e (oui Unknown), length 46
Below is a tcpdump and ping output while trying to ping the container (.199) from my pc (.4):
ping 192.168.100.199
Pinging 192.168.100.199 with 32 bytes of data:
Reply from 192.168.100.4: Destination host unreachable.
Reply from 192.168.100.4: Destination host unreachable.
Reply from 192.168.100.4: Destination host unreachable.
Reply from 192.168.100.4: Destination host unreachable.
23:35:35.489507 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:35:36.089711 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:35:37.089188 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:35:38.097340 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:35:39.089430 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:35:40.090133 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:35:41.064716 ARP, Request who-has _gateway tell raspberrypi, length 28
23:35:41.065268 ARP, Reply _gateway is-at 20:f1:7c:2d:de:4e (oui Unknown), length 46
23:35:41.094970 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:35:42.090042 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:35:43.089270 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:35:44.096895 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:35:45.089774 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:35:46.090225 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:36:59.304728 ARP, Request who-has _gateway tell raspberrypi, length 28
23:36:59.305463 ARP, Reply _gateway is-at 20:f1:7c:2d:de:4e (oui Unknown), length 46
23:37:07.590683 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:37:08.602561 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:37:09.590424 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:37:10.589920 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:37:11.595971 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:37:12.590187 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:37:13.590145 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:37:14.596994 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:37:15.590554 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
23:37:16.590022 ARP, Request who-has 192.168.100.199 tell 192.168.100.4, length 46
I am running on docker on:
$ uname -a
Linux raspberrypi 4.19.97-v7+ #1294 SMP Thu Jan 30 13:15:58 GMT 2020 armv7l GNU/Linux
$ cat /etc/os-release
PRETTY_NAME="Raspbian GNU/Linux 10 (buster)"
NAME="Raspbian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=raspbian
ID_LIKE=debian
HOME_URL="http://www.raspbian.org/"
SUPPORT_URL="http://www.raspbian.org/RaspbianForums"
BUG_REPORT_URL="http://www.raspbian.org/RaspbianBugs"
Is there something wrong with this config? I’ve been debugging this for 2 days and running out of options. I will try next to get a capture on the docker macvlan interface from within a container and see what I get.
Any help or explanation on why this is happening would be appreciated.
Thank you,
George