Docker Community Forums

Share and learn in the Docker community.

Docker Host with multiple VLANs


#1

Background Information

I have a server with one physical network interface that is running Docker.
This interface is configured as a 802.1Q trunk. To avoid asymetric routing I configured routing tables for each subnet.
Thats my interfaces /etc/network/interfaces :

auto enp3s0
iface enp3s0 inet dhcp
    post-up ip route add 192.168.1.0/24 dev enp3s0 table 1
    post-up ip route add default via 192.168.1.1 table 1
    post-up ip rule add from 192.168.1.0/24 table 1 priority 101
    post-up ip route flush cache
    pre-down ip rule del from 192.168.1.0/24 table 1 priority 101
    pre-down ip route flush table 1
    pre-down ip route flush cache

auto enp3s0.2
iface enp3s0.2 inet dhcp
        hwaddress ether 00:11:22:33:44:55
        post-up ip route add 192.168.2.0/24 dev enp3s0.2 table 2
        post-up ip route add default via 192.168.2.1 table 2
        post-up ip rule add from 192.168.2.0/24 table 2 priority 102
        post-up ip route flush cache
        pre-down ip rule del from 192.168.2.0/24 table 2 priority 102
        pre-down ip route flush table 2
        pre-down ip route flush cache

auto enp3s0.4
iface enp3s0.4 inet dhcp
        hwaddress ether 00:11:22:33:44:56
        post-up ip route add 192.168.4.0/24 dev enp3s0.4 table 4
        post-up ip route add default via 192.168.4.1 table 4
        post-up ip rule add from 192.168.4.0/24 table 4 priority 104
        post-up ip route flush cache
        pre-down ip rule del from 192.168.4.0/24 table 4 priority 104
        pre-down ip route flush table 4
        pre-down ip route flush cache
...

This setup works fine, if I start container with the --net=host parameter. The containers are accessible from each subnet/vlan.

The Problem

I would like to have more control about the ports and the accessibility (not every docker should be reachable in every subnet).
If I use the parameter -p (e.g. -p 3777:3777) the dockers are not reachable anymore.

This guide https://hicu.be/docker-networking-macvlan-vlan-configuration
adress a simliar problem, but I do not want to extend my vlans to docker and assign an IP on each docker instance. This is to much.

Desired solution

My server has an IP in every subnet/vlan,
192.168.1.199 (native vlan / mgmt)
192.168.2.199 (vlan2)
192.168.4.199 (vlan4)

I would like to start dockers with the -p paramenter and will choose on wich interface it is accessible.
e.g. docker run --p 192.168.4.199:9000:9000 --name portainer …
and it should only accessible through 192.168.4.199:9000

Maybe my ip route / ip rule settings are not well configured or/and I need a docker bridge for each subnet…but that’s the point where I can not get any further. Up to now, if I choose the --p parameter and the docker is connected to the default docker bridge…the docker is not accessible at all.

Do you have any idea?

Greets,
Mark