Is it possible to disable nat in docker-compose?

[bdbear]

How can I implement

enable_ip_masquerade=false

Into

networks:
   front:
     driver: bridge
     ipam:
       driver: default
       config:
       -
         subnet: 172.25.0.0/24

[joffrey (Joffrey F)]

This should work:

networks:
   front:
     driver: bridge
     driver_opts:
       com.docker.network.bridge.enable_ip_masquerade: 'false'
     ipam:
       driver: default
       config:
       -
         subnet: 172.25.0.0/24

[bdbear]

I tested that last night. But forgot to update the post. It does not disable automatization of ip tables on the subnet. So I think i have to do something like they describe in this post

@kar1

Hi,

I had more or less the same issue and here is how I fixed it (ob Ubuntu, but I assume it will be the same on Debian).
I added to the docker daemon the following options (in /etc/sysconfig/docker):

OPTIONS=‘–bip 10.190.33.254/24 -g /data/docker --iptables=false’

• –bip sets the IP addresses and netmask for the containers
• –iptables prevents Docker from modyfing my iptables rules

In the docker systemd unit file (/lib/systemd/system/docker.service), I added this line:

ExecStartPost=/docker_network_conf/docker_iptables.sh
(The script must be executed after the docker daemon is up)

And the script simply looks like:

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

iptables -t nat -A POSTROUTING -s 10.190.33.0/24 ! -o docker0 -j SNAT --to-source [HOST_IP]
iptables -t nat -A POSTROUTING -s 10.190.33.0/24 ! -o docker0 -j MASQUERADE

[dlesaffrew (David Lesaffre)]

in more recent versions of docker, use this:

networks:
  network-name:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.gateway_mode_ipv4: 'routed'