Recently i found this for give to docker a "personal" ip

ip addr del dev eth0
ip link add link eth0 dev eth0m type macvlan mode bridge
ip link set eth0m up
ip addr add dev eth0m
route add default gw

On container i did

CID=$(docker run -d ...)
pipework eth0 $CID[email protected]

This works fine if host and docker containers all are on same subnet( in this case) But if i want to use a different subnet for dockers? For example

I have tried a iptables masquerade,but nothing works,the docker container cannot ping or reach external network(internet).

iptables -t nat -A POSTROUTING -m iprange --src-range -o eth0 -j MASQUERADE

Of course ip forwarding is enabled

1 Answer 1


Solution found. The host must setup as router,enable iptables NAT and enable route to new ip class,in this case eth0m is the bridged network

iptables -A FORWARD -i eth0m -o eth0m -j ACCEPT
iptables -A FORWARD -i eth0m -o eth0m  -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -t nat  -A POSTROUTING -o eth0m -j MASQUERADE

pipework must use the new router,in this case is

pipework eth0 $DOCKID[email protected]

and finally route must be added,in this case is the other ip class

route add -net netmask  dev eth0m

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .