2

I've got a script that listens for ICMP ping packets (containing data payload) and while this works if you run it from command line, it doesn't work in a Docker container because ICMP ping packets are not being routed from the server instance to the container.

This is running on AWS Container Service which slightly complicates things.

I think this will forward all packets

sudo iptables -t nat -A POSTROUTING --out-interface veth* -j MASQUERADE  
sudo iptables -A FORWARD --in-interface eth1 -j ACCEPT

How do I forward specifically ICMP ping ("echo") packets arriving on the 'eth0' interface of the instance to the local IP or virtual interface of the docker container (e.g. 172.0.0.1 or veth*).

Improve this question

1 Answer 1

Reset to default
1

Nooo

You don't want to prevent all ICMP packets from being processed by the host.

See: Filter all ICMP and watch the world burn

(I think you want to assign the container a real IP address.

Probably simplest using macvlan - given that you're not already using bridging on eth0. You create a macvlan attached to eth0 and assign it to the container. There's a script called pipework that everybody uses, until Docker sorts out native networking support. There's also ipvlan (newer), in case your network doesn't tolerate assigning additional MAC addresses. The nice thing about macvlan is it works fine with DHCP4 though).

Improve this answer
4
  • The docker0 interface already bridges on eth0 on the instance, but that itself bridges to a veth* interface which is bound to eth0 on the container.
    – user279171
    Jun 17, 2016 at 12:48
  • If it was bridged all the way then your container already has an ip address, reachable by the network eth0 is connected to, and your problem is something blocking the desired packets. Is that confirmed by brctl show?
    – sourcejedi
    Jun 17, 2016 at 14:32
  • I can ping the container from inside the container instance, because it has a 172.0.0.* address. But I can't ping the container externally on that address. Say my container instance has an IP of 54.0.0.1, if I ping that address it's the container instance responds to ICMP pings. I want to use that address, but the pings to be forwarded to the container, so the container responds to the pings.
    – user279171
    Jun 17, 2016 at 15:41
  • ok, question fixed
    – sourcejedi
    Jun 17, 2016 at 17:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .