I'm struggling with this problem for two days.


  • Docker network (and interface) named docknet type bridge subnet
  • Two interfaces eth0 ( and eth1 (
  • Default routing goes through eth0

What I want:

  • Outgoing traffic from container attached to docknet must go to eth1

What I tried:

  • Default iptable rule created by docker left untouched:

-A POSTROUTING -s ! -o docknet -j MASQUERADE

  • My rules:

iptables -t mangle -I PREROUTING -s -j MARK --set-mark 1

ip rule add from all fwmark 1 table 2

Where table 2 is:

default via dev eth1 proto static

With this setup when I try to ping from a container ( attached to docknet the following happens:

  • gets translated to
  • the packet goes through eth1
  • the packet returns to eth1 with src addr and dst

from here a reverse translation from to should happen but running tcpdump -i any host there is not trace about this translation

I checked out also conntrack -L and this is the result:

icmp 1 29 src= dst= type=8 code=0 id=9 src= dst= type=0 code=0 id=9 mark=0 use=1

Useful info:

  • eth1 is actually a 4G usb dongle
  • ip forwarding is active
  • curl --interface eth1 ipinfo.io works as expected

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.