0

First of all, sorry about my English lul

I have a pretty simple infrastructure running under docker:

container1: iptables firewall;

container2: https repository;

container3: ansible server.

container1 has two interfaces so it can goes out trought WAN via eth0 and communicate with containers 2 and 3 via eth1 (LAN).

The problem im facing is to make LAN able to reach the internet (ping -c3 google.com).

container1 - I've already set ipv4_forwarding and made WAN's GW my default route (it communicates with the other two containers and reaches the internet).

container2; container3 - they communicate normally on LAN but just can't ping FW's IP addr so don't reach the WAN... I've set a static route spreading FW's WAN subnet and now they can ping 200.200.100.1 (docker's bridged interface which is used as FW subnet GW, FW IP: 200.200.200.2).

Am I missing any iptables conf (didn't make nothing yet) or do I need to configure a route out of the docker (between interfaces docker0-docker1 on host machine)?

Can send container routing tables if you need it, maybe there's something missing.

Hope some buddy could give me a hand ")

Kind Regards.

1 Answer 1

0

Assuming the LAN subnet is 10.20.20.0/24 (docker IP range) and the interface to the internet (WAN) is eth0

Execute the following commands on the host machine where docker bridge is (your host machine will act as a firewall in this case)

# apt install iptables-persistent -y
# iptables -t nat -A POSTROUTING ! -d 10.20.20.0/24 -o eth0 -j MASQUERADE
# iptables -I FORWARD -j ACCEPT
# netfilter-persistent save
# netfilter-persistent reload
3
  • Bruce, same thing even after doing this... don't know if the problem is the container acting as fw or any network issue on my local machine... don't we need to configure iptables outside docker too? Oct 21, 2019 at 22:17
  • In my example, 10.20.20.0/24 is the IP range that docker containers are using. The iptables commands will be executed on the host machine. Oct 23, 2019 at 6:03
  • works fine ;] thanks a lot bruvahhh Oct 26, 2019 at 1:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .