How to use docker container as a router for other containers in the same network

user_5632555 0
Viewed 3053

I want to use docker-compose to setup one container (C1) works as a router/gateway, C1 forwards the tcp data from container (C2) to internet. But C2 cannot access internet at all, traceroute shows packets reached C1 then no more further actions

with this similar setup using virtual machines, it works fine. Why is that?

C2(set C1 as default router) -> C1 -> internet

C1: alpine image, with iptables installed, ip: 1.1 . ping or traceroute works here

iptables -A FORWARD -o eth0 -j ACCEPT;

C2: alpine image, use ip route to replace default router, ip: 1.3

ip route replace default via 172.28.1.1

version: '3'
services:
    C1:
        build: ./projects/C1
        container_name: C1
        privileged: true
        cap_add:
            - NET_ADMIN
            - SYS_MODULE
        sysctls:
            # - net.ipv4.conf.all.src_valid_mark=1
            - net.ipv4.ip_forward=1
        networks:
            testing_net:
                ipv4_address: 172.28.1.1

    C2:
        build: ./projects/C2
        container_name: C2
        cap_add:
            - NET_ADMIN
            - SYS_MODULE
        privileged: true
        # sysctls:
            # - net.ipv4.conf.all.src_valid_mark=1
            # - net.ipv4.ip_forward=1
        networks:
            testing_net:
                ipv4_address: 172.28.1.3
                
networks:
    testing_net:
        ipam:
            driver: default
            config:
                - subnet: 172.28.0.0/16
docker-compose docker networking
1 Answers

From wireshark, I can see C1/C2 is sending out SYN packet, but website no response. According to this https://serverfault.com/a/496548/565903, I have to set tcp timestamp 0 so in docker-compose.yml file, C1 section, add tcp_timestamps = 0 then I can access public internet from C2.

        sysctls:
            - net.ipv4.ip_forward=1
            - net.ipv4.tcp_timestamps=0
user_56325550
Related