Docker containers on macvlan can't ping external internet

Question

I am trying to set up a pihole docker instance running on a macvlan on a Raspberry Pi 4B.

I am unable to ping the external internet from my container.

I've managed to reduce the problem for replication:

Create a macvlan on wlan0, which has promiscuous mode enabled.
Launch a docker container and attempt to ping the external world.

Details: I'm running a raspberry pi 4, using the wlan0 interface. I have enabled promiscuous mode on wlan0

I create the macvlan network with docker network create -d macvlan --subnet=10.0.37.27/24 --gateway=10.0.37.1 --ip-range 10.0.37.65/29 -o parent=wlan0 --aux-address="pi4=10.0.37.69" macvlan0 - this creates a child interface called macvlan0 under wlan0. This means that containers will get assigned IP's from .65-.70

I then run a busybox container to ping my wlan0 physical IP: docker run --net=macvlan0 busybox ping 10.0.37.27. This works.

If I try to ping 1.1.1.1 or even the gateway at 10.0.37.1, it fails I verified the routing table is correct with docker run --net=macvlan0 busybox ip route get 1.1.1.1 and I get a result 1.1.1.1 via 10.0.37.1 dev eth0 src 10.0.37.64, which is perfectly reasonable.

Analysis:

I don't understand what is going on. I'm able to ping my container from my host, and my host from my container ( I set up a macvlan-shim). My ip route and route -n show reasonable routing tables

And yet, ping externally fails. I'm very confused.

ifconfig on the pi4

docker0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        ether 02:42:c5:da:e3:84  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether dc:a6:32:08:56:eb  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 483666  bytes 87269371 (87.2 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 483666  bytes 87269371 (87.2 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

macvlan-shim: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.37.69  netmask 255.255.255.248  broadcast 0.0.0.0
        inet6 fe80::bcd6:6fff:fe61:4eaf  prefixlen 64  scopeid 0x20<link>
        ether be:d6:6f:61:4e:af  txqueuelen 1000  (Ethernet)
        RX packets 94178  bytes 21676941 (21.6 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 227298  bytes 9556744 (9.5 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST>  mtu 1500
        inet 10.0.37.27  netmask 255.255.255.0  broadcast 10.0.37.255
        inet6 fe80::dea6:32ff:fe08:56ec  prefixlen 64  scopeid 0x20<link>
        ether dc:a6:32:08:56:ec  txqueuelen 1000  (Ethernet)
        RX packets 401557  bytes 108910986 (108.9 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 719387  bytes 112456816 (112.4 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Docker containers on macvlan can't ping external internet

0 Answers0