bare metal LXD host: ubuntu 14.04 server
LXD version: 2.16 (running from the snap package)
Container: ubuntu 16.04 (with nginx installed, so it should server the nginx startpage to port 80 I assume)
expected behaviour
the container get’s an v4 IP address from the 172.20.14.xxx range assigned
I can see the nginx startpage in a browser from any client in my local network (172.20.14.xxx)
I can ping the nginx server from any client and likewise can to ping any client from inside the container
actual behavior
the container shows no v4 IP address assigned to it with the br0 profile
the container shows v4 IP address 10.146.203.174 (eth0) assigned to it with the default profile
A lot of what you’re seeing could be explained by mac filtering on your host’s network interface like what VMware does on all its networks (but it’s not the only such case).
actually I had a pretty similar problem (and could not solve it) when testing this in a Virtualbox VM
I was thinking it was a VBox problem, but now get my doubts about that thought
The behavior above exactly matches what you’d get if there was some kind of mac filtering going on somewhere… What’s your network infrastructure like outside of your host? Could it be that the switch your host is connected to is doing mac filtering?
I think you’re now at the stage where running tcpdump against p5p1 is probably the best way to figure out what’s going on. See whether any of the incoming traffic from your other machines even reaches the host and see if the traffic from the container is making it out of the host.
(yes, that’s firewalling on the same L2 subnet which is weird, but Linux does let you do that and on some kernels will have that enabled by default, so your rules may affect more than what you think they will)
that’s a lot to digest (another reminder of how I have only scratch the surface of networking so far) … will poke around and see what I can come up with.
My Network is being managed by an Asus RT-N66U Router, which connects with a modem provided by my ISP which I have no access to.
In the so called “Network Map” of the Router I can see the static IP of my container. So to some extent the router is aware of it’s existence but can’t ping it.
as far as I can tell there is not MAC filtering going on in that aforementioned router. The only place where I can even find such an option is in the Wireless settings, so even if that was enabled it should not be able to do anything to the problematic server (who is wired to my network)
Your FORWARD table defaults to a policy of DROP without any rule explicitly accepting the traffic from your containers, so that’s going to drop anything going in or out of your containers.
The default policy is ACCEPT, so something on your system (my guess would be whatever setup the DOCKER chains) changed this to DROP and is now blocking all other routed traffic.
iptables -P FORWARD ACCEPT
Will fix the issue by setting the default policy back to ACCEPT, though that won’t survive a reboot, so you should get to the bottom of whatever made that change on your system.
Thanks, this actually helped me as well. I was banging my head in the wall, and the strange is that there was indeed FORWARD rules present for the lxdbr0 interface… Very odd. Pinging the default gw worked, it just wouldn’t forward the traffic like it should.
Anyway, fixing it like this lets me postpone digging deeper into it for a while, since I don’t reboot very often. Again, thanks!
Again, thanks!