Docket containers doesnt have internet access, but dns works

devvil · 2022-06-04 16:43:05

Hello, i am using docker containers for testing purposes and i dont have internet access in my containers when i execute commands like "ping www.google.com" and "apt update" (in the case of ubuntu containers)

This is the output from these commands

[root@devvildaz devvildaz]# docker run --network=docker -it busybox ping www.google.com
PING www.google.com (64.233.190.106): 56 data bytes
^C
--- www.google.com ping statistics ---
4 packets transmitted, 0 packets received, 100% packet loss

apt update command execution

W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/jammy/InRelease Could not connect to archive.ubuntu.com:80 (91.189.91.38), connection timed out Could not connect to archive.ubuntu.com:80 (185.125.190.36), connection timed out Could not connect to archive.ubuntu.com:80 (185.125.190.39), connection timed out Could not connect to archive.ubuntu.com:80 (91.189.91.39), connection timed out
W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/ … /InRelease Unable to connect to archive.ubuntu.com:80:
W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/ … /InRelease Unable to connect to archive.ubuntu.com:80:
W: Failed to fetch http://security.ubuntu.com/ubuntu/dists … /InRelease Could not connect to security.ubuntu.com:80 (185.125.190.39), connection timed out Could not connect to security.ubuntu.com:80 (91.189.91.38), connection timed out Could not connect to security.ubuntu.com:80 (185.125.190.36), connection timed out Could not connect to security.ubuntu.com:80 (91.189.91.39), connection timed out
W: Some index files failed to download. They have been ignored, or old ones used instead.

I see that my container gets the ip of the destination after the dns request, but it still doesn't have access to the internet, for example, in the execution of the ping command, the container gets the ip of "www.google.com", the same with the ubuntu apt update command execution

PING www.google.com (64.233.190.106): 56 data bytes

Could not connect to archive.ubuntu.com:80 (91.189.91.39)

Also i show the tcpdump output when i executed ping command

[devvildaz@devvildaz ~]$ sudo tcpdump -i docker1
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on docker1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
11:23:47.740184 IP6 fe80::42:5bff:fe84:708c > ff02::16: HBH ICMP6, multicast listener report v2, 4 group record(s), length 88
11:23:47.898585 ARP, Request who-has devvildaz tell 172.17.0.2, length 28
11:23:47.898647 ARP, Reply devvildaz is-at 02:42:5b:84:70:8c (oui Unknown), length 28
11:23:47.898661 IP 172.17.0.2.51414 > _gateway.domain: 2+ AAAA? www.google.com. (32)
11:23:47.936223 IP _gateway.domain > 172.17.0.2.51414: 2 4/0/0 AAAA 2800:3f0:4003:c01::6a, AAAA 2800:3f0:4003:c01::69, AAAA 2800:3f0:4003:c01::67, AAAA 2800:3f0:4003:c01::68 (144)
11:23:47.937122 IP 172.17.0.2.45513 > _gateway.domain: 3+ A? www.google.com. (32)
11:23:47.974445 IP _gateway.domain > 172.17.0.2.45513: 3 6/0/0 A 142.251.0.103, A 142.251.0.147, A 142.251.0.106, A 142.251.0.105, A 142.251.0.99, A 142.251.0.104 (128)
11:23:47.974968 IP 172.17.0.2 > cj-in-f103.1e100.net: ICMP echo request, id 1, seq 0, length 64
11:23:48.266932 IP6 fe80::42:5bff:fe84:708c > ff02::16: HBH ICMP6, multicast listener report v2, 4 group record(s), length 88
11:23:48.975139 IP 172.17.0.2 > cj-in-f103.1e100.net: ICMP echo request, id 1, seq 1, length 64
11:23:49.975293 IP 172.17.0.2 > cj-in-f103.1e100.net: ICMP echo request, id 1, seq 2, length 64
11:23:50.975459 IP 172.17.0.2 > cj-in-f103.1e100.net: ICMP echo request, id 1, seq 3, length 64
11:23:51.975614 IP 172.17.0.2 > cj-in-f103.1e100.net: ICMP echo request, id 1, seq 4, length 64
11:23:52.960160 ARP, Request who-has 172.17.0.2 tell devvildaz, length 28
11:23:52.960229 ARP, Reply 172.17.0.2 is-at 02:42:ac:11:00:02 (oui Unknown), length 28
11:23:52.975777 IP 172.17.0.2 > cj-in-f103.1e100.net: ICMP echo request, id 1, seq 5, length 64

ifconfig:

docker1: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet 172.17.0.1 netmask 255.255.255.0 broadcast 172.17.0.255
inet6 fe80::42:5bff:fe84:708c prefixlen 64 scopeid 0x20<link>
ether 02:42:5b:84:70:8c txqueuelen 0 (Ethernet)
RX packets 297 bytes 20825 (20.3 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 73 bytes 8283 (8.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
enp4s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.100.30 netmask 255.255.255.0 broadcast 192.168.100.255
inet6 fe80::5698:f343:193b:ea28 prefixlen 64 scopeid 0x20<link>
ether 0c:9d:92:1a:10:b5 txqueuelen 1000 (Ethernet)
RX packets 164741 bytes 139897826 (133.4 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 138244 bytes 24673988 (23.5 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 1475 bytes 74680 (72.9 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1475 bytes 74680 (72.9 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

iptables:

Chain INPUT (policy ACCEPT 40025 packets, 35M bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
164 13130 DOCKER-ISOLATION-STAGE-1 all -- * * 0.0.0.0/0 0.0.0.0/0
38 5234 ACCEPT all -- * docker1 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all -- * docker1 0.0.0.0/0 0.0.0.0/0
262 17234 ACCEPT all -- docker1 !docker1 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker1 docker1 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- docker1 enp4s0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 33545 packets, 4869K bytes)
pkts bytes target prot opt in out source destination
Chain DOCKER (1 references)
pkts bytes target prot opt in out source destination
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
pkts bytes target prot opt in out source destination
138 9509 DOCKER-ISOLATION-STAGE-2 all -- docker1 !docker1 0.0.0.0/0 0.0.0.0/0
164 13130 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-ISOLATION-STAGE-2 (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * docker1 0.0.0.0/0 0.0.0.0/0
138 9509 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0

iptables nat

Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DOCKER all -- anywhere anywhere ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DOCKER all -- anywhere !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.0.0/24 anywhere
MASQUERADE all -- anywhere anywhere
MASQUERADE all -- anywhere anywhere
MASQUERADE all -- 172.17.0.0/16 anywhere
MASQUERADE all -- 172.17.0.0/24 anywhere
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- anywhere anywhere

route

[root@devvildaz devvildaz]# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default _gateway 0.0.0.0 UG 100 0 0 enp4s0
172.17.0.0 0.0.0.0 255.255.255.0 U 0 0 0 docker1
192.168.100.0 0.0.0.0 255.255.255.0 U 100 0 0 enp4s0

The same scenario also for when you use a virtual machine with virt -manager, however this problem was solved by using a Wifi Adapter through passthrought mode

sorry if my english is not so good.

Arch Linux

#1 2022-06-04 16:43:05

Docket containers doesnt have internet access, but dns works

Board footer