You are not logged in.
Hi i want to ping a ipv6 address in a docker container with busybox
I got this result
My docker run --rm -t busybox ping6 -c 4 google.com
PING google.com (2a00:1450:400a:808::200e): 56 data bytes
ping6: sendto: Cannot assign requested address
cat /etc/docker/daemon.json
{
"data-root": "/home/data/docker"
}
{
"ipv6": true,
"fixed-cidr-v6": ""2a02:168:a774::/64"
}
cat /etc/iptables/ip6tables.rules
# Generated by ip6tables-save v1.8.7 on Sat Oct 30 15:02:35 2021
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i enp2s0 -j ACCEPT
-A RH-Firewall-1-INPUT -i docker0 -j ACCEPT
-A RH-Firewall-1-INPUT -p icmpv6 -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 32768:61000 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 ! --syn -j ACCEPT
# open port 53
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 53 -j ACCEPT
# open port 22
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j ACCEPT
# open port ftp rtorrent speedtest tcp
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 5060 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 55000:55111 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 50000:50010 -j ACCEPT
#open port speedtest rtorrent dns udp
-A RH-Firewall-1-INPUT -m udp -p udp --dport 546 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 5060 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 6881 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 8080 -j ACCEPT
# open port 80 & 443
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited
COMMIT
# Completed on Sat Oct 30 15:02:35 2021
# Generated by ip6tables-save v1.8.7 on Sat Oct 30 15:02:35 2021
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 2a02:168:a774::/64 ! -o docker0 -j MASQUERADE
COMMIT
# Completed on Sat Oct 30 15:53:25 2021
cat /etc/resolv.conf
# This is /run/systemd/resolve/stub-resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.
nameserver 127.0.0.53
options edns0 trust-ad
search home
The resolv.conf is managed by NetworkManager and has ipv4+ipv6 nameserver
ip a
.....
7: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:ef:d0:81:66 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:efff:fed0:8166/64 scope link
valid_lft forever preferred_lft forever
Docker got no IPv6 from the ISP. Why?
What is wrong?
Last edited by Morta (2021-11-04 20:55:49)
Offline
NAT:
# iptables -t nat -A POSTROUTING -o internet0 -j MASQUERADE
# iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# iptables -A FORWARD -i net0 -o internet0 -j ACCEPT
Can I take this rules to ip6tables? Or how I have to adjust this rules for ip6tables?
Offline
Offline
I set the config like in the wiki but still have problem.
[root@5erver]# ping -v6 google.ch
PING google.ch(zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003)) 56 data bytes
64 Bytes von zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003): icmp_seq=1 ttl=106 Zeit=3.53 ms
64 Bytes von zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003): icmp_seq=2 ttl=106 Zeit=3.34 ms
64 Bytes von zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003): icmp_seq=3 ttl=106 Zeit=2.90 ms
64 Bytes von zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003): icmp_seq=4 ttl=106 Zeit=2.91 ms
64 Bytes von zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003): icmp_seq=5 ttl=106 Zeit=2.90 ms
64 Bytes von zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003): icmp_seq=6 ttl=106 Zeit=2.86 ms
64 Bytes von zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003): icmp_seq=7 ttl=106 Zeit=2.89 ms
64 Bytes von zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003): icmp_seq=8 ttl=106 Zeit=2.88 ms
--- google.ch ping statistics ---
8 Pakete übertragen, 8 empfangen, 0% packet loss, time 7009ms
rtt min/avg/max/mdev = 2.864/3.026/3.526/0.240 ms
[root@5erver]# ping -v6 -c5 -s1500 google.ch
PING google.ch(zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003)) 1500 data bytes
--- google.ch ping statistics ---
5 Pakete übertragen, 0 empfangen, 100% packet loss, time 4044ms
I can't send packages over 1500 MTU
[root@5erver]# docker run curlimages/curl curl -v -6 google.ch
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 2a00:1450:400a:803::2003:80...
* Immediate connect fail for 2a00:1450:400a:803::2003: Address not available
* Closing connection 0
curl: (7) Couldn't connect to serv
curl fails
ip6tables looks like this
[root@5erver]# cat /etc/iptables/ip6tables.rules
# Generated by ip6tables-save v1.8.7 on Sat Oct 30 15:02:35 2021
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i enp2s0 -j ACCEPT
-A RH-Firewall-1-INPUT -i docker0 -j ACCEPT
-A RH-Firewall-1-INPUT -p ipv6-icmp -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 32768:61000 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 ! --syn -j ACCEPT
# open port 53
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 53 -j ACCEPT
# open port 22
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j ACCEPT
# open port ftp rtorrent speedtest tcp
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 5060 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 55000:55111 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 50000:50010 -j ACCEPT
#open port speedtest rtorrent dns udp
-A RH-Firewall-1-INPUT -m udp -p udp --dport 546 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 5060 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 6881 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 8080 -j ACCEPT
# open port 80 & 443
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited
COMMIT
# Completed on Sat Oct 30 15:02:35 2021
# Generated by ip6tables-save v1.8.7 on Sat Oct 30 15:02:35 2021
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s fd00::/80 ! -o docker0 -j MASQUERADE
COMMIT
# Completed on Sat Oct 30 15:53:25 2021
Offline
https://wiki.archlinux.org/title/Networ … eue_length
ip link set docker0 mtu 1000
Edit: a brief google survey suggests that docker is gonna be happy w/ a 1400 MTU
I cannot express how much I hate this container shit.
Last edited by seth (2021-11-02 14:46:35)
Offline
Ok thanks for the links! I read that for 10 GbeE I can set MTU to jumbo frames with 9000. I will do this system wide and for docker like you said to 1400 MTU.
Last edited by Morta (2021-11-02 16:02:28)
Offline
Leave the host MTU alone for the moment - the entire link chain (all switches, your "router") must support jumbo frames and you don't want to introduce another variable.
If docker is happy w/ the 1400 MTU you can *independently* try to use jumbo frames on the host and if that works w/o problems and by the docker problem description, you might even be able to use a huge MTU (eg. 8000) there as well.
Do not try to mess around with intersecting configurations in parallel - you'll only create ambigious errors.
Offline
Leave the host MTU alone for the moment - the entire link chain (all switches, your "router") must support jumbo frames and you don't want to introduce another variable.
If docker is happy w/ the 1400 MTU you can *independently* try to use jumbo frames on the host and if that works w/o problems and by the docker problem description, you might even be able to use a huge MTU (eg. 8000) there as well.Do not try to mess around with intersecting configurations in parallel - you'll only create ambigious errors.
You are right. Step by step and my router doesn’t support MTU over 1500 I have seen.
So Jumboframes are dead for me.
Offline
ip link set docker0 mtu 1454
cat /etc/docker/daemon.json
{
"data-root": "/home/data/docker"
}
{
"ipv6": true,
"fixed-cidr-v6": "fd00::/80"
}
{
"mtu": 1454
}
systemctl restart docker
docker run curlimages/curl curl -v -6 google.ch
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 2a00:1450:400a:803::2003:80...
* Immediate connect fail for 2a00:1450:400a:803::2003: Address not available
* Closing connection 0
curl: (7) Couldn't connect to server
ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 04:d9:f5:bc:8f:c6 brd ff:ff:ff:ff:ff:ff
3: enp4s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 04:d9:f5:bc:8f:c7 brd ff:ff:ff:ff:ff:ff
4: enp5s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 04:d9:f5:bc:8f:c8 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.2/24 brd 192.168.1.255 scope global enp5s0
valid_lft forever preferred_lft forever
5: enp6s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 04:d9:f5:bc:8f:c9 brd ff:ff:ff:ff:ff:ff
6: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:1b:21:e7:ab:02 brd ff:ff:ff:ff:ff:ff
inet 192.168.11.162/24 brd 192.168.11.255 scope global dynamic noprefixroute enp2s0
valid_lft 56796sec preferred_lft 56796sec
inet6 2a02:168:a774:0:deca:fbad:c0:ffee/64 scope global dynamic noprefixroute
valid_lft 4294959173sec preferred_lft 4294959173sec
inet6 fe80::21b:21ff:fee7:ab02/64 scope link noprefixroute
valid_lft forever preferred_lft forever
7: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1454 qdisc noqueue state DOWN group default
link/ether 02:42:ef:d0:81:66 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:efff:fed0:8166/64 scope link
valid_lft forever preferred_lft forever
It's still fails....
Offline
Did you check that ping with packet size 1454 is working?
| alias CUTF='LANG=en_XX.UTF-8@POSIX ' |
Offline
Did you check that ping with packet size 1454 is working?
It doesn't work with 1454 so I took 1400 MTU works with ping -v6 -s but it has wrote that the packages are cutted. What does it mean?
And docker doesn't work with MTU 1400.
ping -v6 -c5 -s1400 google.ch
PING google.ch(zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003)) 1400 data bytes
76 Bytes from zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003): icmp_seq=1 ttl=106 (cutted)
76 Bytes from zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003): icmp_seq=2 ttl=106 (cutted)
76 Bytes from zrh04s16-in-x03.1e100.net (2a00:1450:400a:808::2003): icmp_seq=3 ttl=106 (cutted)
Why they are cutted? From the firewall? My router MTU is max. 1500 and the server is directly connected to the router.
Last edited by Morta (2021-11-02 16:53:10)
Offline
That is just google not returning the whole package. cloudflare (1.1.1.1) or ping.archlinux.org work just fine. By the way, MTU would be the value given to ping plus 28. (so -s1400 would be mtu 1428)
ping -M do -s 1400 ping.archlinux.org
I have no idea, why docker doesn't work, though.
Last edited by progandy (2021-11-02 17:26:19)
| alias CUTF='LANG=en_XX.UTF-8@POSIX ' |
Offline
That is just google not returning the whole package. cloudflare (1.1.1.1) or ping.archlinux.org work just fine. By the way, MTU would be the value given to ping plus 28. (so -s1400 would be mtu 1428)
ping -M do -s 1400 ping.archlinux.org
I have no idea, why docker doesn't work, though.
Ok, thanks for explain but why i can’t ping 1454 with the system. I changed the network rules to MTU 1500. Had I to reboot?
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited
Could be this line wrong in the iptables?
Offline
Lower the MTU significantly. Test 1400.
Offline
Lower the MTU significantly. Test 1400.
Ok, I have to adjust also the systemwide configuration or only the mtu of docker0 interface and daemon.json?
The interface and daemon I had already with MTU 1400 and it doesn’t work.
Offline
Only docker (whether you change the config or the nic, they should cause the same) - you want to increase the dfference to the hosts 1500.
Try 1000 and the 500 to see whether it hangs on the MTU.
Offline
So I set inteface docker0 to MTU 500 and 1000 also changed daemon.json to MTU 500 and 1000. It doesn't work. I believe that is a firewall issue with forwarding or a problem imcp ipv6 traffic.
I use NetworkManager have I to set there also a MTU value?
Last edited by Morta (2021-11-02 19:24:48)
Offline
The mtu is attached to the NIC and the number you can see in "ip a" is relevant.
What exactly doesn't work? ping or curl?
Tried, google doesn't respond to arbitrarily big ICMP requests, try to ping archlinux.org (IPv4 & IPv6)
Can you curl on IPv4?
Offline
Yes i can curl a ipv4.
Both doesn’t work ping6 and curl with ipv6.
The dns is working and shows me a ip but no route or traffic
Last edited by Morta (2021-11-02 22:17:12)
Offline
ip route get $(dig -6 +short archlinux.org)
ping -v6 -c5 -s1500 archlinux.org
Offline
ip route get $(dig -6 +short archlinux.org) ping -v6 -c5 -s1500 archlinux.org
For that i need a Arch Container or how can I do this without it?
Ping I do in a busybox and curl in a curlimage or do you mean in the main system?
There is working curl v6 and ping6 till MTU 1400 + 28
Last edited by Morta (2021-11-02 22:33:30)
Offline
"$(dig -6 +short archlinux.org)" only resolves the IPv6 of archlinux.org - you can copy the ping result.
Offline
"$(dig -6 +short archlinux.org)" only resolves the IPv6 of archlinux.org - you can copy the ping result.
Ok I will do tomorrow is nearly midnight in my timezone
Offline
"$(dig -6 +short archlinux.org)" only resolves the IPv6 of archlinux.org - you can copy the ping result.
This command neither works with busybox on docker or on the server.
docker run --rm -t busybox ip route get $(dig -6 +short archlinux.org)
ip: need at least destination address
[root@5erver morta]# ip route get $(dig -6 +short archlinux.org)
Error: any valid prefix is expected rather than ";;".
[root@5erver morta]# ping -v6 -c5 -s1500 archlinux.org
PING archlinux.org(archlinux.org (2a01:4f9:c010:6b1f::1)) 1500 data bytes
1508 Bytes von archlinux.org (2a01:4f9:c010:6b1f::1): icmp_seq=1 ttl=41 Zeit=29.5 ms
1508 Bytes von archlinux.org (2a01:4f9:c010:6b1f::1): icmp_seq=2 ttl=41 Zeit=29.3 ms
1508 Bytes von archlinux.org (2a01:4f9:c010:6b1f::1): icmp_seq=3 ttl=41 Zeit=28.9 ms
1508 Bytes von archlinux.org (2a01:4f9:c010:6b1f::1): icmp_seq=4 ttl=41 Zeit=28.8 ms
^C
--- archlinux.org ping statistics -
docker run --rm -t busybox ping -v6 -c5 -s1500 archlinux.org
PING archlinux.org (2a01:4f9:c010:6b1f::1): 1500 data bytes
ping: sendto: Cannot assign requested address
MTU for docker0 and daemon.json are 1500
Offline
seth wrote:"$(dig -6 +short archlinux.org)" only resolves the IPv6 of archlinux.org - you can copy the ping result.
This command neither works with busybox on docker or on the server.
"$(dig -6 +short archlinux.org)" only resolves the IPv6 of archlinux.org - you can copy the ping result.
…
docker run --rm -t busybox ip route get 2a01:4f9:c010:6b1f::1
Can you regular-ass ping archlinux from docker?
docker run --rm -t busybox ping -v6 -c5 archlinux.org
Offline