You are not logged in.
Morta wrote:seth wrote:"$(dig -6 +short archlinux.org)" only resolves the IPv6 of archlinux.org - you can copy the ping result.
This command neither works with busybox on docker or on the server.
seth wrote:"$(dig -6 +short archlinux.org)" only resolves the IPv6 of archlinux.org - you can copy the ping result.
…
docker run --rm -t busybox ip route get 2a01:4f9:c010:6b1f::1
Can you regular-ass ping archlinux from docker?
docker run --rm -t busybox ping -v6 -c5 archlinux.org
I can‘t ping a ipv6 adress in docker. It’s shows me the IP but no ping traffic
Offline
docker run --rm -t busybox ip route get 2a01:4f9:c010:6b1f::1
…
Offline
docker run --rm -t busybox ip route get 2a01:4f9:c010:6b1f::1
…
[morta@5erver ~]$docker run --rm -t busybox ip route get 2a01:4f9:c010:6b1f::1
ip: RTNETLINK answers: Network is unreachable
[morta@5erver ~]$ docker run --rm -t busybox ip route get 1.1.1.1
1.1.1.1 via 172.17.0.1 dev eth0 src 172.17.0.2
Offline
docker run --rm -t busybox ip a
docker run --rm -t busybox ip r
Last edited by seth (2021-11-03 12:35:07)
Offline
[root@5erver morta]# docker run --rm -t busybox ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
66: eth0@if67: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
[root@5erver morta]# docker run --rm -t busybox ip r
default via 172.17.0.1 dev eth0
172.17.0.0/16 dev eth0 scope link src 172.17.0.2
[root@5erver morta]#
Offline
There's not IPv6 lease in that VM *at all* - did you chck the sublinks in https://wiki.archlinux.org/title/Docker#IPv6 ?
Offline
There's not IPv6 lease in that VM *at all* - did you chck the sublinks in https://wiki.archlinux.org/title/Docker#IPv6 ?
cat /etc/docker/daemon.json
{
"data-root": "/home/data/docker"
}
{
"ipv6": true,
"fixed-cidr-v6": "fd00::/80"
}
{
"mtu": "1500"
}
at /etc/iptables/ip6tables.rules
# Generated by ip6tables-save v1.8.7 on Sat Oct 30 15:02:35 2021
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i enp2s0 -j ACCEPT
-A RH-Firewall-1-INPUT -i docker0 -j ACCEPT
-A RH-Firewall-1-INPUT -p ipv6-icmp -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 32768:61000 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 ! --syn -j ACCEPT
# open port 53
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 53 -j ACCEPT
# open port 22
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j ACCEPT
# open port ftp rtorrent speedtest tcp
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 5060 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 55000:55111 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 50000:50010 -j ACCEPT
#open port speedtest rtorrent dns udp
-A RH-Firewall-1-INPUT -m udp -p udp --dport 546 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 5060 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 6881 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 8080 -j ACCEPT
# open port 80 & 443
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited
COMMIT
# Completed on Sat Oct 30 15:02:35 2021
# Generated by ip6tables-save v1.8.7 on Sat Oct 30 15:02:35 2021
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s fd00::/80 ! -o docker0 -j MASQUERADE
COMMIT
# Completed on Sat Oct 30 15:53:25 2021
I did what is written in the wiki.
I can't understand that error.
Last edited by Morta (2021-11-03 12:48:25)
Offline
https://github.com/docker/docker.github … rk/ipv6.md and https://github.com/moby/moby/issues/36954
This has nothing to do w/ netfilter or the MTU - the docker image has no IPv6 address or route. Could also be the image.
Offline
https://github.com/docker/docker.github … rk/ipv6.md and https://github.com/moby/moby/issues/36954
This has nothing to do w/ netfilter or the MTU - the docker image has no IPv6 address or route. Could also be the image.
Ok, and why the curl image isn't working? That is written in the wiki and doesn't work also.
Offline
Could also be the image.
Offline
I hate this container shit too! Npw!
Offline
Stupid question, you did restart the docker service after altering the docker.json?
Alternatively:
https://www.linode.com/community/questi … containers
=> https://github.com/robbertkl/docker-ipv … -container
=> https://aur.archlinux.org/packages/docker-ipv6nat/
Offline
Yes, I restared a few times after editing daemon.json
Offline
I have no idea about docker configuration, but now that I look at your config again I imagine that everything should be in a single json dictionary like this. (Try it without setting mtu as well.)
$ cat /etc/docker/daemon.json
{
"data-root": "/home/data/docker",
"ipv6": true,
"fixed-cidr-v6": "fd00::/80",
"mtu": "1500"
}
Last edited by progandy (2021-11-03 13:57:07)
| alias CUTF='LANG=en_XX.UTF-8@POSIX ' |
Online
I have no idea about docker configuration, but now that I look at your config again I imagine that everything should be in a single json dictionary like this. (Try it without setting mtu as well.)
$ cat /etc/docker/daemon.json { "data-root": "/home/data/docker", "ipv6": true, "fixed-cidr-v6": "fd00::/80", "mtu": "1500" }
Thanks but shouldn’t been the problem.
It‘s so that we have to start docker with a ipv6 or ip6 flag. Seems that ipv6 isn’t native. What is a shame we are in the year 2021 and ipv6 is common.
Offline
Thanks but shouldn’t
https://www.youtube.com/watch?v=5RyYrs5tu60
Did you try?
If docker only reads the first dictionary, it'll completely ignore the IPv6 and mtu instructions…
Offline
Thanks but shouldn’t
https://www.youtube.com/watch?v=5RyYrs5tu60
Did you try?
If docker only reads the first dictionary, it'll completely ignore the IPv6 and mtu instructions…
Ok Ok I will try it :-)
Offline
docker run --rm --ip6 -t curlimages/curl curl -v -6 archlinux.org
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 2a01:4f9:c010:6b1f::1:80...
* Immediate connect fail for 2a01:4f9:c010:6b1f::1: Address not available
The error message
[morta@5erver ~]$ ping -v6 -s 1454 archlinux.org
PING archlinux.org(archlinux.org (2a01:4f9:c010:6b1f::1)) 1454 data bytes
1462 Bytes von archlinux.org (2a01:4f9:c010:6b1f::1): icmp_seq=1 ttl=41 Zeit=29.6 ms
1462 Bytes von archlinux.org (2a01:4f9:c010:6b1f::1): icmp_seq=2 ttl=41 Zeit=29.0 ms
1462 Bytes von archlinux.org (2a01:4f9:c010:6b1f::1): icmp_seq=3 ttl=41 Zeit=28.9 ms
1462 Bytes von archlinux.org (2a01:4f9:c010:6b1f::1): icmp_seq=4 ttl=41 Zeit=29.0 ms
1462 Bytes von archlinux.org (2a01:4f9:c010:6b1f::1): icmp_seq=5 ttl=41 Zeit=29.0 ms
^C
--- archlinux.org ping statistics ---
5 Pakete übertragen, 5 empfangen, 0% packet loss, time 4006ms
rtt min/avg/max/mdev = 28.859/29.105/29.641/0.274 ms
I can ping with mtu 1454 on the system
[morta@5erver ~]$ cat /etc/docker/daemon.json
{
"data-root": "/home/data/docker"
}
{
"ipv6": true,
"fixed-cidr-v6": "fd00::/80"
}
{
"mtu": "1454"
}
I was not able to change the config like above discribed from progandy. It's says the contianer start to quickly. Also systemcl reset-failed doesn't help.
[morta@5erver ~]$ docker run --rm --ip6 -t curlimages/curl curl -v -6 archlinux.org
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 2a01:4f9:c010:6b1f::1:80...
* Immediate connect fail for 2a01:4f9:c010:6b1f::1: Address not available
* Closing connection 0
curl: (7) Couldn't connect to server
Also with --ip6 falg and mtu 1454 fails the connecting
[morta@5erver ~]$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 04:d9:f5:bc:8f:c6 brd ff:ff:ff:ff:ff:ff
3: enp4s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 04:d9:f5:bc:8f:c7 brd ff:ff:ff:ff:ff:ff
4: enp5s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 04:d9:f5:bc:8f:c8 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.2/24 brd 192.168.1.255 scope global enp5s0
valid_lft forever preferred_lft forever
5: enp6s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 04:d9:f5:bc:8f:c9 brd ff:ff:ff:ff:ff:ff
6: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:1b:21:e7:ab:02 brd ff:ff:ff:ff:ff:ff
inet 192.168.11.162/24 brd 192.168.11.255 scope global dynamic noprefixroute enp2s0
valid_lft 75086sec preferred_lft 75086sec
inet6 2a02:168:a774:0:deca:fbad:c0:ffee/64 scope global dynamic noprefixroute
valid_lft 4294965971sec preferred_lft 4294965971sec
inet6 fe80::21b:21ff:fee7:ab02/64 scope link noprefixroute
valid_lft forever preferred_lft forever
7: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1454 qdisc noqueue state DOWN group default
link/ether 02:42:83:be:7b:e3 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:83ff:febe:7be3/64 scope link
valid_lft forever preferred_lft forever
8: br-abac02be342e: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:78:00:4b:9d brd ff:ff:ff:ff:ff:ff
inet 172.18.0.1/16 brd 172.18.255.255 scope global br-abac02be342e
valid_lft forever preferred_lft forever
inet6 fd00:dead:beef::1/48 scope global tentative
valid_lft forever preferred_lft forever
inet6 fe80::1/64 scope link tentative
valid_lft forever preferred_lft forever
Here my interface setting
Why the ipv6 interface doesn't come up? I have also installed docker-ipv6nat service but doesn't help and it's running!
Last edited by Morta (2021-11-04 18:49:02)
Offline
I was not able to change the config like above discribed from progandy. It's says the contianer start to quickly. Also systemcl reset-failed doesn't help.
Try again. Then post the exact contents of daemon.json and the error log of docker (probably [sudo] journalctl -fu docker.service)
| alias CUTF='LANG=en_XX.UTF-8@POSIX ' |
Online
Ok I see the docker-ipv6nat brings a new interface up and makes double configuration of docker.
So I will try following:
If you can see the added ip6tables rules, but it's still not working, it might be that forwarding is not enabled for IPv6. This is usually the case if you're using router advertisements (e.g. having net.ipv6.conf.eth0.accept_ra=1). Enabling forwarding in such a case will break router advertisements. To overcome this, use the following in your /etc/sysctl.conf:
net.ipv6.conf.eth0.accept_ra = 2
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.default.forwarding = 1
To see if it‘s working without docker-ipv6nat.
If it‘s fails I will remove the daemon.json entries then start docker-ipv6nat and look if there ip6tables rules for the new interface br* from docker-ipv6nat.
Offline
I was not able to change the config like above discribed from progandy. It's says the contianer start to quickly. Also systemcl reset-failed doesn't help.
Try again. Then post the exact contents of daemon.json and the error log of docker (probably [sudo] journalctl -fu docker.service)
Ok I will do it but step for step. It will be a mess if I mix all this configs and addons for ipv6
Last edited by Morta (2021-11-04 19:16:49)
Offline
sudo journalctl -fu docker
-- Journal begins at Tue 2021-06-22 18:01:02 CEST. --
Nov 04 22:24:35 5erver systemd[1]: Starting Docker Application Container Engine...
Nov 04 22:24:35 5erver dockerd[2845]: unable to configure the Docker daemon with file /etc/docker/daemon.json: json: cannot unmarshal string into Go struct field Config.mtu of type int
Nov 04 22:24:35 5erver systemd[1]: docker.service: Main process exited, code=exited, status=1/FAILURE
Nov 04 22:24:35 5erver systemd[1]: docker.service: Failed with result 'exit-code'.
Nov 04 22:24:35 5erver systemd[1]: Failed to start Docker Application Container Engine.
Nov 04 22:24:35 5erver systemd[1]: docker.service: Scheduled restart job, restart counter is at 3.
Nov 04 22:24:35 5erver systemd[1]: Stopped Docker Application Container Engine.
Nov 04 22:24:35 5erver systemd[1]: docker.service: Start request repeated too quickly.
Nov 04 22:24:35 5erver systemd[1]: docker.service: Failed with result 'exit-code'.
Nov 04 22:24:35 5erver systemd[1]: Failed to start Docker Application Container Engine.
That is the error log from journalctl.
cat /etc/docker/daemon.json
{
"data-root": "/home/data/docker",
"ipv6": true,
"fixed-cidr-v6": "fd00::/80",
"mtu": "1454"
}
How can I check if the .conf file in the folder /etc/sysctl.d/ is working?
Last edited by Morta (2021-11-04 20:32:42)
Offline
Nov 04 22:24:35 5erver dockerd[2845]: unable to configure the Docker daemon with file /etc/docker/daemon.json: json: cannot unmarshal string into Go struct field Config.mtu of type int
The problem seems to be the "mtu" setting. Docker is unable to automatically convert the string to an integer, You need to specify it as a number without the quotes or try to remove it completely.
$ cat /etc/docker/daemon.json
{
"data-root": "/home/data/docker",
"ipv6": true,
"fixed-cidr-v6": "fd00::/80"
}
$ cat /etc/docker/daemon.json
{
"data-root": "/home/data/docker",
"ipv6": true,
"fixed-cidr-v6": "fd00::/80",
"mtu": 1454
}
Edit: At least this shows that all variables must be declared in a single json dictionary, the others are ignored. Otherwise that error would have occured earlier.
Last edited by progandy (2021-11-04 20:40:03)
| alias CUTF='LANG=en_XX.UTF-8@POSIX ' |
Online
$ cat /etc/docker/daemon.json
{
"data-root": "/home/data/docker",
"ipv6": true,
"fixed-cidr-v6": "fd00::/80",
"mtu": 1454
}
This is accepted as config for daemon.json!
docker run --rm -t curlimages/curl curl -v -6 archlinux.org
* Trying 2a01:4f9:c010:6b1f::1:80...
* Immediate connect fail for 2a01:4f9:c010:6b1f::1: Address not available
* Closing connection 0
curl: (7) Couldn't connect to server
Still not working.
How can I check if the sysctl config is persistent ?
[morta@5erver ~]$ sudo systemctl status docker
● docker.service - Docker Application Container Engine
Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled; vendor preset: disabled)
Drop-In: /etc/systemd/system/docker.service.d
└─execstart.conf
Active: active (running) since Thu 2021-11-04 22:29:25 CET; 12min ago
TriggeredBy: ● docker.socket
Docs: https://docs.docker.com
Main PID: 4019 (dockerd)
Tasks: 47 (limit: 76900)
Memory: 50.1M
CPU: 6.083s
CGroup: /system.slice/docker.service
├─4019 /usr/bin/dockerd -H unix:///var/run/docker.sock -H tcp://0.0.0.0:4243
├─4056 containerd --config /var/run/docker/containerd/containerd.toml --log-level info
└─4227 /usr/bin/containerd-shim-runc-v2 -namespace moby -id 3ace37de30371ea2a9009a78267217573d6c721b8ee7e11893781a97a4b15c6d -address /var/run/docker/containerd/containerd.sock
Nov 04 22:40:01 5erver dockerd[4056]: time="2021-11-04T22:40:01.141425913+01:00" level=info msg="shim disconnected" id=3400bb215cd248dac147fdcc0a85980efee680dc2609db3292cfaf340a1890b6
Nov 04 22:40:01 5erver dockerd[4056]: time="2021-11-04T22:40:01.141551931+01:00" level=warning msg="cleaning up after shim disconnected" id=3400bb215cd248dac147fdcc0a85980efee680dc2609db3292cfaf340a1890b6 namespace=moby
Nov 04 22:40:01 5erver dockerd[4056]: time="2021-11-04T22:40:01.141598701+01:00" level=info msg="cleaning up dead shim"
Nov 04 22:40:01 5erver dockerd[4056]: time="2021-11-04T22:40:01.165619413+01:00" level=warning msg="cleanup warnings time=\"2021-11-04T22:40:01+01:00\" level=info msg=\"starting signal loop\" namespace=moby pid=5543\n"
Nov 04 22:40:09 5erver dockerd[4056]: time="2021-11-04T22:40:09.687791240+01:00" level=info msg="starting signal loop" namespace=moby path=/run/docker/containerd/daemon/io.containerd.runtime.v2.task/moby/e803d5ccdfe0b47a1c51cd6231b1f4f4d2>
Nov 04 22:40:09 5erver dockerd[4056]: time="2021-11-04T22:40:09.972091939+01:00" level=info msg="shim disconnected" id=e803d5ccdfe0b47a1c51cd6231b1f4f4d2bb8bf914943fb4fa4a4f5ac0df076a
Nov 04 22:40:09 5erver dockerd[4056]: time="2021-11-04T22:40:09.972146379+01:00" level=warning msg="cleaning up after shim disconnected" id=e803d5ccdfe0b47a1c51cd6231b1f4f4d2bb8bf914943fb4fa4a4f5ac0df076a namespace=moby
Nov 04 22:40:09 5erver dockerd[4056]: time="2021-11-04T22:40:09.972157130+01:00" level=info msg="cleaning up dead shim"
Nov 04 22:40:09 5erver dockerd[4019]: time="2021-11-04T22:40:09.972137083+01:00" level=info msg="ignoring event" container=e803d5ccdfe0b47a1c51cd6231b1f4f4d2bb8bf914943fb4fa4a4f5ac0df076a module=libcontainerd namespace=moby topic=/tasks/d>
Nov 04 22:40:09 5erver dockerd[4056]: time="2021-11-04T22:40:09.980226918+01:00" level=warning msg="cleanup warnings time=\"2021-11-04T22:40:09+01:00\" level=info msg=\"starting signal loop\" namespace=moby pid=5664\
Seems to run so far...
Offline
After installing, enabled and start docker-ip6nat is curlimage working!!!
[morta@5erver ~]$ docker run --rm --ip6 -t curlimages/curl curl -v -6 archlinux.org
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 2a01:4f9:c010:6b1f::1:80...
* Connected to archlinux.org (2a01:4f9:c010:6b1f::1) port 80 (#0)
> GET / HTTP/1.1
> Host: archlinux.org
> User-Agent: curl/7.79.1-DEV
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< Server: nginx
< Date: Thu, 04 Nov 2021 20:53:10 GMT
< Content-Type: text/html
< Content-Length: 162
< Connection: keep-alive
< Location: https://archlinux.org/
<
{ [162 bytes data]
100 162 100 162 0 0 2674 0 --:--:-- --:--:-- --:--:-- <html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx</center>
</body>
</html>
2700
* Connection #0 to host archlinux.org left intact
Thanks to all who helps me!!!! Only problem is i don’t know really why.
Last edited by Morta (2021-11-04 20:59:41)
Offline