Docker容器无法使用macvlan网络驱动程序访问或ping WAN

Question

I'm trying to configure a Docker network using the macvlan driver, but my containers can't reach the gateway or the WAN.

The network is set up like so:

docker network create -d macvlan --subnet=10.1.1.0/24 --ip-range=10.1.1.160/28 --gateway=10.1.1.1 -o parent=ens160 pub_net

The host OS is Ubuntu 16.04, which itself is a VM running on ESXi (lots of layers, I know). The ens160 interface is connected to an ESXi vSwitch ("LAN"). The gateway (10.1.1.1) is a pfSense VM on the same machine, and connected to the same "LAN" vSwitch. The pfSense VM is also connected to a "WAN" vSwitch which physically connects to the upstream network. The Ubuntu host OS has an IP and full WAN connectivity, but the Docker container does not.

Some details about the Ubuntu host:

host$ ifconfig
docker0   Link encap:Ethernet  HWaddr aa:bb:cc:00:e2:77  
          inet addr:172.17.0.1  Bcast:0.0.0.0  Mask:255.255.0.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ens160    Link encap:Ethernet  HWaddr aa:bb:cc:9b:be:f2  
          inet addr:10.1.1.22  Bcast:10.1.1.255  Mask:255.255.255.0
          inet6 addr: fe80::c7b7:d64c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:64642 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1881 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:19190911 (19.1 MB)  TX bytes:169266 (169.2 KB)

ens192    Link encap:Ethernet  HWaddr aa:bb:cc:9b:be:fc  
          inet addr:10.2.2.22  Bcast:10.2.2.255  Mask:255.255.255.0
          inet6 addr: fe80::bb15:267d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:294 errors:0 dropped:10 overruns:0 frame:0
          TX packets:515 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:57996 (57.9 KB)  TX bytes:63258 (63.2 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:2637 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2637 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:204727 (204.7 KB)  TX bytes:204727 (204.7 KB)


host$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.2.2.1        0.0.0.0         UG    100    0        0 ens192
0.0.0.0         10.1.1.1        0.0.0.0         UG    101    0        0 ens160
10.1.1.0        0.0.0.0         255.255.255.0   U     100    0        0 ens160
10.2.2.0        0.0.0.0         255.255.255.0   U     100    0        0 ens192
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 ens192
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0

Switching to the Docker container, and details there:

host$ sudo docker run --net=pub_net -it alpine /bin/sh

container$ ifconfig
eth0      Link encap:Ethernet  HWaddr AA:BB:CC:01:01:A0  
          inet addr:10.1.1.160  Bcast:0.0.0.0  Mask:255.255.255.0
          inet6 addr: fe80::42:1a0/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:15 errors:0 dropped:0 overruns:0 frame:0
          TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1789 (1.7 KiB)  TX bytes:634 (634.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:2 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:224 (224.0 B)  TX bytes:224 (224.0 B)

container$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.1.1.1        0.0.0.0         UG    0      0        0 eth0
10.1.1.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0

As mentioned, if I ping 10.1.1.1 (or any other external IP) from within the container I get no response. If I ping another Docker container on the same host I do get a response.

What do I need to change so that the container can reach the WAN?

Answer 1

You need to turn on promiscuous mode and allow forged transmits for your LAN vSwitch. This is because macvlan mode requires the guest to be listening for the falsified MAC addresses as well as be able to falsify MAC addresses.

VMware Knowledge Base article on promiscuous mode

VMware documentation on forged transmits