Docker macvlan virtualization network and host communication problem solving - the road to dream

By default, each macvlan can communicate with each other, but cannot communicate with the host! !

Main reason: Intercommunication is prohibited for security reasons

For example, if the host pings the IP of the container, even though they belong to the same network segment, they cannot be pinged, and vice versa.

Here are two examples to illustrate how to solve this problem.

Example one

环境说明:

宿主机: 10.0.1.80
容器:10.0.1.2
虚拟 IP(做路由实现通信):10.0.1.8
宿主机物理网卡名称:ens33

# 添加一个虚拟接口桥接到物理网卡
ip link add macvlan-proxy link ens33 type macvlan mode bridge

# 给虚拟接口配置ip
ip addr add 10.0.1.8/32 dev macvlan-proxy

# 启用虚拟接口
ip link set macvlan-proxy up

# 添加到容器网络的静态路由规则
ip route add 10.0.1.2/32 dev macvlan-proxy

此时,就可以实现宿主机和容器通信了

使用 ifconfig 查看是否有 macvlan-proxy 的网卡出现。
使用 route -n 查看是否有相关路由出现
10.0.1.2 0.0.0.0 255.255.255.255 UH 0 0 0 macvlan-proxy
使用 ping 直接测试

 Example two

环境说明:

宿主机网络:192.168.100.100

容器网络:172.20.0.0/16

虚拟IP:172.20.1.2/16

宿主机物理网卡:ens32


ip link add macvlan-proxy link ens32 type macvlan mode bridge

ip addr add 172.20.1.2/16 dev macvlan-proxy

ip link set macvlan-proxy up

ip route add 172.20.1.2/16 dev macvlan-proxy

此处容器网络和宿主机不同网段,宿主机通过虚拟IP和容器网络进行通信

另一种方式:

环境说明:

宿主机网络:192.168.100.100

容器网络:172.20.0.0/16

虚拟IP:192.168.100.110/32

宿主机物理网卡:ens32


ip link add macvlan-proxy link ens32 type macvlan mode bridge

ip addr add 192.168.100.110/32 dev macvlan-proxy

ip link set macvlan-proxy up

ip route add 172.20.1.2/16 dev macvlan-proxy

References:

Solve the communication problem between Docker macvlan network and host machine

macvlan network docker container communicates with the host - operation and maintenance learning record

Guess you like

Origin blog.csdn.net/qq_34777982/article/details/130736402