【发布时间】：2020-07-04 13:22:50
【问题描述】：
当我使用 docker 在我的一台主机上以默认桥接模式创建容器时
docker run --name bb -dit busybox
现在我得到了一个 IP：172.17.0.2
当我ping这个IP时，不起作用
但是，当我对接口 docker0 使用 tcpdump 时，ping 可以工作*
或者将 docker0 设置为混杂模式，ping 也可以工作*
我的问题是：为什么我需要将 docker0 置于混杂模式（仅此主机），其他主机不需要这样做
我的 iptables 结果：
Chain INPUT (policy ACCEPT 29031 packets, 8703K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- eth0 * <hide> 192.168.0.0/24 policy match dir in pol ipsec reqid 8 proto 50
0 0 ACCEPT all -- * eth0 192.168.0.0/24 <hide> policy match dir out pol ipsec reqid 8 proto 50
0 0 ACCEPT all -- eth0 * <hide> 192.168.0.0/24 policy match dir in pol ipsec reqid 8 proto 50
0 0 ACCEPT all -- * eth0 192.168.0.0/24 <hide> policy match dir out pol ipsec reqid 8 proto 50
0 0 ACCEPT all -- eth0 * 10.10.10.0/24 192.168.0.0/24 policy match dir in pol ipsec reqid 8 proto 50
0 0 ACCEPT all -- * eth0 192.168.0.0/24 10.10.10.0/24 policy match dir out pol ipsec reqid 8 proto 50
56 11716 ACCEPT all -- eth0 * <hide> 10.10.1.0/24 policy match dir in pol ipsec reqid 8 proto 50
81 6292 ACCEPT all -- * eth0 10.10.1.0/24 <hide> policy match dir out pol ipsec reqid 8 proto 50
0 0 ACCEPT all -- eth0 * <hide> 10.10.1.0/24 policy match dir in pol ipsec reqid 8 proto 50
0 0 ACCEPT all -- * eth0 10.10.1.0/24 <hide> policy match dir out pol ipsec reqid 8 proto 50
1320 53255 ACCEPT all -- eth0 * 10.10.10.0/24 10.10.1.0/24 policy match dir in pol ipsec reqid 8 proto 50
1344 104K ACCEPT all -- * eth0 10.10.1.0/24 10.10.10.0/24 policy match dir out pol ipsec reqid 8 proto 50
2218 1192K DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0
2218 1192K DOCKER-ISOLATION-STAGE-1 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * docker_gwbridge 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all -- * docker_gwbridge 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker_gwbridge !docker_gwbridge 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- docker_gwbridge docker_gwbridge 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 27320 packets, 8507K bytes)
pkts bytes target prot opt in out source destination
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER-ISOLATION-STAGE-2 all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER-ISOLATION-STAGE-2 all -- docker_gwbridge !docker_gwbridge 0.0.0.0/0 0.0.0.0/0
2218 1192K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-ISOLATION-STAGE-2 (2 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * docker0 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- * docker_gwbridge 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
54846 16M RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
--------------------------------------------------------------------------------
nat
Chain PREROUTING (policy ACCEPT 6853 packets, 399K bytes)
pkts bytes target prot opt in out source destination
5353 327K DOCKER all -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 5353 packets, 327K bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 57595 packets, 3457K bytes)
pkts bytes target prot opt in out source destination
3 252 DOCKER all -- * * 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT 57970 packets, 3481K bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0
2 224 MASQUERADE all -- * !docker_gwbridge 172.18.0.0/16 0.0.0.0/0
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all -- docker0 * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- docker_gwbridge * 0.0.0.0/0 0.0.0.0/0
NETWORK ID NAME DRIVER SCOPE
a20b11f6afaf bridge bridge local
b39d1b268305 docker_gwbridge bridge local
5870d314fa6f host host local
e0883dc1d6d0 none null local
ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 00:15:5d:00:02:10 brd ff:ff:ff:ff:ff:ff
inet 192.168.0.3/24 brd 192.168.0.255 scope global eth0
valid_lft forever preferred_lft forever
inet 10.10.1.3/24 brd 10.10.1.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::215:5dff:fe00:210/64 scope link
valid_lft forever preferred_lft forever
3: docker_gwbridge: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether 02:42:0b:48:8e:44 brd ff:ff:ff:ff:ff:ff
inet 172.18.0.1/16 brd 172.18.255.255 scope global docker_gwbridge
valid_lft forever preferred_lft forever
inet6 fe80::42:bff:fe48:8e44/64 scope link
valid_lft forever preferred_lft forever
4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
link/ether 02:42:f8:5d:0a:13 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:f8ff:fe5d:a13/64 scope link
valid_lft forever preferred_lft forever
8: vethca01e3e@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP
link/ether 62:a0:50:02:72:94 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 fe80::60a0:50ff:fe02:7294/64 scope link
valid_lft forever preferred_lft forever
tcpdump -vv -ni vethca01e3e
tcpdump: listening on vethca01e3e, link-type EN10MB (Ethernet), capture size 65535 bytes
12:20:47.972359 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:20:47.972397 ARP, Ethernet (len 6), IPv4 (len 4), Reply 172.17.0.2 is-at 02:42:ac:11:00:02, length 28
12:20:48.973716 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:20:48.973750 ARP, Ethernet (len 6), IPv4 (len 4), Reply 172.17.0.2 is-at 02:42:ac:11:00:02, length 28
12:20:49.975718 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:20:49.975742 ARP, Ethernet (len 6), IPv4 (len 4), Reply 172.17.0.2 is-at 02:42:ac:11:00:02, length 28
tcpdump -vvv -p -ni docker0
tcpdump: listening on docker0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:21:05.458191 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:21:06.459709 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:21:07.461705 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
veth 重播 arp 但 docker0 忽略它
【问题讨论】：
标签： docker networking iptables