Here is ip route show
on the host:
default via 10.0.1.5 dev br0 proto static metric 425
10.0.1.0/22 dev br0 proto kernel scope link src 10.0.1.97 metric 425
10.0.1.5 dev br0 proto static scope link metric 425
Here it is on the containers (they both return the same, except the source IP is the container's static IP):
default via 10.0.1.5 dev veth0
10.0.1.0/22 dev veth0 proto kernel scope link src 10.0.1.101
The process I have to take to get this setup to work is a bit involved. If I run nmcli c
on the host once it's done, I get:
NAME - UUID - TYPE - DEVICE
br0 - e37726ec-e18a-4785-ba29-d7545108962e - bridge - br0
br0-ether - f898c107-ac7f-4bd4-8068-f39ade069fee - 802-3-ethernet - enp7s0
br0-httpd.veth0 - 3418e958-f735-4143-b8af-d49e788be0f0 - 802-3-ethernet - httpd.veth0
br0-mysqld.veth0 - 54a6a2e3-2066-4294-aae0-4d8bc8df7e33 - 802-3-ethernet - mysqld.veth0
This is after I've rebooted the machine and completed the following steps:
- Start both containers.
- Enable both connections for br0 on host
(the connections have to exist for this to work, so the containers have to be started already).
- Set the veth0 device in both containers to "down" state with
ip link
.
(netctl can't start a profile for an 'up' interface)
- Start the netctl profile in both containers.
This will give me a static IP address on a device that's bridged on the host for the LAN. Can't use DHCP. Can't use NAT, and I can't figure out another way to make this work.
Anyway, if I try and ping the containers' IP addresses from the host:
Summary
[user@host ~]$ ping 10.0.1.97 (host pinging itself)
PING 10.0.1.97 (10.0.1.97) 56(84) bytes of data.
64 bytes from 10.0.1.97: icmp_seq=1 ttl=64 time=0.063 ms
64 bytes from 10.0.1.97: icmp_seq=2 ttl=64 time=0.050 ms
--- 10.0.1.97 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1055ms
rtt min/avg/max/mdev = 0.050/0.056/0.063/0.009 ms
[user@host ~]$ ping 10.0.1.99 (container 1)
PING 10.0.1.99 (10.0.1.99) 56(84) bytes of data.
64 bytes from 10.0.1.99: icmp_seq=1 ttl=64 time=0.115 ms
64 bytes from 10.0.1.99: icmp_seq=2 ttl=64 time=0.045 ms
--- 10.0.1.99 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1051ms
rtt min/avg/max/mdev = 0.045/0.080/0.115/0.035 ms
[user@host ~]$ ping 10.0.1.101 (container 2)
PING 10.0.1.101 (10.0.1.101) 56(84) bytes of data.
--- 10.0.1.101 ping statistics ---
9 packets transmitted, 0 received, 100% packet loss, time 8172ms
.... Hmm, I can't ping one of the containers, but I can the other. That's weird because in the container with IP address 10.0.1.101, I can ping the host, but not the container with IP address 10.0.1.99. 
[root@container2 /]# ping 10.0.1.97 (host)
PING 10.0.1.97 (10.0.1.97) 56(84) bytes of data.
64 bytes from 10.0.1.97: icmp_seq=1 ttl=64 time=0.163 ms
64 bytes from 10.0.1.97: icmp_seq=2 ttl=64 time=0.068 ms
^C
--- 10.0.1.97 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1016ms
rtt min/avg/max/mdev = 0.068/0.115/0.163/0.048 ms
[root@container2 /]# ping 10.0.1.99 (container 1)
PING 10.0.1.99 (10.0.1.99) 56(84) bytes of data.
From 10.0.1.101 icmp_seq=1 Destination Host Unreachable
^C
--- 10.0.1.99 ping statistics ---
4 packets transmitted, 0 received, +1 errors, 100% packet loss, time 3096ms
pipe 3
[root@container2 /]# ping 10.0.1.101 (container 2, itself)
PING 10.0.1.101 (10.0.1.101) 56(84) bytes of data.
64 bytes from 10.0.1.101: icmp_seq=1 ttl=64 time=0.059 ms
64 bytes from 10.0.1.101: icmp_seq=2 ttl=64 time=0.040 ms
^C
--- 10.0.1.101 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1048ms
rtt min/avg/max/mdev = 0.040/0.049/0.059/0.011 ms
For completeness, here is container 1's ping results:
[root@container1 /]# ping 10.0.1.97 (host)
PING 10.0.1.97 (10.0.1.97) 56(84) bytes of data.
64 bytes from 10.0.1.97: icmp_seq=1 ttl=64 time=0.113 ms
64 bytes from 10.0.1.97: icmp_seq=2 ttl=64 time=0.067 ms
^C
--- 10.0.1.97 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1052ms
rtt min/avg/max/mdev = 0.067/0.090/0.113/0.023 ms
[root@container1 /]# ping 10.0.1.99 (container 1, itself)
PING 10.0.1.99 (10.0.1.99) 56(84) bytes of data.
64 bytes from 10.0.1.99: icmp_seq=1 ttl=64 time=0.051 ms
64 bytes from 10.0.1.99: icmp_seq=2 ttl=64 time=0.041 ms
^C
--- 10.0.1.99 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1024ms
rtt min/avg/max/mdev = 0.041/0.046/0.051/0.005 ms
[root@container1 /]# ping 10.0.1.101 (container 2)
PING 10.0.1.101 (10.0.1.101) 56(84) bytes of data.
^C
--- 10.0.1.101 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3087ms
So it seems the notables are the following information:
- The host cannot ping Container 2.
- Container 2 cannot ping Container 1.
- Container 1 cannot ping Container 2.
- The host can ping Container 1.
- Both Container 1 & 2 can ping the host.
I didn't manually configure any ip table rules, except for SSH, but I destroyed and recreated the container after doing so, and it worked before, so I don't know why that would've done something.
This issue started when I recreated Container 1 to restart my installation process for the services I'm working on. It was working 100% fine before I did that. After recreating the container, I restarted the machine.
This is bizarre. 