I have been trying to no avail to get this working. I have an OPNsense router that is running AdGuard for DNS on port 53 with an upstream of Unbound for recursive DNS on 5353.

 

My networks:

WAN - xx.xx.xx.xx public IP

LAN - 10.0.17.0/24 (primary LAN)

VLAN117 - 10.0.117.0/24

 

I am trying to get a docker container running on VLAN117 in Unraid.

 

I have two Omada network switches (SG2210MP v4.20 & SG3428X v1.30) that have the VLAN implemented, and I know it's working properly because I set up a VM on Unraid on VLAN117 that works. Routes to the internet, follows my firewall rules in OPNsense, etc.

 

When I create a Docker macvlan network, I can't get anything external working. I have tried every which way of creating the macvlan, parent as br0, br0.117, eth0, eth0.117, vhost0, vhost0.117. I've tried ipvlan. Some combinations give me  a

docker: Error response from daemon: failed to create the ipvlan port: device or resource busy.

which is not my primary concern error, but if anyone knows anything about this too that would be great.

 

When I ping or nslookup google I just get host unreachable. I can see the traffic showing up in OPNsense, I can see the DNS queries in AdGuard log, so I know it's getting to the places it needs to go, but it's like it just doesn't send the packet back to the container.

 

docker run -it --rm --net vlan117 --ip 10.0.117.205 alpine
/ # ping google.com
ping: bad address 'google.com'
/ # nslookup google.com
;; connection timed out; no servers could be reached

/ # ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=58 time=6.671 ms
64 bytes from 8.8.8.8: seq=1 ttl=58 time=6.317 ms
64 bytes from 8.8.8.8: seq=2 ttl=58 time=6.327 ms

 

Attached a tcpdump output where I tried to ping google.com and then subsequently successfully pinged 10.0.117.1. Pinging 8.8.8.8 directly also works perfectly fine.

 

Again, VM works fine, so I have most likely narrowed it down to docker and not any upstream routing rules, but open to all suggestions.

Just going to post this here in case anyone runs into a similar issue.

 

What I did to fix this was to force --dns=10.0.117.1 on the Docker container.

 

I believe the issue is that my DNS server on my OPNSense router was listening on all interfaces, including the VLAN interface, and it was replying from both the default interface address and the VLAN interface, so I was getting a duplicate response which was causing issues.

 

Originally I had only tried forcing --dns=10.0.17.1 (the DNS of my main LAN) and that wasn't working, I didn't think to try the gateway of the VLAN instead, but that was the solution for me.

Edited February 19, 20242 yr by RegularSizeRoss