So I know this issue is with OPNsense itself, but all my searches just come up with results on how to setup VLANs which isn't helpful. Basically, I have an OPNsense router (25.7) and unRaid (7.1.4). My router was not updated so about a few days ago I updated it to 25.7. Before this, everything was fine. After the update, not of my containers using "Other: br0" and static IPs can ping the router, and the router cannot ping them. But any PC on my network can ping the container. Does anyone know what setting in OPNsesnse would cause this behavior?

Also, I tried changing my unRaid docker config from ipvlan to macvlan and when trying to start containers, I get this error:

"docker: Error response from daemon: failed to create the macvlan port: device or resource busy."

If I could solve this error, using macvlan should work since the container will have an entry in the DHCP server.

I have an opnsense 25.7.3 and unraid 7.1.4.

I have no ipvlan docker.

I have containers with custom bridge network and also macvlan.

I have no connection problem for my containers but i never test from inside the container a ping to the router. They are supposed to communicate between them in their own network or to the outside on the mapped ports. A ping doesn't seem to be relevant. Ping is layer 3 thing and doesn't use a port.

I tested with to 2 containers: one with macvlan network ping is ok and one with bridge network ping to opnsense is also ok. But on both case traceroute doesn't work.

So i don't even know if it's relevant in your case. If so you could provide more details:

have you enabled host access on custom networks?

in opnsense is the network lan or vlan ? By default inter vlan is blocked.

what mode is your ipvlan network L2 or L3 ?

what is your network address ? what is the result of docker network inspect br0 ?

When you switch from ipvlan to macvlan in unraid you have to check if your ipvlan network still exists. You can't have overlapping networks.

When using a macvlan docker address is assigned manually or by docker daemon. Whatever network driver your container uses it can't speak to a dhcp server. You have to check your container doesn't use a duplicate address.

I seriously doubt opnsense has an issue at least on pinging local networks. Docker networking is very complicated. Unraid tries to make it simple but the truth is most people (including myself) use their containers as if they are like any other device on the network.

Thanks for the help! Here are the answers.

have you enabled host access on custom networks?

A. yes, checked and verified.

in opnsense is the network lan or vlan ? By default inter vlan is blocked.

A. lan.

what mode is your ipvlan network L2 or L3 ?

A. I don't understand this question, it's whatever the setting in Settings -> Docker is.

what is your network address ? what is the result of docker network inspect br0 ?

A. My lan network is 10.10.6.0/23. The router is 10.10.6.66, the unraid host is 10.10.6.2 and the container that cannot be pinged is 10.10.6.180. I also have a pi-hole at 10.10.6.25 but I doubt this has anything to do with it. Docker inspect shows ipvlan but thats because I changed it back so that my containers would start.

When you switch from ipvlan to macvlan in unraid you have to check if your ipvlan network still exists. You can't have overlapping networks. A.

I don't understand what this means, its only a drop down and can only be one or the other. Do I need to delete the network config and reboot?

Ok, so for anyone else having this issue, here's what worked.

Stop the array, change ipvlan to macvlan in the docker settings, and then reboot.

After reboot and starting the arrays and containers, open terminal and type "docker network inspect br0".

Find the mac address assigned and add a static lease in the OPNsense router.

Then the container can ping the router and vice versa.