UnRaid 7.2.3. I noticed today that Dockers setup to run thru VPNs setup via VPN Manager are no longer reaching the Internet. this includes both full restart, and deletion of docker.img file and recreation of key containers to test against.

Below is a segment of my syslog when I start and stop one such Docker that is aligned to a VPN that has worked before (as of yesterday, to be exact):

Dec 28 18:42:54 Morningstar kernel: br-f1c71bf35e99: port 1(vethb1fca43) entered disabled state
Dec 28 18:42:54 Morningstar kernel: vethaa67c28: renamed from eth0
Dec 28 18:42:54 Morningstar kernel: br-f1c71bf35e99: port 1(vethb1fca43) entered disabled state
Dec 28 18:42:54 Morningstar kernel: vethb1fca43 (unregistering): left allmulticast mode
Dec 28 18:42:54 Morningstar kernel: vethb1fca43 (unregistering): left promiscuous mode
Dec 28 18:42:54 Morningstar kernel: br-f1c71bf35e99: port 1(vethb1fca43) entered disabled state
Dec 28 18:42:54 Morningstar kernel: br-f1c71bf35e99: port 1(vethb1fca43) entered disabled state
Dec 28 18:42:54 Morningstar kernel: vethaa67c28: renamed from eth0
Dec 28 18:42:54 Morningstar kernel: br-f1c71bf35e99: port 1(vethb1fca43) entered disabled state
Dec 28 18:42:54 Morningstar kernel: vethb1fca43 (unregistering): left allmulticast mode
Dec 28 18:42:54 Morningstar kernel: vethb1fca43 (unregistering): left promiscuous mode
Dec 28 18:42:54 Morningstar kernel: br-f1c71bf35e99: port 1(vethb1fca43) entered disabled state

A sample of a few Dockers, both on VPNs and on Bridge, shows I get similar messages as above when I start and stop them; only the "vethb1fca43" changes. I will also note that, when I switch Dockers to Bridge, they can reach the Internet (tested by switching my Firefox ESR Docker from VPN to Bridge.

I can find few references to this issue, elsewhere. A couple other notes:

• Saw reference to needing ipv6 enabled; not sure why I'd need that now as I've had it disabled in both UnRaid and OPNSense for some time.

• Was up to 87% full with Docker Image file; I did re-create it with more space, and you can see in logs I got, for a time post-resizing, a error saying Docker image file couldn't mount. Eventually, it did.

• I did update OPNSense to 25.7.10 yesterday; however, everything worked fine after that, up until today.

Thanks for the help!

morningstar-diagnostics-20251228-2003.zip

Follow-ups:

I forgot to mention that post-Docker.img re-creation, that I did lose all the Docker networks for the VPNs I had. I did my final tests before posting yesterday against a re-created VPN.

What has also happened, is that now even containers I created after that with VNC connections, such as FirefoxESR, won't connect to VNC if I'm on the VPN. This is not the prior behavior, nor the behavior I recall from my tests yesterday. It works fine when connected to the bridge network.

My gut -- for what little that's worth -- says there's something deeply broken about my docker networking stack. For reference, post-docker.img re-creation:

docker network ls
NETWORK ID     NAME      DRIVER    SCOPE
e0d4cdd9fc47   bridge    bridge    local
6ab26766bcf9   host      host      local
19bb0f77fd87   none      null      local
5832de116521   wg6       bridge    local

wg0 thru 5 are tunnels created prior to the docker.img deletion, two of which I created yesterday in my earlier testing.

Ideas welcome, as I'm pretty stumped.