I have created a docker container on a separate VLAN. When I attempt to ping the gateway defined for the vlan from the docker container console using that vlan, it is unsuccessful. I have a “pass any” firewall rule defined on the router, which is running pfSense, so the ping should be working. After crawling though all the settings many times, including the route tables, I don’t see what is wrong. Here is a block diagram, and screenshots of all of the settings. Any help from another set of eyes is much appreciated.

The network and vlan settings in unRAID:

The docker settings in unraid:

The network configuration for the docker container that is using the vlan:

Output from “ip a” from console of docker container that is using the vlan:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000

    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

    inet 127.0.0.1/8 scope host lo

       valid_lft forever preferred_lft forever

    inet6 ::1/128 scope host proto kernel_lo

       valid_lft forever preferred_lft forever

2: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000

    link/ipip 0.0.0.0 brd 0.0.0.0

32: eth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default

    link/ether 4c:cc:6a:04:94:fb brd ff:ff:ff:ff:ff:ff link-netnsid 0

    inet 10.55.5.4/24 brd 10.55.5.255 scope global eth0

       valid_lft forever preferred_lft forever

 

Output from “route” from console of docker container that is using the vlan:

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         10.55.5.1       0.0.0.0         UG    0      0        0 eth0

10.55.5.0       *               255.255.255.0   U     0      0        0 eth0

VLAN Configuration in the router:

VLAN any-to-any firewall rule in the router

Routing table entries of interest in the router:

I did some testing with a packet capture application on my router, results below. As shown below, a ping from the router (10.55.83.10) to the docker vlan=br0.5 console (10.55.5.4) fails. The packet capture result shows an ARP request being sent on the vlan (PIHOLE_VLAN), but no response and the ping fails. I'm at the limits of my knowledge here, and not clear how to debug further.

Ping from docker vlan=br0.5 console (10.55.5.4) to vlan gateway (10.55.5.1) (FAILS)

No 10.55.5.1/24 subnet traffic captured on router interfaces LAN nor PIHOLE_VLAN

 

Ping from docker vlan=br0.5 console (10.55.5.4) to itself (10.55.5.4) (succeeds)

No 10.55.5.1/24 subnet traffic captured on router interfaces LAN nor PIHOLE_VLAN

 

 

 

Ping from router (10.55.83.10) to vlan gateway (10.55.5.1) (succeeds)

No 10.55.5.1/24 subnet traffic captured on router interfaces LAN nor PIHOLE_VLAN

 

Ping from router (10.55.83.10) to docker vlan=br0.5 console (10.55.5.4) (FAILS)

No 10.55.5.1/24 subnet traffic captured on router interfaces LAN.

10.55.5.1/24 subnet Packet Capture on router interface PIHOLE_VLAN:

ARP, Request who-has 10.55.5.4 tell 10.55.5.1, length 28

 

 

 

Ping from docker br0 console (10.55.83.190) to vlan gateway (10.55.5.1) (succeeds)

10.55.5.1/24 subnet Packet Capture on router interface LAN:

14:18:24.383104 IP 10.55.83.190 > 10.55.5.1: ICMP echo request, id 14565, seq 1, length 64

14:18:24.383241 IP 10.55.5.1 > 10.55.83.190: ICMP echo reply, id 14565, seq 1, length 64

 

Ping from docker br0 console (10.55.83.190) to docker vlan=br0.5 console (10.55.5.4) (FAILS)

10.55.5.1/24 subnet Packet Capture on router interface LAN:

10.55.83.190 > 10.55.5.4: ICMP echo request, id 18095, seq 1, length 64

10.55.5.1/24 subnet Packet Capture on router interface PIHOLE_VLAN:

ARP, Request who-has 10.55.5.4 tell 10.55.5.1, length 28