Setup:

• Unraid 7.2.5 on Unraid Server A (Terramaster F4-242)

• Docker custom network type: macvlan on br0

• Nginx Proxy Manager (jc21/nginx-proxy-manager) on br0 with static IP 192.168.178.5

• ISP: Vodafone Germany, DS-Lite (IPv6-only external connectivity)

• Fritzbox 7530 AX with IPv6 port forwarding to NPM's GUA address

• Everything worked perfectly on 7.2.4 and all previous versions for years

What happened: After upgrading to 7.2.5 and rebooting, all externally exposed services became unreachable immediately. No other changes were made.

Root symptom: Cloudflare (acting as reverse proxy) returns 522 (Connection Timed Out) for all domains.

Diagnosis via tcpdump on br0:

Cloudflare → NPM: Flags [S]  (SYN arrives correctly)
NPM → Cloudflare: Flags [S.] (SYN-ACK sent, hlim 255)
Cloudflare → NPM: Flags [S]  (SYN repeated — ACK never arrives)

The SYN-ACK leaves the Nginx Proxy Manager (on unraid server A) (hlim 255 confirms: it exits the host) but never reaches Cloudflare. The TCP handshake never completes. Notable: cksum incorrect on all outgoing SYN-ACK packets from the macvlan container.

What was tried:

• Fixed MAC address for NPM container (new Docker 29 requirement) ✓

• Confirmed Fritzbox port forwarding points to correct IPv6 GUA (2a00:...) ✓

• Fritzbox rebooted multiple times ✓

• NPM container recreated, database restored ✓

• Downgrade to 7.2.4 — problem persists (MAC remains fixed, IPv6 unchanged)

• ethtool tx/rx checksumming disabled on br0 and eth0 — no change

• iptables/ip6tables checked — no blocks on port 443

Key observation: The cksum incorrect on SYN-ACK packets from the macvlan container suggests a checksum offloading issue introduced with Docker 29 / kernel 6.12.85-Unraid on macvlan over br0. This may cause intermediate routers or Vodafone's DS-Lite AFTR gateway to silently drop the packets.

System:

• Unraid 7.2.5 (downgraded to 7.2.4 again, problem remains)

• Docker 29.3.1

• Kernel 6.12.85-Unraid

• Network: macvlan on br0

• ISP: Vodafone DE, DS-Lite, AFTR: 2a00:0:cff:34a0::1

Going to 7.2.5 broke Nginx Proxy Manager for me as well. I'm using macvlan for the container. Tried ipvlan, same issue. Changed to dedicated docker network - works.

With macvlan, I already had a MAC set in my docker compose file before updating. Tried without, or by changing it, no luck. No DNS resolution. ("communicate with host" is disabled)

"getent hosts pypi.org"
comes back blank.

Docker container logs when on macvlan:

[5/4/2026] [5:56:15 PM] [Certbot ] › ▶ start Installing cloudflare... [5/4/2026] [5:56:23 PM] [Certbot ] › ✖ error WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection object at 0x152a39cd0190>: Failed to establish a new connection: [Errno 101] Network is unreachable')': /simple/certbot-dns-cloudflare/ WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection object at 0x152a39cd0e90>: Failed to establish a new connection: [Errno 101] Network is unreachable')': /simple/certbot-dns-cloudflare/

Edited May 5May 5 by samsausages

TLDR: The old docker macvlan network was bugged from the update. I had to remove it manually and recreate it.
----
Update on this, was looking at it more closely. I composed down all stacks & removed all docker networks to eliminate any potential conflicts and do more testing.

On the docker settings page, I noticed that one of the networks, br2.10, doesn't have a gateway defined. Just shows -----. The others do have gateways assigned and when I attach containers it works. no way to edit that gateway, even with docker disabled.

Resolution:
Removed network manually with:
docker network remove br2.10
(May give you an error, since it's bugged)

Turned off docker.

Checked Unraid Network settings and there still was an entry in the routing table for br2.10

Deleted entry manually.

Went back to docker settings, now I could define a gateway IP for br2.10.
Added entry.

Enabled docker.

Profit.

Edited May 5May 5 by samsausages

On 5/5/2026 at 2:59 PM, samsausages said:

TLDR: The old docker macvlan network was bugged from the update. I had to remove it manually and recreate it.
----
Update on this, was looking at it more closely. I composed down all stacks & removed all docker networks to eliminate any potential conflicts and do more testing.

On the docker settings page, I noticed that one of the networks, br2.10, doesn't have a gateway defined. Just shows -----. The others do have gateways assigned and when I attach containers it works. no way to edit that gateway, even with docker disabled.

Resolution:
Removed network manually with:
docker network remove br2.10
(May give you an error, since it's bugged)

Turned off docker.

Checked Unraid Network settings and there still was an entry in the routing table for br2.10

Deleted entry manually.

Went back to docker settings, now I could define a gateway IP for br2.10.
Added entry.

Enabled docker.

Profit.

Thanks for this, I noticed on my docker network settings I never had Gateway setup in the first place for one of my VLANS. Either way, after setting one, and disabling bonding (wasn't really being used anyway), and now my Plex container works again.

I indeed Profit, thanks.

16 hours ago, sp33dy905 said:

Thanks for this, I noticed on my docker network settings I never had Gateway setup in the first place for one of my VLANS. Either way, after setting one, and disabling bonding (wasn't really being used anyway), and now my Plex container works again.

I indeed Profit, thanks.

Great news! Glad it resolved it!

I had to deal with this again last evening after a reboot. May have a bigger issue here. If it happens again I'll report back, but usually don't do reboots often, so may be a while.