15 hours ago15 hr I like to use custom networks to 'isolate' my different compose stacks from one another. However, in some cases those custom networks need to be able to access the internet. Presently, from what I understand, they use the default interface of the unRAID server itself (br0 in my case). What I am trying to do is force it to use a different interface, br0.60 (VLAN60 in my case). In my current network configuration, br0, the default unRAID network interface is on a VLAN that has a lot of access. However, br0.60, VLAN60 is very restricted access (internet only - no LAN). I have my Immich stack using immich-net for its internal communication, but I recently learned that I may have setup the docker custom network incorrectly allowing it to access my LAN via br0 if it wanted to.user@unRAID:~# docker network inspect immich-net[ { "Name": "immich-net", "Id": "3967a7082d89960643d148badb42518af03daeebf39a10f5f18363281f27e8b6", "Created": "2026-01-18T11:17:07.9217006-06:00", "Scope": "local", "Driver": "bridge", "EnableIPv4": true, "EnableIPv6": false, "IPAM": { "Driver": "default", "Options": {}, "Config": [ { "Subnet": "172.19.0.0/16", "Gateway": "172.19.0.1" } ] }, "Internal": false, "Attachable": false, "Ingress": false, "ConfigFrom": { "Network": "" }, "ConfigOnly": false, "Options": {}, "Labels": {}, "Containers": { "32b7469d9a572541c2c76dcd4f08a93b9864c1d6e64a992a2f819424d8455d01": { "Name": "immich_server", "EndpointID": "f1f1cdd5f00680d97e7f7d701d91982a3ba353dde76dd6f3c1fd58c37aad5b3b", "MacAddress": "16:4d:d4:5d:25:9c", "IPv4Address": "172.19.0.5/16", "IPv6Address": "" }, "73d2240d8ce7f7eb1020673a965524496ed7e5994c2ed6509d32efdc475931cf": { "Name": "immich_postgres", "EndpointID": "fe24f8404d2ef652d8312d891a8c3b66e0e7afe9840544e34a13aad5c84d11d5", "MacAddress": "ca:13:f5:ed:64:7d", "IPv4Address": "172.19.0.4/16", "IPv6Address": "" }, "bf9c653495a445c7c3c84b96ec5eee7b3399afa893876d076fd58720a5aa05c1": { "Name": "immich_redis", "EndpointID": "7c205aad907ae390b323077ac41b61b91963e9a4a4e721d81b08afb2379f7c07", "MacAddress": "52:87:1f:7d:e3:1d", "IPv4Address": "172.19.0.2/16", "IPv6Address": "" }, "dca30d2121ab79b312958e5a3e97c57961aa69e0d93f1627e81d80fb463aae49": { "Name": "immich_machine_learning", "EndpointID": "9836a749174ee4ea5670af1ce063b5b8ec041dd9e8bbc10dd4c6992c45ec246a", "MacAddress": "5e:fe:66:4e:83:63", "IPv4Address": "172.19.0.3/16", "IPv6Address": "" } }, "Status": { "IPAM": { "Subnets": { "172.19.0.0/16": { "IPsInUse": 7, "DynamicIPsAvailable": 65529 } } } } }]If any of the containers that belong to immich-net want to use the internet, from what I understand, they use the br0 interface. I do not want that, I want them to use the br0.60 interface. That forces them through my firewall to ensure segmentation rules are applied. Can someone please help me in configuring a new network with that setup. I am very ignorant on how to tie the docker networking stack into the unRAID networking stack.
6 hours ago6 hr Community Expert Containers on a user-defined bridge network like immich-net are NATed by the Unraid host and follow the host's routing table. Their outbound traffic always leaves through the host default route (br0 in your case). They can also reach anything the host can reach, including your LAN and the server itself. You can't point a bridge network at a different host interface.What you want is a mix of two networks:- An internal network for the stack's own traffic (server to postgres/redis). An internal network has no gateway, so containers that are only on it have no outside access at all.- The Unraid br0.60 custom network for the containers that need internet or must be reached by clients. Those containers get their own IP on VLAN60 and use the VLAN60 gateway, so everything goes through your firewall.1. Create the br0.60 Docker network- Settings > Network Settings: VLAN 60 should already be there as br0.60. The server itself doesn't need an IP on that VLAN, and leaving it without one is better for isolation.- Settings > Docker: stop Docker, switch to Advanced View, enable the custom network on interface br0.60, and set its subnet and gateway (your firewall's VLAN60 address). If your firewall also hands out DHCP on that VLAN, set a DHCP pool range outside its range. Start Docker. docker network ls should now show a network named br0.60.- Leave "Host access to custom networks" disabled, so those containers can't reach the Unraid host.2. Recreate immich-net as internalWith the stack stopped:docker network rm immich-netdocker network create --internal immich-net3. Attach the networks in your compose fileservices: immich-server: networks: - immich-net - vlan60 # remove the "ports:" section, port mappings do not apply on br0.60 immich-machine-learning: networks: - immich-net - vlan60 # needed to download models redis: networks: - immich-net database: networks: - immich-netnetworks: immich-net: external: true vlan60: external: true name: br0.60Optionally, give the server a fixed VLAN60 address so it's easier to write firewall rules for: networks: immich-net: vlan60: ipv4_address: <free IP in your VLAN60 subnet>Because immich-net is internal and has no gateway, the only default route inside those containers is the VLAN60 gateway. All their outbound traffic goes through your firewall and your segmentation rules apply. Postgres and redis have no outside access at all.4. FirewallClients will now reach Immich at its VLAN60 IP on port 2283 (http://<vlan60 ip>:2283), not at the server IP. Add a rule allowing your LAN (or a reverse proxy) to reach that IP and port. Any reverse proxy or mobile app setting that points at the old address needs to change too.To check the result, look in your firewall for traffic from the container's VLAN60 IP when Immich checks for updates or downloads ML models.
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.