[SOLVED] unRAID can't communicate with dockers running in a vlan

[DZMM]

I'm running rclone plugin and the new cache feature includes plex integration.  I run plex in a vlan docker, but unRAID is unable to communicate with the docker i.e. if I try and ping the docker 192.168.30.90 from unraid 172.30.12.2, it shows as unreachable. 

 

I can ping 192.168.30.90 from a VM running on the same vlan as the plex docker (192.168.30.10) and from a VM running on br0, so VMs can do it.

 

I can ping VMs running on VLANs from unRAID, so it's not a firewall issue.

 

I know there's a weird macvlan thing where dockers not on a vlan can't speak to dockers on a vlan, and vice versa.....does this also apply to unRAID i.e. the OS/plugins can't speak to dockers within vlans?

 

@bonienl and the network experts - help please!

Edited June 18, 2018 by DZMM

[strike]

3 hours ago, DZMM said:

does this also apply to unRAID i.e. the OS/plugins can't speak to dockers within vlans?

I'm no network expert but yes, containers running on a macvlan are isolated from the host. There's a post (probably several) where @bonienl explains this somewhere, use the "site" option in a google search and I'm sure you'll find it. You could probably allow traffic manually by configuring routing tables or something, but again I'm no network expert so don't take my word for it.

[DZMM]

2 hours ago, strike said:

I'm no network expert but yes, containers running on a macvlan are isolated from the host. There's a post (probably several) where @bonienl explains this somewhere, use the "site" option in a google search and I'm sure you'll find it. You could probably allow traffic manually by configuring routing tables or something, but again I'm no network expert so don't take my word for it.

grrr, I'd read it to be that dockers not on a macvlan couldn't speak to macvlan dockers and vice versa - I didn't realise until now it applied to the host as well.

 

Hopefully there is a way around it - I just need my rclone plugin on unRAID to be able to communicate with plex running in a macvlan.

[ken-ji]

Your scenario should be working. Can you show us your network definitions and routes + unraid network setup? (I think all that is in your diagnostics file)

Make sure that if you do put plex docker on a VLAN (ie br0.1|eth0.1), make sure that there is no assigned IP to that interface for unRAID.

See

and 

This is my setup and I am using a secondary interface, but it should be the same.

 

[DZMM]

1 hour ago, ken-ji said:

Your scenario should be working. Can you show us your network definitions and routes + unraid network setup? (I think all that is in your diagnostics file)

Make sure that if you do put plex docker on a VLAN (ie br0.1|eth0.1), make sure that there is no assigned IP to that interface for unRAID.

 

This is my setup and I am using a secondary interface, but it should be the same.

 

That's what I assumed.  Pinging docker from unraid:

 

root@Highlander:~# ping 192.168.30.90
PING 192.168.30.90 (192.168.30.90) 56(84) bytes of data.
From 192.168.30.2 icmp_seq=1 Destination Host Unreachable
From 192.168.30.2 icmp_seq=2 Destination Host Unreachable
From 192.168.30.2 icmp_seq=3 Destination Host Unreachable

Thanks for offering to have a look - diags attached

highlander-diagnostics-20180617-1109.zip

[DZMM]

1 hour ago, ken-ji said:

Make sure that if you do put plex docker on a VLAN (ie br0.1|eth0.1), make sure that there is no assigned IP to that interface for unRAID.

 

 

Just re-read this.  My plex docker is on br0.33 - are you saying I shouldn't have filled in 192.168.30.2 here for the IPV4 address?

Edited June 17, 2018 by DZMM

[ken-ji]

Yep. you need to keep it empty. See my setup linked above.

 

Technical explanation why it doesn't work:

if there is an ip assigned to the VLAN interface, unRAID will use that to talk to the docker network as it is a directly attached network (check the routing table). which will fail because it is a macvlan subinterface of the VLAN interface. Same issue with br0 and docker network on that interface

if there is no ip assigned to the VLAN interface, unRAID will now need to use the router to talk to docker network. which now works as it is a valid external communication, same as how the internet can talk back to your docker container.

 

traceroute will give you a better idea of what's wrong.

Edited June 17, 2018 by ken-ji

[DZMM]

20 minutes ago, ken-ji said:

Yep. you need to keep it empty. See my setup linked above.

 

Technical explanation why it doesn't work:

if there is an ip assigned to the VLAN interface, unRAID will use that to talk to the docker network as it is a directly attached network (check the routing table). which will fail because it is a macvlan subinterface of the VLAN interface. Same issue with br0 and docker network on that interface

if there is no ip assigned to the VLAN interface, unRAID will now need to use the router to talk to docker network. which now works as it is a valid external communication, same as how the internet can talk back to your docker container.

 

traceroute will give you a better idea of what's wrong.

Ahh, I just assumed when setting up VLANs you had to create an address for unRAID.  Will fix, once I doublecheck I'm not referencing the old VLAN unRAID IP addresses anywhere.

 

Thanks

[DZMM]

All sorted now - thanks