unRAID and Docker networking and DNS.

[tbrasser]

Dear unRAID community,

 

I've been running unRAID for a few years now, and most of the time, everything works as expected. However, I keep having weird DNS issues when I'm trying to route all my internet traffic through a VPN using my (opnsense) router. My reverse proxy setup works fine (always), but seemingly at random I fail to resolve domainnames from containers / the unraid host / sometimes other devices on the network.

 

I've been reading up on the Docker custom networks and how it works internally, however, I've been unable to get it to work.

 

Current situation:

public-ip-->[ISP Modem/Router]192.168.178.1-------192.168.178.10[OPNSense Router]10.0.0.1/24----------Rest of my network (unRAID server, WIFI-AP's, Switches etc)

• The OPNSense router is in the DMZ of my ISP-provided box (that I unfortunately can't put into bridge mode)
• I have allowed private IP ranges on WAN on my OPNSense router
• I have set 8.8.8.8 and 8.8.4.4 as the only DNS in the OPNSense router, this is what all clients get via the DHCP server that is running on the LAN interface.
• I have disabled any type of DNS resolver/forwarder for now.
• This DHCP server gives out adresses from 10.0.0.64 till 10.0.0.127

 

I have 2 interfaces in my unRAID box, eth0 and eth1, I have configured unRAID as follows:

• eth0 has the ip 10.0.0.10 via DHCP (static lease), bridging is disabled
• eth1 has no ip, bridging is enabled (br1)
• Docker custom network on br1 is 10.0.0.0/24, default gateway 10.0.0.1, no DHCP.
• I spin up every docker container with a specific IP on br1 (between 10.0.0.128 and 10.0.0.254) and I provide the --dns=8.8.8.8 flag.

 

The problem I keep facing, and the reason I went and configured everything as above, is that whenever I make changes on how devices on my network access the internet (over VPN or not etc) I get weird DNS issues, either my unRAID host can't ping google.com, or my docker containers are unable to resolve domainnames. 

 

What I'd want ideally:

• I can't begin this list without stating that I'm trying to get rid of this DMZ / double-NAT situation, it sucks.
• I want a simple network (for a start, can do vlans later for iot/guest things)
• All devices on my network should be able to resolve internal and external domains.
• I like my current setup of using my /24 subnet as follows: .1 for the default gateway, .2-.63 for static leases, .64-.127 for dynamic leases, .128 and above for docker containers running on the unRAID host. 

 

Here are some screenshots and outputs of various commands:

- unraid gui settings related to networking and docker

- opnsense gui settings related to dns/dhcp and overview 

- ping and dns results from my laptop (10.0.0.20)

- ping and dns results from the unraid host (10.0.0.10)

- ping and dns results from a container started with --dns=8.8.8.8 on br1 with 10.0.0.181 ip

 

 

Can someone help me debug this? I haven't been able to get a stable network for ages now, and I have no clue what I'm doing wrong. 

server-diagnostics-20181027-1759.zip