<p>The problem was in this line:</p>

<pre><code>sudo docker network create --internal --subnet=192.168.2.0/24 netR
</code></pre>

<p>The <code>--internal</code> option makes the network unreachable from other Docker networks.</p>

<p>The solution was to remove this option.</p>

CC BY-SA 4.0
2019-06-01T14:53:56.890Z
2019-06-01T14:53:56.890Z
Kazh
<p>Two containers are created with this <code>Dockerfile</code>:</p>

<pre><code>FROM ubuntu:18.04

RUN apt update &amp;&amp; apt upgrade -y &amp;&amp; apt install -y vim iputils-ping net-tools tcpdump iproute* iptables traceroute
</code></pre>

<p>The were created with the following commands in a <code>Ubuntu 18.04</code> machine:</p>

<pre><code>sudo docker network create --internal --subnet=192.168.2.0/24 netR

sudo docker network create --internal --subnet=172.16.1.0/24 netB1

sudo docker run --name R1_ipsec --hostname R1 --privileged --cap-add=NET_ADMIN --net netR --ip="192.168.2.100" -dit image1
sudo docker run --name R2_ipsec --hostname R2 --privileged --cap-add=NET_ADMIN --net netR --ip="192.168.2.200" -dit image1

sudo docker network connect --ip="172.16.1.254" netR R1

sudo docker run --name PC1_ipsec --hostname PC1_ipsec --privileged --cap-add=NET_ADMIN --net netB1 --ip="172.16.1.2" -dit image1

sudo docker exec PC1 route delete default gw 172.16.1.1

sudo docker exec PC1 route add default gw 172.16.1.254 dev eth0
</code></pre>

<p>The problem: <code>PC1</code> can't ping the <code>R1</code>'s interface <code>192.168.1.100</code>, even if <code>R1</code> have <code>net.ipv4.ip_forward = 1</code></p>

<p>Doker version: <code>Docker version 18.06.1-ce, build e68fc7a</code></p>

<docker><networking>
Docker: subnet clients can't ping other subnet
Kazh
# Docker: subnet clients can't ping other subnet

(Asked by: username_0 on 2018-11-27)

Two containers are created with this Dockerfile:
FROM ubuntu:18.04

RUN apt update && apt upgrade -y && apt install -y vim iputils-ping net-tools tcpdump iproute* iptables traceroute

The were created with the following commands in a Ubuntu 18.04 machine:
sudo docker network create --internal --subnet=192.168.2.0/24 netR

sudo docker network create --internal --subnet=172.16.1.0/24 netB1

sudo docker run --name R1_ipsec --hostname R1 --privileged --cap-add=NET_ADMIN --net netR --ip="192.168.2.100" -dit image1
sudo docker run --name R2_ipsec --hostname R2 --privileged --cap-add=NET_ADMIN --net netR --ip="192.168.2.200" -dit image1

sudo docker network connect --ip="172.16.1.254" netR R1

sudo docker run --name PC1_ipsec --hostname PC1_ipsec --privileged --cap-add=NET_ADMIN --net netB1 --ip="172.16.1.2" -dit image1

sudo docker exec PC1 route delete default gw 172.16.1.1

sudo docker exec PC1 route add default gw 172.16.1.254 dev eth0

The problem: PC1 can't ping the R1's interface 192.168.1.100, even if R1 have net.ipv4.ip_forward = 1
Doker version: Docker version 18.06.1-ce, build e68fc7a

**Tags:** docker, networking


---

## 1 answers

### Answer by username_0 on 2019-06-01. Score: 0 | Accepted answer

The problem was in this line:
sudo docker network create --internal --subnet=192.168.2.0/24 netR

The --internal option makes the network unreachable from other Docker networks.
The solution was to remove this option.


---

