Unable to connect to hosts through VPN

[alexschultz]

Expected behavior

Should be able to access hosts accross vpn

Actual behavior

DNS resolves IP address, but is not able to connect

Information

just upgraded to docker for mac ce Version 17.06.0-ce-mac18 (18433). I have a compose file with many containers that connect over a VPN. The problem I am having is that I can resolve hostnames over the VPN to an IP address, but when I actually make a request to the host I am trying to hit, it gives me a response from a totally different (invalid) IP address. I know DNS is resolving the host because when I ping the host, it shows the correct IP address but the response is supposedly coming from something else

PING example.host.com (192.168.65.174) 56(84) bytes of data.
From something-else.host.com (192.168.65.2) icmp_seq=1 Destination Host Unreachable
From something-else.host.com (192.168.65.2) icmp_seq=2 Destination Host Unreachable
From something-else.host.com (192.168.65.2) icmp_seq=3 Destination Host Unreachable’

[OK] db.git
[OK] vmnetd
[OK] dns
[OK] driver.amd64-linux
[OK] virtualization VT-X
[OK] app
[OK] moby
[OK] system
[OK] moby-syslog
[OK] db
[OK] env
[OK] virtualization kern.hv_support
[OK] slirp
[OK] osxfs
[OK] moby-console
[OK] logs
[OK] docker-cli
[OK] menubar
[OK] disk

9848A4C6-554E-4390-91CC-2E179F94C995

Steps to reproduce the behavior

1. start container on host with vpn configured for another network
2. ping host in remote network

[djs55]

Thanks for your report.

There seems to be a genuine clash between your environment's legitimate use of 192.168.65.x and the internal VM<->host use of 192.168.65.x. I believe it only manifests in 17.06 because we've reserved more IP addresses to use for additional clients.

For the record here are the 2 shell fragments we discussed for changing the internal IP addresses on community slack:

cd ~/Library/Containers/com.docker.docker/Data/database/
git reset --hard
mkdir -p com.docker.driver.amd64-linux/slirp
echo 192.168.63.2 > com.docker.driver.amd64-linux/slirp/docker
echo 192.168.63.1 > com.docker.driver.amd64-linux/slirp/host
git add com.docker.driver.amd64-linux/slirp/docker 
git add com.docker.driver.amd64-linux/slirp/host
git commit -s -m 'change ip'

and

cd ~/Library/Containers/com.docker.docker/Data/database/
git checkout state
echo 192.168.63.3 > com.docker.driver.amd64-linux/slirp/extra_dns 
echo -n 0 > com.docker.driver.amd64-linux/slirp/bridge-connections
git add com.docker.driver.amd64-linux/slirp/extra_dns 
git add com.docker.driver.amd64-linux/slirp/bridge-connections
git commit -m 'remove more IPs'

(I believe both are needed)

[alexschultz]

Thanks for the feedback. That fixed my issue and allowed me to connect over the VPN. Just curious, is this fix documented anywhere and what are the consequences of using this approach?

[djs55]

@alexschultz thanks for the confirmation! This workaround isn't documented anywhere yet, but I'll try to write it up and make a PR here: https://github.com/docker/docker.github.io/blob/master/docker-for-mac/networking.md which will be published https://docs.docker.com/docker-for-mac/networking/

The only consequence is that it breaks a new feature of the networking component that you probably aren't using. If you are developing with https://github.com/linuxkit/linuxkit then you can type linuxkit run <OS image> and the LinuxKit image will boot and connect to the same network that Docker for Mac is using. With this workaround enabled, LinuxKit won't be able to get an IP address by DHCP.

There are 2 code changes I'd like to make

1. the ability to change the range of IP addresses handed out by the DHCP server -- this is hardcoded at the moment
2. perhaps a UI-based mechanism (or a config file?) to change the network range -- something a bit easier than the script full of git commands

[djs55]

FYI we've gone a step further and added a UI element to allow the network to be customised. It should be in the 17.07 edge release, due very soon.

[alexschultz]

That's awesome thank you!

…

On Fri, Jul 14, 2017, 6:26 AM David Scott ***@***.***> wrote: FYI we've gone a step further and added a UI element to allow the network to be customised. It should be in the 17.07 edge release, due very soon. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1803 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABc4Y8eKJSCpT-6ZBy2fF7qPEf-Snpzhks5sN16IgaJpZM4OLBYe> .

[djs55]

Closing ticket as the option to customise the IP address range is available on both edge and stable branches in the preferences dialog:

Thanks again for your report!

[DiegoGallegos4]

how to make the same configuration explained above in the UI?

[YRM64]

Alexschultz, legitimate concerns, and djs55 excellent response in addressing alexschulttz's concerns.

[docker-robott]

Closed issues are locked after 30 days of inactivity.
This helps our team focus on active issues.

If you have found a problem that seems similar to this, please open a new issue.

Send feedback to Docker Community Slack channels #docker-for-mac or #docker-for-windows.
/lifecycle locked