[问题已处理]docker中2个网桥互ping不通

两个网桥

br-65f和docker0

 

分别以2个网桥启动了一个busybox:latest 但是互相ping不通

 

后来发现是防火墙配置的问题

iptables -nvL |grep DROP

 

 

删除对应的规则

[root@izbp18yjhaftfs1kndfnjrz ~]# iptables -L INPUT --line-numbers

Chain INPUT (policy ACCEPT)

num  target     prot opt source               destination        

1    ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED

2    ACCEPT     all  --  anywhere             anywhere           

3    INPUT_direct  all  --  anywhere             anywhere           

4    INPUT_ZONES_SOURCE  all  --  anywhere             anywhere           

5    INPUT_ZONES  all  --  anywhere             anywhere           

6    DROP       all  --  anywhere             anywhere             ctstate INVALID

7    REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

[root@izbp18yjhaftfs1kndfnjrz ~]# iptables -D INPUT 6

[root@izbp18yjhaftfs1kndfnjrz ~]# iptables -L INPUT --line-numbers

Chain INPUT (policy ACCEPT)

num  target     prot opt source               destination        

1    ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED

2    ACCEPT     all  --  anywhere             anywhere           

3    INPUT_direct  all  --  anywhere             anywhere            

4    INPUT_ZONES_SOURCE  all  --  anywhere             anywhere           

5    INPUT_ZONES  all  --  anywhere             anywhere           

6    REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

需要重启防火墙后生效

[root@izbp18yjhaftfs1kndfnjrz ~]# iptables -nvL |grep DROP

Chain FORWARD (policy DROP 0 packets, 0 bytes)

    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID

   88  7392 DROP       all  --  *      docker0  0.0.0.0/0            0.0.0.0/0          

 2180  183K DROP       all  --  *      br-65fbd2716988  0.0.0.0/0            0.0.0.0/0          

 [root@izbp18yjhaftfs1kndfnjrz ~]# systemctl  restart firewalld

[root@izbp18yjhaftfs1kndfnjrz ~]# iptables -nvL |grep DROP

    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID

0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID







也可以通过把防火墙命令导入到文件之后 查看详细的命令再做修改

iptables-save > /tmp/1.txt



[root@izbp18yjhaftfs1kndfnjrz ~]# cat /tmp/1.txt

# Generated by iptables-save v1.4.21 on Mon Sep 23 22:06:49 2019

*mangle

:PREROUTING ACCEPT [2298:164094]

:INPUT ACCEPT [2000:139062]

:FORWARD ACCEPT [298:25032]

:OUTPUT ACCEPT [2109:218435]

:POSTROUTING ACCEPT [2407:243467]

:FORWARD_direct - [0:0]

:INPUT_direct - [0:0]

:OUTPUT_direct - [0:0]

:POSTROUTING_direct - [0:0]

:PREROUTING_ZONES - [0:0]

:PREROUTING_ZONES_SOURCE - [0:0]

:PREROUTING_direct - [0:0]

:PRE_public - [0:0]

:PRE_public_allow - [0:0]

:PRE_public_deny - [0:0]

:PRE_public_log - [0:0]

-A PREROUTING -j PREROUTING_direct

-A PREROUTING -j PREROUTING_ZONES_SOURCE

-A PREROUTING -j PREROUTING_ZONES

-A INPUT -j INPUT_direct

-A FORWARD -j FORWARD_direct

-A OUTPUT -j OUTPUT_direct

-A POSTROUTING -j POSTROUTING_direct

-A PREROUTING_ZONES -g PRE_public

-A PRE_public -j PRE_public_log

-A PRE_public -j PRE_public_deny

-A PRE_public -j PRE_public_allow

COMMIT

# Completed on Mon Sep 23 22:06:49 2019

# Generated by iptables-save v1.4.21 on Mon Sep 23 22:06:49 2019

*security

:INPUT ACCEPT [1934:135782]

:FORWARD ACCEPT [298:25032]

:OUTPUT ACCEPT [2109:218435]

:FORWARD_direct - [0:0]

:INPUT_direct - [0:0]

:OUTPUT_direct - [0:0]

-A INPUT -j INPUT_direct

-A FORWARD -j FORWARD_direct

-A OUTPUT -j OUTPUT_direct

COMMIT

# Completed on Mon Sep 23 22:06:49 2019

# Generated by iptables-save v1.4.21 on Mon Sep 23 22:06:49 2019

*raw

:PREROUTING ACCEPT [2298:164094]

:OUTPUT ACCEPT [2109:218435]

:OUTPUT_direct - [0:0]

:PREROUTING_ZONES - [0:0]

:PREROUTING_ZONES_SOURCE - [0:0]

:PREROUTING_direct - [0:0]

:PRE_public - [0:0]

:PRE_public_allow - [0:0]

:PRE_public_deny - [0:0]

:PRE_public_log - [0:0]

-A PREROUTING -j PREROUTING_direct

-A PREROUTING -j PREROUTING_ZONES_SOURCE

-A PREROUTING -j PREROUTING_ZONES

-A OUTPUT -j OUTPUT_direct

-A PREROUTING_ZONES -g PRE_public

-A PRE_public -j PRE_public_log

-A PRE_public -j PRE_public_deny

-A PRE_public -j PRE_public_allow

COMMIT

# Completed on Mon Sep 23 22:06:49 2019

# Generated by iptables-save v1.4.21 on Mon Sep 23 22:06:49 2019

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [2104:208371]

:DOCKER - [0:0]

:DOCKER-ISOLATION-STAGE-1 - [0:0]

:DOCKER-ISOLATION-STAGE-2 - [0:0]

:DOCKER-USER - [0:0]

:FORWARD_IN_ZONES - [0:0]

:FORWARD_IN_ZONES_SOURCE - [0:0]

:FORWARD_OUT_ZONES - [0:0]

:FORWARD_OUT_ZONES_SOURCE - [0:0]

:FORWARD_direct - [0:0]

:FWDI_public - [0:0]

:FWDI_public_allow - [0:0]

:FWDI_public_deny - [0:0]

:FWDI_public_log - [0:0]

:FWDO_public - [0:0]

:FWDO_public_allow - [0:0]

:FWDO_public_deny - [0:0]

:FWDO_public_log - [0:0]

:INPUT_ZONES - [0:0]

:INPUT_ZONES_SOURCE - [0:0]

:INPUT_direct - [0:0]

:IN_public - [0:0]

:IN_public_allow - [0:0]

:IN_public_deny - [0:0]

:IN_public_log - [0:0]

:OUTPUT_direct - [0:0]

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -j INPUT_direct

-A INPUT -j INPUT_ZONES_SOURCE

-A INPUT -j INPUT_ZONES

-A INPUT -m conntrack --ctstate INVALID -j DROP

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j DOCKER-USER

-A FORWARD -j DOCKER-ISOLATION-STAGE-1

-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -o docker0 -j DOCKER

-A FORWARD -i docker0 ! -o docker0 -j ACCEPT

-A FORWARD -i docker0 -o docker0 -j ACCEPT

-A FORWARD -o br-65fbd2716988 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -o br-65fbd2716988 -j DOCKER

-A FORWARD -i br-65fbd2716988 ! -o br-65fbd2716988 -j ACCEPT

-A FORWARD -i br-65fbd2716988 -o br-65fbd2716988 -j ACCEPT

-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -i lo -j ACCEPT

-A FORWARD -j FORWARD_direct

-A FORWARD -j FORWARD_IN_ZONES_SOURCE

-A FORWARD -j FORWARD_IN_ZONES

-A FORWARD -j FORWARD_OUT_ZONES_SOURCE

-A FORWARD -j FORWARD_OUT_ZONES

-A FORWARD -m conntrack --ctstate INVALID -j DROP

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

-A OUTPUT -j OUTPUT_direct

-A DOCKER-ISOLATION-STAGE-1 -j RETURN

-A DOCKER-ISOLATION-STAGE-2 -j RETURN

-A DOCKER-USER -j RETURN

-A FORWARD_IN_ZONES -g FWDI_public

-A FORWARD_OUT_ZONES -g FWDO_public

-A FWDI_public -j FWDI_public_log

-A FWDI_public -j FWDI_public_deny

-A FWDI_public -j FWDI_public_allow

-A FWDI_public -p icmp -j ACCEPT

-A FWDO_public -j FWDO_public_log

-A FWDO_public -j FWDO_public_deny

-A FWDO_public -j FWDO_public_allow

-A INPUT_ZONES -g IN_public

-A IN_public -j IN_public_log

-A IN_public -j IN_public_deny

-A IN_public -j IN_public_allow

-A IN_public -p icmp -j ACCEPT

-A IN_public_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT

-A IN_public_allow -p tcp -m tcp --dport 3306 -m conntrack --ctstate NEW -j ACCEPT

-A IN_public_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT

COMMIT

# Completed on Mon Sep 23 22:06:49 2019

# Generated by iptables-save v1.4.21 on Mon Sep 23 22:06:49 2019

*nat

:PREROUTING ACCEPT [79:4456]

:INPUT ACCEPT [68:3964]

:OUTPUT ACCEPT [216:14812]

:POSTROUTING ACCEPT [216:14812]

:DOCKER - [0:0]

:OUTPUT_direct - [0:0]

:POSTROUTING_ZONES - [0:0]

:POSTROUTING_ZONES_SOURCE - [0:0]

:POSTROUTING_direct - [0:0]

:POST_public - [0:0]

:POST_public_allow - [0:0]

:POST_public_deny - [0:0]

:POST_public_log - [0:0]

:PREROUTING_ZONES - [0:0]

:PREROUTING_ZONES_SOURCE - [0:0]

:PREROUTING_direct - [0:0]

:PRE_public - [0:0]

:PRE_public_allow - [0:0]

:PRE_public_deny - [0:0]

:PRE_public_log - [0:0]

-A PREROUTING -j PREROUTING_direct

-A PREROUTING -j PREROUTING_ZONES_SOURCE

-A PREROUTING -j PREROUTING_ZONES

-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER

-A OUTPUT -j OUTPUT_direct

-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER

-A POSTROUTING -s 10.0.0.0/16 ! -o docker0 -j MASQUERADE

-A POSTROUTING -s 172.26.0.0/16 ! -o br-65fbd2716988 -j MASQUERADE

-A POSTROUTING -j POSTROUTING_direct

-A POSTROUTING -j POSTROUTING_ZONES_SOURCE

-A POSTROUTING -j POSTROUTING_ZONES

-A DOCKER -i docker0 -j RETURN

-A DOCKER -i br-65fbd2716988 -j RETURN

-A POSTROUTING_ZONES -g POST_public

-A POST_public -j POST_public_log

-A POST_public -j POST_public_deny

-A POST_public -j POST_public_allow

-A PREROUTING_ZONES -g PRE_public

-A PRE_public -j PRE_public_log

-A PRE_public -j PRE_public_deny

-A PRE_public -j PRE_public_allow

COMMIT

# Completed on Mon Sep 23 22:06:49 2019

 

再次测试ping 命令  其实reload之后就立马生效了