Cannot access the VPN network inside a container

devantoine commented 6 years ago

Expected behavior

When I'm connected through a VPN I should be able to access the VPN network inside a container.

Actual behavior

When I'm connected through a VPN I cannot access the VPN network, either by hostname or by IP.

Information

Diagnostic ID: FD552713-528B-478F-9BA6-8A6528AA18A4

Docker for Mac: version: 18.03.0-ce-mac60 (dd2831d4b7421cf559a0881cc7a5fdebeb8c2b98)
macOS: version 10.13.3 (build: 17D102)
logs: /tmp/FD552713-528B-478F-9BA6-8A6528AA18A4/20180418-152905.tar.gz
[OK]     vpnkit
[OK]     vmnetd
[OK]     dns
[OK]     driver.amd64-linux
[OK]     virtualization VT-X
[OK]     app
[OK]     moby
[OK]     system
[OK]     moby-syslog
[OK]     kubernetes
[OK]     files
[OK]     env
[OK]     virtualization kern.hv_support
[OK]     osxfs
[OK]     moby-console
[OK]     logs
[OK]     docker-cli
[OK]     disk

Steps to reproduce the behavior

Connect to the VPN (I'm not sure which one it is, it's the client's VPN and I'm using the Pulse Secure client)
Start docker-compose
Log into a container
Try to connect to one of the VPN network machine, using SSH, either by hostname or by IP
Wait for the connection time out.

Additional informations

This was working perfectly fine when I was using Linux with the same client.

azaeng04 commented 3 years ago

Is this issue with normal intel based macs? Cos this is also an issue on the latest version for the M1 chip. Cannot ping services behind a VPN.

Has anyone tried setting up a VPN client inside a docker container and pointing other docker containers to it?

marcoiai commented 3 years ago

What worked for me was to change docker subnet mask from /24 to /28, then restarted and I can now ping, telnet and other things on my vpn network. It says the default is /28 but docker desktop ships with /24 on it. Maybe it's a typo, I don't know.

juanmrad commented 2 years ago

This is an issue still for me. I am not able to have my docker containers connect using my vpn.

and0p commented 2 years ago

This was happening to me as well, but only when Kubernetes was enabled.

In my case it was because the corporate VPN uses subnets in the 10.x.x.x range (as many do), specifically 10.1.x.x , and the Docker Kubnetes engine uses the same subnet for its own network interface (10.1.0.0/16). Note that this isn't the IP of the tunnel or anything you would see in ifconfig, just the IP range frequently used in the network behind the VPN.

There is currently no way to configure this from the Docker UI, but if you can change it permanently by editing ~/Library/Group Containers/group.com.docker/cni/10-default.conflist and restarting the Docker service (from bug icon in top right of dashboard is easiest). Not sure if existing containers need to be rebuilt for any reason. I also have not tested if this will keep working after host reboot or if the Docker app is upgraded.

I changed mine to the unused range 10.250.0.0/16 and it fixed the issue. My 10-default.conflist now looks like this:

{
        "cniVersion": "0.3.1",
        "name": "default",
        "plugins": [
            {
            "type": "bridge",
            "bridge": "cni0",
            "isDefaultGateway": true,
            "ipMasq": true,
            "hairpinMode": true,
            "ipam": {
                "type": "host-local",
                "subnet": "10.250.0.0/16",
                "gateway": "10.250.0.1"
            },
            "dns": {
                "nameservers": ["10.250.0.1"]
            }
            },
            {
            "type": "portmap",
            "capabilities": {
                "portMappings": true
            },
            "snat": true
            }
        ]
    }

Thanks to https://stackoverflow.com/a/68658242 and https://stackoverflow.com/a/69903312 for the direction, as well as @cdenneen above.

duxing commented 1 year ago

ran into the same issue and after hours of testing, I identified the issue to be docker network related. did a docker network prune and the issue is resolved. I think the factory reset method mentioned in this thread is equivalent to that

guizsantos commented 1 year ago

Pruning docker networks will only work if the network causing the issue is not attached to any containers. Otherwise you will have to kill the containers and then prune. Using docker network inspect helps to identify the culprit. For a more permanent solution take a look at this guide, which makes use of previously mentioned daemon.json and the default-address-pool configuration.

plokko commented 1 month ago

I used Rest to factory defaults and now it seems like I'm able to access the resources in the VPN.

I had the same problem on windows: i could not connect on the OpenVPN client connection (on Window) even if WSL2 could connect without any issue. Tried debugging networking, giving host network, etc. but nothing worked and i did not find the issue (maybe an iptable/routing mismatch on the Docker bridge nework?). A docker reset did fix the issue "like magic".

docker / for-mac