I have docker-1.9.1
running on a QNAP raid machine. It has the default bridge
network using subnet 10.0.3.0/24
. In iptables I see a rule in the nat
table:
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE
I am assuming that Docker created this rule itself.
I have created a new bridge network:
docker network create \
--gateway=10.0.5.1 \
--subnet=10.0.5.0/24 \
-o "com.docker.network.bridge.host_binding_ipv4"="0.0.0.0" \
-o "com.docker.network.bridge.enable_icc"="true" \
-o "com.docker.network.driver.mtu"="1500" \
-o "com.docker.network.bridge.name"="lxcbr1" \
-o "com.docker.network.bridge.enable_ip_masquerade"="true" \
isolated_nw
This does not create a rule in iptables. Did I miss a step?
Here's the full setup commands and results, copying @larsks' example:
[/share/Containers] # docker --version
Docker version 1.9.1, build 147ce3e
[/share/Containers] # iptables -t nat -S | grep 10.0.5.0
[/share/Containers] # docker network create \
> --gateway=10.0.5.1 \
> --subnet=10.0.5.0/24 \
> -o "com.docker.network.bridge.host_binding_ipv4"="0.0.0.0" \
> -o "com.docker.network.bridge.enable_icc"="true" \
> -o "com.docker.network.driver.mtu"="1500" \
> -o "com.docker.network.bridge.name"="lxcbr1" \
> -o "com.docker.network.bridge.enable_ip_masquerade"="true" \
> isolated_nw
a7b5c938008169f32fcdfc1d9409716b725cc916b30f472ac6ec2a1d71fb77f0
[/share/Containers] # iptables -t nat -S | grep 10.0.5.0
[/share/Containers] # iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE
[/share/Containers] #