NgTech-LTD/gns3-server
2
0
Fork 0
mirror of https://github.com/GNS3/gns3-server.git synced 2026-09-05 17:45:15 +03:00
Code Issues Packages Projects Releases Wiki Activity
gns3-server/.claude/memory/docker-iptables-forward-bridge.md
YueGuobin aabbee3a04
fix(builtin): bring kernel bridge UP after creation 
brctl create leaves the bridge administratively DOWN. Add link set up
so the bridge actually forwards frames between enslaved ports.

Also record Docker iptables FORWARD DROP pitfall in project memory.
2026-07-18 01:11:25 +08:00

1.4 KiB
Raw Blame History

name, description, metadata
name description metadata
docker-iptables-forward-bridge Docker iptables FORWARD DROP blocks kernel bridge forwarding, fix and symptoms
type
reference

Docker sets the iptables FORWARD chain default policy to DROP when the Docker daemon starts. This blocks all forwarded traffic through Linux kernel bridges on the host — including gns3br{N} bridges created by the builtin Ethernet Switch (ubridge brctl).

Symptoms

  • Nodes connected to the switch can send frames into the bridge (visible in tcpdump -i gns3br{N}) but never receive forwarded unicast frames.
  • bridge fdb show may fail to learn MAC addresses (frames dropped before the bridge learning path).
  • ARP and multicast/broadcast may appear to work because they flood, but unicast replies never reach the destination.
  • OSPF Hello / CDP visible on both sides but ICMP echo reply never returns.
  • ubridge bridge get_stats shows symmetric IN/OUT counts (relay is fine), bridge fdb show shows learned MACs, bridge link show shows state forwarding on all ports — yet unicast still doesn't work.

Fix

Run once per host boot, or make persistent via iptables-persistent / firewall config:

sudo iptables -P FORWARD ACCEPT

Related