mirror of
https://github.com/GNS3/gns3-server.git
synced 2026-09-12 21:15:27 +03:00
aabbee3a04
brctl create leaves the bridge administratively DOWN. Add link set up so the bridge actually forwards frames between enslaved ports. Also record Docker iptables FORWARD DROP pitfall in project memory.
39 lines
1.4 KiB
Markdown
39 lines
1.4 KiB
Markdown
---
|
|
name: docker-iptables-forward-bridge
|
|
description: Docker iptables FORWARD DROP blocks kernel bridge forwarding, fix and symptoms
|
|
metadata:
|
|
type: reference
|
|
---
|
|
|
|
Docker sets the iptables `FORWARD` chain default policy to `DROP` when the
|
|
Docker daemon starts. This blocks **all** forwarded traffic through Linux
|
|
kernel bridges on the host — including `gns3br{N}` bridges created by the
|
|
builtin Ethernet Switch (ubridge `brctl`).
|
|
|
|
## Symptoms
|
|
|
|
- Nodes connected to the switch can send frames into the bridge (visible in
|
|
`tcpdump -i gns3br{N}`) but never receive forwarded unicast frames.
|
|
- `bridge fdb show` may fail to learn MAC addresses (frames dropped before
|
|
the bridge learning path).
|
|
- ARP and multicast/broadcast may appear to work because they flood, but
|
|
unicast replies never reach the destination.
|
|
- OSPF Hello / CDP visible on both sides but ICMP echo reply never returns.
|
|
- `ubridge bridge get_stats` shows symmetric IN/OUT counts (relay is fine),
|
|
`bridge fdb show` shows learned MACs, `bridge link show` shows `state forwarding`
|
|
on all ports — yet unicast still doesn't work.
|
|
|
|
## Fix
|
|
|
|
Run once per host boot, or make persistent via iptables-persistent / firewall config:
|
|
|
|
```bash
|
|
sudo iptables -P FORWARD ACCEPT
|
|
```
|
|
|
|
## Related
|
|
|
|
- [[ethernet-switch-ubridge-brctl-migration]] — the kernel bridge that hits this
|
|
- [[gns3-server-linux-only]] — datapath constraint
|
|
- [[gns3-ubridge-permission]] — another host-level prerequisite (CAP_NET_ADMIN)
|