Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #211221 > unrolled thread

systemd-networkd, bridge and containers: unable to ping host from guest

Back to article view | Back to linux.debian.user

Contents

  systemd-networkd, bridge and containers: unable to ping host from  guest lanquil <lanquil@gmx.com> - 2019-07-11 15:50 +0200
    Re: systemd-networkd, bridge and containers: unable to ping host from  guest john doe <johndoe65534@mail.com> - 2019-07-11 17:10 +0200
      Re: systemd-networkd, bridge and containers: unable to ping host  from guest lanquil <lanquil@gmx.com> - 2019-07-11 18:00 +0200
        Re: systemd-networkd, bridge and containers: unable to ping host  from guest Reco <recoverym4n@enotuniq.net> - 2019-07-11 18:20 +0200
    Re: systemd-networkd, bridge and containers: unable to ping host  from guest Reco <recoverym4n@enotuniq.net> - 2019-07-11 17:50 +0200

#211221 — systemd-networkd, bridge and containers: unable to ping host from guest

[Multipart message — attachments visible in raw view] — view raw

Hello,

In my machine (4.19.0-5-amd64 #1 SMP Debian 4.19.37-5 (2019-06-19) x86_64 GNU/Linux) I've setup a bridge with systemd-networkd.

I've then setup a systemd-nspawn container and some virtual machines with qemu/virt-manager (Debian and Windows10 guest).

The problem I'm encountering is that in all guests (Debian and Windows, DHCP or static IP configurations) I'm never able to ping the host system. From the host I'm instead able to ping the guest.
In the guests everything else seems to work and I'm able to reach the internet as expected.

Can someone kindly give me some hint on how to solve this issue?

I really don't know if it's related to systemd-networkd, Debian, iptables...
I'm therefore posting here this question, but I'm open to suggestions for a more appropriate place to ask for assistance...

The configuration files are:

`/etc/systemd/network/br0.netdev`:
[NetDev]
Name=br0
Kind=bridge
MACAddress=08:60:6e:d6:4d:7b


`/etc/systemd/network/br0.network`:
[Match]
Name=en*

[Network]
Bridge=br0


`/etc/systemd/network/20-wired.network`:
[Match]
Name=br0

[Network]
DNS=172.17.0.10
DNS=172.17.0.20

[Address]
Address=172.17.1.48/16

[Route]
Gateway=172.17.0.1


`ip a` on the host:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000
    link/ether 08:60:6e:d6:4d:7b brd ff:ff:ff:ff:ff:ff
    inet6 fe80::a60:6eff:fed6:4d7b/64 scope link 
       valid_lft forever preferred_lft forever
3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 08:60:6e:d6:4d:7b brd ff:ff:ff:ff:ff:ff
    inet 172.17.1.48/16 brd 172.17.255.255 scope global br0
       valid_lft forever preferred_lft forever
    inet6 fe80::a60:6eff:fed6:4d7b/64 scope link 
       valid_lft forever preferred_lft forever
6: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UNKNOWN group default qlen 1000
    link/ether fe:54:00:9c:89:fa brd ff:ff:ff:ff:ff:ff
    inet6 fe80::fc54:ff:fe9c:89fa/64 scope link 
       valid_lft forever preferred_lft forever
7: vb-sidcontaine@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br0 state UP group default qlen 1000
    link/ether da:a4:31:ec:1e:57 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::d8a4:31ff:feec:1e57/64 scope link 
       valid_lft forever preferred_lft forever


`brctl show` on the host:
bridge name     bridge id               STP enabled     interfaces
br0             8000.08606ed64d7b       no              enp3s0
                                                        vb-sidcontaine
                                                        vnet0

with vb-sidcontainer = systemd-nspawn container
vnet0 = qemu VM

Peace,

-- 
                                        ~ Sandro ~

[toc] | [next] | [standalone]

#211227

On 7/11/2019 3:29 PM, lanquil wrote:
> Hello,
>
> In my machine (4.19.0-5-amd64 #1 SMP Debian 4.19.37-5 (2019-06-19) x86_64 GNU/Linux) I've setup a bridge with systemd-networkd.
>
> I've then setup a systemd-nspawn container and some virtual machines with qemu/virt-manager (Debian and Windows10 guest).
>
> The problem I'm encountering is that in all guests (Debian and Windows, DHCP or static IP configurations) I'm never able to ping the host system. >From the host I'm instead able to ping the guest.
> In the guests everything else seems to work and I'm able to reach the internet as expected.
>
> Can someone kindly give me some hint on how to solve this issue?
>
> I really don't know if it's related to systemd-networkd, Debian, iptables...
> I'm therefore posting here this question, but I'm open to suggestions for a more appropriate place to ask for assistance...
>

If you can, I would turn off iptables to see if iptables is the culprit.

--
John Doe

[toc] | [prev] | [next] | [standalone]

#211237 — Re: systemd-networkd, bridge and containers: unable to ping host from guest

[Multipart message — attachments visible in raw view] — view raw

On Thu 11 Jul 2019 at 16:51:50 +0200, john doe wrote:
> 
> If you can, I would turn off iptables to see if iptables is the culprit.

Ok, I have nftables.service active and stopping it I'm able to ping the host from the
guest. So this was the problem. Thank you very much =)

If I remember well, I configured nftables.conf using one of the Debian defaults. Since
it's a topic I still have not find the time to study, I'm a little blind on what I can
do to fix the configuration...

/etc/nftables.conf::

    #!/usr/sbin/nft -f

    flush ruleset

    table inet filter {
    	chain input {
    		type filter hook input priority 0;

    		# accept any localhost traffic
    		iif lo accept

    		# accept traffic originated from us
    		ct state established,related accept

    		# activate the following line to accept common local services
    		tcp dport { 22 } ct state new accept
    		#tcp dport { 22, 80, 443 } ct state new accept

    		# accept neighbour discovery otherwise IPv6 connectivity breaks.
    		ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit,  nd-router-advert, nd-neighbor-advert } accept

    		# count and drop any other traffic
    		counter drop
    	}
    }


-- 
                                        ~ Sandro ~

[toc] | [prev] | [next] | [standalone]

#211238 — Re: systemd-networkd, bridge and containers: unable to ping host from guest

	Hi.

On Thu, Jul 11, 2019 at 05:37:43PM +0200, lanquil wrote:
> On Thu 11 Jul 2019 at 16:51:50 +0200, john doe wrote:
> > 
> > If you can, I would turn off iptables to see if iptables is the culprit.
> 
> Ok, I have nftables.service active and stopping it I'm able to ping the host from the
> guest. So this was the problem. Thank you very much =)
> 
> If I remember well, I configured nftables.conf using one of the Debian defaults. Since
> it's a topic I still have not find the time to study, I'm a little blind on what I can
> do to fix the configuration...

An nft equivalent of:

iptables -A INPUT -p icmp --icmp-type 3 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT

Which should be:

icmp type destination-unreachable counter accept
icmp type echo-request counter accept

Reco

[toc] | [prev] | [next] | [standalone]

#211233 — Re: systemd-networkd, bridge and containers: unable to ping host from guest

	Hi.

On Thu, Jul 11, 2019 at 03:29:57PM +0200, lanquil wrote:
> The problem I'm encountering is that in all guests (Debian and
> Windows, DHCP or static IP configurations) I'm never able to ping the
> host system.

And the "tcpdump -pni br0 icmp" shows us what exactly here?
Assuming that the guest uses ICMP for pings. They have some curious
views at this at M$ .

> From the host I'm instead able to ping the guest.

Likewise. Please provide the output of tcpdump.


> Can someone kindly give me some hint on how to solve this issue?

On a first glance I see nothing unusual here, but libvirt likes to wreak
havok with host's netfilter/nft rules. With the best intentions, of
course.

So, an output of both iptables-save and iptables-legacy-save would be
helpful here too.

Reco

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web