Home / server / Questions / 885820
In Process
djsumdog
Asked: 2017-11-30 10:30:35 +0800 CST

IPv6 Connectivity within Docker on a Vultr host with ndppd

  • 772

I found another answer and looked through the official Docker ipv6 docs, but I'm still having trouble with IPv6 and Docker. If I expose public ports on Docker containers, I can connect to them via IPv6. From within the container, I can ping6 out to other IPv6 hosts on other providers. However if I try to make a TCP connection over IPv6 (http, telnet, nc, etc.) it timesout and fails.

Here is my public adapter:

2: ens3: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 56:00:01:46:4e:fe brd ff:ff:ff:ff:ff:ff
    inet 45.32.64.134/23 brd 45.32.65.255 scope global ens3
       valid_lft forever preferred_lft forever
    inet6 2001:19f0:6001:1c12:5400:1ff:fe46:4efe/64 scope global mngtmpaddr dynamic 
       valid_lft 2591898sec preferred_lft 604698sec
    inet6 2001:19f0:6001:1e43:5400:1ff:fe46:4efe/64 scope global mngtmpaddr dynamic 
       valid_lft 2591898sec preferred_lft 604698sec
    inet6 fe80::5400:1ff:fe46:4efe/64 scope link 
       valid_lft forever preferred_lft forever

The 2001:19f0:6001:1c12:/64 is the one I care about (Vultr lets you reserve IPv6 addresses that will survive rebuilds, but it also gives you another address for some reason). I setup my daemon.json for Docker like so:

{
    "tls": true,
    "tlsverify": true,
    "tlscacert": "/etc/docker/ca.pem",
    "tlscert": "/etc/docker/server.crt",
    "tlskey": "/etc/docker/server-key.pem",
    "ipv6": true,
    "fixed-cidr-v6": "2001:19f0:6001:1c12::1/80",
    "hosts": ["127.0.0.1:2376", "10.10.6.10:2376", "fd://"]
}

and my ndppd conf like so:

route-ttl 30000
proxy ens3 {
  router yes
  timeout 500
  ttl 30000
  rule 2001:19f0:6001:1c12::/64 {
    static
  }
}

I can ping6 fine:

docker exec -it mycontainer ping6 google.com
PING google.com (2607:f8b0:4007:80b::200e): 56 data bytes
64 bytes from 2607:f8b0:4007:80b::200e: seq=0 ttl=56 time=1.166 ms
64 bytes from 2607:f8b0:4007:80b::200e: seq=1 ttl=56 time=0.575 ms
64 bytes from 2607:f8b0:4007:80b::200e: seq=2 ttl=56 time=0.475 ms
^C
--- google.com ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.475/0.738/1.166 ms

..which I couldn't do before ndppd was running, but I still can't connect via IPv6 outbound: 

docker run -it alpine ash -c "ip -6 addr show dev eth0; ip -6 route show"
191: eth0@if192: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 state UP 
    inet6 2001:19f0:6001:1c12::242:ac11:7/80 scope global flags 02 
       valid_lft forever preferred_lft forever
    inet6 fe80::42:acff:fe11:7/64 scope link tentative 
       valid_lft forever preferred_lft forever
2001:19f0:6001:1c12::/80 dev eth0  metric 256 
fe80::/64 dev eth0  metric 256 
default via 2001:19f0:6001:1c12::1 dev eth0  metric 1024 
unreachable default dev lo  metric -1  error -101
ff00::/8 dev eth0  metric 256 
unreachable default dev lo  metric -1  error -101

What am I missing?

networking

1 Answers

  1. Turns out I was pretty much on the right track and my actual issue was with the firewall. The following needs to be set in /etc/default/ufw if you're using UFW to setup your iptables rules:

    DEFAULT_FORWARD_POLICY="ACCEPT"

    For completeness, the Docker daemon.json doesn't need the ::1 in the subnet:

    "fixed-cidr-v6": "2001:19f0:6001:1c12::/80"

    ..and the ndppd.conf should look like the following:

    proxy ens3 {
  timeout 500
  ttl 30000
  rule 2001:19f0:6001:1c12::/80 {
    static
  }
}
    • 2