easytier局域网ip流量无法到达docker网络解决办法

作者
244 次阅读

本文最后更新于 2026年3月9日。

这个是解决racknerd服务器的问题经验。当时nas是直接桥接网络就可以了。

防火墙允许tun0的流量转发就可以了

执行下面防火墙命令后就可以正常访问了

# 允许 tun0 所有的进出转发，不限端口，不限 IP
iptables -I DOCKER-USER -i tun0 -j ACCEPT
iptables -I DOCKER-USER -o tun0 -j ACCEPT

设置成永久有效

iptables-save > /etc/sysconfig/iptables

探索

# ip address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:16:3c:f2:cd:d3 brd ff:ff:ff:ff:ff:ff
    altname enp0s3
    altname ens3
    inet 155.94.145.26/24 brd 155.94.145.255 scope global eth0
       valid_lft forever preferred_lft forever
3: br-c7c9ca99288d: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:07:c9:ba:5a brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.1/16 brd 172.18.255.255 scope global br-c7c9ca99288d
       valid_lft forever preferred_lft forever
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:04:15:5f:d9 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
9: veth6bb5f69@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-c7c9ca99288d state UP group default
    link/ether c6:4d:2a:2c:2e:4e brd ff:ff:ff:ff:ff:ff link-netnsid 1
14: tun0: <POINTOPOINT,UP,LOWER_UP> mtu 1360 qdisc fq_codel state UNKNOWN group default qlen 500
    link/none
    inet 10.10.10.13/24 brd 10.10.10.255 scope global tun0
       valid_lft forever preferred_lft forever
16: veth9cf4752@if15: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-c7c9ca99288d state UP group default
    link/ether 36:bc:b4:9f:d5:3c brd ff:ff:ff:ff:ff:ff link-netnsid 0

分析上面内容为什么无法通过10.10.10.13访问到容器中的应用，防火墙已经开启，容器端口映射也设置了


[root@racknerd-88be497 ~]# sudo nano /etc/sysctl.conf
[root@racknerd-88be497 ~]# sudo sysctl -p
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
net.ipv4.ip_forward = 1
[root@racknerd-88be497 ~]# # 允许 tun0 进来的流量转发到容器网桥 br-c7c9ca99288d
[root@racknerd-88be497 ~]# iptables -I DOCKER-USER -i tun0 -o br-c7c9ca99288d -j ACCEPT
[root@racknerd-88be497 ~]#
[root@racknerd-88be497 ~]# # 允许容器返回给 tun0 的流量（已建立连接的状态）
[root@racknerd-88be497 ~]# iptables -I DOCKER-USER -i br-c7c9ca99288d -o tun0 -m state --state ESTABLISHED,RELATED -j ACCEPT
[root@racknerd-88be497 ~]# iptables-save > /etc/sysconfig/iptables
[root@racknerd-88be497 ~]# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
[root@racknerd-88be497 ~]# iptables -L DOCKER-USER -n
Chain DOCKER-USER (1 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0