{"action":"created","issue":{"url":"https://api.github.com/repos/rancher/rancher/issues/1608","labels_url":"https://api.github.com/repos/rancher/rancher/issues/1608/labels{/name}","comments_url":"https://api.github.com/repos/rancher/rancher/issues/1608/comments","events_url":"https://api.github.com/repos/rancher/rancher/issues/1608/events","html_url":"https://github.com/rancher/rancher/issues/1608","id":96581201,"number":1608,"title":"Linked containers running on different hosts cannot ping","user":{"login":"anapsix","id":1256199,"avatar_url":"https://avatars.githubusercontent.com/u/1256199?v=3","gravatar_id":"","url":"https://api.github.com/users/anapsix","html_url":"https://github.com/anapsix","followers_url":"https://api.github.com/users/anapsix/followers","following_url":"https://api.github.com/users/anapsix/following{/other_user}","gists_url":"https://api.github.com/users/anapsix/gists{/gist_id}","starred_url":"https://api.github.com/users/anapsix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anapsix/subscriptions","organizations_url":"https://api.github.com/users/anapsix/orgs","repos_url":"https://api.github.com/users/anapsix/repos","events_url":"https://api.github.com/users/anapsix/events{/privacy}","received_events_url":"https://api.github.com/users/anapsix/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":21,"created_at":"2015-07-22T14:25:13Z","updated_at":"2015-08-13T22:37:15Z","closed_at":null,"body":"> TLDR;\r\ncross-host network is not working\r\n\r\nI've got a simple 2-3 component service, consisting of redis instance, webdis instance and an optional load balancer.\r\n\r\nHere is my `docker-compose.yml`:\r\n```\r\nhaproxy:\r\n  image: 'tutum/haproxy:0.1'\r\n  environment:\r\n    - BACKEND_PORT=7379\r\n  links:\r\n    - 'webdis'\r\n  ports:\r\n    - '8000:80'\r\n    - '1936:1936'\r\nwebdis:\r\n  image: 'anapsix/webdis'\r\n  ports:\r\n   - '7379:7379'\r\n  links:\r\n   - 'redis'\r\nredis:\r\n  image: 'anapsix/redis:latest'\r\n```\r\nI start service up with `rancher-compose up`, which is reflected in Rancher Web-UI.\r\n![image](https://cloud.githubusercontent.com/assets/1256199/8827188/1f293954-3059-11e5-95ca-4f221622bd92.png)\r\nHowever, it appears that `webdis` instance cannot talk to `redis` instance (and `haproxy` cannot connect to `webdis` as well) even though the containers are linked.  \r\nHostname `redis` is properly resolvable from withing `webdis`, but pings fail.\r\n```\r\n### webdis container\r\n/ # ip a s eth0                                                                 \r\n23: eth0: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP\r\n    link/ether 02:96:4a:73:08:55 brd ff:ff:ff:ff:ff:ff\r\n    inet 172.17.0.7/16 scope global eth0\r\n       valid_lft forever preferred_lft forever\r\n    inet 10.42.14.165/16 scope global eth0\r\n       valid_lft forever preferred_lft forever\r\n    inet6 fe80::96:4aff:fe73:855/64 scope link\r\n       valid_lft forever preferred_lft forever\r\n\r\n/ # ping -c 4 redis\r\nPING redis (10.42.247.116): 56 data bytes\r\n--- redis ping statistics ---\r\n4 packets transmitted, 0 packets received, 100% packet loss\r\n```\r\nYet `haproxy` container, that runs on the same host can ping `redis`, though I have to use the IP, since `redis` is not linked to `haproxy`.\r\n```\r\n### haproxy container                                                          \r\n/ # ip a s eth0                                                \r\n23: eth0: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default \r\n    link/ether 02:96:4a:19:f2:2f brd ff:ff:ff:ff:ff:ff\r\n    inet 172.17.0.7/16 scope global eth0\r\n       valid_lft forever preferred_lft forever\r\n    inet 10.42.168.239/16 scope global eth0\r\n       valid_lft forever preferred_lft forever\r\n    inet6 fe80::96:4aff:fe19:f22f/64 scope link\r\n       valid_lft forever preferred_lft forever\r\n\r\n/ # ping -c 4 10.42.247.116\r\nPING 10.42.247.116 (10.42.247.116) 56(84) bytes of data.\r\n64 bytes from 10.42.247.116: icmp_seq=1 ttl=64 time=0.106 ms\r\n64 bytes from 10.42.247.116: icmp_seq=2 ttl=64 time=0.074 ms\r\n64 bytes from 10.42.247.116: icmp_seq=3 ttl=64 time=0.079 ms\r\n64 bytes from 10.42.247.116: icmp_seq=4 ttl=64 time=0.054 ms\r\n--- 10.42.247.116 ping statistics ---\r\n4 packets transmitted, 4 received, 0% packet loss, time 2999ms\r\n```\r\n\r\n\r\n## environment\r\nRancher and RancherOS on bare metal\r\n```\r\nRancherOS v0.3.3\r\nrancher/agent-instance:v0.3.1\r\nrancher/agent:v0.7.9\r\nCATTLE_RANCHER_SERVER_IMAGE=v0.25.0\r\nCATTLE_CATTLE_VERSION=v0.58.0\r\n```"},"comment":{"url":"https://api.github.com/repos/rancher/rancher/issues/comments/130868434","html_url":"https://github.com/rancher/rancher/issues/1608#issuecomment-130868434","issue_url":"https://api.github.com/repos/rancher/rancher/issues/1608","id":130868434,"user":{"login":"vincent99","id":753917,"avatar_url":"https://avatars.githubusercontent.com/u/753917?v=3","gravatar_id":"","url":"https://api.github.com/users/vincent99","html_url":"https://github.com/vincent99","followers_url":"https://api.github.com/users/vincent99/followers","following_url":"https://api.github.com/users/vincent99/following{/other_user}","gists_url":"https://api.github.com/users/vincent99/gists{/gist_id}","starred_url":"https://api.github.com/users/vincent99/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vincent99/subscriptions","organizations_url":"https://api.github.com/users/vincent99/orgs","repos_url":"https://api.github.com/users/vincent99/repos","events_url":"https://api.github.com/users/vincent99/events{/privacy}","received_events_url":"https://api.github.com/users/vincent99/received_events","type":"User","site_admin":false},"created_at":"2015-08-13T22:37:15Z","updated_at":"2015-08-13T22:37:15Z","body":"@anapsix does `nc` on other ports (e.g. 80 or 12345) work?  What kind of network are they on? Are `nick` and `matt` VMs (on the same host?), bare metal, etc?\r\n\r\nConsumer home routers sometimes have IPSec config options for pass through and such, maybe that's poorly implemented and mangles IPSec that is purely within the network?"}}