{"action":"created","issue":{"url":"https://api.github.com/repos/projectcalico/calico-docker/issues/426","labels_url":"https://api.github.com/repos/projectcalico/calico-docker/issues/426/labels{/name}","comments_url":"https://api.github.com/repos/projectcalico/calico-docker/issues/426/comments","events_url":"https://api.github.com/repos/projectcalico/calico-docker/issues/426/events","html_url":"https://github.com/projectcalico/calico-docker/issues/426","id":99404189,"number":426,"title":"Host cannot communicate with containers when using IP-IP","user":{"login":"slaws","id":5597551,"avatar_url":"https://avatars.githubusercontent.com/u/5597551?v=3","gravatar_id":"","url":"https://api.github.com/users/slaws","html_url":"https://github.com/slaws","followers_url":"https://api.github.com/users/slaws/followers","following_url":"https://api.github.com/users/slaws/following{/other_user}","gists_url":"https://api.github.com/users/slaws/gists{/gist_id}","starred_url":"https://api.github.com/users/slaws/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/slaws/subscriptions","organizations_url":"https://api.github.com/users/slaws/orgs","repos_url":"https://api.github.com/users/slaws/repos","events_url":"https://api.github.com/users/slaws/events{/privacy}","received_events_url":"https://api.github.com/users/slaws/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/projectcalico/calico-docker/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/projectcalico/calico-docker/labels/kubernetes","name":"kubernetes","color":"006b75"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-08-06T10:21:12Z","updated_at":"2015-09-25T19:20:50Z","closed_at":null,"body":"Hello,\r\n\r\nI have actually 2 k8s nodes (192.168.112.7 and 192.168.112.10) running containers on subnet 172.17.0.0/16.\r\nThis k8s cluster is running on an Openstack tenant (I'm just a user of this tenant).\r\n\r\nThe pool  172.17.0.0/16 is configured with ipip and nat-outgoing.\r\nThe communication between containers on different hosts is working fine.\r\n\r\nHowever hosts cannot communicate with remote containers. Return packets are lost.\r\n\r\nAfter making some tests asked on IRC it seems that return packets are using the wrong interface : \r\n```\r\n# tcpdump -i tunl0 icmp                                                                                                                    \r\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\r\nlistening on tunl0, link-type RAW (Raw IP), capture size 262144 bytes\r\n09:43:33.992886 IP 192.168.112.7 > 172.17.2.2: ICMP echo request, id 13435, seq 145, length 64\r\n09:43:34.993046 IP 192.168.112.7 > 172.17.2.2: ICMP echo request, id 13435, seq 146, length 64\r\n09:43:35.992981 IP 192.168.112.7 > 172.17.2.2: ICMP echo request, id 13435, seq 147, length 64\r\n09:43:36.993017 IP 192.168.112.7 > 172.17.2.2: ICMP echo request, id 13435, seq 148, length 64\r\n^C\r\n\r\n# tcpdump -i eth0 icmp\r\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\r\nlistening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes\r\n09:43:54.993062 IP 172.17.2.2 > 192.168.112.7: ICMP echo reply, id 13435, seq 166, length 64\r\n09:43:55.992958 IP 172.17.2.2 > 192.168.112.7: ICMP echo reply, id 13435, seq 167, length 64\r\n09:43:56.993048 IP 172.17.2.2 > 192.168.112.7: ICMP echo reply, id 13435, seq 168, length 64\r\n09:43:57.992968 IP 172.17.2.2 > 192.168.112.7: ICMP echo reply, id 13435, seq 169, length 64\r\n^C\r\n```\r\n\r\nIs there a way to work around this ?"},"comment":{"url":"https://api.github.com/repos/projectcalico/calico-docker/issues/comments/143329760","html_url":"https://github.com/projectcalico/calico-docker/issues/426#issuecomment-143329760","issue_url":"https://api.github.com/repos/projectcalico/calico-docker/issues/426","id":143329760,"user":{"login":"Symmetric","id":1524910,"avatar_url":"https://avatars.githubusercontent.com/u/1524910?v=3","gravatar_id":"","url":"https://api.github.com/users/Symmetric","html_url":"https://github.com/Symmetric","followers_url":"https://api.github.com/users/Symmetric/followers","following_url":"https://api.github.com/users/Symmetric/following{/other_user}","gists_url":"https://api.github.com/users/Symmetric/gists{/gist_id}","starred_url":"https://api.github.com/users/Symmetric/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Symmetric/subscriptions","organizations_url":"https://api.github.com/users/Symmetric/orgs","repos_url":"https://api.github.com/users/Symmetric/repos","events_url":"https://api.github.com/users/Symmetric/events{/privacy}","received_events_url":"https://api.github.com/users/Symmetric/received_events","type":"User","site_admin":false},"created_at":"2015-09-25T19:20:50Z","updated_at":"2015-09-25T19:20:50Z","body":"@TeaBough I think your problem is that your VM IPs are in your calico subnet. You've created a rule which will push all traffic (from container or host) into the docker table, and that table only has the route `192.168.31.0/24 dev tunl0`.\r\n\r\nTry setting your Calico pool to a prefix that doesn't include your VM IPs, say `192.168.32.0/24`. Then use the following route config:\r\n\r\n```\r\n# echo '8    docker' >> /etc/iproute2/rt_tables\r\n# ip rule add from 192.168.32.0/24 table docker\r\n# ip route add 192.168.31.0/24 table docker dev tunl0\r\n```"}}