First, I create 2 docker hosts using the following settings:
## CLUSTER CONFIGURATION
# Firewall: firewalld
# OS: CentOS7
# IPs:
- 10.10.2.3
- 10.10.2.4
# Docker daemons:
/usr/bin/docker daemon -H fd:// -H tcp://0.0.0.0:2375 \
--cluster-store=consul://10.10.2.3:8500 \
--cluster-advertise=10.10.2.3:2375
/usr/bin/docker daemon -H fd:// -H tcp://0.0.0.0:2375 \
--cluster-store=consul://10.10.2.3:8500 \
--cluster-advertise=10.10.2.4:2375
Then, I create an overlay network:
docker network create -d overlay my-overlay-network
Then, I try to ping a container on Node2 from a container on Node1 using the hostname of the container:
# ssh 10.10.2.4
docker run --net my-overlay-network --hostname 10-10-2-4-container centos /bin/sh -c 'while true; do sleep 1; done'
# Start firewalld, and open ports on both machines
systemctl start firewalld
/usr/bin/firewall-cmd \
# Add Consul ports
--add-port=8300/tcp \
--add-port=8301/tcp \
--add-port=8301/udp \
--add-port=8302/tcp \
--add-port=8302/udp \
--add-port=8400/tcp \
--add-port=8500/tcp \
--add-port=8600/tcp \
--add-port=8600/udp
# Add Docker ports
--add-port=2375/tcp \
--add-port=7946/tcp \
--add-port=7946/udp \
--add-port=4789/tcp
# From Node1. This fails! The hostname resolves correctly
# to the right subnet and IP, but the ping packet doesn't return.
docker run --net my-overlay-network centos ping -c node2-container
# After disabling the firewall, it works fine.
systemctl stop firewalld # From 10.10.2.3
systemctl stop firewalld # From 10.10.2.4
docker run --net my-overlay-network centos ping -c 10-10-2-4-container
Basically, it looks like I can't ping my node when the firewall is on. The hostname appears to resolve correctly. How can I configure my firewall to work with Docker's overlay network?