Answers: <p>The problem was in this line:</p>
  
  <pre><code>sudo docker network create --internal --subnet=192.168.2.0/24 netR
  </code></pre>
  
  <p>The <code>--internal</code> option makes the network unreachable from other Docker networks.</p>
  
  <p>The solution was to remove this option.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-06-01T14:53:56.890Z
Answers: 2019-06-01T14:53:56.890Z
Answers: Kazh
Body: <p>Two containers are created with this <code>Dockerfile</code>:</p>
  
  <pre><code>FROM ubuntu:18.04
  
  RUN apt update &amp;&amp; apt upgrade -y &amp;&amp; apt install -y vim iputils-ping net-tools tcpdump iproute* iptables traceroute
  </code></pre>
  
  <p>The were created with the following commands in a <code>Ubuntu 18.04</code> machine:</p>
  
  <pre><code>sudo docker network create --internal --subnet=192.168.2.0/24 netR
  
  sudo docker network create --internal --subnet=172.16.1.0/24 netB1
  
  sudo docker run --name R1_ipsec --hostname R1 --privileged --cap-add=NET_ADMIN --net netR --ip="192.168.2.100" -dit image1
  sudo docker run --name R2_ipsec --hostname R2 --privileged --cap-add=NET_ADMIN --net netR --ip="192.168.2.200" -dit image1
  
  sudo docker network connect --ip="172.16.1.254" netR R1
  
  sudo docker run --name PC1_ipsec --hostname PC1_ipsec --privileged --cap-add=NET_ADMIN --net netB1 --ip="172.16.1.2" -dit image1
  
  sudo docker exec PC1 route delete default gw 172.16.1.1
  
  sudo docker exec PC1 route add default gw 172.16.1.254 dev eth0
  </code></pre>
  
  <p>The problem: <code>PC1</code> can't ping the <code>R1</code>'s interface <code>192.168.1.100</code>, even if <code>R1</code> have <code>net.ipv4.ip_forward = 1</code></p>
  
  <p>Doker version: <code>Docker version 18.06.1-ce, build e68fc7a</code></p>
  
Tags: <docker><networking>
Title: Docker: subnet clients can't ping other subnet
UserDisplayName: Kazh
ThreadText: # Docker: subnet clients can't ping other subnet
  
  (Asked by: username_0 on 2018-11-27)
  
  Two containers are created with this `Dockerfile`:
  
  ```
  FROM ubuntu:18.04
  
  RUN apt update && apt upgrade -y && apt install -y vim iputils-ping net-tools tcpdump iproute* iptables traceroute
  
  ```
  
  The were created with the following commands in a `Ubuntu 18.04` machine:
  
  ```
  sudo docker network create --internal --subnet=192.168.2.0/24 netR
  
  sudo docker network create --internal --subnet=172.16.1.0/24 netB1
  
  sudo docker run --name R1_ipsec --hostname R1 --privileged --cap-add=NET_ADMIN --net netR --ip="192.168.2.100" -dit image1
  sudo docker run --name R2_ipsec --hostname R2 --privileged --cap-add=NET_ADMIN --net netR --ip="192.168.2.200" -dit image1
  
  sudo docker network connect --ip="172.16.1.254" netR R1
  
  sudo docker run --name PC1_ipsec --hostname PC1_ipsec --privileged --cap-add=NET_ADMIN --net netB1 --ip="172.16.1.2" -dit image1
  
  sudo docker exec PC1 route delete default gw 172.16.1.1
  
  sudo docker exec PC1 route add default gw 172.16.1.254 dev eth0
  
  ```
  
  The problem: `PC1` can't ping the `R1`'s interface `192.168.1.100`, even if `R1` have `net.ipv4.ip_forward = 1`
  
  Doker version: `Docker version 18.06.1-ce, build e68fc7a`
  
  **Tags:** docker, networking
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2019-06-01. Score: 0 | Accepted answer
  
  The problem was in this line:
  
  ```
  sudo docker network create --internal --subnet=192.168.2.0/24 netR
  
  ```
  
  The `--internal` option makes the network unreachable from other Docker networks.
  
  The solution was to remove this option.
  
  
  ---
  
  