我有一台运行 KVM 和 Docker 的服务器。物理机的 IP 为192.168.1.13，KVM 内的机器的 IP 为192.168.1.40，其端口桥接到物理机上的物理网络接口。问题是外部世界无法访问虚拟机，反之亦然。但主机可以访问外部世界和虚拟机。
这是ifconfig主机上的结果：
... (lo interface ignored)
br-5c76c0836bc3 Link encap:Ethernet HWaddr 02:42:f8:92:8d:06
inet addr:172.18.0.1 Bcast:0.0.0.0 Mask:255.255.0.0
inet6 addr: fe80::42:f8ff:fe92:8d06/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:496 (496.0 B)
docker0 Link encap:Ethernet HWaddr 02:42:41:9e:bc:0f
inet addr:172.17.0.1 Bcast:0.0.0.0 Mask:255.255.0.0
inet6 addr: fe80::42:41ff:fe9e:bc0f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3 errors:0 dropped:0 overruns:0 frame:0
TX packets:72555 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:100 (100.0 B) TX bytes:8895509 (8.8 MB)
veth312b28e Link encap:Ethernet HWaddr 56:2c:1c:a1:93:d6
inet6 addr: fe80::542c:1cff:fea1:93d6/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3 errors:0 dropped:0 overruns:0 frame:0
TX packets:107147 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:142 (142.0 B) TX bytes:13511363 (13.5 MB)
virbr0 Link encap:Ethernet HWaddr 00:00:00:00:00:00
inet addr:192.168.122.1 Bcast:192.168.122.255 Mask:255.255.255.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
br0 Link encap:Ethernet HWaddr 94:**:**:**:**:d5
inet addr:192.168.1.13 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::96de:80ff:fed9:e8d5/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8668453 errors:0 dropped:0 overruns:0 frame:0
TX packets:7807533 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:18268047855 (18.2 GB) TX bytes:8304004607 (8.3 GB)
enp2s0 Link encap:Ethernet HWaddr 94:**:**:**:**:d5
inet6 addr: fe80::96de:80ff:fed9:e8d5/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:16943241 errors:0 dropped:289 overruns:0 frame:0
TX packets:10558830 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:19001088198 (19.0 GB) TX bytes:8478281605 (8.4 GB)
vnet0 Link encap:Ethernet HWaddr fe:54:00:**:**:0c
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:809 errors:0 dropped:0 overruns:0 frame:0
TX packets:133 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:70397 (70.3 KB) TX bytes:11914 (11.9 KB)
结果如下brctl show：
bridge name bridge id STP enabled interfaces
br-5c76c0836bc3 8000.0242f8928d06 no
br0 8000.94de80d9e8d5 yes enp2s0
vnet0
docker0 8000.0242419ebc0f no veth312b28e
virbr0 8000.000000000000 yes
我调查了这个问题，发现 iptables 正在丢弃我的数据包。
# iptables -x -v --line-numbers -L FORWARD 1 ↵
Chain FORWARD (policy DROP 7422 packets, 740173 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- any virbr0 anywhere 192.168.122.0/24 ctstate RELATED,ESTABLISHED
2 0 0 ACCEPT all -- virbr0 any 192.168.122.0/24 anywhere
3 0 0 ACCEPT all -- virbr0 virbr0 anywhere anywhere
4 0 0 REJECT all -- any virbr0 anywhere anywhere reject-with icmp-port-unreachable
5 0 0 REJECT all -- virbr0 any anywhere anywhere reject-with icmp-port-unreachable
6 31719 2588550 DOCKER-ISOLATION all -- any any anywhere anywhere
7 1 40 ACCEPT all -- any docker0 anywhere anywhere ctstate RELATED,ESTABLISHED
8 1 44 DOCKER all -- any docker0 anywhere anywhere
9 1 44 ACCEPT all -- docker0 !docker0 anywhere anywhere
10 0 0 ACCEPT all -- docker0 docker0 anywhere anywhere
11 0 0 ACCEPT all -- any br-5c76c0836bc3 anywhere anywhere ctstate RELATED,ESTABLISHED
12 0 0 DOCKER all -- any br-5c76c0836bc3 anywhere anywhere
13 0 0 ACCEPT all -- br-5c76c0836bc3 !br-5c76c0836bc3 anywhere anywhere
14 0 0 ACCEPT all -- br-5c76c0836bc3 br-5c76c0836bc3 anywhere anywhere
当从虚拟机 ping 外部世界时，policy DROP计数器以及pkts第 6 行的计数器将随着每个 ICMP 回显数据包而增加 1。这是怎么发生的？如何解决？
答案1
我发现这不是 的错误DOCKER-ISOLATION，而是由于bridge-nf-call-iptables打开了该选项。打开该选项将导致 iptables 处理流量，从而丢弃数据包。