Problem Introduction

I have a network topology which looks like the below diagram. All hosts are running different Linux distributions, and all my configuration should (hopefully) be done on Host A, which is RHEL7.

Network Topology Graph

with this routing table:

Destination     Gateway         Genmask         Flags Metric Ref    Use 

default         fw.gatename.         UG    100    0        0 enp34s0   U     0      0        0 enp9s0 UH    0      0        0 bridge1   U     100    0        0 enp2s0f1   U     100    0        0 enp2s0f0   U     100    0        0 enp7s0     U     0      0        0 docker0 UH    0      0        0 bridge2 UH    0      0        0 bridge0 UH    0      0        0 bridge1   U     100    0        0 enp34s0   U     0      0        0 enp35s0 UH    0      0        0 bridge2   U     0      0        0 virbr0

My main goal is to have each physical interface of Host A map to a Docker container, so that traffic can flow freely only between both ends of this mapping (and no traffic to or from interfaces outside this mapping).

For example, Container1 should be able to (only) communicate with Host B (along the red links of the diagram), and Container2 should be able to (only) communicate with Host C (along the green links of the diagram).

An initial attempt

By default, docker creates a bridge br-97707d67f97c (for example), which I've removed (because it connects all containers to each other). I created the three bridges (bridge0, bridge1, bridge2), because I thought there might be some hope for some way to make the bridge 'private'.

As it stands right now, I can ping from any container to any interface on Host A, B, or C; I can't ping from one container to another, which I assume is due to them being on the same subnet and confusing the bridge.


How can I logically separate interfaces on a host so that they can only interact with only the interface(s) I want them to?


I was able to resolve this error by starting from scratch, then separating my interfaces by subnet.

To use the the diagram in my question as an example, I changed the IP address for Container2 to be within the subnet, so, for example. I changed the address for Container1 to be on the 192.168.30/24 subnet.

I also removed the IP addresses from enp35s0 and enp9s0, because I considered that these were unnecessary, as the bridges in my example should only operate on OSI Layer 2.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.