mjhjmtu

We have a Docker host (A virtual machine) hosted on VMware. This docker host has two network interfaces. ens160 and ens192

• ens192 is configured with a normal IP address


• ens160 is configured without an IP address with promiscuous mode ON


• Promiscuous mode is also ON in the Port Group in vmware


• IP forwarding is enabled : net.ipv4.ip_forward=1


• firewalld on the Dockerhost is off

Interfaces

[root@dockerone ~]# netstat -i
Kernel Interface table
Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
docker0 1500 393 0 0 0 1405 0 0 0 BMRU
ens160 1500 16034090 0 89 0 1255 0 0 0 BMPRU
ens192 1500 96324 0 1 0 6352 0 0 0 BMRU
ens160.2 1500 97658 0 0 0 362 0 0 0 BMPRU

Network Creation

docker network create -d macvlan --subnet=10.200.131.0/24 --gateway=10.200.131.1 -o parent=ens160.231 macvlan231

Container creation

docker run --name alp1 --net=macvlan231 --ip=10.200.131.191 -itd alpine /bin/sh
docker exec -it alp1 sh

docker run --name alp2 --net=macvlan231 --ip=10.200.131.190 -itd alpine /bin/sh
docker exec -it alp2 sh

The two containers can communicate with one another but not to the outside world.

Ahh figured it out...
On the VMware virtual switch port group, all three need to be enabled:
1. Promiscous Mode
2. MAC Address Changes
3. Forged transmits