0
Problem Introduction
I have a network topology which looks like the below diagram. All hosts are running different Linux distributions, and all my configuration should (hopefully) be done on Host A, which is RHEL7.
with this routing table:
Destination Gateway Genmask Flags Metric Ref Use
Iface
default fw.gatename. 0.0.0.0 UG 100 0 0 enp34s0
10.0.1.0 0.0.0.0 255.255.255.0 U 0 0 0 enp9s0
10.0.1.2 0.0.0.0 255.255.255.255 UH 0 0 0 bridge1
10.12.0.0 0.0.0.0 255.255.255.0 U 100 0 0 enp2s0f1
10.14.0.0 0.0.0.0 255.255.255.0 U 100 0 0 enp2s0f0
10.17.0.0 0.0.0.0 255.255.255.0 U 100 0 0 enp7s0
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
172.18.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 bridge2
172.18.0.3 0.0.0.0 255.255.255.255 UH 0 0 0 bridge0
172.18.0.4 0.0.0.0 255.255.255.255 UH 0 0 0 bridge1
192.168.3.0 0.0.0.0 255.255.255.0 U 100 0 0 enp34s0
192.168.30.0 0.0.0.0 255.255.255.0 U 0 0 0 enp35s0
192.168.30.91 0.0.0.0 255.255.255.255 UH 0 0 0 bridge2
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0
My main goal is to have each physical interface of Host A map to a Docker container, so that traffic can flow freely only between both ends of this mapping (and no traffic to or from interfaces outside this mapping).
For example, Container1 should be able to (only) communicate with Host B (along the red links of the diagram), and Container2 should be able to (only) communicate with Host C (along the green links of the diagram).
An initial attempt
By default, docker creates a bridge br-97707d67f97c
(for example), which I've removed (because it connects all containers to each other). I created the three bridges (bridge0
, bridge1
, bridge2
), because I thought there might be some hope for some way to make the bridge 'private'.
As it stands right now, I can ping from any container to any interface on Host A, B, or C; I can't ping from one container to another, which I assume is due to them being on the same subnet and confusing the bridge.
Question
How can I logically separate interfaces on a host so that they can only interact with only the interface(s) I want them to?