Tunnelling inter-host networking through a Docker Swarm Overlay network

Matt Hanley
Aug 16 · 5 min read

Prepare the host

ln -s /var/run/docker/netns /var/run/netns
ip netns
~# docker network ls
ed31264a1f4f bridge bridge local
5ef35596d5b1 docker_gwbridge bridge local
or1wj1px3q8b testoverlay overlay swarm
bf9f478ebd5d host host local
scybkysot08x ingress overlay swarm
a9871bc3532d none null local
~# ip netns
fe5b42ad2e7e (id: 3)
1-or1wj1px3q (id: 2)
1-scybkysot0 (id: 0)
ingress_sbox (id: 1)

Accessing the Overlay network from the Docker host

Create a new veth pair

ip link add dev veth1 type veth peer name veth2
ip link set dev veth2 netns 1-or1wj1px3q

Assign an IP address and set the MAC address on the host interface

ip a a dev veth1
ip link set dev veth1 address 02:42:0a:00:00:64

Add veth2 to Docker’s bridge device

ip netns exec 1-or1wj1px3q ip link set master br0 veth2


ip netns exec 1-or1wj1px3q ip link set mtu 1450 veth2
ip link set mtu 1450 dev veth1

Bring the interfaces up

ip netns exec 1-or1wj1px3q ip link set up dev veth2
ip link set up dev veth1

Configure forwarding over VXLAN overlay

Create permanent ARP entries

ip netns exec 1-or1wj1px3q ip n a lladdr 02:42:0a:00:00:65 nud permanent dev vxlan0

Configure forwarding

ip netns exec 1-or1wj1px3q bridge fdb add 02:42:0a:00:00:65 dev vxlan0 dst x.x.x.x self permanent
~# ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=10.4 ms
64 bytes from icmp_seq=2 ttl=64 time=10.0 ms


Matt Hanley

Written by

Application Delivery and DevOps Specialist.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade