Hi there,
I'm trying to get some containers running on my Linksys WRT3200ACM running OpenWrt 23.05.5, r24106-10cc5fcd00. Due to the nftables/iptables incompatibility with Docker, I decided to try my luck at podman. I followed the guide at https://openwrt.org/docs/guide-user/virtualization/docker_host to no avail. Then, I tried the configuration outlined by oskarirauta here - https://github.com/openwrt/packages/issues/22255#issuecomment-1743827579 .
Suddenly this worked - I could ping my pod's IP, and even curl the nginx container I'd spun up. However, literally a few seconds later, when I issued another curl command, the pod was unreachable. Here is a console log:
BusyBox v1.36.1 (2024-09-23 12:34:46 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 23.05.5, r24106-10cc5fcd00
-----------------------------------------------------
root@OpenWrt:~# podman pod ls
POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS
a8bbce7cacba navi Exited 55 minutes ago e0957f004f73 2
root@OpenWrt:~# podman pod rm navi
a8bbce7cacbadccdf7d4c08f72df4b3e1d6a4389fe715e0e0e969a0618124650
root@OpenWrt:~# podman pod create --replace --name navi --hostname navi --ip 10.129.0.2
5d064b457bf111bda67a82197162955e75d59cfa2d2222a10425e2c9bdd0e6a3
root@OpenWrt:~# podman create --name navi --pod navi --replace --systemd false nginx
99aac83e5dfed9e72346fc43455d4749b32a700d5ce5f1da53af74eeb9017dd5
root@OpenWrt:~# podman pod start navi
5d064b457bf111bda67a82197162955e75d59cfa2d2222a10425e2c9bdd0e6a3
root@OpenWrt:~# podman pod ls
POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS
5d064b457bf1 navi Running 20 seconds ago 0532f5422503 2
root@OpenWrt:~# ping 10.129.0.2
PING 10.129.0.2 (10.129.0.2): 56 data bytes
64 bytes from 10.129.0.2: seq=0 ttl=64 time=0.165 ms
64 bytes from 10.129.0.2: seq=1 ttl=64 time=0.081 ms
64 bytes from 10.129.0.2: seq=2 ttl=64 time=0.084 ms
64 bytes from 10.129.0.2: seq=3 ttl=64 time=0.083 ms
64 bytes from 10.129.0.2: seq=4 ttl=64 time=0.088 ms
64 bytes from 10.129.0.2: seq=5 ttl=64 time=0.073 ms
64 bytes from 10.129.0.2: seq=6 ttl=64 time=0.075 ms
64 bytes from 10.129.0.2: seq=7 ttl=64 time=0.071 ms
^C
--- 10.129.0.2 ping statistics ---
8 packets transmitted, 8 packets received, 0% packet loss
round-trip min/avg/max = 0.071/0.090/0.165 ms
root@OpenWrt:~# curl http://10.129.0.2
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
root@OpenWrt:~# curl http://10.129.0.2
^C
root@OpenWrt:~# ping 10.129.0.2
PING 10.129.0.2 (10.129.0.2): 56 data bytes
^C
--- 10.129.0.2 ping statistics ---
6 packets transmitted, 0 packets received, 100% packet loss
root@OpenWrt:~# podman pod ls
POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS
5d064b457bf1 navi Running 2 minutes ago 0532f5422503 2
root@OpenWrt:~# podman pod restart navi
5d064b457bf111bda67a82197162955e75d59cfa2d2222a10425e2c9bdd0e6a3
root@OpenWrt:~# ping 10.129.0.2
PING 10.129.0.2 (10.129.0.2): 56 data bytes
^C
--- 10.129.0.2 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss
root@OpenWrt:~#
Here are the config files. I've only made some slight adjustments to e.g. block traffic from wan to the podman zone:
root@OpenWrt:~# cat /etc/containers/networks/podman.json
{
"name": "podman",
"id": "5ef894788befd4d42498314b6e66282ca730aa2e1e82f9b9597bf4d1725ca074",
"driver": "bridge",
"network_interface": "podman0",
"created": "2023-02-20T08:56:34.652030952Z",
"subnets": [
{
"subnet": "10.129.0.0/24",
"gateway": "10.129.0.1"
}
],
"ipv6_enabled": false,
"internal": false,
"dns_enabled": true,
"ipam_options": {
"driver": "host-local"
}
}
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fddb:4e9a:26d6::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
list dns '8.8.8.8'
option ipaddr '192.168.2.1'
config device
option name 'wan'
option macaddr '32:23:03:dc:1c:18'
config interface 'wwan'
option proto 'dhcp'
option device 'phy1-sta0'
config interface 'repeater_bridge'
option proto 'relay'
option ipaddr '192.168.1.10'
list network 'lan'
list network 'wwan'
config interface 'podman0'
option proto 'cni'
option device 'podman0'
option target '10.129.0.0/24'
option gateway '10.129.0.1'
option source '10.100.0.1'
option disabled '1'
root@OpenWrt:~# cat /etc/hotplug.d/10-cni
#!/bin/sh
[ $(uci get network.${INTERFACE}.proto) = "cni" ] && {
[ "$ACTION" = add ] && ifup ${INTERFACE}
[ "$ACTION" = remove ] && ifdown ${INTERFACE}
[ "$ACTION" = change ] && {
ifdown ${INTERFACE}
sleep 1
ifup ${INTERFACE}
}
}
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
list network 'wwan'
config zone
option name podman
list network 'podman0'
option input REJECT
option output ACCEPT
option forward ACCEPT
option mtu_fix 1
config forwarding
option src lan
option dest podman
config forwarding
option src podman
option dest wan
#config forwarding
# option src wan
# option dest podman
config rule
option name 'Allow-Podman-DNS'
option src 'podman'
list dest_ip '10.129.0.1'
option dest_port '53'
option target 'ACCEPT'
root@OpenWrt:~#
Does anyone know what could be causing this strange behaviour? I'd be very grateful for any kind of support. Thanks!
